[Bug] Sigma Protocol 2 Verification Failure
## Summary
zkVM proof verification fails with a panic in the Dory sigma protocol verification. The error occurs because Jolt discards the correct `VerifierSetup` loaded from the URS file and regenerates it using a buggy formula in Dory's `VerifierSetup::from_prover_setup()`.
Here is error when using `max_trace_length = 2^25`
```
thread 'main' panicked at /$HOME/.cargo/git/checkouts/dory-52e051d93bc7618a/c6dff3f/src/vmv/evaluate.rs:294:5:
Sigma protocol 2 verification failed: d2 != e(e1, Gamma_{2, fin})
```
## Environment
Our Project: https://github.com/tcoratger/sig-agg/pull/2/files
- **Jolt version**: `master` branch, commit `dbc011e2`
- **Dory version**: `markosg04/dory` branch `dev/twist-shout`, commit `c6dff3f`
- **Guest configuration**: `max_trace_length = 33_554_432` (2^25)
- **Platform**: macOS Darwin 25.1.0
## Root Cause
[dory/src/core/setup.rs](https://github.com/markosg04/dory/blob/dev/twist-shout/src/core/setup.rs#L474) has a bug in recovering `max_log_n`:
```rust
/// Constructor from an existing prover setup
pub fn from_prover_setup(prover_setup: &ProverSetup<E>) -> Self {
// Since g1_vec has length n = 1 << (max_log_n / 2), we have max_log_n = 2 * log2(g1_vec.len())
let max_log_n = prover_setup.core.g1_vec.len().trailing_zeros() as usize;
```
should be `let max_log_n = 2 * (prover_setup.core.g1_vec.len().trailing_zeros() as usize);`
## Mathematical Impact
For `max_trace_length = 2^25`:
**Setup Generation** (`ProverSetup::new`):
```rust
let n = 1 << ((max_log_n + 1) / 2);
// For max_log_n = 33:
// n = 1 << ((33 + 1) / 2) = 1 << 17 = 131,072 generators
```
**Verifier Reconstruction** (`VerifierSetup::from_prover_setup`):
```rust
let max_log_n = prover_setup.core.g1_vec.len().trailing_zeros() as usize;
// g1_vec.len() = 131,072
// trailing_zeros(131,072) = 17
```
This causes the verifier's delta/chi arrays to have wrong dimensions, resulting in mismatched `g_fin` parameter and failed pairing check.
3 条评论