Improve Merkle root hashing circuit by 1 constraint / level

CHANGELOG.md

@@ -17,20 +17,19 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 
 ## [Unreleased](https://github.com/o1-labs/snarkyjs/compare/4573252d...HEAD)
 
-### Breaking changes
-
-- Change type of verification key returned by `SmartContract.compile()` to match `VerificationKey` https://github.com/o1-labs/snarkyjs/pull/812
+> There are no unreleased changes yet
 
-### Fixed
+## [0.9.5](https://github.com/o1-labs/snarkyjs/compare/21de489...4573252d)
 
-- Update the zkApp verification key from within one of its own methods, via proof https://github.com/o1-labs/snarkyjs/pull/812
+### Breaking changes
 
-## [0.9.5](https://github.com/o1-labs/snarkyjs/compare/21de489...4573252d)
+- Change type of verification key returned by `SmartContract.compile()` to match `VerificationKey` https://github.com/o1-labs/snarkyjs/pull/812
 
 ### Fixed
 
 - Failing `Mina.transaction` on Berkeley because of unsatisfied constraints caused by dummy data before we fetched account state https://github.com/o1-labs/snarkyjs/pull/807
   - Previously, you could work around this by calling `fetchAccount()` for every account invovled in a transaction. This is not necessary anymore.
+- Update the zkApp verification key from within one of its own methods, via proof https://github.com/o1-labs/snarkyjs/pull/812
 
 ## [0.9.4](https://github.com/o1-labs/snarkyjs/compare/9acec55...21de489)
 

src/lib/merkle-tree.unit-test.ts

@@ -0,0 +1,25 @@
+import { Bool, Field } from './core.js';
+import { maybeSwap, maybeSwapBad } from './merkle_tree.js';
+import { Random, test } from './testing/property.js';
+import { expect } from 'expect';
+import { isReady } from '../snarky.js';
+
+await isReady;
+
+test(Random.bool, Random.field, Random.field, (b, x, y) => {
+  let [x0, y0] = maybeSwap(Bool(!!b), Field(x), Field(y));
+  let [x1, y1] = maybeSwapBad(Bool(!!b), Field(x), Field(y));
+
+  // both versions of `maybeSwap` should behave the same
+  expect(x0).toEqual(x1);
+  expect(y0).toEqual(y1);
+
+  // if the boolean is true, it shouldn't swap the fields; otherwise, it should
+  if (b) {
+    expect(x0.toBigInt()).toEqual(x);
+    expect(y0.toBigInt()).toEqual(y);
+  } else {
+    expect(x0.toBigInt()).toEqual(y);
+    expect(y0.toBigInt()).toEqual(x);
+  }
+});

src/lib/merkle_tree.ts

@@ -9,6 +9,9 @@ import { Bool, Field } from './core.js';
 // external API
 export { Witness, MerkleTree, MerkleWitness, BaseMerkleWitness };
 
+// internal API
+export { maybeSwap, maybeSwapBad };
+
 type Witness = { isLeft: boolean; sibling: Field }[];
 
 /**
@@ -181,8 +184,8 @@ class BaseMerkleWitness extends CircuitValue {
     let n = this.height();
 
     for (let i = 1; i < n; ++i) {
-      const left = Circuit.if(this.isLeft[i - 1], hash, this.path[i - 1]);
-      const right = Circuit.if(this.isLeft[i - 1], this.path[i - 1], hash);
+      let isLeft = this.isLeft[i - 1];
+      const [left, right] = maybeSwap(isLeft, hash, this.path[i - 1]);
       hash = Poseidon.hash([left, right]);
     }
 
@@ -220,3 +223,17 @@ function MerkleWitness(height: number): typeof BaseMerkleWitness {
   arrayProp(Bool, height - 1)(MerkleWitness_.prototype, 'isLeft');
   return MerkleWitness_;
 }
+
+function maybeSwapBad(b: Bool, x: Field, y: Field): [Field, Field] {
+  const x_ = Circuit.if(b, x, y); // y + b*(x - y)
+  const y_ = Circuit.if(b, y, x); // x + b*(y - x)
+  return [x_, y_];
+}
+
+// more efficient version of `maybeSwapBad` which reuses an intermediate variable
+function maybeSwap(b: Bool, x: Field, y: Field): [Field, Field] {
+  let m = b.toField().mul(x.sub(y)); // b*(x - y)
+  const x_ = y.add(m); // y + b*(x - y)
+  const y_ = x.sub(m); // x - b*(x - y) = x + b*(y - x)
+  return [x_, y_];
+}