6 · Generalized Bulletproofs (GBP)

We finally arrived in our last part in which the prover will fold the secrets in a compact and zero-knowledge proof, while the verifier will get the folded proof and be convinced that the proof is legit. Let's do it from both perspectives. First we will go through all the equations once from the prover side and learn why it becomes zero-knowledge and logarithmic in size.

From the prover side

Let's start seeing the steps that the prover would do (obviously he will not do each step because they are fully developed here for educational purposes only and the prover will jump directly to the last equations in order to create the proof itself).

The full GBP equation again reads as:

We will go through all the steps here to achieve the compact final equations that the prover uses to create the final proof which will be stored in the blockchain and which contains most of the size of the membership proofs. So let's get started with the steps that we need to perform to achieve that:

1 - Squeeze the circuits equation into one number by dotting with $(1,y,y^2,\dots )$

2 - Squeeze the GBP in the same way, each row weighted by a power of $z$. Then fold both into one line. Notice that the equation holds and everything sums to zero.

3 - Push $z\overrightarrow{z}$ through each matrix product and name the results. The verifier could compute all of these himself.

4 - The second bracket becomes a sum of separate inner products

5 - Move the constant term to the right, which flips its sign.

Now let's collapse the six inner products into three

6 - The two $a_O$ terms share a right vector, so combine them: $⟨w_O,a_O⟩-⟨\overrightarrow{y},a_O⟩=⟨w_O-\overrightarrow{y},a_O⟩$

7 - The first term is a product of two secrets. $\overrightarrow{y}$ is public, so shift it across: $⟨\overrightarrow{y},a_L\circ a_R⟩=⟨a_L,\overrightarrow{y}\circ a_R⟩$

8 - Rewrite the $w_R$ term in the same $\overrightarrow{y}\circ a_R$ basis: $⟨w_R,a_R⟩=⟨w_R\circ {\overrightarrow{y}}^{-1},\overrightarrow{y}\circ a_R⟩$

9 - Terms one and three now share the right vector $\overrightarrow{y}\circ a_R$, so collect them:

10 - Add $\delta (y,z)=⟨{\overrightarrow{y}}^{-1}\circ w_R,w_L⟩$ to both sides. It has no witness in it, so the verifier can add it too.

11 - Terms two and three now share $w_L$: $⟨w_L,a_L⟩+⟨{\overrightarrow{y}}^{-1}\circ w_R,w_L⟩=⟨a_L+{\overrightarrow{y}}^{-1}\circ w_R,w_L⟩$

12 - The first two share the left vector $a_L+w_R\circ {\overrightarrow{y}}^{-1}$, so collect once more and then only three inner products remain:

Now let's make the three inner products into one via vector polynomials.

13 - We have a sum of inner products $\Delta ={\sum }_i⟨L_i,R_i⟩$ that we want to see as a single inner product. Put the left vectors into one vector polynomial and the right vectors into another and this will be the whole trick. Now we manipulate a bit the powers so partners add up to the same total $n^{\prime }$: give left term $i$ the power $p_i$, and its right partner the power $n^{\prime }-p_i$:

14 - Now multiply them out. The inner product of two vector polynomials is the ordinary polynomial you get by taking the inner product of each pair of vector-coefficients and adding the powers

15 - Split that double sum into the $i=j$ part and the $i\ne j$ part

16 - Now you can see what happened. Every diagonal pair $(i,i)$ lands on $X^{n^{\prime }}$ and adds itself to that one coefficient. Every off-diagonal pair lands somewhere else. So reading out the $X^{n^{\prime }}$ coefficient recovers exactly $\Delta$

Just a piece of notation here. $\left[X^m\right]P(X)$ means "the coefficient sitting in front of $X^m$ in the polynomial $P$". For example $\left[X^2\right](7+4X+5X^2+9X^3)=5$. It just reads one coefficient out of a polynomial and throws the rest away.

So finally three inner products became the single number $\Delta$, sitting as one coefficient of one polynomial, and evaluating that polynomial at a random point (step 19) turns it into a single inner product of two ordinary vectors.

17 - Now let's run the recipe of steps 13 to 16 on the exact three inner products of step 12. Each pair becomes one term of $l(X)$ and its partner one term of $r(X)$, at powers chosen to add up to $n^{\prime }=2c+2$. Two fresh random blinding vectors $s_L,s_R$ are dropped in at power $n^{\prime }+1$, so they mask the secrets without ever landing on $X^{n^{\prime }}$

Match the terms against step 12:

• The circuit secrets pair $⟨a_L+w_R\circ {\overrightarrow{y}}^{-1},\overrightarrow{y}\circ a_R+w_L⟩$ is the $X^{c+1}$ term on both sides.
• The outputs pair $⟨w_O-\overrightarrow{y},a_O⟩$ splits as $a_O$ at $X^{n^{\prime }}$ against $w_O-\overrightarrow{y}$ at $X^0$
• The tree pair $⟨w_C,a_C⟩$ splits one commitment at a time, $a_{C,i}$ at $X^{n^{\prime }-1-i}$ against $w_{C,i}$ at $X^{1+i}$.

Every partner power sums to $n^{\prime }$.

which is exactly the left side of step 12, and step 12 set it equal to $-w_c+\delta$. That value is what step 19 names $t_{n^{\prime }}$. The blinds do not disturb it: $s_L$ and $s_R$ sit at $X^{n^{\prime }+1}$, and no term pairs with them to reach $X^{n^{\prime }}$ (their own diagonal lands at $X^{2n^{\prime }+2}$), so they hide $l$ and $r$ while leaving the $X^{n^{\prime }}$ coefficient untouched.

18 - Again, let's check the powers add to $n^{\prime }$ for each wanted pair

19 - The product $⟨l(X),r(X)⟩$ is a single polynomial. Call it $t(X)$. Its coefficients are the numbers $t_j$, and steps 13 to 18 were arranged so that one of them, the coefficient of $X^{n^{\prime }}$, is exactly the value of the whole Generalized Bulletproof equation.

So the entire proof has come down to one claim: the coefficient $t_{n^{\prime }}$. Every other $t_j$ is a byproduct of the multiplication and doesn't mean much (but we need to store them to prove that the whole thing is correct). Now the prover must convince the verifier of that one coefficient without ever handing over $l$ and $r$.

Before we continue let's look what some symbols represent:

• $t(X)$ is the polynomial and its coefficients are the numbers $t_j$ and $t_{n^{\prime }}$ is the single one that carries the equation we care about
• $T_j$ is a committed point that hides one coefficient $t_j$, where $T_j=t_{j}G+{\tau }_{j}H$, with ${\tau }_j$ the blind inside it.
• $\widehat{t}=t(x)$ is the polynomial's value at a number $x$, the one scalar the prover will open.

The way to prove a coefficient of a hidden polynomial is to commit everything first, then open at a random $x$. Steps 20 to 25 do exactly that.

20 - The prover's first message is a batch of Pedersen commitments: everything it must pin down before the opening challenge $x$, namely the secret values of the circuit, the tree nodes, and the "useless" coefficients of $t$. In each equation the scalars multiply a generator vector ${𝐆}_k,{𝐇}_k$ (or a single $G$ for a scalar), plus a blind times $H$, so the prover is bound to them while revealing nothing:

Term by term:

• $A_I$ commits the two input wire vectors: $a_L$ on the ${𝐆}_k$, $a_R$ on the ${𝐇}_k$. The blind is $\alpha$. (proof: w46 C1 · w123 C2)
• $A_O$ commits the output wires $a_O$ on the ${𝐆}_k$. The blind is $\beta$. (proof: w47 C1 · w124 C2)
• $S$ commits the fresh random vectors $s_L,s_R$, the masks that will hide the wires when $l(X),r(X)$ are opened at $x$. The blind is $\rho$. (proof: w48 C1 · w125 C2)
• $C_i$ are Pedersen vector commitments to the tape $a_{C,i}$ on the ${𝐆}_k$, with blind ${\mu }_i$. These terms hold the branches of the path, the children of each node the prover climbs, the blinds and the discrete-log decompositions and divisor coefficients that weld those branches to the real tree and re-randomize the output tuple, under fresh random blinds. (proof: w15–w30 C1 · w31–w45 C2)
• Each $T_j$ is a committed point $T_j=t_{j}G+{\tau }_{j}H$ that hides one byproduct coefficient $t_j$ of the polynomial $t(X)$ behind a blind ${\tau }_j$. The prover commits one $T_j$ for every byproduct it must hide. The special $t_{n^{\prime }}$ is not among them, because the verifier rebuilds it from public data in check one. (proof: w49–w101 C1 · w126–w175 C2)

Two reasons everything is committed rather than sent in the clear. The blinds $\alpha ,\beta ,\rho ,{\mu }_i,{\tau }_j$ (each times $H$) make every point reveal nothing about its contents, which is the zero-knowledge. And fixing them all before $x$ is drawn is what makes the Fiat-Shamir challenge sound: the prover is pinned to this witness and cannot adapt it to the challenge.

Once those commitments are done, the verifier's challenges are fixed by hashing them, so the prover cannot go back and adjust anything. The table below shows how each challenge is composed. The one we use next is $x$, drawn right after the $T_j$.

challenge	equation
$y$	$y=𝔽(\mathscr{H}(\dots \Vert A_I\Vert A_O\Vert S\Vert ⟨\mathrm{c}\mathrm{h}⟩))$
$z$	$z=𝔽(\mathscr{H}(\dots \Vert ⟨\mathrm{c}\mathrm{h}⟩))$
$x$	$x=𝔽(\mathscr{H}(\dots \Vert T_{j\ne n^{\prime }}\Vert ⟨\mathrm{c}\mathrm{h}⟩))$
$x_{ip}$	$x_{ip}=𝔽(\mathscr{H}(\dots \Vert {\tau }_x\Vert u\Vert \widehat{t}\Vert ⟨\mathrm{c}\mathrm{h}⟩))$
round $x_k$	$x_k=𝔽(\mathscr{H}(\dots \Vert L_k\Vert R_k\Vert ⟨\mathrm{c}\mathrm{h}⟩))$

21 - Open the polynomial at $x$. Evaluating $l(X),r(X),t(X)$ at $X=x$ turns $l$ and $r$ back into plain vectors and collapses the polynomial to one number, $\widehat{t}=t(x)=⟨l,r⟩$. The prover sends $\widehat{t}$ together with the matching blind ${\tau }_x$. This ${\tau }_x$ is the blind of the whole opened value, which means, ${\tau }_x$ is the blind of all $T_j$ blinds ${\tau }_j$ recombined at $x$, namely ${\tau }_x={\sum }_j{\tau }_j{x}^j$. Because $x$ is settled only after the $T_j$ are fixed, the prover cannot shape the polynomial to fit it.

In the proof: $\widehat{t}$ is w104 C1 · w178 C2. ${\tau }_x$ is w102 C1 · w176 C2.

22 - Gather the blinds of the point commitments $A_I,A_O,S,C_i$ into one scalar $u$, each weighted by the power its commitment occupies in $l(X)$

In the proof: $u$ is w103 C1 · w177 C2.

The powers of $l(X)$ come from step 17. Its $X^{c+1}$ coefficient came from $A_I$ (blind $\alpha$), its $X^{n^{\prime }}$ from $A_O$ (blind $\beta$), its $X^{n^{\prime }+1}$ from $S$ (blind $\rho$), and each $X^{n^{\prime }-1-i}$ from $C_i$ (blind ${\mu }_i$). So $u$ collects the blinds of exactly those four point commitments and nothing else. It leaves out the $T_j$ blinds, which already sit inside ${\tau }_x$ for check one. So the prover sends $u$ so that check two can subtract $uH$ and cancel all four masks in one shot. That cancellation is the zero-knowledge, since the blinds hide the committed values inside each point and then vanish together in the final equation.

23 - Check one. The goal here is to make sure that $\widehat{t}$ is the genuine $t(x)$ whose $X^{n^{\prime }}$ coefficient equals $\delta -w_c$. $\widehat{t}$ is a public value published by the prover in the proof. The verifier rebuilds $t(x)$ as a commitment out of the $T_j$ and one public term on $G$

The $w_c$ here is the constant from step 3: $w_c={\sum }_{k=1}^q{z}^k{c}_k$. Each $c_k$ is the constant term of constraint $k$ and $q$ is the number of constraints. They come from the gadgets that build the circuit, for example the point-on-curve check contributes the curve constant $b$, the equality and offset gadgets contribute their $-y_0$ shifts, the divisor gates their intercept, and so on. A constraint that sets no constant contributes as $c_k=0$. The verifier reweights them by the same constraint powers $z^k$ it used everywhere else and sums, which is why $w_c$ is a single public number the verifier recomputes on its own.

So this equation checks that the opened scalar $\widehat{t}$ is the honest evaluation $t(x)$ whose $X^{n^{\prime }}$ coefficient is the public value $\delta -w_c$. With that, the prover has locked the coefficient $t_{n^{\prime }}$ and can no longer change it.

24 - Check two. The idea here is to construct a point commitment $P$ that opens as $⟨l,r⟩=\widehat{t}$ for the very $l,r$ hidden inside the committed points. First, let's start constructing $P$, as the verifier would do, with only public information. The idea is to weight each published point by the power of $x$ that its coefficients sit and regroup them by generator.

The top line weights each committed point $A_I,A_O,S,C_i$ by the power of $x$ it occupies in $l(X)$. The middle line folds the public weight vectors $w_L,w_R,w_O,w_C$ onto the generators ${𝐆}_k,{𝐇}_k$. The last line subtracts $uH$, which cancels the blinds of those four point commitments and glues $\widehat{t}$ to $G$ through $x_{ip}$.

Substitute the commitment definitions and every blind cancels, leaving

Step by step: how equation 24 becomes equation 25 (the equation just above)

0. What $l_k$ and $r_k$ are. In step 17, $l(X)$ and $r(X)$ are vector polynomials: each coefficient of a power $X^p$ is itself a length-$n$ vector, one entry per generator. Opening at the challenge $x$ (step 21) collapses each polynomial to a single vector, $l=l(x)$ and $r=r(x)$. Then $l_k$ and $r_k$ are just the $k$-th entries of those two vectors, the parts that ride on ${𝐆}_k$ and ${𝐇}_k$. Reading the coefficients of step 17 component by component:

$$\begin{array}{ccc}\hfill l_k& =(a_{L,k}+{\overrightarrow{y}}^{-k}{w}_{R,k})x^{c+1}+a_{O,k}{x}^{n^{\prime }}+s_{L,k}{x}^{n^{\prime }+1}+\sum _i{a}_{C,i,k}{x}^{n^{\prime }-1-i}\hfill & \text{(1)}\\ \hfill r_k& =({\overrightarrow{y}}^k{a}_{R,k}+w_{L,k})x^{c+1}+(w_{O,k}-{\overrightarrow{y}}^k)x^0+{\overrightarrow{y}}^k{s}_{R,k}{x}^{n^{\prime }+1}+\sum _i{w}_{C,i,k}{x}^{1+i}\hfill & \text{(2)}\end{array}$$

The index $k$ runs over the $n$ generator slots, not over the powers of $X$. Everything below rebuilds exactly these two components, $l_k$ on ${𝐆}_k$ and ${\overrightarrow{y}}^{-k}{r}_k$ on ${𝐇}_k$.

1. Write out the commitments. Like we did in step 20, just a more compact notation.

$$A_I=⟨a_L,𝐆⟩+⟨a_R,𝐇⟩+\alpha H,A_O=⟨a_O,𝐆⟩+\beta H,S=⟨s_L,𝐆⟩+⟨s_R,𝐇⟩+\rho H,C_i=⟨g_i,𝐆⟩+{\mu }_{i}H$$

2. Substitute them into the top line of step 24. Insert those definitions into $x^{c+1}{A}_I+x^{n^{\prime }}{A}_O+x^{n^{\prime }+1}S+{\sum }_i{x}^{n^{\prime }-1-i}{C}_i$ and split each term by the generator it lands on

$$\begin{array}{ccc}\hfill \text{on }{𝐆}_k:& x^{c+1}{a}_{L,k}+x^{n^{\prime }}{a}_{O,k}+x^{n^{\prime }+1}{s}_{L,k}+\sum _i{x}^{n^{\prime }-1-i}{g}_{i,k}\hfill & \text{(1)}\\ \hfill \text{on }{𝐇}_k:& x^{c+1}{a}_{R,k}+x^{n^{\prime }+1}{s}_{R,k}\hfill & \text{(2)}\\ \hfill \text{on }H:& \alpha x^{c+1}+\beta x^{n^{\prime }}+\rho x^{n^{\prime }+1}+\sum _i{\mu }_i{x}^{n^{\prime }-1-i}\hfill & \text{(3)}\end{array}$$

3. Finish the ${𝐆}_k$ side. The ${𝐆}_k$ row above is $l_k$ missing only the public piece ${\overrightarrow{y}}^{-1}\circ w_R$ of $l$'s $X^{c+1}$ coefficient. The middle line of step 24 supplies exactly that piece, so the two add up to the full coefficient

$$\underset{\text{from the commitments}}{\underbrace{(x^{c+1}{a}_{L,k}+\dots )}}+\underset{\text{from the middle line}}{\underbrace{{\overrightarrow{y}}^{-k}{x}^{c+1}{w}_{R,k}}}=l_k⟹\sum _k{l}_k{𝐆}_k$$

4. Finish the ${𝐇}_k$ side. Everything on ${𝐇}_k$ is measured against the reweighted generator ${𝐇}_k^{\prime }={\overrightarrow{y}}^{-k}{𝐇}_k$. The commitment parts $a_{R,k},s_{R,k}$ are for the moment alone but when added to the public parts $w_L,w_O,w_C$ from the middle line, each already carrying its ${\overrightarrow{y}}^{-k}$, then we can see the $r_k$ forming:

$$\underset{\text{commitments}}{\underbrace{x^{c+1}{a}_{R,k}+x^{n^{\prime }+1}{s}_{R,k}}}+\underset{\text{middle line}}{\underbrace{{\overrightarrow{y}}^{-k}(x^{c+1}{w}_{L,k}+w_{O,k}+{\sum }_i{x}^{1+i}{w}_{C,i,k})}}={\overrightarrow{y}}^{-k}{r}_k-(\text{the }-\overrightarrow{y}\text{ piece, next step})$$

5. Account for the lone $-{\sum }_k{𝐇}_k$. One piece of $r$'s $X^0$ coefficient $w_O-\overrightarrow{y}$ is still missing: the public $-\overrightarrow{y}$. On the reweighted generator it collapses to a constant $-1$ with no $y$ left

$${\overrightarrow{y}}^{-k}·(-y^k){𝐇}_k=-{𝐇}_k⟹-\sum _k{𝐇}_k$$

That is the bare term in step 24 which coefficient is exactly $-1$ per generator, not a missing scalar. Adding it completes the ${𝐇}_k$ side to ${\sum }_k{\overrightarrow{y}}^{-k}{r}_k{𝐇}_k$.

6. Cancel the blinds. The $H$ row of step 2 is precisely the scalar $u$ of step 22. The last line of step 24 carries $-uH$, so the two annihilate

$$(\alpha x^{c+1}+\beta x^{n^{\prime }}+\rho x^{n^{\prime }+1}+\sum _i{\mu }_i{x}^{n^{\prime }-1-i})H-uH=(u-u)H=𝒪$$

This is the zero-knowledge step: the masks vanish together and leave nothing on $H$.

7. Glue $\widehat{t}$ to $U$. The remaining term of the last line is $x_{ip}\widehat{t}G$, which is $\widehat{t}U$ once we name $U:=x_{ip}G$.

Result. Collecting steps 3, 4 to 5, 6, and 7

$$P=\sum _k{l}_k{𝐆}_k+\sum _k{\overrightarrow{y}}^{-k}{r}_k{𝐇}_k+\widehat{t}U$$

which is exactly equation 25.

So the same $\widehat{t}$ is genuinely $t(x)$ of the prover's real witness, so it cannot be a number made up to satisfy check one. Together the two checks force $t_{n^{\prime }}=\delta -w_c$ on the true witness.

Now the final part, the logarithmic fold.

25 - Regrouped, that point is exactly $l$ on the $𝐆$'s, $r$ on the reweighted $𝐇$'s and $\widehat{t}$ glued to $U$

26 - Rename $a:=l$, $b:=r$. The entire statement is now one inner product

27 - Split each vector in half. The prover sends the two points that cross the split

In the proof: the round $L_k,R_k$ are w105–w120 C1 · w179–w192 C2, interleaved $L_0,R_0,L_1,R_1,\dots$.

28 - A fresh challenge $x$ for this round is drawn in the same way by (hashing the round's $L,R$). Fold vectors and generators with opposite powers.

29 - Why it works: expand one folded inner product and watch the diagonal survive while the off-diagonal splits off

30 - The same expansion on the $𝐆$ and ${𝐇}^{\prime }$ sides gives the identical pattern:

31 - Add the three lines: the $x^2$ parts are exactly $L$, the $x^{-2}$ parts are exactly $R$. So the folded statement is the same statement but half the length.

32 - After ${\log }_{2}n$ rounds each vector is a single scalar $a,b$, sent in the clear. Each original generator survives times a product of the round challenges, $s_k={\prod }_j{x}_j^{\pm 1}$ chosen by the bits of $k$

the reversed index $s_{n-1-k}$ on the $𝐇$ side is because $b$ folded with the opposite powers to $a$, so its surviving products come out mirrored.

In the proof: $a$ is w121 C1 · w193 C2. $b$ is w122 C1 · w194 C2.

Notice that the checks 1 and 2 are each multiplied by an independent random weight and dropped into one accumulator, so the whole proof, is settled by a single multiexponentiation, for each curve, collapsing to the identity, if it holds.

From the verifier point of view

Before we run all of that backwards, let's stop for a second and see clearly what the Generalized Bulletproof equation actually is for each side, because the prover and the verifier are reading the very same line written in two different domains. The prover reads it as arithmetic between secret numbers. The verifier reads it in the exponent, as operations between public points.

And why are these two the same thing? Because a Pedersen commitment is a group homomorphism, $\phi (ax+by)=a\phi (x)+b\phi (y)$. Any linear relation that the prover knows to be $0$ in the field becomes a relation between points equal to $𝒪$, and since $𝐆,𝐇,{𝐆}_k,{𝐇}_k$ have no known discrete-log relation between them, the point equation can only collapse to $𝒪$ if the scalar coefficients were already zero.

Now an important question: how can we be sure that the prover ran the honest circuit to arrive at that polynomial equation? Well, the matrices $W_L,W_R,W_O,W_C$ and the constants $c$ are not in the proof at all. They are the circuit, they are public and fixed, the same for every transaction, and we build them ourselves before even start looking at the proof that the prover gave us. If you look at the code, the verifier reconstructs its weights by himself and never from the proof. The prover chooses the witness and nothing else. So when the folded equation closes to $𝒪$, it closes against the verifier matrices, and the binding of the commitments together with Schwartz-Zippel force his hidden witness to satisfy exactly the constraints that the verifier wrote.

Alright, to get started let's try to follow one real output $O$ all the way through and see where it ends up. $O$ is born as an ordinary one-time output on Ed25519, sitting on chain. When someone spends it, the transaction never names it, the transaction only publishes the re-randomized tuple $\tilde{O},\tilde{I},\tilde{C}$ and SAL proves the ownership of $\tilde{O}$. Meanwhile $(O,I,C)$ is one leaf among hundreds of millions in the tree and we use the different circuits to prove that we know a path (in a hidden way) from that leaf up to our root and that $\tilde{O}$ is the honest disguise of it, and doing that it turns $O$'s coordinates and every node of the path into the wires $a_L,a_R,a_O$ and the tree openings $a_C$. Those wires fold into $l(X)$ and $r(X)$, which get sealed into the commitments $A_I,A_O,S$ and the layer commitments $C_{𝐆}$. Finally the two checks and the logarithmic fold crush everything into the few bytes that are inside the fcmp_pp field: $A_I,A_O,S$, the layer commitments, the coefficient commitments $T_j$, the opened scalars ${\tau }_x,u,\widehat{t}$, and then the round points $L_k,R_k$ with the final $a,b$. And nowhere in all of that does $O$ ever appear itself! It survives only as blinded points and a handful of folded scalars that look uniformly random to us, and yet, by everything we did above, they were proved to be a genuine leaf of our own tree.

Now backwards

We previously built the proof forwards (from the prover perspective), now let's do it backwards (from the verifier's perspective) taking what we have on chain as starting point.

Reading what the prover sent:

1 - Read the three wire commitments, then draw the challenges the transcript binds to them:

2 - Rebuild the public weight vectors, folding the fixed circuit with powers of $z$. Note $w_R$ already absorbs the ${\overrightarrow{y}}^{-1}$ here

3 - Get the one public constant of the whole equation, $\delta (y,z)$, from those weights alone:

4 - Read the $t$-polynomial commitments and the challenge $x$ that opens them, then read the three opened scalars in the clear.

5 - Check one: the $t$-polynomial identity (random weight $w_1$)

The same as previously: $\widehat{t}$ claims to be the $X^{n^{\prime }}$ coefficient of $t(X)$ and the verifier rebuilds that coefficient as a commitment and demands equality.

Everything on the right is public or a point the prover already sent. Passing this pins $\widehat{t}$ to the public value $\delta -w_c$: the prover cannot name any other $\widehat{t}$ without breaking the binding of the $T_j$ commitments.

6 - Check two: Rebuild $P$ and fold (random weight $w_2$)

Weight each public point by the power of $x$ its coefficients sit at, exactly the prover's step 22. The commitments $C_{𝐆}$ enter here, at $x^{n^{\prime }-1-i}$.

7- The weight vectors fold onto the generators, each at the power of $x$ its coefficient occupies in $l(X)$ and $r(X)$: $w_R$ onto the ${𝐆}_k$ and $w_L,w_O$ together with the tree weights $w_C$ onto the ${𝐇}_k$, the whole $𝐇$ side reweighted by ${\overrightarrow{y}}^{-1}$.

8 - Glue the opened $\widehat{t}$ to the independent base and subtract the gathered blind $u$.

Steps 6 to 8 rebuild exactly the point of the prover's step 24, $P={\sum }_k{l}_k{𝐆}_k+{\sum }_k{\overrightarrow{y}}^{-k}{r}_k{𝐇}_k+\widehat{t}U$, with $a:=l$, $b:=r$. Nothing secret was used: every coefficient is a public weight or an opened scalar, every point was sent by the prover.

9 - The inner-product argument now folds $P$ through ${\log }_{2}n$ rounds. Each $(L_k,R_k)$ is read and enters at $x_k^2$ and $x_k^{-2}$. The final $a,b$ collapse the generators through the challenge products $s_k$.

Why the proof is valid?

• Check one forces $\widehat{t}$ to equal the public value $\delta -w_c$. A wrong $\widehat{t}$ would need a second opening of the $T_j$ commitments, that is, a discrete-log relation among independent generators, which nobody can produce.
• Check two forces $⟨a,b⟩=\widehat{t}$ for the reconstructed $a=l(x)$, $b=r(x)$. By the polynomial identity of step 17, $⟨l(x),r(x)⟩=t(x)$, whose $X^{n^{\prime }}$ coefficient is the whole GBP equation of step 13. So $\widehat{t}$ being that coefficient and equal to $⟨a,b⟩$ means the circuit-plus-tree equation held on the committed witness.
• Independence is what makes the batch honest. $𝐆,𝐇,{𝐆}_k,{𝐇}_k$ share no known relation, so a random-weighted sum of the check equations can vanish only if each holds as written. A cheating prover would leave a nonzero coefficient on some generator that no weighting can cancel.

So a proof passes when, and only when, the opened $\widehat{t}$ is at once the public constant value (check one) and the inner product of the reconstructed witness vectors (check two), across both curve proofs together. That one scalar is tied above to the root by the Schnorr proof and below to the public tuple $\tilde{O},\tilde{I},R,\tilde{C}$ by the circuit.

Next we can see how a real proof looks like in the blockchain.