# OpenVM

Markdown version of https://l2beat.com/zk-catalog/openvmprover

## Summary

- Creator: Axiom
- Total Value Secured: $42.88 M (-9.25% compared to seven days ago)
- Trusted setups for Halo2 (Plonk):
  - Halo2 KZG over BN254, risk yellow (medium risk) per the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381): Trusted setup for KZG commitments managed by Halo2 team on the base of the first 71 contributions to the Perpetual Powers of Tau contributions.
  - Used in: [Scroll](https://l2beat.com/layer2s/projects/scroll)
  - Verifiers: 4 successful (verified by [L2BEAT](https://l2beat.com))
- zkVM: Plonky3 (STARK), OpenVM (ISA), Baby Bear (Field)
- Final wrap: Halo2 (Plonk), BN254 (curve), KZG (PCS)

### About

OpenVM prover is a zk proving system for customizable modular VM built by Axiom and used to prove Scroll L2 STF.

### Links

- Website: https://openvm.dev
- Docs: https://book.openvm.dev, https://openvm.dev/whitepaper.pdf, https://www.youtube.com/watch?v=NHwd-gJ8xg4
- Repository: https://github.com/openvm-org/openvm, https://github.com/scroll-tech/zkvm-prover/tree/master
- Social: https://t.me/openvm

## Value Secured

The interactive TVS chart is shown on [the HTML page](https://l2beat.com/zk-catalog/openvmprover#tvs).

## Proof System

### Description

[OpenVM](https://github.com/openvm-org/openvm?tab=readme-ov-file) is a STARK proving system based on [Plonky3 proving library](https://github.com/Plonky3/Plonky3), that has “no-CPU” design paradigm and allows adding new custom instructions to its instruction set architecture (ISA). It supports [recursive STARK aggregation](https://docs.openvm.dev/book/guest-libraries/verify-stark) and provides an [SDK](https://github.com/openvm-org/openvm-solidity-sdk) for creating Solidity verifier smart contracts.

### Proof system

The proof system is split into ZK frontend, i.e. arithmetization, and ZK backend, i.e. a polynomial IOP with the Fiat-Shamir heuristic. In practice, a batched FRI-based polynomial commitment is used as the backend. OpenVM backend relies on Plonky3 prover system.

OpenVM arithmetizes the execution trace using AIR with Interactions over BabyBear prime field. Interactions which include LogUp, permutation check and others.

#### zkVM design

OpenVM uses read-only program memory, read/write data memory as well as inputs and hints from host to enable non-deterministic computation. The execution logic is organized into a set of system chips and custom chips, without any centralized CPU-like chip. Interactions between chips are managed by program, execution and memory buses.

Currently OpenVM ISA supports RISC-V instructions, keccak-256 and SHA256 hash functions, int256 arithmetic, modular arithmetic over arbitrary fields, some elliptic curve operations for the secp256k1 and secp256r1 curves and pairing operations on the BN254 and BLS12-381 curves.

#### Recursion circuits

OpenVM supports recursive proving and continuations, i.e. splitting a single execution trace into several rather independent ones, by recursive verification of generated STARK proofs in a specialized OpenVM program optimized for efficient proof verification (called native VM).

#### Final wrap

The STARK proof is wrapped in Halo2 SNARK with KZG commitments over BN254 curve for efficient onchain processing. KZG commitment relies on Perpetual Powers of Tau trusted setup ceremony, see [below](https://l2beat.com/zk-catalog/openvmprover#trusted-setups) for more details.

## Milestones & Incidents

- 2025-05-26 (incident): [[Disclosed vulnerability] Plonky3 final polynomial degree check vulnerability](https://forum.scroll.io/t/security-council-report-scroll-mainnet-emergency-upgrade-on-2025-05-26/810). Fix of a bug in OpenVM that was analogous to an identified vulnerability in Plonky3 library.

## Trusted Setups

Risk levels follow the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381). Yellow (medium risk): all contributions are published and the final output can be verified, the ceremony client is open source, there were at least 30 contributions, participation was open to the public and announced, and participants are publicly identified. Green (lowest risk): everything required for yellow, with at least 150 contributions. Red (highest risk): at least one requirement for yellow is not met. N/A: the proof system needs no trusted setup.

### Halo2 KZG over BN254

- Risk: yellow (medium risk)
- Proof systems: Halo2 (Plonk)

A trusted setup used for KZG commitments over BN254 curve for Halo2 SNARK proving system
(when it is set up not in a transparent way). De-facto it is the first 71 entries in the Perpetual Powers of Tau
ceremony that were converted to a particular format.

- The main coordination point is this Halo2 KZG repo to convert pptau format into Halo2-suitable format: [https://github.com/han0110/halo2-kzg-srs?tab=readme-ov-file#perpetual-powers-of-tau](https://github.com/han0110/halo2-kzg-srs?tab=readme-ov-file#perpetual-powers-of-tau)
- Ceremony is [Perpetual Powers of Tau](https://github.com/weijiekoh/perpetualpowersoftau): [https://github.com/scroll-tech/scroll-prover/blob/main/circuit-assets.md](https://github.com/scroll-tech/scroll-prover/blob/main/circuit-assets.md)

## Verifier IDs

List of different onchain verifiers for this proving system. Unique ID distinguishes different deployments of the same verifier from different verifiers (e.g. different versions).

### Plonk: Halo2

Rust implementation of Halo2 SNARK proving system, originally developed for ZCash.

#### OpenVM v2.0.0 PostFeynman

Custom verifier ID: solidity codehash of the verifier smart contract, i.e. keccak256 of the EVM bytecode.

- Verifier ID: `0x00dfb6855747412fa70b8a75aaa4950f1deafaace9d2a4e9923ad2e1a3589928`
- Source: https://github.com/openvm-org/openvm/tree/v2.0.0
- Verification: successful
- Used in: [Scroll](https://l2beat.com/layer2s/projects/scroll)

**Known deployments**

- [0x0d2A59fd7060460F07c30C2817b4E79576da01C6](https://etherscan.io/address/0x0d2A59fd7060460F07c30C2817b4E79576da01C6#code) on Ethereum, used in: [Scroll](https://l2beat.com/layer2s/projects/scroll)

##### Verification steps

The verification steps are based on [this guide](https://github.com/scroll-tech/scroll-sc-tools/pull/11), with two
adjustments to make the regeneration reproducible:
- Formatting. The verifier generated by the guide's `--recompute` mode has the same executable code as the deployed one but a different codehash because of different formatting.
- Setup params. Degrees 22 and 23 are required, not the 22 and 24 in the script.

Memory usage peaks around 30 GiB on an Ubuntu machine.

1. Install dependency packages: `sudo apt-get update && sudo apt-get install build-essential pkg-config libssl-dev`.
2. Install the required Rust toolchains, Solidity compiler and Foundry:
```
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
. .cargo/env
rustup toolchain install nightly-2025-11-20   # used by scroll-sc-tools; OpenVM's generator uses stable

cargo install svm-rs
svm install 0.8.19
solc --version  # should be 0.8.19

curl -L https://foundry.paradigm.xyz | bash
source ~/.bashrc    # or similar depending on your shell
foundryup
```

3. Clone the [scroll-sc-tools](https://github.com/scroll-tech/scroll-sc-tools) repo and check out the PR #11 commit:
`git checkout f105d1dcdf0d945f2a3028a4f557ab9369486c1a`.
4. Modify the script to download all required trusted setup params: line 8 of `scripts/download-params.sh` should be changed to `degrees=("22" "23" "24")`.
5. Download trusted setup params (around 4 GiB): `bash scripts/download-params.sh`.
6. Clone the [openvm-solidity-sdk](https://github.com/openvm-org/openvm-solidity-sdk) repo at tag v2.0 and build OpenVM's verifier generator:
```
git clone https://github.com/openvm-org/openvm-solidity-sdk.git
cd openvm-solidity-sdk
git checkout 7dc4d9936834e75d3e08186f0c757418858715df   # tag v2.0
cargo build --release --locked --manifest-path tools/generate-verifier/Cargo.toml --bin generate-verifier
```
7. Regenerate the verifier (Scroll uses the deferral variant): `tools/generate-verifier/target/release/generate-verifier --variant deferral --output-dir generated`.
8. Format the generated sources with the repo's forge fmt config and check they are byte-identical to the published
sources. The diff should print nothing:
```
cp foundry.toml generated/
forge fmt --root generated
diff -r -x '*.json' generated/src/v2.0-deferral src/v2.0-deferral
```
9. Compile the published sources (now shown identical to the regenerated ones) with the exact settings of the deployment,
and print the codehash. It should be `0x00dfb6855747412fa70b8a75aaa4950f1deafaace9d2a4e9923ad2e1a3589928`:
```
cd scroll-sc-tools
cargo run --release -- generate-verifier
```
10. Verify that the deployed verifier smart contract has the same codehash: `cast keccak $(cast code 0x0d2A59fd7060460F07c30C2817b4E79576da01C6 --rpc-url <YOUR_ETHEREUM_RPC_URL>)`.

#### OpenVM v1.6.0 PostFeynman

Custom verifier ID: solidity codehash of the verifier smart contract, i.e. keccak256 of the EVM bytecode.

- Verifier ID: `0x6a74f16c472ea2698ee461daf35ffb62faaef6280d40390961daa181bc805663`
- Source: https://github.com/openvm-org/openvm/tree/v1.6.0
- Verification: successful (verified by [L2BEAT](https://l2beat.com))
- Used in: none

**Known deployments**

- [0x96cbcC4333E172927fDa8B631C716d43E2FBA01C](https://etherscan.io/address/0x96cbcC4333E172927fDa8B631C716d43E2FBA01C#code) on Ethereum, used in: none

##### Verification steps

The verification steps are based on [this guide](https://github.com/scroll-tech/scroll-sc-tools/tree/feat/galileo?tab=readme-ov-file), with slight adjustments to resolve build failures. Memory usage peaks around 80 GiB on an ubuntu machine.

1. Install dependency packages: `sudo apt-get update && sudo apt-get install build-essential pkg-config libssl-dev`.
2. Install specifically required rust toolchain, solidity compiler and forge toolchain:
```
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
. .cargo/env
rustup toolchain install nightly-2025-02-14

cargo install svm-rs
svm install 0.8.19
solc --version  # should be 0.8.19

curl -L https://foundry.paradigm.xyz | bash
source ~/.bashrc    # or similar depending on your shell
foundryup
```
3. Check out the correct version of the [scroll-sc-tools](https://github.com/scroll-tech/scroll-sc-tools) repo: `git checkout 8658047684eedff2d6f9071264989f7e6f5b1f14`.
4. Modify the script to download all required trusted setup params: line 8 of `scripts/download-params.sh` should be changed to `degrees=("22" "23" "24")`.
5. Download trusted setup params (around 4 GiB): `bash scripts/download-params.sh`.
6. Generate the verifier file and output its code hash: `RUST_MIN_STACK=16777216 cargo run --release -- generate-verifier --recompute`.
7. Verify that the deployed verifier smart contract has the same codehash: `cast keccak $(cast code 0x96cbcC4333E172927fDa8B631C716d43E2FBA01C --rpc-url <YOUR_ETHEREUM_RPC_URL>)`.

#### OpenVM Feynman

Custom verifier ID: solidity codehash of the verifier smart contract, i.e. keccak256 of the EVM bytecode.

- Verifier ID: `0x30af8474d8e13b8ce6a96eae63293310e7c1072b890bde77f96786497a9e5f4b`
- Source: https://github.com/openvm-org/openvm/tree/v1.2.1-rc.1
- Verification: successful (verified by [L2BEAT](https://l2beat.com))
- Used in: [Scroll](https://l2beat.com/layer2s/projects/scroll)

**Known deployments**

- [0x39854DF30b3482Ef546F68B8981Fae5A2C426eA4](https://etherscan.io/address/0x39854DF30b3482Ef546F68B8981Fae5A2C426eA4#code) on Ethereum, used in: [Scroll](https://l2beat.com/layer2s/projects/scroll)

##### Verification steps

The verification steps are based on [this guide](https://github.com/scroll-tech/scroll-sc-tools/tree/feat/feynman?tab=readme-ov-file), with slight adjustments to resolve build failures. Memory usage peaks around 60 GiB on an ubuntu machine.

1. Install dependency packages: `sudo apt-get update && sudo apt-get install build-essential pkg-config libssl-dev`.
2. Install specifically required rust toolchain and solidity compiler:
```
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
. .cargo/env
rustup toolchain install nightly-2025-02-14

cargo install svm-rs
svm install 0.8.19
solc --version  # should be 0.8.19
```
3. Check out the correct version of the [scroll-sc-tools](https://github.com/scroll-tech/scroll-sc-tools) repo: `git checkout feat/feynman`. The commit hash should be `74c0bd1994171dcb69c6da82e93cf6d273f9b984`.
4. Modify the script to download all required trusted setup params: line 8 of `scripts/download-params.sh` should be changed to `degrees=("22" "24")`.
5. Download trusted setup params (around 3 GiB): `bash scripts/download-params.sh`.
6. Generate the verifier file and output its code hash: `RUST_MIN_STACK=16777216 cargo run --release -- generate-verifier`.
7. Verify that the deployed verifier smart contract has the same codehash: `cast keccak $(cast code 0x39854DF30b3482Ef546F68B8981Fae5A2C426eA4 --rpc-url <YOUR_ETHEREUM_RPC_URL>)`.

#### OpenVM Galileo

Custom verifier ID: solidity codehash of the verifier smart contract, i.e. keccak256 of the EVM bytecode.

- Verifier ID: `0xf86ce35d4f5b1478f21194d9c6fc825f8d8afc0468425c981dc017149f0cac5e`
- Source: https://github.com/openvm-org/openvm/tree/v1.4.0
- Verification: successful (verified by [L2BEAT](https://l2beat.com))
- Used in: [Scroll](https://l2beat.com/layer2s/projects/scroll)

**Known deployments**

- [0x749fC77A1a131632a8b88e8703E489557660C75e](https://etherscan.io/address/0x749fC77A1a131632a8b88e8703E489557660C75e#code) on Ethereum, used in: [Scroll](https://l2beat.com/layer2s/projects/scroll)

##### Verification steps

The verification steps are based on [this guide](https://github.com/scroll-tech/scroll-sc-tools/tree/feat/galileo?tab=readme-ov-file), with slight adjustments to resolve build failures. Memory usage peaks around 50 GiB on an ubuntu machine.

1. Install dependency packages: `sudo apt-get update && sudo apt-get install build-essential pkg-config libssl-dev`.
2. Install specifically required rust toolchain and solidity compiler:
```
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
. .cargo/env
rustup toolchain install nightly-2025-02-14

cargo install svm-rs
svm install 0.8.19
solc --version  # should be 0.8.19
```
3. Check out the correct version of the [scroll-sc-tools](https://github.com/scroll-tech/scroll-sc-tools) repo: `git checkout feat/galileo`. The commit hash should be `f880a705954dc205cae7e1add474bd9e6cad1610`.
4. Modify the script to download all required trusted setup params: line 8 of `scripts/download-params.sh` should be changed to `degrees=("22" "23" "24")`.
5. Download trusted setup params (around 4 GiB): `bash scripts/download-params.sh`.
6. Generate the verifier file and output its code hash: `RUST_MIN_STACK=16777216 cargo run --release -- generate-verifier --recompute`. If this step produces a build failure because of `SOLC_VERSION_0_8_31_CHECKSUM` duplication, open the problematic `builds.rs` file and remove all occurances of the duplicate (second version of `SOLC_VERSION_0_8_31_CHECKSUM`). This requires altering several lines, including changing the hardcoded length of `ALL_SOLC_VERSIONS` array. Rerun the command after altering the file.
7. Verify that the deployed verifier smart contract has the same codehash: `cast keccak $(cast code 0x749fC77A1a131632a8b88e8703E489557660C75e --rpc-url <YOUR_ETHEREUM_RPC_URL>)`.

## Program Hashes

List of known guest zkVM programs used by this prover. Each program represents a piece of offchain execution that is verified onchain. The program hash serves as the program's unique identifier.

### Executable of the Scroll bundle program v0.5.2

Proves the correct execution of a bundle of Scroll L2 blocks, which is the unit of L2 state finalisation from L1’s perspective.

- Hash: `0x003ac2e012d8a7fb1495d94839fe36559b52fd6d60a532884c7558de2b88bf72`
- Repository: https://github.com/scroll-tech/zkvm-prover/tree/0.5.2/crates/circuits/bundle-circuit
- Verification: successful
- Used in: [Scroll](https://l2beat.com/layer2s/projects/scroll)

#### Verification steps

Steps due to the guide here: [https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174](https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174).

1. Install docker [https://docs.docker.com/get-started/get-docker/](https://docs.docker.com/get-started/get-docker/) and make sure it is running `docker ps`.
2. Checkout the correct branch in [zkvm-prover](https://github.com/scroll-tech/zkvm-prover/tree/master) repo: `git checkout 0.5.2` Commit hash should be `8f29f60cc73495e8586338a67433a812097427c4`.
3. Build the guest programs from the root repo dir: `make build-guest`. It will regenerate `bundle_exe_commit.rs`.
4. Run `compress_commitment` function from [https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174](https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174) on the `COMMIT` array from the previous step to generate `digest_2` value. A sample rust implementation is:
    ```
use openvm_stark_sdk::p3_baby_bear::BabyBear;
use openvm_stark_sdk::p3_bn254_fr::Bn254Fr;
use openvm_stark_sdk::openvm_stark_backend::p3_field::FieldAlgebra;
use openvm_stark_sdk::openvm_stark_backend::p3_field::PrimeField32;

fn compress_commitment(commitment: &[u32; 8]) -> Bn254Fr {
    let order = Bn254Fr::from_canonical_u64(BabyBear::ORDER_U32 as u64);

    let mut base = Bn254Fr::ONE;      // from PrimeCharacteristicRing
    let mut compressed = Bn254Fr::ZERO; // from PrimeCharacteristicRing

    for val in commitment {
        compressed += Bn254Fr::from_canonical_u64(*val as u64) * base;
        base *= order;
    }

    compressed
}
```

### Config of the Scroll bundle program v0.5.2

This is not a ZK program, but a commitment to the config of Scroll bundle program (bundle leaf commitment). It also needs to be checked to verify the expected ZK verification.

- Hash: `0x009305f0762291e3cdd805ff6d6e81f1d135dbfdeb3ecf30ad82c3855dde7909`
- Repository: https://github.com/scroll-tech/zkvm-prover/tree/0.5.2/crates/circuits/bundle-circuit
- Verification: successful
- Used in: [Scroll](https://l2beat.com/layer2s/projects/scroll)

#### Verification steps

Steps due to the guide here: [https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174](https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174).

1. Install docker [https://docs.docker.com/get-started/get-docker/](https://docs.docker.com/get-started/get-docker/) and make sure it is running `docker ps`.
2. Checkout the correct branch in [zkvm-prover](https://github.com/scroll-tech/zkvm-prover/tree/master) repo: `git checkout 0.5.2` Commit hash should be `8f29f60cc73495e8586338a67433a812097427c4`.
3. Build the guest programs from the root repo dir: `make build-guest`. It will regenerate `circuits/bundle-circuit/bundle_leaf_commit.rs`.
4. Run `compress_commitment` function from [https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174](https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174) on the `COMMIT` array from the previous step to generate `digest_2` value. A sample rust implementation is:
    ```
use openvm_stark_sdk::p3_baby_bear::BabyBear;
use openvm_stark_sdk::p3_bn254_fr::Bn254Fr;
use openvm_stark_sdk::openvm_stark_backend::p3_field::FieldAlgebra;
use openvm_stark_sdk::openvm_stark_backend::p3_field::PrimeField32;

fn compress_commitment(commitment: &[u32; 8]) -> Bn254Fr {
    let order = Bn254Fr::from_canonical_u64(BabyBear::ORDER_U32 as u64);

    let mut base = Bn254Fr::ONE;      // from PrimeCharacteristicRing
    let mut compressed = Bn254Fr::ZERO; // from PrimeCharacteristicRing

    for val in commitment {
        compressed += Bn254Fr::from_canonical_u64(*val as u64) * base;
        base *= order;
    }

    compressed
}
```

### Executable of the Scroll bundle program v0.7.1

Proves the correct execution of a bundle of Scroll L2 blocks, which is the unit of L2 state finalisation from L1’s perspective.

- Hash: `0x0062333dc88631be7af046cc8d3c24f346de172aa2030a28b445ab500889d297`
- Repository: https://github.com/scroll-tech/zkvm-prover/tree/v0.7.1/crates/circuits/bundle-circuit
- Verification: successful
- Used in: [Scroll](https://l2beat.com/layer2s/projects/scroll)

#### Verification steps

Steps due to the guide here: [https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174](https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174).

Although the guide below uses docker for reproducable builds, we failed to obtain the correct program hash on a MacOS machine.
The steps below work only for a Linux OS (e.g. Ubuntu).

1. On a Linux machine, install docker [https://docs.docker.com/get-started/get-docker/](https://docs.docker.com/get-started/get-docker/) and make sure it is running `docker ps`.
2. Checkout the correct branch in [zkvm-prover](https://github.com/scroll-tech/zkvm-prover/tree/master) repo: `git checkout 0.7.1` Commit hash should be `85dc6bc56728b8eef22281fdb215c136d7b5bbda`.
3. Build the guest programs from the root repo dir: `make build-guest`. It will regenerate `circuits/bundle-circuit/bundle_leaf_commit.rs`.
4. Run `compress_commitment` function from [https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174](https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174) on the `COMMIT` array from the previous step to generate `digest_2` value. A sample rust implementation is:
    ```
use openvm_stark_sdk::p3_baby_bear::BabyBear;
use openvm_stark_sdk::p3_bn254_fr::Bn254Fr;
use openvm_stark_sdk::openvm_stark_backend::p3_field::FieldAlgebra;
use openvm_stark_sdk::openvm_stark_backend::p3_field::PrimeField32;

fn compress_commitment(commitment: &[u32; 8]) -> Bn254Fr {
    let order = Bn254Fr::from_canonical_u64(BabyBear::ORDER_U32 as u64);

    let mut base = Bn254Fr::ONE;      // from PrimeCharacteristicRing
    let mut compressed = Bn254Fr::ZERO; // from PrimeCharacteristicRing

    for val in commitment {
        compressed += Bn254Fr::from_canonical_u64(*val as u64) * base;
        base *= order;
    }

    compressed
}
```

### Executable of the Scroll bundle program v0.9.1

Proves the correct execution of a bundle of Scroll L2 blocks, which is the unit of L2 state finalisation from L1’s perspective.

- Hash: `0x006770fb0f71f20718b614c8c5d3fb39482f0527806e67b0ea00ab5508245655`
- Repository: https://github.com/scroll-tech/zkvm-prover/tree/v0.9.1/crates/circuits/bundle-circuit
- Verification: successful
- Used in: [Scroll](https://l2beat.com/layer2s/projects/scroll)

#### Verification steps

Steps due to the guide here: [https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174](https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174).

The steps below work only for Linux OS (linux/amd64).

1. Install docker [https://docs.docker.com/get-started/get-docker/](https://docs.docker.com/get-started/get-docker/) and make sure it is running `docker ps`.
2. Checkout the correct commit in [zkvm-prover](https://github.com/scroll-tech/zkvm-prover/tree/master) repo: `git checkout v0.9.1` (commit `bf887150bb671af9b17dd53e92b7f2bbf01ec745`).
3. Build the guest programs from the root repo dir: `make build-guest`. It will regenerate `crates/circuits/bundle-circuit/bundle_exe_commit.rs`. The rebuilt file is byte-identical to the one committed in the repo, with `COMMIT` array `[230646913, 1550155984, 1593546189, 445636947, 993877920, 922842868, 418587344, 1363280000]`.
4. Run `compress_commitment` function from [https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174](https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174) on the `COMMIT` array from the previous step to generate `digest_2` value. A sample rust implementation is:
    ```
use openvm_stark_sdk::p3_baby_bear::BabyBear;
use openvm_stark_sdk::p3_bn254_fr::Bn254Fr;
use openvm_stark_sdk::openvm_stark_backend::p3_field::FieldAlgebra;
use openvm_stark_sdk::openvm_stark_backend::p3_field::PrimeField32;

fn compress_commitment(commitment: &[u32; 8]) -> Bn254Fr {
    let order = Bn254Fr::from_canonical_u64(BabyBear::ORDER_U32 as u64);

    let mut base = Bn254Fr::ONE;      // from PrimeCharacteristicRing
    let mut compressed = Bn254Fr::ZERO; // from PrimeCharacteristicRing

    for val in commitment {
        compressed += Bn254Fr::from_canonical_u64(*val as u64) * base;
        base *= order;
    }

    compressed
}
```

### Config of the Scroll bundle program v0.9.1

This is not a ZK program, but a commitment to the config of Scroll bundle program (bundle leaf commitment). It also needs to be checked to verify the expected ZK verification.

- Hash: `0x00488b196ca5b2ea1fda4c960fe2e1b0b9715c0428a8ec6fb01a64684f8533f7`
- Repository: https://github.com/scroll-tech/zkvm-prover/tree/v0.9.1/crates/circuits/bundle-circuit
- Verification: successful
- Used in: [Scroll](https://l2beat.com/layer2s/projects/scroll)

#### Verification steps

Steps due to the guide here: [https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174](https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174).

The steps below work only for Linux OS (linux/amd64).

1. On a Linux machine, install docker [https://docs.docker.com/get-started/get-docker/](https://docs.docker.com/get-started/get-docker/) and make sure it is running `docker ps`.
2. Checkout the correct commit in [zkvm-prover](https://github.com/scroll-tech/zkvm-prover/tree/master) repo: `git checkout v0.9.1` (commit `bf887150bb671af9b17dd53e92b7f2bbf01ec745`).
3. Build the guest programs from the root repo dir: `make build-guest`. It will regenerate `crates/circuits/bundle-circuit/bundle_vm_commit.rs`. The rebuilt file is byte-identical to the one committed in the repo, with `COMMIT` array `[1986621377, 858531750, 1460740544, 1489416258, 402142684, 1028207948, 2010771520, 956067622]`.
4. Run `compress_commitment` function from [https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174](https://scrollzkp.notion.site/Prover-Architecture-Post-Euclid-1de7792d22af80e3a8ecdd03b5f02174) on the `COMMIT` array from the previous step to generate `digest_2` value. A sample rust implementation is:
    ```
use openvm_stark_sdk::p3_baby_bear::BabyBear;
use openvm_stark_sdk::p3_bn254_fr::Bn254Fr;
use openvm_stark_sdk::openvm_stark_backend::p3_field::FieldAlgebra;
use openvm_stark_sdk::openvm_stark_backend::p3_field::PrimeField32;

fn compress_commitment(commitment: &[u32; 8]) -> Bn254Fr {
    let order = Bn254Fr::from_canonical_u64(BabyBear::ORDER_U32 as u64);

    let mut base = Bn254Fr::ONE;      // from PrimeCharacteristicRing
    let mut compressed = Bn254Fr::ZERO; // from PrimeCharacteristicRing

    for val in commitment {
        compressed += Bn254Fr::from_canonical_u64(*val as u64) * base;
        base *= order;
    }

    compressed
}
```