Summary
When runtime inputs (via input.json) exceed the field prime p, the witness generator silently reduces them modulo p without any warning or error. A developer passing a = p+5 gets the same result as a = 5 with no indication that the input was modified.
Environment
- Circom: 2.2.3 (latest master)
- Node: v18.17.1
- snarkjs: 0.7.6
- OS: Ubuntu
Reproducer
pragma circom 2.0.0;
template Test() {
signal input a;
signal output out;
out <== a * a + a + 1;
}
component main = Test();
circom test.circom --r1cs --wasm --output .
# Normal input — correct
echo '{"a": "5"}' > input.json
node test_js/generate_witness.js test_js/test.wasm input.json w.wtns
snarkjs wtns export json w.wtns w.json
cat w.json # output = 31 ✓
# Input exceeding field prime — silently wrong!
echo '{"a": "21888242871839275222246405745257275088548364400416034343698204186575808495622"}' > input.json
# This is p+5, should warn but silently becomes 5
node test_js/generate_witness.js test_js/test.wasm input.json w.wtns
snarkjs wtns export json w.wtns w.json
cat w.json # output = 31 (same as a=5!) — no warning!
Results
Circuit: out = a² + a + 1
| Input (a) |
Expected behavior |
Actual output |
| 5 |
31 |
✅ 31 |
| p+5 |
Warning or error |
❌ 31 (silently treated as a=5) |
| 2p+5 |
Warning or error |
❌ 31 (silently treated as a=5) |
| 100p+5 |
Warning or error |
❌ 31 (silently treated as a=5) |
| p |
Warning or error |
❌ 1 (silently treated as a=0) |
| p² |
Warning or error |
❌ 1 (silently treated as a=0) |
| 2²⁵⁶ |
Warning or error |
❌ Silent reduction |
| 10¹⁰⁰ |
Warning or error |
❌ Silent reduction |
Expected Behavior
The witness generator should either:
- Reject inputs >= p with an error:
Error: input value exceeds field prime
- Warn the user:
Warning: input 'a' exceeds field prime, reducing modulo p
Comparison with Noir
Noir (nargo) correctly rejects oversized inputs:
Failed to deserialize inputs: The value exceeds the field prime
Summary
When runtime inputs (via
input.json) exceed the field primep, the witness generator silently reduces them modulopwithout any warning or error. A developer passinga = p+5gets the same result asa = 5with no indication that the input was modified.Environment
Reproducer
Results
Circuit:
out = a² + a + 1Expected Behavior
The witness generator should either:
Error: input value exceeds field primeWarning: input 'a' exceeds field prime, reducing modulo pComparison with Noir
Noir (nargo) correctly rejects oversized inputs: