fix(blobs): bind emulated values to canonical bn254 scalars

Author: altergui

crypto/blobs/evaluation.go

@@ -30,6 +30,7 @@ import (
 	"fmt"
 	"math/big"
 
+	"github.com/consensys/gnark-crypto/ecc"
 	"github.com/consensys/gnark/frontend"
 	"github.com/consensys/gnark/std/math/emulated"
 )
@@ -38,6 +39,8 @@ const (
 	N = 1 << 12 // 4096 evaluation points
 )
 
+var maxCanonicalBN254Scalar = emulated.ValueOf[FE](new(big.Int).Sub(ecc.BN254.ScalarField(), big.NewInt(1)))
+
 // FE is type modulus for BLS12‑381 Fr.
 type FE = emulated.BLS12381Fr
 
@@ -175,22 +178,18 @@ func VerifyFullBlobEvaluationBN254(
 	// Convert all native scalars => emulated via the hint
 	var blobEmu [N]emulated.Element[FE]
 	for i := range N {
-		e, err := hintNativeToEmu(api, fr, blob[i])
+		e, err := liftNativeBN254ToEmulated(api, fr, blob[i])
 		if err != nil {
 			return err
 		}
 		blobEmu[i] = *e
-		// verify that the native input matches the emulated one created by the hint
-		api.AssertIsEqual(emulatedToNative(api, &blobEmu[i]), blob[i])
 	}
 
 	// Convert the native evaluation point z => emulated
-	zEmu, err := hintNativeToEmu(api, fr, z)
+	zEmu, err := liftNativeBN254ToEmulated(api, fr, z)
 	if err != nil {
 		return err
 	}
-	// verify that the native input matches the emulated one created by the hint
-	api.AssertIsEqual(emulatedToNative(api, zEmu), z)
 
 	// Verify the barycentric evaluation (does NOT check KZG commitment/proof)
 	if err := VerifyBarycentricEvaluation(api, zEmu, y, blobEmu); err != nil {
@@ -201,8 +200,20 @@ func VerifyFullBlobEvaluationBN254(
 	return VerifyKZGProof(api, commitment, proof, *zEmu, *y)
 }
 
+// liftNativeBN254ToEmulated lifts a native BN254 scalar into the emulated
+// field, constraining the witness to the canonical BN254 scalar range [0, pBN254)
+// and proving it recomposes back to the original native input.
+func liftNativeBN254ToEmulated(api frontend.API, fr *emulated.Field[FE], native frontend.Variable) (*emulated.Element[FE], error) {
+	emu, err := hintNativeToEmu(fr, native)
+	if err != nil {
+		return nil, err
+	}
+	fr.AssertIsLessOrEqual(emu, &maxCanonicalBN254Scalar)
+	api.AssertIsEqual(emulatedToNative(api, emu), native)
+	return emu, nil
+}
+
 // emulatedToNative converts an emulated element to a native BN254 variable.
-// This is used to ensure that the native input matches the emulated output.
 func emulatedToNative(api frontend.API, e *emulated.Element[FE]) frontend.Variable {
 	nbBits := FE{}.BitsPerLimb()
 	acc := frontend.Variable(0)

crypto/blobs/hints.go

@@ -86,11 +86,7 @@ func splitNativeHint(_ *big.Int, nativeIn, emuOut []*big.Int) error {
 
 // hintNativeToEmu converts a native BN254 variable to an emulated element
 // using the copyNativeToEmu hint.
-// It is important to verify that the native input matches the emulated output
-// to ensure soundness, in the circuit.
-func hintNativeToEmu(_ frontend.API, fr *emulated.Field[FE],
-	vNat frontend.Variable,
-) (*emulated.Element[FE], error) {
+func hintNativeToEmu(fr *emulated.Field[FE], vNat frontend.Variable) (*emulated.Element[FE], error) {
 	emu, err := fr.NewHintWithNativeInput(copyNativeToEmu, 1, vNat)
 	if err != nil {
 		return nil, err