Intermediate Signals and Sub-Component Circom’s primary purpose is to compile down to a Rank 1 Constraint System (R1CS), but its secondary purpose is to populate the witness. For most circuits, the...

Introduction to ZK Circuits with Circom Circom is a programming language for creating Rank 1 Constraint Systems (R1CS) and populating the witness vector of the R1CS. The R1CS format is of interest...

Public and Private Inputs A public input in Circom is a signal in the witness that will be revealed to the verifier. For example, suppose we want to create a ZK proof that states: “we know the input...

Symbolic Variables in Circom A symbolic variable in Circom is a variable that has been assigned values from a signal. When a signal is assigned to a variable (thereby turning it into a symbolic...

Circom Template Parameters, Variables, Loops, If Statements, Assert This chapter covers essential syntax, which you'll see in most Circom programs. With Circom, we're able to define a Rank 1...

Hello World Circom Introduction This chapter shows the relationship between Circom code and the Rank 1 Constraint System (R1CS) it compiles to. Understanding R1CSs is critical to understanding...

Indicate Then Constrain If we want to say that “ can be equal to 5 or 6” we can simply use the following constraint: However, suppose we want to say that “ is less than 5 or is greater than 17.” In...

Quadratic Constraints Circom Constraints A Rank 1 Constraint System has at most one multiplication between signals per constraint. This is called a "quadratic" constraint. Any constraint containing...

AliasCheck and Num2Bits_strict in Circomlib An alias bug in Circom (or any ZK circuit language) occurs when a binary array of signals encodes a number larger than the field element can hold. We will...

Hacking Underconstrained Circom Circuits With Fake Proofs The operator in Circom can be dangerous because it assigns values to signals but does not constrain them. But how do you actually ~~exploit~~...

Converting Algebraic Circuits to R1CS (Rank One Constraint System) This article is explains how to turn a set of arithmetic constraints into Rank One Constraint System (R1CS). The focus of this...

Circom language tutorial with circomlib walkthrough This tutorial introduces the Circom language and how to use it, along with common pitfalls. We will also explain a significant portion of the...