Documentation

Core BLS pairing check shared by full fanout and partial fanout.

Verifies the KZG membership pairing identity:

e(commitment, G2) = e(proof, P_S(τ)·G2)

Argument mapping:

• commitment: A(τ)·G1 — the accumulator commitment from the Closed datum
• proof: Q(τ)·G1 — the quotient polynomial committed over G1, proving subset membership
• crsG2: [G2, τ·G2, ...] — used on-chain to compute P_S(τ)·G2 via MSM
• ints: integer encodings of element hashes, defining P_S(X) = ∏(X − sᵢ)

A subset of N elements yields P_S of degree N, so evaluating P_S(τ)·G2 consumes N+1 CRS points. getG2Commitment pairs the coefficients with the CRS using zipWith, which silently drops the coefficients the CRS cannot cover: an oversized subset would then be checked against a truncated, lower-degree polynomial instead of being rejected. Verifying a different identity than the one asked for is never the safe answer, so bail out whenever the polynomial outruns the CRS.