Use `read/write_slice` to avoide `serde` at zkVM boundary & optimize zlVM ELF build

[nuke-web3]

We should not do serde operations in/out of the ZK program, as we operate on large data and the cycles spent to do it are pretty huuuuge:

#82 (comment)

# 0.125 MB blob
INFO execute: clk = 0 pc = 0x20aa78
INFO execute: ┌╴deserialize input
INFO execute: └╴63,881 cycles
INFO execute: ┌╴create blob
WARNING: Using insecure random number generator.
INFO execute: └╴67,162 cycles
INFO execute: ┌╴compute keccak hash
INFO execute: └╴5,264 cycles
INFO execute: ┌╴convert blob to shares
INFO execute: └╴17,315 cycles
INFO execute: ┌╴verify proof
INFO execute: └╴50,456 cycles
INFO execute: ┌╴check keccak hash
INFO execute: └╴619 cycles
INFO execute: ┌╴commit output
INFO execute: └╴1,416 cycles
INFO execute: gas: 1676576


# 1.5 MB blob
INFO execute: clk = 0 pc = 0x20aa78
INFO execute: ┌╴deserialize input
INFO execute: clk = 10000000 pc = 0x202d28
INFO execute: clk = 20000000 pc = 0x202d14
INFO execute: └╴27,746,571 cycles
INFO execute: ┌╴create blob
INFO execute: clk = 30000000 pc = 0x20a7a8
INFO execute: clk = 40000000 pc = 0x20a8c4
WARNING: Using insecure random number generator.
INFO execute: clk = 50000000 pc = 0x219ec4
INFO execute: clk = 60000000 pc = 0x213d08
INFO execute: clk = 70000000 pc = 0x20a9cc
INFO execute: clk = 80000000 pc = 0x20aa48
INFO execute: clk = 90000000 pc = 0x2120d4
INFO execute: clk = 100000000 pc = 0x20a5b8
INFO execute: clk = 110000000 pc = 0x212030
INFO execute: clk = 120000000 pc = 0x20a69c
INFO execute: └╴97,020,929 cycles
INFO execute: ┌╴compute keccak hash
INFO execute: └╴5,142,260 cycles
INFO execute: ┌╴convert blob to shares
INFO execute: clk = 130000000 pc = 0x20a8bc
INFO execute: clk = 140000000 pc = 0x20a8a0
INFO execute: └╴16,996,745 cycles
INFO execute: ┌╴verify proof
INFO execute: clk = 150000000 pc = 0x219ec4
INFO execute: clk = 160000000 pc = 0x20a65c
INFO execute: clk = 170000000 pc = 0x20a65c
INFO execute: clk = 180000000 pc = 0x20d3e8
INFO execute: └╴36,835,395 cycles
INFO execute: ┌╴check keccak hash
INFO execute: └╴619 cycles
INFO execute: ┌╴commit output
INFO execute: └╴1,280 cycles
INFO execute: gas: 315341119
INFO execute: close time.busy=95.5s time.idle=15.2µs

[nuke-web3]

for reference, we can impl something like https://github.com/celestiaorg/pda-proxy/blob/main/zkVM/common/src/lib.rs#L42 for this use case.

[nuke-web3]

And for sure we need optimizations to reduce cycles! see https://github.com/search?q=repo%3Acelestiaorg%2Fpda-proxy%20lto&type=code

[nuke-web3]

from #105 work, chatting w/ GPT:

https://chatgpt.com/share/e/68d19429-f484-8001-95a9-7ab8ffdd66f9

---

Prompt

We are using a zkVM (SP1) to generate a proof of the equivalence of a blob inclusion on Celestia (a Namespaced Merkle Tree root, sha256) and the blob's raw bytes keccak hash.
We MUST optimize the cycles consumed by the zkVM program.
First read and study https://dev.risczero.com/api/zkvm/optimization that we can apply.

Make a step-wise plan to optimize the zkVM cycle usage

zkVM program

#![no_main]
#![doc = include_str!("../README.md")]

sp1_zkvm::entrypoint!(main);

use celestia_types::hash::Hash;
use eq_common::{compute_blob_keccak, ZKStackEqProofInput, ZKStackEqProofOutput};

pub fn main() {
    println!("cycle-tracker-start: deserialize");
    let input: ZKStackEqProofInput = sp1_zkvm::io::read();
    println!("cycle-tracker-end: deserialize");

    println!("cycle-tracker-start: verify NMT proof");
    let wrapped_root_hash = Hash::Sha256(input.data_root);
    input
        .share_proof
        .verify(wrapped_root_hash)
        .expect("NMT proof failed");
    println!("cycle-tracker-end: verify NMT proof");

    println!("cycle-tracker-start: compute keccak hash from shares");
    let computed_keccak = compute_blob_keccak(input.share_proof.data);
    println!("cycle-tracker-end: compute keccak hash from shares");

    println!("cycle-tracker-start: commit");
    let output = ZKStackEqProofOutput {
        keccak_hash: computed_keccak,
        data_root: input.data_root,
        batch_number: input.batch_number,
        chain_id: input.chain_id,
    }
    .to_vec();
    sp1_zkvm::io::commit_slice(&output);
    println!("cycle-tracker-end: commit");
}

Shared lib

use celestia_types::{
    consts::appconsts::{
        CONTINUATION_SPARSE_SHARE_CONTENT_SIZE, FIRST_SPARSE_SHARE_CONTENT_SIZE, NAMESPACE_SIZE,
        SEQUENCE_LEN_BYTES, SHARE_INFO_BYTES, SHARE_SIZE, SIGNER_SIZE,
    },
    ShareProof,
};
use serde::{Deserialize, Serialize};
use sha3::{Digest, Keccak256};

#[cfg(feature = "host")]
mod error;
#[cfg(feature = "host")]
pub use error::{ErrorLabels, InclusionServiceError};

#[cfg(feature = "grpc")]
/// gRPC generated bindings
pub mod eqs {
    include!("generated/eqs.rs");
}

/*
    For now, we only support ZKStackEqProofs
    These are used for Celestia integrations with Matter Labs' ZKStack
    TODO: Add support for Payy Celestia integration
*/
#[derive(Serialize, Deserialize, Clone, Debug)]
pub struct ZKStackEqProofInput {
    pub share_proof: ShareProof,
    pub data_root: [u8; 32],
    pub batch_number: u32,
    pub chain_id: u64,
}

pub struct ZKStackEqProofOutput {
    pub keccak_hash: [u8; 32],
    pub data_root: [u8; 32],
    pub batch_number: u32,
    pub chain_id: u64,
}

impl ZKStackEqProofOutput {
    // Simple encoding, rather than use any Ethereum libraries
    pub fn to_vec(&self) -> Vec<u8> {
        let mut encoded = Vec::new();
        encoded.extend_from_slice(&self.keccak_hash);
        encoded.extend_from_slice(&self.data_root);
        encoded.extend_from_slice(&self.batch_number.to_le_bytes());
        encoded.extend_from_slice(&self.chain_id.to_le_bytes());
        encoded
    }

    #[cfg(feature = "host")]
    pub fn from_bytes(data: &[u8]) -> Result<Self, InclusionServiceError> {
        if data.len() != 76 {
            return Err(InclusionServiceError::OutputDeserializationError);
        }
        let decoded = ZKStackEqProofOutput {
            keccak_hash: data[0..32]
                .try_into()
                .map_err(|_| InclusionServiceError::OutputDeserializationError)?,
            data_root: data[32..64]
                .try_into()
                .map_err(|_| InclusionServiceError::OutputDeserializationError)?,
            batch_number: u32::from_le_bytes(
                data[64..68]
                    .try_into()
                    .map_err(|_| InclusionServiceError::OutputDeserializationError)?,
            ),
            chain_id: u64::from_le_bytes(
                data[68..76]
                    .try_into()
                    .map_err(|_| InclusionServiceError::OutputDeserializationError)?,
            ),
        };
        Ok(decoded)
    }
}

/// Computes Keccak‐256 over the reconstructed blob bytes by streaming
/// payload portions of each share, skipping headers and, for version 1, the signer.
/// Supports share versions 0 and 1; panics on unknown versions.
///
/// See: https://celestiaorg.github.io/celestia-app/shares.html#share-version
pub fn compute_blob_keccak(raw_shares: Vec<[u8; SHARE_SIZE]>) -> [u8; 32] {
    let mut hasher = Keccak256::new();
    let mut iter = raw_shares.iter();

    if let Some(first_share) = iter.next() {
        let bytes = first_share.as_ref();
        let info_offset = NAMESPACE_SIZE;
        let info = bytes[info_offset];
        let version = info >> 1;

        let mut offset = info_offset + SHARE_INFO_BYTES + SEQUENCE_LEN_BYTES;
        if version == 1 {
            offset += SIGNER_SIZE;
        }

        let content_len = FIRST_SPARSE_SHARE_CONTENT_SIZE;

        match version {
            0 | 1 => hasher.update(&bytes[offset..offset + content_len]),
            other => panic!("unsupported share version {} in first share", other),
        }
    }

    for share in iter {
        let bytes = share.as_ref();
        let info = bytes[NAMESPACE_SIZE];
        let version = info >> 1; // same logic for share version
        let offset = NAMESPACE_SIZE + SHARE_INFO_BYTES;
        let content_len = CONTINUATION_SPARSE_SHARE_CONTENT_SIZE;

        match version {
            0 | 1 => hasher.update(&bytes[offset..offset + content_len]),
            other => panic!("unsupported share version {} in continuation share", other),
        };
    }

    hasher.finalize().into()
}

#[cfg(test)]
mod test {
    use super::*;

    #[test]
    #[cfg(feature = "host")]
    fn test_serialization() {
        let output = ZKStackEqProofOutput {
            keccak_hash: [0; 32],
            data_root: [0; 32],
            batch_number: 0u32,
            chain_id: 0u64,
        };
        let encoded = output.to_vec();
        let decoded = ZKStackEqProofOutput::from_bytes(&encoded).unwrap();
        assert_eq!(output.keccak_hash, decoded.keccak_hash);
        assert_eq!(output.data_root, decoded.data_root);
    }
}

---

Response

Here’s a focused, step-wise plan to cut zkVM cycles for your SP1 guest, grounded in the (transferable) guidance from RISC Zero’s optimization guide and SP1’s own docs. I’ve split it into “Do first” (highest ROI, lowest risk), “Then”, and “Advanced”. I’ll call out concrete edits to your code where possible.

---

1) Measure before changing anything (and keep measuring)

1. Use cycle markers exactly as you’re doing and also enable the SP1 profiler to see hot frames.
   SP1: use the built-in cycle profiler (“Cycle Tracking”) and interpret profiles by callframe. ([Succinct Docs]1)
   RISC Zero guide (transferable): use env::cycle_count(), flamegraphs, and Amdahl’s Law mindset; optimize what dominates cycles. ([RISC Zero]2)

2. Collect per-section cycle counts for: deserialize → NMT verify → keccak → commit. Keep a CSV (or pprof) from multiple runs/sizes. This is your baseline and regression guard. ([RISC Zero]2)

---

2) Highest-ROI code changes

A. Switch to SP1 precompiles for hashing (massive win)

• Keccak: replace sha3::Keccak256 with SP1’s keccak precompile (via a patched crate).
  How: use a patched tiny-keccak or the SP1 keccak example; both route to the precompile under the hood. ([GitHub]3)

• SHA-256 inside NMT verification: ensure the NMT verifier uses SP1’s SHA-256 precompile instead of a pure-Rust implementation.
  How: if celestia_types::ShareProof::verify pulls in sha2/ring/sha256 software, either:
  (a) patch the dependency to SP1’s sha256 precompile (sp1_core::syscall::precompiles::sha256), or
  (b) fork a minimal NMT verifier that calls the precompile when hashing internal nodes/leaves.
  This change tends to cut hashing cycles by orders of magnitude on SP1. ([Docs.rs]4)

Why this first? Hashing dominates both NMT verification and blob hashing; SP1 precompiles (keccak, sha256) are built exactly to nuke this cost. ([Succinct]5)

B. Avoid serde when you can (read raw bytes)

• For large inputs, reading raw bytes is substantially cheaper than serde. In your case, the input type ZKStackEqProofInput is deserialized via sp1_zkvm::io::read(). If feasible, pass the witness as bytes and parse only what you need inside the guest using sp1_zkvm::io::read_vec() (no serde). This alone can shave a meaningful chunk off “deserialize”. ([Succinct Docs]6)

  Practical compromise: If refactoring the host/ABI is too invasive now, keep the struct but remove any nested allocations/strings and prefer fixed-size arrays. If you later switch, define a compact binary format that puts the proof bytes last so the verifier can stream-verify without copying.

C. Remove heap churn and panics in the guest

• Make to_vec() zero-alloc & stack-backed. Replace the Vec<u8> with a fixed [u8; 76] buffer and write fields directly, then commit_slice(&buf). This reduces dirty pages and allocator calls (paging is expensive when you write new pages). ([RISC Zero]2)

• Avoid expect!/panic! in hot paths (expect("NMT proof failed")); panics pull formatting and unwinding code. Prefer if !verify { commit error code or early return }. RISC-Zero’s guide stresses single-threaded, no FP, and the cost model; removing panic paths helps codegen & paging. ([RISC Zero]2)

---

3) Stream and slice like a zkVM (paging & bounds)

A. Stream the keccak over share slices without copies

Your compute_blob_keccak mostly streams already—great. Ensure no intermediate allocations:

• Take &[ [u8; SHARE_SIZE] ] instead of Vec<[u8; SHARE_SIZE]> to avoid a move/copy.
• Use iter() over borrowed slices only; never collect.
• Use chunks_exact() when slicing share payloads to avoid extra bounds checks in loops.

These reduce loads/stores and keep the working set tiny (fewer 1 KB pages touched → fewer page-ins/outs). ([RISC Zero]2)

B. Page-in/out awareness

RISC Zero’s model explains pages are 1 KB and first access per page costs proof-side hashing; writing creates “dirty” pages that must be paged out at segment boundaries. The lesson transfers: minimize the set of pages you touch and dirty. Prefer stack arrays and single, preallocated buffers. ([RISC Zero]2)

• Keep big constants and small working buffers on the stack when possible.
• Reuse a single scratch buffer for NMT node hashing (if you fork the verifier).
• Avoid random access; touch memory sequentially. ([RISC Zero]2)

---

4) Micro-architectural choices that matter in a zkVM

• In zkVMs, relative costs differ from native CPUs: e.g., shifts vs multiplies, div vs add—differences are much smaller; some “CPU folklore” optimizations don’t help. Don’t over-engineer bit-twiddling; let the compiler pick simple ops and focus on paging + precompiles. ([RISC Zero]2)

• Avoid floating point (slow and software-emulated). You’re already on integers only—good. ([RISC Zero]2)

• Single-threaded: no async, atomics, or parallelism in guest code (just overhead). ([RISC Zero]2)

---

5) Specialize the NMT verifier (if hashing precompile isn’t plug-and-play)

If patching celestia_types::ShareProof::verify to use the SHA-256 precompile is awkward:

1. Write a tiny NMT verifier just for blob shares (no genericity / no allocs).
2. Inline small helpers for node hashing and path verification to reduce call overhead.
3. Use fixed-size arrays for Merkle path and node buffers; avoid Vec.
4. Batch inner-node hash calls where possible to reduce per-call overhead.
5. Prefer contiguous node layout so your traversal touches adjacent memory pages.

These changes aim to (a) keep the working set in a handful of pages, (b) route every SHA-256 block through the precompile. ([RISC Zero]2)

---

6) Compiler & build settings (evidence-based)

A recent study evaluated LLVM pass impacts on zkVMs (SP1 & RISC Zero). Two actionable takeaways: inlining helps a lot; LICM (loop-invariant code motion) can hurt. Consider experimenting with more aggressive inlining and watching for LICM regressions. ([arXiv]7)

Concrete knobs to try (measure each):

• profile.release: opt-level = 3, lto = "fat", codegen-units = 1, incremental = false.
• Add #[inline(always)] to tiny hash/parse helpers in hot loops (don’t blanket inline everything).
• Ensure panic = abort for the guest crate (removes unwinding bloat), then replace panics with early returns as above.

Keep diffs small and compare cycle counts after each tweak; the paper shows strong linear correlation between cycle count and proving time—so the profiler wins will carry through. ([arXiv]7)

---

7) Input/Output hygiene

• Inputs: If you must stick with serde now, ensure ZKStackEqProofInput fields are fixed-size arrays and integers (you have that—good). Later, switch to raw bytes with io::read_vec() and a hand parser for the proof path & shares. ([Succinct Docs]6)

• Outputs: Replace to_vec() with:

  let mut out = [0u8; 76];
  out[0..32].copy_from_slice(&computed_keccak);
  out[32..64].copy_from_slice(&input.data_root);
  out[64..68].copy_from_slice(&input.batch_number.to_le_bytes());
  out[68..76].copy_from_slice(&input.chain_id.to_le_bytes());
  sp1_zkvm::io::commit_slice(&out);

This avoids heap alloc and an extra dirty page.

---

8) Clean up prints & logging

• Keep your println!("cycle-tracker-*") only while profiling. Printing costs cycles and touches I/O pages. Remove them (or gate behind #[cfg(feature = "profile")]) for production runs. ([Succinct Docs]1)

---

9) Sanity checks specific to your blob hashing

• Your compute_blob_keccak logic: continue to slice directly into share payloads and stream to the hasher; avoid assembling the blob. This matches the guide’s advice to read/process raw bytes. If you move to raw inputs, you can stream-hash as you parse the shares (zero extra copies). ([RISC Zero]2)

• For version handling, prefer returning an error over panic! on unknown versions (cheaper and fewer code paths).

---

10) Advanced / nice-to-have

• GPU prover / prover settings: parallel proving won’t change guest cycles, but affects end-to-end latency/cost. Keep your guest lean, then leverage SP1’s GPU prover for production. ([Succinct]5)

• Chunking very large inputs: If inputs ever balloon, adopt a Merkle-ized chunk input so the guest only reads chunks it needs—reduces page-ins. (RISC Zero’s guide discusses Merkle chunking; the idea transfers.) ([RISC Zero]2)

---

Quick checklist of concrete code & config edits

1. Keccak precompile

   • Patch tiny-keccak as in sp1-keccak-preimage, or switch to SP1’s patched keccak crate. Replace sha3::Keccak256 usage. Measure. ([GitHub]3)

2. SHA-256 precompile in NMT

   • Audit ShareProof::verify’s hash calls; swap to SP1’s sha256 precompile (via patched crate or minimal fork). Measure. ([Docs.rs]4)

3. Eliminate guest allocations

   • Replace to_vec() with fixed [u8; 76]; commit directly.
   • Ensure no Vec growth inside compute_blob_keccak or NMT code.

4. Serde → raw bytes (when possible)

   • If you can change the host ABI: pass raw bytes; in guest, call sp1_zkvm::io::read_vec() and parse manually. ([Succinct Docs]6)

5. Build settings

   • opt-level=3, lto="fat", codegen-units=1, panic=abort; selectively #[inline(always)] hot, tiny helpers. Validate impact; watch for LICM regressions. ([arXiv]7)

6. Remove panics/logging in hot paths

   • Replace expect with error returns; gate prints behind a feature. ([RISC Zero]2)

7. Paging hygiene

   • Prefer stack arrays; reuse scratch buffers; ensure sequential access patterns in NMT verify.

---

Why these steps map to fewer cycles

• Precompiles replace hundreds/thousands of RISC-V ops per block with a handful of zkVM “accelerator” ops; the RISC Zero guide quantifies SHA-256 compression costs and the general effect transfers conceptually; SP1 publicly documents dramatic cycle reductions from precompiles (keccak/sha256). ([RISC Zero]2)

• Paging minimization reduces expensive page-in/out hashing (first access ~5k cycles; typical ~1.1k per page). Smaller working sets and fewer writes → fewer dirty pages. ([RISC Zero]2)

• Inlining & no-alloc shrink call overhead and memory traffic; the compiler-pass study shows inlining reduces SP1 cycles ~30%. ([arXiv]7)

---

If you’d like, I can sketch the keccak precompile swap (a tiny diff) and a minimal, precompile-backed SHA-256 Merkle node hasher you can drop into the NMT verifier.