circom

Circom proving stack for EVML scripts: proofs from pre-built wasm/zkey artifacts or in-place circuit compilation with groth16, plonk and fflonk setups via snarkjs, BN254 field arithmetic, circomlib Poseidon hashing and Merkle trees (LeanIMT and fixed-depth), EdDSA over Baby Jubjub, and verifier-calldata accessors for on-chain proof verification.

⚗️ Experimental — available at next.evmcrispr.com.

load circom

Commands

Command	Description
circom:prove	Generate a proof with snarkjs (groth16, plonk or fflonk) and bind the result (proof + public signals, as JSON) to . Prove from pre-built artifacts (--wasm/--zkey, system auto-detected from the zkey) or compile a circuit in-place (--circom; groth16 setups are DEV-ONLY, plonk/fflonk are deterministic). Read the verifier-call arguments back with @circom:proof.

Helpers

Helper	Returns	Description
@circom:constraints	number	Compile circom source (inline text or a http/ipfs URL) and return its constraint count, useful to size the powers-of-tau a setup needs (a 2^p ptau supports up to 2^p constraints).
@circom:eddsa.pub	array	Derive the EdDSA public key (a Baby Jubjub point, as an [x y] pair) from a secret, the circom-ecosystem signature scheme used by Semaphore and MACI identities. The secret is sensitive: anything bound to a variable can be printed.
@circom:eddsa.sign	array	Sign a field-element message with EdDSA over Baby Jubjub (Poseidon variant), returning the signature as [R8x R8y S]; destructure it or pass it whole to @circom:eddsa.verify or into circuit inputs.
@circom:eddsa.verify	bool	Verify an EdDSA (Baby Jubjub, Poseidon variant) signature: the [R8x R8y S] array from @circom:eddsa.sign against a message and an [x y] public key.
@circom:field	number	Reduce a value into the BN254 scalar field: values >= the field prime wrap around and negative values wrap to p -
@circom:field.bits	array	Decompose a value into its bits, least-significant first, e.g. a Merkle path index into the per-level indices a circuit expects.
@circom:field.hash	number	Hash hex bytes with keccak256 and reduce the digest into the BN254 scalar field, the standard way to map addresses, strings or arbitrary data into a circuit input.
@circom:field.rand	number	Generate a uniformly random BN254 field element (rejection-sampled, no modulo bias) for secrets, trapdoors and commitment salts.
@circom:poseidon	number	Hash 1-16 field elements with the circomlib Poseidon permutation over the BN254 scalar field (the hash used by Semaphore, Tornado and most circom circuits).
@circom:proof	array	Project the proof JSON bound by circom:prove into the argument tuple of its snarkjs-exported verifier: [a b c signals] for groth16 (pi_b already swapped for the on-chain pairing check), [proof signals] for plonk/fflonk (a flat 24-element array). Destructure with set [$a $b $c $signals] @circom:proof($proof) or set [$p $signals] @circom:proof($proof).
@circom:tree.proof	array	Generate the Poseidon Merkle inclusion proof for the leaf at the given index, as a [pathIndex siblings] pair ready for destructuring, or [pathIndex siblings length] with pad:<n>, which zero-pads lean siblings to the fixed length circuits expect. Fixed-depth proofs always have exactly depth siblings; lean proofs skip levels without one and compress the path index accordingly.
@circom:tree.root	number	Compute the Poseidon Merkle root of an array of field-element leaves. A single-leaf lean tree has root = leaf.
@circom:tree.verify	bool	Verify a Poseidon Merkle inclusion proof against a root, using the path index and siblings produced by @circom:tree.proof.
@circom:verifier	string	Compile circom source (inline text or a http/ipfs URL), run an in-place setup, and return the Solidity verifier source with the verification key embedded, ready to pipe into @contracts:solidity to deploy. groth16 setups are DEV-ONLY (no ceremony); plonk/fflonk setups are deterministic and production-grade given a real powers-of-tau.
@circom:verify	bool	Verify a proof off-chain against a verification key (groth16, plonk or fflonk auto-detected from the proof), with no deployed verifier needed. Get the vkey from @circom:vkey or a hosted vkey JSON.
@circom:vkey	string	Compile circom source, run the in-place setup and return the verification key as JSON, for @circom:verify off-chain checks. Shares the compile and setup caches with @circom:verifier and circom:prove --circom.