Transparent 且 Post-quantum zkSNARKs

mutourend

已于 2024-06-13 10:59:52 修改

阅读量1.1k

点赞数 8

分类专栏：零知识证明文章标签：零知识证明

于 2024-06-08 22:57:43 首次发布

本文链接：https://blog.csdn.net/mutourend/article/details/139550974

版权

零知识证明专栏收录该内容

339 篇文章 140 订阅

订阅专栏

1. 引言

前序博客有：

在这里插入图片描述
上图摘自STARKs and STARK VM: Proofs of Computational Integrity。

上图选自：Dan Boneh 斯坦福大学 CS251 Fall 2023 Building a SNARK 课件。

SNARK方案由 Polynomial IOP（信息理论对象） ➕ 多项式承诺方案（密码学对象） 组成。

当前的Polynomial IOP主要分为三大类：

1）基于interactive proofs（IPs）的Polynomial IOP：如Hyrax、vSQL、Libra、Virgo等。【 $P$ 无需做FFT运算】
2）基于multi-prover interactive proofs（MIPs）的Polynomial IOP：如Spartan、Brakedown、Xiphos等。【 $P$ 无需做FFT运算】
3）基于constant-round的Polynomial IOP：如Marlin、PlonK、StarkWare的SNARKs等。【 $P$ 需要做FFT运算】

以上方案都是通过增加 $P$ 开销，来减少proof长度以及降低 $V$ 开销。
以上1）2）类，只要其结合的多项式承诺方案也不需要FFT，则 $P$ 无需做FFT运算。

当前的多项式承诺方案主要分为四大类：

1）基于pairing的多项式承诺方案（既不transparent，也不post-quantum）
- 如KZG10、PST13、ZGKPP18等。
- 独特属性有：具有constant sized evaluation proofs。
2）基于discrete logarithm的多项式承诺方案（transparent，但不post-quantum）
- 如BCCGP16、Bulletproofs、Hyrax、Dory等。【其中Dory即需要discret-log hardness，还需要pairing。】
3）基于IOPs+hashing（transparent 且 post-quantum）
- 如Ligero、FRI、Brakedown等。
4）基于Groups of unknown order的多项式承诺方案（若使用class groups具有transparent属性，但不是post-quantum的）
- 如DARK、Dew等。
- 由于使用class groups， $P$ 非常慢。

现有的多项式承诺方案有：

KZG多项式承诺：PlonK和Marlin采用KZG多项式承诺。其既不是transparent的，也不是post-quantum secure的。2020年。
Bulletproofs多项式承诺：为transparent的，但不是post-quantum secure的。2017年。
Hyrax多项式承诺：为transparent的，但不是post-quantum secure的。2017年。
Dory多项式承诺：为transparent的，但不是post-quantum secure的。2020年。
FRI多项式承诺：为post-quantum secure的。2017年。基于纠错码。
Ligero多项式承诺：为post-quantum secure的。2017年。基于纠错码。
Ligero++多项式承诺：为post-quantum secure的。2020年。基于纠错码。
Brakedown多项式承诺：为post-quantum secure的。2021年。基于纠错码。
Orion多项式承诺：为post-quantum secure的。2022年。基于纠错码。

上面的5种post-quantum secure多项式承诺方案均是基于纠错码，使用的唯一密码学原语为哈希。同时具有如下属性：

验证开销随着bits of security的位数增加而增加。（所谓验证开销，是由哈希evaluation数量以及field operation数量来衡量的。）

粗略来说，这些post-quantum多项式承诺方案的单次“迭代”仅可实现小数量的bits of security（如2-4）。因此，需重复该协议多次来“放大”安全等级，而随着每次重复，验证开销也会随之增加。因此，控制PQ-SNARKs的验证开销（对应为区块链应用中的gas开销），协议设计者通常有动力将security level设置为较低值。

除极少数例外情况（见2018年论文 Batching Techniques for Accumulators with Applications to IOPs and Stateless Blockchains）外，Non-PQ-SNARK（透明和不透明）中不会出现具体安全和验证成本之间的紧张关系。Non-PQ-SNARK使用椭圆曲线群，其中离散对数被认为很难计算，其安全级别由所使用的群确定。椭圆曲线群的合适大小，以及每个群操作的成本，随着所需的安全级别而增长。然而，proof 中群元素的数量与群的选择无关。

而在PQ-SNARKs中，不仅hash evaluation的size会随着所需的安全等级增加而增加，proof中所需的evaluation数以及Verifier计算的 evaluation数也将随着所需安全等级增加而增加。

本文重点关注Transparent 且 Post-quantum zkSNARKs，在：

libiop: a C++ library for IOP-based zkSNARKs（C++）【2021年5月后未更新】

中实现了几种仅依赖于lightweight symmetric cryptography（任意Cryptographic hash function）的 Transparent 且 Post-quantum zkSNARKs 方案：

1）Ligero协议：argument size为 $O(\sqrt{N})$ ，见2017年论文Ligero: Lightweight Sublinear Arguments Without a Trusted Setup。
2）Aurora协议：argument size为 $O(\log ^2 N)$ ，见2018年论文Aurora: Transparent Succinct Arguments for R1CS。
3）Fractal协议：argument size为 $O(\log ^2 N)$ ，见2019年论文FRACTAL: Post-Quantum and Transparent Recursive Proofs from Holography。

以上这3种Transparent 且 Post-quantum zkSNARKs 方案，均支持基于smooth prime fields和binary extension fields的R1CS。所谓R1CS，为一种NP-complete relation that generalizes arithmetic circuit satisfiability。

不同于Ligero，其中Aurora和Fractal中有额外有趣的点在于：

FRI low-degree test：详情见Fast Reed-Solomon Interactive Oracle Proofs of Proximity。

2. 由IOPs 到 zkSNARKs

Interactive Oracle Proofs（IOPs）：

为Probabilistically checkable proof 的multi-round generalization
IOPs的性能，优于，PCPs
libiop: a C++ library for IOP-based zkSNARKs库，通过Interactive Oracle Proofs（IOPs）（本文接下来按作者名，称为BCS transformation），实现了由IOPs构建的zkSNARKs。

BCS transformation：

使用cryptographic hash function（模型化为random oracle）
来将，任意public-coin IOP
编译为某SNARG

该SNARG具有如下属性：

transparent：生成/验证proof strings所需的全局参数，仅为，该哈希函数
post-quantum：在quantum random oracle模型内，其是安全的
lightweight：除该哈希函数之外，无需其它密码学依赖

BCS transformation的描述见：

Eli Ben-Sasson、Alessandro Chiesa 和 Nicholas Spooner 2016年论文 Interactive Oracle Proofs

BCS transformation的post-quantum安全性论证见：

Alessandro Chiesa、Peter Manohar 和 Nicholas Spooner 2020年论文 Succinct Arguments in the Quantum Random Oracle Model

BCS transformation保持了proof of knowledge：

若底层的IOP是proof of knowledge，则所生成的SNARG为an argument of knowledge（即 a SNARK）

同理，BCS transformation保持了zero knowledge：

若底层IOP是（honest-verifier）zero knowledge，则所生成的SNARK是zero knowledge的（即 a zkSNARG）

同时，BCS transformation可扩展为：

向holographic IOPs，编译为，preprocessing SNARGs
- 详情见：Alessandro Chiesa、Dev Ojha 和 Nicholas Spooner 2019年论文 FRACTAL: Post-Quantum and Transparent Recursive Proofs from Holography
- 该特性，使得SNARGs可为，任意计算（而不仅仅是结构化计算），提供fast verification。

3. IOP协议

https://github.com/scipr-lab/libiop/tree/master/libiop/iop：该目录下包含了编写IOP协议的基础设施。
https://github.com/scipr-lab/libiop/tree/master/libiop/protocols：该目录下包含了几个使用该基础设施实现的协议，具体为：

	language	round complexity	oracle length (field elts)	query complexity	indexer time (field ops)	prover time (field ops)	verifier time (field ops)
Ligero-IOP	R1CS	2	O(N)	O(N^0.5)	N/A	O(N logN)	O(N)
Aurora-IOP	R1CS	O(log N)	O(N)	O(log N)	N/A	O(N logN)	O(N)
Fractal-IOP	R1CS	O(log N)	O(N)	O(log N)	O(N logN)	O(N logN)	O(log N)

其中：

1）Ligero-IOP：见2017年论文Ligero: Lightweight Sublinear Arguments Without a Trusted Setup。
- 更准确来说，Ligero论文中仅描述了arithmetic circuits构建。而Aurora论文附录中解释了如何将，该arithmetic circuits构建，扩展为，支持R1CS。因此，实际在libiop: a C++ library for IOP-based zkSNARKs代码库中所实现的Ligero协议，借助了Aurora论文中的该扩展技术。
2）Aurora-IOP：见2018年论文Aurora: Transparent Succinct Arguments for R1CS。
3）Fractal-IOP：见2019年论文FRACTAL: Post-Quantum and Transparent Recursive Proofs from Holography。

其中比Ligero-IOP更高效，的，Aurora-IOP和Fractal-IOP，结合了2大元素：【详情见 2018年论文Aurora: Transparent Succinct Arguments for R1CS 】

1）RS-encoded IOP，即基于纠错码
- https://github.com/scipr-lab/libiop/tree/master/libiop/protocols/encoded：该目录下包含了RS-encoded IOPs，覆盖了Ligero、Aurora和Fractal协议核心的RS-encoded IOPs。
2）对RS code的proximity test
- https://github.com/scipr-lab/libiop/tree/master/libiop/protocols/ldt：该目录下包含了对RS code的proximity tests。其包含了：
  - direct test：用于Ligero
  - FRI protocol：用于Aurora和Fractal。

4. BCS transformation

https://github.com/scipr-lab/libiop/tree/master/libiop/bcs：该目录下将BCS transformation作为独立组件。
https://github.com/scipr-lab/libiop/tree/master/libiop/snark：该目录下，包含，将BCS transformation用于以上IOP协议，所获得的zkSNARKs。具体有：

	language	indexer time	prover time	argument size	verifier time
Ligero-SNARK	R1CS	N/A	O_κ(N logN)	O_κ(N^0.5)	O_κ(N)
Aurora-SNARK	R1CS	N/A	O_κ(N logN)	O_κ(log² N)	O_κ(N)
Fractal-SNARK	R1CS	O_κ(N logN)	O_κ(N logN)	O_κ(log² N)	O_κ(log² N)

其中：

κ 用于表示上表中的asymptotics还依赖于该安全参数。
make_zk：设置该标签，表示该BCS transformation应保留zero knowledge属性；而不设置，则表示该所转换的IOP是非zero knowledge的，因此也无需保留zero knowledge属性。

5. libiop库安装及测试

编译运行前，需安装：

依赖项Installation instructions

测试文件见：

https://github.com/scipr-lab/libiop/blob/master/libiop/tests

若运行所有测试用例，则运行：

make check

/data/libiop/build# make check
Test project /data/libiop/build
      Start  1: test_exponentiation
 1/42 Test  #1: test_exponentiation ...................   Passed    0.15 sec
      Start  2: test_fft
 2/42 Test  #2: test_fft ..............................   Passed    2.99 sec
      Start  3: test_lagrange
 3/42 Test  #3: test_lagrange .........................   Passed    0.55 sec
      Start  4: test_merkle_tree
 4/42 Test  #4: test_merkle_tree ......................   Passed    0.68 sec
      Start  5: test_linearized_polynomial
 5/42 Test  #5: test_linearized_polynomial ............   Passed    0.53 sec
      Start  6: test_vanishing_polynomial
 6/42 Test  #6: test_vanishing_polynomial .............   Passed    0.41 sec
      Start  7: test_lagrange_polynomial
 7/42 Test  #7: test_lagrange_polynomial ..............   Passed    3.92 sec
      Start  8: test_bivariate_embedding
 8/42 Test  #8: test_bivariate_embedding ..............   Passed    0.40 sec
      Start  9: test_successor_ordering
 9/42 Test  #9: test_successor_ordering ...............   Passed    0.55 sec
      Start 10: test_algebra_utils
10/42 Test #10: test_algebra_utils ....................   Passed    0.00 sec
      Start 11: test_iop
11/42 Test #11: test_iop ..............................   Passed    0.06 sec
      Start 12: test_iop_query_position
12/42 Test #12: test_iop_query_position ...............   Passed    0.00 sec
      Start 13: test_aurora_protocol
13/42 Test #13: test_aurora_protocol ..................   Passed    0.27 sec
      Start 14: test_r1cs_to_lincheck_reduction
14/42 Test #14: test_r1cs_to_lincheck_reduction .......   Passed    0.84 sec
      Start 15: test_basic_lincheck
15/42 Test #15: test_basic_lincheck ...................   Passed    0.79 sec
      Start 16: test_boundary_constraint
16/42 Test #16: test_boundary_constraint ..............   Passed    0.15 sec
      Start 17: test_holographic_lincheck
17/42 Test #17: test_holographic_lincheck .............   Passed    0.31 sec
      Start 18: test_sumcheck
18/42 Test #18: test_sumcheck .........................   Passed    0.71 sec
      Start 19: test_direct_ldt
19/42 Test #19: test_direct_ldt .......................   Passed    0.16 sec
      Start 20: test_fri
20/42 Test #20: test_fri ..............................   Passed    0.64 sec
      Start 21: test_fri_aux
21/42 Test #21: test_fri_aux ..........................   Passed    0.02 sec
      Start 22: test_fri_optimizer
22/42 Test #22: test_fri_optimizer ....................***Exception: SegFault  0.33 sec
      Start 23: test_fractal_protocol
23/42 Test #23: test_fractal_protocol .................   Passed    0.20 sec
      Start 24: test_ligero_interleaved_lincheck_et
24/42 Test #24: test_ligero_interleaved_lincheck_et ...   Passed    0.90 sec
      Start 25: test_ligero_interleaved_lincheck_ot
25/42 Test #25: test_ligero_interleaved_lincheck_ot ...   Passed    0.96 sec
      Start 26: test_ligero_protocol
26/42 Test #26: test_ligero_protocol ..................   Passed    0.07 sec
      Start 27: test_ligero_interleaved_rowcheck
27/42 Test #27: test_ligero_interleaved_rowcheck ......   Passed    0.23 sec
      Start 28: test_ldt_reducer
28/42 Test #28: test_ldt_reducer ......................   Passed    1.46 sec
      Start 29: test_fractal_indexer
29/42 Test #29: test_fractal_indexer ..................   Passed    9.45 sec
      Start 30: test_rational_linear_combination
30/42 Test #30: test_rational_linear_combination ......   Passed    0.05 sec
      Start 31: test_rational_sumcheck
31/42 Test #31: test_rational_sumcheck ................   Passed    0.03 sec
      Start 32: test_rowcheck
32/42 Test #32: test_rowcheck .........................   Passed    0.08 sec
      Start 33: test_r1cs
33/42 Test #33: test_r1cs .............................   Passed    0.04 sec
      Start 34: test_identity_matrices
34/42 Test #34: test_identity_matrices ................   Passed    0.01 sec
      Start 35: test_poseidon
35/42 Test #35: test_poseidon .........................   Passed    0.00 sec
      Start 36: test_pow
36/42 Test #36: test_pow ..............................   Passed    0.87 sec
      Start 37: test_bcs_transformation
37/42 Test #37: test_bcs_transformation ...............***Exception: SegFault  0.10 sec
      Start 38: test_serialization
38/42 Test #38: test_serialization ....................***Failed    0.07 sec
      Start 39: test_aurora_snark
39/42 Test #39: test_aurora_snark .....................   Passed    3.81 sec
      Start 40: test_fractal_snark
40/42 Test #40: test_fractal_snark ....................   Passed   21.59 sec
      Start 41: test_ligero_snark
41/42 Test #41: test_ligero_snark .....................   Passed    0.10 sec
      Start 42: test_linking
42/42 Test #42: test_linking ..........................   Passed    0.30 sec

93% tests passed, 3 tests failed out of 42

Total Test time (real) =  54.82 sec

The following tests FAILED:
	 22 - test_fri_optimizer (SEGFAULT)
	 37 - test_bcs_transformation (SEGFAULT)
	 38 - test_serialization (Failed)
Errors while running CTest
Output from these tests are in: /data/libiop/build/Testing/Temporary/LastTest.log
Use "--rerun-failed --output-on-failure" to re-run the failed cases verbosely.
make[3]: *** [CMakeFiles/check.dir/build.make:70: CMakeFiles/check] Error 8
make[2]: *** [CMakeFiles/Makefile2:415: CMakeFiles/check.dir/all] Error 2
make[1]: *** [CMakeFiles/Makefile2:422: CMakeFiles/check.dir/rule] Error 2
make: *** [Makefile:179: check] Error 2

若仅运行Aurora协议所有测试用例，则运行：

	$ ./test_aurora_snark
	$ ./test_aurora_protocol

6. libiop库性能分析

https://github.com/scipr-lab/libiop/tree/master/libiop/profiling：该目录下包含生成，具有timing和argument size信息的，协议执行traces。
- 这些traces均对应为单线程环境

如，可基于181 bit prime field（其中RS-extra-dimensions=3），采用如下命令，为Ligero、Aurora和Fractal创建traces：

  $ ./instrument_aurora_snark --make_zk 1 --is_multiplicative 1 --field_size=181 --optimize_localization=1
  $ ./instrument_fractal_snark --make_zk 1 --is_multiplicative 1 --field_size=181 --optimize_localization=1
  $ ./instrument_ligero_snark --make_zk 1 --is_multiplicative 1 --field_size=181 --RS_extra_dimensions=3

根据以上命令所生成的traces，绘制了如下性能分析图表：
在这里插入图片描述

/data/libiop/build/libiop# ./instrument_aurora_snark --make_zk 1 --is_multiplicative 1 --field_size=181 --optimize_localization=1
Reset time counters for profiling
Selected parameters:
- log_n_min = 8
- log_n_max = 20
- security_level = 128
- LDT_reducer_soundness_type = heuristic
- FRI_soundness_type = heuristic
- is_multiplicative = true
- field_size = 181
- make_zk = true
- hash_enum = blake2b

================================================================================

(enter) Check satisfiability of R1CS example	[             ]	(0.0036s x1.00 from start)
(leave) Check satisfiability of R1CS example	[0.0001s x0.99]	(0.0036s x1.00 from start)

* R1CS number of constraints: 256
* R1CS number of variables: 255
* R1CS number of variables for primary input: 15
* R1CS number of variables for auxiliary input: 240
* R1CS size of constraint system (bytes): 19296
* R1CS size of primary input (bytes): 360
* R1CS size of auxiliary input (bytes): 5760

(enter) Aurora SNARK prover                	[             ]	(0.0037s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 119.9
  * RS extra dimensions = 3
  * codeword domain dim = 13
  * constraint domain dim = 8
  * variable domain dim = 8
  * query bound = 81
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 172.0
  * interactive repetitions = 1
  * constraint domain dim = 8
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 167.0
  * codeword domain dim = 13
  * max tested degree bound = 1024
  * max constraint degree bound = 673
  * absolute proximity parameter = 7167
  * fractional proximity parameter = 0.874878
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 118
  * achieved query soundness error (bits) = 119.9
  * codeword domain dim = 13
  * effective proximity parameter = 0.874878
  * number of interactive repetitions = 1
  * number of query repetitions = 40
  * localization parameter array = { 1 2 2 2 2 }
  * number of reductions = 5

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Submit witness oracles             	[             ]	(0.0044s x1.00 from start)
    (enter) Sumcheck: sample masking polynomial components	[             ](0.0044s x1.00 from start)
    (leave) Sumcheck: sample masking polynomial components	[0.0076s x1.00](0.0120s x1.00 from start)
    (enter) Sumcheck: compute masking polynomial codeword	[             ](0.0120s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.0121s x1.00 from start)
        * Vector size: 592
        * Subgroup size: 8192
      (leave) Call to multiplicative_FFT_wrapper 	[0.0020s x1.00]	(0.0141s x1.00 from start)
    (leave) Sumcheck: compute masking polynomial codeword	[0.0021s x1.00](0.0141s x1.00 from start)
    (enter) Compute randomized f_w             	[             ]	(0.0141s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.0172s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.00]	(0.0172s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.0172s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 256
      (leave) Call to multiplicative_FFT_wrapper 	[0.0000s x1.01]	(0.0172s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.0172s x1.00 from start)
        * Vector size: 256
        * Coset size: 256
      (leave) Call to multiplicative_IFFT_wrapper	[0.0001s x1.00]	(0.0173s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.0185s x1.00 from start)
        * Vector size: 321
        * Subgroup size: 8192
      (leave) Call to multiplicative_FFT_wrapper 	[0.0016s x1.00]	(0.0201s x1.00 from start)
    (leave) Compute randomized f_w             	[0.0060s x1.00]	(0.0201s x1.00 from start)
    (enter) Compute A/B/Cz                     	[             ]	(0.0201s x1.00 from start)
    (leave) Compute A/B/Cz                     	[0.0000s x1.00]	(0.0202s x1.00 from start)
    (enter) Compute f_{A/B/Cz} over codeword domain	[             ]	(0.0202s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.0202s x1.00 from start)
        * Vector size: 256
        * Coset size: 256
      (leave) Call to multiplicative_IFFT_wrapper	[0.0001s x1.00]	(0.0203s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.0203s x1.00 from start)
        * Vector size: 256
        * Coset size: 256
      (leave) Call to multiplicative_IFFT_wrapper	[0.0001s x1.00]	(0.0204s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.0204s x1.00 from start)
        * Vector size: 256
        * Coset size: 256
      (leave) Call to multiplicative_IFFT_wrapper	[0.0001s x1.00]	(0.0205s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.0205s x1.00 from start)
        * Vector size: 337
        * Subgroup size: 8192
      (leave) Call to multiplicative_FFT_wrapper 	[0.0016s x1.00]	(0.0221s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.0221s x1.00 from start)
        * Vector size: 337
        * Subgroup size: 8192
      (leave) Call to multiplicative_FFT_wrapper 	[0.0016s x1.00]	(0.0237s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.0237s x1.00 from start)
        * Vector size: 337
        * Subgroup size: 8192
      (leave) Call to multiplicative_FFT_wrapper 	[0.0016s x1.00]	(0.0253s x1.00 from start)
    (leave) Compute f_{A/B/Cz} over codeword domain	[0.0052s x1.00]	(0.0254s x1.00 from start)
    (enter) Call IOP oracle submission routines	[             ]	(0.0254s x1.00 from start)
    (leave) Call IOP oracle submission routines	[0.0000s x1.03]	(0.0254s x1.00 from start)
  (leave) Submit witness oracles             	[0.0210s x1.00]	(0.0254s x1.00 from start)
  (enter) LDT Reducer: Submit masking polynomial	[             ]	(0.0254s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.0382s x1.00 from start)
      * Vector size: 1024
      * Subgroup size: 8192
    (leave) Call to multiplicative_FFT_wrapper 	[0.0019s x1.00]	(0.0401s x1.00 from start)
  (leave) LDT Reducer: Submit masking polynomial	[0.0147s x1.00]	(0.0401s x1.00 from start)
  (enter) Finish prover round                	[             ]	(0.0401s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(0.0401s x1.00 from start)
      (enter) BCS: Sample randomness             	[             ]	(0.0401s x1.00 from start)
      (leave) BCS: Sample randomness             	[0.0030s x1.00]	(0.0431s x1.00 from start)
    (leave) Construct Merkle tree              	[0.0079s x1.00]	(0.0480s x1.00 from start)
  (leave) Finish prover round                	[0.0079s x1.00]	(0.0480s x1.00 from start)
  (enter) pow                                	[             ]	(0.0480s x1.00 from start)
  (leave) pow                                	[0.0000s x1.06]	(0.0480s x1.00 from start)
  (enter) multi_lincheck: Calculate and submit proof	[             ]	(0.0480s x1.00 from start)
    (enter) multi_lincheck compute alpha powers	[             ]	(0.0480s x1.00 from start)
    (leave) multi_lincheck compute alpha powers	[0.0000s x1.02]	(0.0480s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_prime	[             ]	(0.0480s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_prime	[0.0000s x1.01]	(0.0480s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_ABC 	[             ]	(0.0480s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_ABC 	[0.0001s x1.00]	(0.0481s x1.00 from start)
    (enter) multi_lincheck IFFT p_alphas       	[             ]	(0.0481s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.0481s x1.00 from start)
        * Vector size: 256
        * Coset size: 256
      (leave) Call to multiplicative_IFFT_wrapper	[0.0001s x1.00]	(0.0482s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.0482s x1.00 from start)
        * Vector size: 256
        * Coset size: 256
      (leave) Call to multiplicative_IFFT_wrapper	[0.0001s x1.00]	(0.0483s x1.00 from start)
    (leave) multi_lincheck IFFT p_alphas       	[0.0002s x1.00]	(0.0483s x1.00 from start)
    (enter) fz evaluated contents              	[             ]	(0.0484s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.0485s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.00]	(0.0485s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.0485s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 8192
      (leave) Call to multiplicative_FFT_wrapper 	[0.0008s x1.00]	(0.0493s x1.00 from start)
    (leave) fz evaluated contents              	[0.0014s x1.00]	(0.0497s x1.00 from start)
    (enter) multi_lincheck evaluated contents  	[             ]	(0.0498s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.0498s x1.00 from start)
        * Vector size: 256
        * Subgroup size: 8192
      (leave) Call to multiplicative_FFT_wrapper 	[0.0014s x1.00]	(0.0512s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.0512s x1.00 from start)
        * Vector size: 256
        * Subgroup size: 8192
      (leave) Call to multiplicative_FFT_wrapper 	[0.0014s x1.00]	(0.0527s x1.00 from start)
    (leave) multi_lincheck evaluated contents  	[0.0043s x1.00]	(0.0541s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.0546s x1.00 from start)
      * Vector size: 1024
      * Coset size: 1024
    (leave) Call to multiplicative_IFFT_wrapper	[0.0004s x1.00]	(0.0551s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.0551s x1.00 from start)
      * Vector size: 336
      * Subgroup size: 8192
    (leave) Call to multiplicative_FFT_wrapper 	[0.0015s x1.00]	(0.0566s x1.00 from start)
  (leave) multi_lincheck: Calculate and submit proof	[0.0087s x1.00]	(0.0566s x1.00 from start)
  (enter) Finish prover round                	[             ]	(0.0567s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(0.0567s x1.00 from start)
    (leave) Construct Merkle tree              	[0.0024s x1.00]	(0.0591s x1.00 from start)
  (leave) Finish prover round                	[0.0024s x1.00]	(0.0591s x1.00 from start)
  (enter) pow                                	[             ]	(0.0591s x1.00 from start)
  (leave) pow                                	[0.0000s x1.05]	(0.0591s x1.00 from start)
  (enter) LDT Reducer: Calculate and submit proof	[             ]	(0.0591s x1.00 from start)
    (enter) Sumcheck: g evaluated contents     	[             ]	(0.0591s x1.00 from start)
    (leave) Sumcheck: g evaluated contents     	[0.0008s x1.00]	(0.0599s x1.00 from start)
    (enter) rowcheck evaluated contents        	[             ]	(0.0600s x1.00 from start)
    (leave) rowcheck evaluated contents        	[0.0006s x1.00]	(0.0605s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.0648s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0012s x1.00]	(0.0660s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(0.0660s x1.00 from start)
      (enter) Finish prover round                	[             ]	(0.0660s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(0.0660s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0006s x1.00]	(0.0666s x1.00 from start)
      (leave) Finish prover round                	[0.0006s x1.00]	(0.0666s x1.00 from start)
      (enter) pow                                	[             ]	(0.0666s x1.00 from start)
      (leave) pow                                	[0.0000s x1.04]	(0.0666s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0006s x1.00]	(0.0666s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.0666s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0005s x1.00]	(0.0671s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(0.0671s x1.00 from start)
      (enter) Finish prover round                	[             ]	(0.0671s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(0.0671s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0002s x1.00]	(0.0673s x1.00 from start)
      (leave) Finish prover round                	[0.0002s x1.00]	(0.0673s x1.00 from start)
      (enter) pow                                	[             ]	(0.0673s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(0.0673s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0002s x1.00]	(0.0673s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.0673s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0001s x1.00]	(0.0675s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(0.0675s x1.00 from start)
      (enter) Finish prover round                	[             ]	(0.0675s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(0.0675s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0001s x1.00]	(0.0675s x1.00 from start)
      (leave) Finish prover round                	[0.0001s x1.00]	(0.0676s x1.00 from start)
      (enter) pow                                	[             ]	(0.0676s x1.00 from start)
      (leave) pow                                	[0.0000s x1.02]	(0.0676s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(0.0676s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.0676s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0001s x1.00]	(0.0677s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(0.0677s x1.00 from start)
      (enter) Finish prover round                	[             ]	(0.0677s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(0.0677s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0000s x1.01]	(0.0677s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.01]	(0.0677s x1.00 from start)
      (enter) pow                                	[             ]	(0.0677s x1.00 from start)
      (leave) pow                                	[0.0000s x1.04]	(0.0677s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(0.0677s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.0677s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0000s x1.01]	(0.0678s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.0678s x1.00 from start)
      * Vector size: 16
      * Coset size: 16
    (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.02]	(0.0678s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(0.0678s x1.00 from start)
      (enter) Finish prover round                	[             ]	(0.0678s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.02]	(0.0678s x1.00 from start)
      (enter) pow                                	[             ]	(0.0678s x1.00 from start)
      (leave) pow                                	[0.0004s x1.00]	(0.0682s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0005s x1.00]	(0.0682s x1.00 from start)
  (leave) LDT Reducer: Calculate and submit proof	[0.0092s x1.00]	(0.0683s x1.00 from start)
  (enter) Obtain transcript                  	[             ]	(0.0683s x1.00 from start)
  (leave) Obtain transcript                  	[0.0030s x1.00]	(0.0713s x1.00 from start)
  * Total size of proof oracles (bytes): 1506816
  * Total size of Merkle tree (bytes): 611136
  * Total size of prover state (bytes): 2117952
(leave) Aurora SNARK prover                	[0.0676s x1.00]	(0.0713s x1.00 from start)

BCS parameters
* digest_len (bytes) = 32
* digest_len (bits) = 256
* hash_type = blake2b
(enter) verifier_seal_interaction_registrations	[             ]	(0.0723s x1.00 from start)
(leave) verifier_seal_interaction_registrations	[0.0006s x1.00]	(0.0730s x1.00 from start)

* Argument size in bytes (IOP): 24242
* Argument size in bytes (BCS): 25312
* Argument size in bytes (total): 49554

If we were to remove pruning of authentication paths in BCS,
the argument would have the following sizes:
* Argument size in bytes (BCS, no pruning): 61088
* Argument size in bytes (total, no pruning): 85330

total prover messages size: 46
total two to one hashes: 941
total leaves hashed: 1052
total hashes: 2073

Transcript info by round
Per round IOP sizes don't include prover messages

round 0
MT_depth 12
IOP size: 11040 bytes
BCS size: 8928 bytes
number of two to one hashes: 277
number of leaves hashed: 480
number of zk hashes: 80
oracles in round: fw, fAz, fBz, fCz, sumcheck_mask, TODO: Fill in this name (batching.tcc), 

round 1
MT_depth 12
IOP size: 1840 bytes
BCS size: 7648 bytes
number of two to one hashes: 277
number of leaves hashed: 80
oracles in round: sumcheck h, 

round 2
MT_depth 10
IOP size: 3680 bytes
BCS size: 5184 bytes
number of two to one hashes: 200
number of leaves hashed: 160
oracles in round: TODO: Fill in this name (batching.tcc), 

round 3
MT_depth 8
IOP size: 3404 bytes
BCS size: 2688 bytes
number of two to one hashes: 119
number of leaves hashed: 148
oracles in round: TODO: Fill in this name (batching.tcc), 

round 4
MT_depth 6
IOP size: 2852 bytes
BCS size: 768 bytes
number of two to one hashes: 53
number of leaves hashed: 124
oracles in round: TODO: Fill in this name (batching.tcc), 

round 5
MT_depth 4
IOP size: 1380 bytes
BCS size: 64 bytes
number of two to one hashes: 15
number of leaves hashed: 60
oracles in round: TODO: Fill in this name (batching.tcc), 


(enter) Aurora SNARK verifier              	[             ]	(0.0735s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 119.9
  * RS extra dimensions = 3
  * codeword domain dim = 13
  * constraint domain dim = 8
  * variable domain dim = 8
  * query bound = 81
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 172.0
  * interactive repetitions = 1
  * constraint domain dim = 8
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 167.0
  * codeword domain dim = 13
  * max tested degree bound = 1024
  * max constraint degree bound = 673
  * absolute proximity parameter = 7167
  * fractional proximity parameter = 0.874878
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 118
  * achieved query soundness error (bits) = 119.9
  * codeword domain dim = 13
  * effective proximity parameter = 0.874878
  * number of interactive repetitions = 1
  * number of query repetitions = 40
  * localization parameter array = { 1 2 2 2 2 }
  * number of reductions = 5

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Aurora IOP protocol initialization and registration	[             ](0.0738s x1.00 from start)
    (enter) verifier_seal_interaction_registrations	[             ]	(0.0740s x1.00 from start)
    (leave) verifier_seal_interaction_registrations	[0.0006s x1.00]	(0.0746s x1.00 from start)
  (leave) Aurora IOP protocol initialization and registration	[0.0010s x1.00](0.0747s x1.00 from start)
  (enter) Check semantic validity of IOP transcript	[             ]	(0.0747s x1.00 from start)
  (leave) Check semantic validity of IOP transcript	[0.0000s x1.04]	(0.0748s x1.00 from start)
  (enter) Construct R1CS verifier state      	[             ]	(0.0748s x1.00 from start)
    (enter) multi_lincheck compute alpha powers	[             ]	(0.0748s x1.00 from start)
    (leave) multi_lincheck compute alpha powers	[0.0000s x1.02]	(0.0748s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_prime	[             ]	(0.0748s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_prime	[0.0000s x1.02]	(0.0748s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_ABC 	[             ]	(0.0748s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_ABC 	[0.0001s x1.00]	(0.0749s x1.00 from start)
    (enter) multi_lincheck IFFT p_alphas       	[             ]	(0.0749s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.0749s x1.00 from start)
        * Vector size: 256
        * Coset size: 256
      (leave) Call to multiplicative_IFFT_wrapper	[0.0001s x1.00]	(0.0750s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.0750s x1.00 from start)
        * Vector size: 256
        * Coset size: 256
      (leave) Call to multiplicative_IFFT_wrapper	[0.0001s x1.00]	(0.0751s x1.00 from start)
    (leave) multi_lincheck IFFT p_alphas       	[0.0002s x1.00]	(0.0751s x1.00 from start)
  (leave) Construct R1CS verifier state      	[0.0003s x1.00]	(0.0751s x1.00 from start)
  (enter) Check LDT verifier predicate       	[             ]	(0.0751s x1.00 from start)
    * Number of FRI interactions: 1
    * Number of FRI query sets per interaction: 40
    * Total number of FRI queries over all query sets (incl. repeated queries): 720
  (leave) Check LDT verifier predicate       	[0.0035s x1.00]	(0.0786s x1.00 from start)
  * IOP transcript valid: true
  * Full protocol decision predicate satisfied: true
(leave) Aurora SNARK verifier              	[0.0051s x1.00]	(0.0786s x1.00 from start)


* Verifier satisfied: true

================================================================================

(enter) Check satisfiability of R1CS example	[             ]	(0.0857s x1.00 from start)
(leave) Check satisfiability of R1CS example	[0.0001s x1.00]	(0.0858s x1.00 from start)

* R1CS number of constraints: 512
* R1CS number of variables: 511
* R1CS number of variables for primary input: 15
* R1CS number of variables for auxiliary input: 496
* R1CS size of constraint system (bytes): 38784
* R1CS size of primary input (bytes): 360
* R1CS size of auxiliary input (bytes): 11904

(enter) Aurora SNARK prover                	[             ]	(0.0858s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 120.0
  * RS extra dimensions = 3
  * codeword domain dim = 14
  * constraint domain dim = 9
  * variable domain dim = 9
  * query bound = 81
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 171.0
  * interactive repetitions = 1
  * constraint domain dim = 9
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 166.0
  * codeword domain dim = 14
  * max tested degree bound = 2048
  * max constraint degree bound = 1185
  * absolute proximity parameter = 14335
  * fractional proximity parameter = 0.874939
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 117
  * achieved query soundness error (bits) = 120.0
  * codeword domain dim = 14
  * effective proximity parameter = 0.874939
  * number of interactive repetitions = 1
  * number of query repetitions = 40
  * localization parameter array = { 1 2 2 2 2 2 }
  * number of reductions = 6

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Submit witness oracles             	[             ]	(0.0863s x1.00 from start)
    (enter) Sumcheck: sample masking polynomial components	[             ](0.0864s x1.00 from start)
    (leave) Sumcheck: sample masking polynomial components	[0.0141s x1.00](0.1005s x1.00 from start)
    (enter) Sumcheck: compute masking polynomial codeword	[             ](0.1005s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.1005s x1.00 from start)
        * Vector size: 1104
        * Subgroup size: 16384
      (leave) Call to multiplicative_FFT_wrapper 	[0.0041s x1.00]	(0.1047s x1.00 from start)
    (leave) Sumcheck: compute masking polynomial codeword	[0.0042s x1.00](0.1047s x1.00 from start)
    (enter) Compute randomized f_w             	[             ]	(0.1047s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.1078s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.02]	(0.1078s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.1078s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 512
      (leave) Call to multiplicative_FFT_wrapper 	[0.0001s x1.00]	(0.1079s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.1079s x1.00 from start)
        * Vector size: 512
        * Coset size: 512
      (leave) Call to multiplicative_IFFT_wrapper	[0.0002s x1.00]	(0.1081s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.1091s x1.00 from start)
        * Vector size: 577
        * Subgroup size: 16384
      (leave) Call to multiplicative_FFT_wrapper 	[0.0035s x1.00]	(0.1126s x1.00 from start)
    (leave) Compute randomized f_w             	[0.0079s x1.00]	(0.1126s x1.00 from start)
    (enter) Compute A/B/Cz                     	[             ]	(0.1126s x1.00 from start)
    (leave) Compute A/B/Cz                     	[0.0001s x1.01]	(0.1127s x1.00 from start)
    (enter) Compute f_{A/B/Cz} over codeword domain	[             ]	(0.1127s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.1127s x1.00 from start)
        * Vector size: 512
        * Coset size: 512
      (leave) Call to multiplicative_IFFT_wrapper	[0.0002s x1.00]	(0.1129s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.1129s x1.00 from start)
        * Vector size: 512
        * Coset size: 512
      (leave) Call to multiplicative_IFFT_wrapper	[0.0002s x1.00]	(0.1130s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.1131s x1.00 from start)
        * Vector size: 512
        * Coset size: 512
      (leave) Call to multiplicative_IFFT_wrapper	[0.0002s x1.00]	(0.1132s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.1133s x1.00 from start)
        * Vector size: 593
        * Subgroup size: 16384
      (leave) Call to multiplicative_FFT_wrapper 	[0.0035s x1.00]	(0.1167s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.1168s x1.00 from start)
        * Vector size: 593
        * Subgroup size: 16384
      (leave) Call to multiplicative_FFT_wrapper 	[0.0034s x1.00]	(0.1202s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.1202s x1.00 from start)
        * Vector size: 593
        * Subgroup size: 16384
      (leave) Call to multiplicative_FFT_wrapper 	[0.0035s x1.00]	(0.1237s x1.00 from start)
    (leave) Compute f_{A/B/Cz} over codeword domain	[0.0110s x1.00]	(0.1237s x1.00 from start)
    (enter) Call IOP oracle submission routines	[             ]	(0.1237s x1.00 from start)
    (leave) Call IOP oracle submission routines	[0.0000s x1.02]	(0.1237s x1.00 from start)
  (leave) Submit witness oracles             	[0.0374s x1.00]	(0.1237s x1.00 from start)
  (enter) LDT Reducer: Submit masking polynomial	[             ]	(0.1237s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.1493s x1.00 from start)
      * Vector size: 2048
      * Subgroup size: 16384
    (leave) Call to multiplicative_FFT_wrapper 	[0.0040s x1.00]	(0.1533s x1.00 from start)
  (leave) LDT Reducer: Submit masking polynomial	[0.0296s x1.00]	(0.1533s x1.00 from start)
  (enter) Finish prover round                	[             ]	(0.1533s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(0.1533s x1.00 from start)
      (enter) BCS: Sample randomness             	[             ]	(0.1533s x1.00 from start)
      (leave) BCS: Sample randomness             	[0.0058s x1.00]	(0.1592s x1.00 from start)
    (leave) Construct Merkle tree              	[0.0150s x1.00]	(0.1684s x1.00 from start)
  (leave) Finish prover round                	[0.0150s x1.00]	(0.1684s x1.00 from start)
  (enter) pow                                	[             ]	(0.1684s x1.00 from start)
  (leave) pow                                	[0.0000s x1.05]	(0.1684s x1.00 from start)
  (enter) multi_lincheck: Calculate and submit proof	[             ]	(0.1684s x1.00 from start)
    (enter) multi_lincheck compute alpha powers	[             ]	(0.1684s x1.00 from start)
    (leave) multi_lincheck compute alpha powers	[0.0000s x1.02]	(0.1684s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_prime	[             ]	(0.1684s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_prime	[0.0000s x1.01]	(0.1684s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_ABC 	[             ]	(0.1684s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_ABC 	[0.0002s x1.00]	(0.1686s x1.00 from start)
    (enter) multi_lincheck IFFT p_alphas       	[             ]	(0.1686s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.1686s x1.00 from start)
        * Vector size: 512
        * Coset size: 512
      (leave) Call to multiplicative_IFFT_wrapper	[0.0002s x1.00]	(0.1688s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.1688s x1.00 from start)
        * Vector size: 512
        * Coset size: 512
      (leave) Call to multiplicative_IFFT_wrapper	[0.0002s x1.00]	(0.1690s x1.00 from start)
    (leave) multi_lincheck IFFT p_alphas       	[0.0004s x1.00]	(0.1690s x1.00 from start)
    (enter) fz evaluated contents              	[             ]	(0.1691s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.1693s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x0.99]	(0.1693s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.1693s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 16384
      (leave) Call to multiplicative_FFT_wrapper 	[0.0016s x1.00]	(0.1709s x1.00 from start)
    (leave) fz evaluated contents              	[0.0026s x1.00]	(0.1716s x1.00 from start)
    (enter) multi_lincheck evaluated contents  	[             ]	(0.1717s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.1717s x1.00 from start)
        * Vector size: 512
        * Subgroup size: 16384
      (leave) Call to multiplicative_FFT_wrapper 	[0.0032s x1.00]	(0.1749s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.1749s x1.00 from start)
        * Vector size: 512
        * Subgroup size: 16384
      (leave) Call to multiplicative_FFT_wrapper 	[0.0032s x1.00]	(0.1781s x1.00 from start)
    (leave) multi_lincheck evaluated contents  	[0.0093s x1.00]	(0.1809s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.1821s x1.00 from start)
      * Vector size: 2048
      * Coset size: 2048
    (leave) Call to multiplicative_IFFT_wrapper	[0.0009s x1.00]	(0.1830s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.1830s x1.00 from start)
      * Vector size: 592
      * Subgroup size: 16384
    (leave) Call to multiplicative_FFT_wrapper 	[0.0033s x1.00]	(0.1863s x1.00 from start)
  (leave) multi_lincheck: Calculate and submit proof	[0.0179s x1.00]	(0.1863s x1.00 from start)
  (enter) Finish prover round                	[             ]	(0.1863s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(0.1863s x1.00 from start)
    (leave) Construct Merkle tree              	[0.0048s x1.00]	(0.1911s x1.00 from start)
  (leave) Finish prover round                	[0.0048s x1.00]	(0.1912s x1.00 from start)
  (enter) pow                                	[             ]	(0.1912s x1.00 from start)
  (leave) pow                                	[0.0000s x1.07]	(0.1912s x1.00 from start)
  (enter) LDT Reducer: Calculate and submit proof	[             ]	(0.1912s x1.00 from start)
    (enter) Sumcheck: g evaluated contents     	[             ]	(0.1912s x1.00 from start)
    (leave) Sumcheck: g evaluated contents     	[0.0016s x1.00]	(0.1928s x1.00 from start)
    (enter) rowcheck evaluated contents        	[             ]	(0.1928s x1.00 from start)
    (leave) rowcheck evaluated contents        	[0.0010s x1.00]	(0.1939s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.2021s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0025s x1.00]	(0.2046s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(0.2046s x1.00 from start)
      (enter) Finish prover round                	[             ]	(0.2046s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(0.2046s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0012s x1.00]	(0.2058s x1.00 from start)
      (leave) Finish prover round                	[0.0012s x1.00]	(0.2058s x1.00 from start)
      (enter) pow                                	[             ]	(0.2058s x1.00 from start)
      (leave) pow                                	[0.0000s x1.05]	(0.2058s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0012s x1.00]	(0.2058s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.2058s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0010s x1.00]	(0.2068s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(0.2068s x1.00 from start)
      (enter) Finish prover round                	[             ]	(0.2068s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(0.2068s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0003s x1.00]	(0.2071s x1.00 from start)
      (leave) Finish prover round                	[0.0003s x1.00]	(0.2071s x1.00 from start)
      (enter) pow                                	[             ]	(0.2071s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(0.2072s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0003s x1.00]	(0.2072s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.2072s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0003s x1.00]	(0.2074s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(0.2074s x1.00 from start)
      (enter) Finish prover round                	[             ]	(0.2074s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(0.2074s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0001s x1.00]	(0.2075s x1.00 from start)
      (leave) Finish prover round                	[0.0001s x1.00]	(0.2075s x1.00 from start)
      (enter) pow                                	[             ]	(0.2075s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(0.2076s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(0.2076s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.2076s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0001s x1.00]	(0.2077s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(0.2077s x1.00 from start)
      (enter) Finish prover round                	[             ]	(0.2077s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(0.2077s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0000s x1.00]	(0.2077s x1.00 from start)
      (leave) Finish prover round                	[0.0001s x1.00]	(0.2077s x1.00 from start)
      (enter) pow                                	[             ]	(0.2077s x1.00 from start)
      (leave) pow                                	[0.0000s x1.02]	(0.2077s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(0.2077s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.2078s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0000s x1.01]	(0.2078s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(0.2078s x1.00 from start)
      (enter) Finish prover round                	[             ]	(0.2078s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(0.2078s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0000s x1.01]	(0.2078s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.00]	(0.2078s x1.00 from start)
      (enter) pow                                	[             ]	(0.2078s x1.00 from start)
      (leave) pow                                	[0.0000s x1.04]	(0.2078s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(0.2078s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.2079s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0000s x1.00]	(0.2079s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.2079s x1.00 from start)
      * Vector size: 8
      * Coset size: 8
    (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.02]	(0.2079s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(0.2079s x1.00 from start)
      (enter) Finish prover round                	[             ]	(0.2079s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.01]	(0.2079s x1.00 from start)
      (enter) pow                                	[             ]	(0.2079s x1.00 from start)
      (leave) pow                                	[0.0053s x1.00]	(0.2132s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0053s x1.00]	(0.2133s x1.00 from start)
  (leave) LDT Reducer: Calculate and submit proof	[0.0221s x1.00]	(0.2133s x1.00 from start)
  (enter) Obtain transcript                  	[             ]	(0.2133s x1.00 from start)
  (leave) Obtain transcript                  	[0.0043s x1.00]	(0.2177s x1.00 from start)
  * Total size of proof oracles (bytes): 3014400
  * Total size of Merkle tree (bytes): 1222944
  * Total size of prover state (bytes): 4237344
(leave) Aurora SNARK prover                	[0.1319s x1.00]	(0.2177s x1.00 from start)

BCS parameters
* digest_len (bytes) = 32
* digest_len (bits) = 256
* hash_type = blake2b
(enter) verifier_seal_interaction_registrations	[             ]	(0.2193s x1.00 from start)
(leave) verifier_seal_interaction_registrations	[0.0007s x1.00]	(0.2200s x1.00 from start)

* Argument size in bytes (IOP): 26611
* Argument size in bytes (BCS): 30368
* Argument size in bytes (total): 56979

If we were to remove pruning of authentication paths in BCS,
the argument would have the following sizes:
* Argument size in bytes (BCS, no pruning): 72032
* Argument size in bytes (total, no pruning): 98643

total prover messages size: 23
total two to one hashes: 1123
total leaves hashed: 1156
total hashes: 2359

Transcript info by round
Per round IOP sizes don't include prover messages

round 0
MT_depth 13
IOP size: 11040 bytes
BCS size: 9824 bytes
number of two to one hashes: 305
number of leaves hashed: 480
number of zk hashes: 80
oracles in round: fw, fAz, fBz, fCz, sumcheck_mask, TODO: Fill in this name (batching.tcc), 

round 1
MT_depth 13
IOP size: 1840 bytes
BCS size: 8544 bytes
number of two to one hashes: 305
number of leaves hashed: 80
oracles in round: sumcheck h, 

round 2
MT_depth 11
IOP size: 3680 bytes
BCS size: 6080 bytes
number of two to one hashes: 228
number of leaves hashed: 160
oracles in round: TODO: Fill in this name (batching.tcc), 

round 3
MT_depth 9
IOP size: 3680 bytes
BCS size: 3840 bytes
number of two to one hashes: 158
number of leaves hashed: 160
oracles in round: TODO: Fill in this name (batching.tcc), 

round 4
MT_depth 7
IOP size: 3404 bytes
BCS size: 1728 bytes
number of two to one hashes: 89
number of leaves hashed: 148
oracles in round: TODO: Fill in this name (batching.tcc), 

round 5
MT_depth 5
IOP size: 2208 bytes
BCS size: 288 bytes
number of two to one hashes: 31
number of leaves hashed: 96
oracles in round: TODO: Fill in this name (batching.tcc), 

round 6
MT_depth 3
IOP size: 736 bytes
BCS size: 32 bytes
number of two to one hashes: 7
number of leaves hashed: 32
oracles in round: TODO: Fill in this name (batching.tcc), 


(enter) Aurora SNARK verifier              	[             ]	(0.2206s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 120.0
  * RS extra dimensions = 3
  * codeword domain dim = 14
  * constraint domain dim = 9
  * variable domain dim = 9
  * query bound = 81
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 171.0
  * interactive repetitions = 1
  * constraint domain dim = 9
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 166.0
  * codeword domain dim = 14
  * max tested degree bound = 2048
  * max constraint degree bound = 1185
  * absolute proximity parameter = 14335
  * fractional proximity parameter = 0.874939
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 117
  * achieved query soundness error (bits) = 120.0
  * codeword domain dim = 14
  * effective proximity parameter = 0.874939
  * number of interactive repetitions = 1
  * number of query repetitions = 40
  * localization parameter array = { 1 2 2 2 2 2 }
  * number of reductions = 6

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Aurora IOP protocol initialization and registration	[             ](0.2209s x1.00 from start)
    (enter) verifier_seal_interaction_registrations	[             ]	(0.2211s x1.00 from start)
    (leave) verifier_seal_interaction_registrations	[0.0007s x1.00]	(0.2219s x1.00 from start)
  (leave) Aurora IOP protocol initialization and registration	[0.0011s x1.00](0.2220s x1.00 from start)
  (enter) Check semantic validity of IOP transcript	[             ]	(0.2220s x1.00 from start)
  (leave) Check semantic validity of IOP transcript	[0.0000s x1.05]	(0.2220s x1.00 from start)
  (enter) Construct R1CS verifier state      	[             ]	(0.2220s x1.00 from start)
    (enter) multi_lincheck compute alpha powers	[             ]	(0.2220s x1.00 from start)
    (leave) multi_lincheck compute alpha powers	[0.0000s x1.01]	(0.2220s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_prime	[             ]	(0.2220s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_prime	[0.0000s x1.02]	(0.2221s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_ABC 	[             ]	(0.2221s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_ABC 	[0.0001s x1.00]	(0.2222s x1.00 from start)
    (enter) multi_lincheck IFFT p_alphas       	[             ]	(0.2222s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.2222s x1.00 from start)
        * Vector size: 512
        * Coset size: 512
      (leave) Call to multiplicative_IFFT_wrapper	[0.0002s x1.00]	(0.2224s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.2224s x1.00 from start)
        * Vector size: 512
        * Coset size: 512
      (leave) Call to multiplicative_IFFT_wrapper	[0.0002s x1.00]	(0.2226s x1.00 from start)
    (leave) multi_lincheck IFFT p_alphas       	[0.0004s x1.00]	(0.2226s x1.00 from start)
  (leave) Construct R1CS verifier state      	[0.0006s x1.00]	(0.2226s x1.00 from start)
  (enter) Check LDT verifier predicate       	[             ]	(0.2226s x1.00 from start)
    * Number of FRI interactions: 1
    * Number of FRI query sets per interaction: 40
    * Total number of FRI queries over all query sets (incl. repeated queries): 880
  (leave) Check LDT verifier predicate       	[0.0049s x1.00]	(0.2275s x1.00 from start)
  * IOP transcript valid: true
  * Full protocol decision predicate satisfied: true
(leave) Aurora SNARK verifier              	[0.0070s x1.00]	(0.2275s x1.00 from start)


* Verifier satisfied: true

================================================================================

(enter) Check satisfiability of R1CS example	[             ]	(0.2422s x1.00 from start)
(leave) Check satisfiability of R1CS example	[0.0001s x1.00]	(0.2423s x1.00 from start)

* R1CS number of constraints: 1024
* R1CS number of variables: 1023
* R1CS number of variables for primary input: 15
* R1CS number of variables for auxiliary input: 1008
* R1CS size of constraint system (bytes): 77952
* R1CS size of primary input (bytes): 360
* R1CS size of auxiliary input (bytes): 24192

(enter) Aurora SNARK prover                	[             ]	(0.2423s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 117.0
  * RS extra dimensions = 3
  * codeword domain dim = 15
  * constraint domain dim = 10
  * variable domain dim = 10
  * query bound = 79
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 170.0
  * interactive repetitions = 1
  * constraint domain dim = 10
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 165.0
  * codeword domain dim = 15
  * max tested degree bound = 4096
  * max constraint degree bound = 2205
  * absolute proximity parameter = 28671
  * fractional proximity parameter = 0.874969
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 116
  * achieved query soundness error (bits) = 117.0
  * codeword domain dim = 15
  * effective proximity parameter = 0.874969
  * number of interactive repetitions = 1
  * number of query repetitions = 39
  * localization parameter array = { 1 2 2 2 2 2 }
  * number of reductions = 6

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Submit witness oracles             	[             ]	(0.2429s x1.00 from start)
    (enter) Sumcheck: sample masking polynomial components	[             ](0.2429s x1.00 from start)
    (leave) Sumcheck: sample masking polynomial components	[0.0263s x1.00](0.2692s x1.00 from start)
    (enter) Sumcheck: compute masking polynomial codeword	[             ](0.2692s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.2693s x1.00 from start)
        * Vector size: 2126
        * Subgroup size: 32768
      (leave) Call to multiplicative_FFT_wrapper 	[0.0086s x1.00]	(0.2779s x1.00 from start)
    (leave) Sumcheck: compute masking polynomial codeword	[0.0087s x1.00](0.2779s x1.00 from start)
    (enter) Compute randomized f_w             	[             ]	(0.2779s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.2809s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.02]	(0.2810s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.2810s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 1024
      (leave) Call to multiplicative_FFT_wrapper 	[0.0001s x1.00]	(0.2811s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.2811s x1.00 from start)
        * Vector size: 1024
        * Coset size: 1024
      (leave) Call to multiplicative_IFFT_wrapper	[0.0004s x1.00]	(0.2815s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.2825s x1.00 from start)
        * Vector size: 1087
        * Subgroup size: 32768
      (leave) Call to multiplicative_FFT_wrapper 	[0.0075s x1.00]	(0.2900s x1.00 from start)
    (leave) Compute randomized f_w             	[0.0121s x1.00]	(0.2900s x1.00 from start)
    (enter) Compute A/B/Cz                     	[             ]	(0.2900s x1.00 from start)
    (leave) Compute A/B/Cz                     	[0.0001s x1.01]	(0.2901s x1.00 from start)
    (enter) Compute f_{A/B/Cz} over codeword domain	[             ]	(0.2901s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.2901s x1.00 from start)
        * Vector size: 1024
        * Coset size: 1024
      (leave) Call to multiplicative_IFFT_wrapper	[0.0004s x1.00]	(0.2905s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.2905s x1.00 from start)
        * Vector size: 1024
        * Coset size: 1024
      (leave) Call to multiplicative_IFFT_wrapper	[0.0004s x1.00]	(0.2909s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.2909s x1.00 from start)
        * Vector size: 1024
        * Coset size: 1024
      (leave) Call to multiplicative_IFFT_wrapper	[0.0004s x1.00]	(0.2913s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.2914s x1.00 from start)
        * Vector size: 1103
        * Subgroup size: 32768
      (leave) Call to multiplicative_FFT_wrapper 	[0.0075s x1.00]	(0.2988s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.2988s x1.00 from start)
        * Vector size: 1103
        * Subgroup size: 32768
      (leave) Call to multiplicative_FFT_wrapper 	[0.0075s x1.00]	(0.3063s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.3063s x1.00 from start)
        * Vector size: 1103
        * Subgroup size: 32768
      (leave) Call to multiplicative_FFT_wrapper 	[0.0075s x1.00]	(0.3138s x1.00 from start)
    (leave) Compute f_{A/B/Cz} over codeword domain	[0.0237s x1.00]	(0.3138s x1.00 from start)
    (enter) Call IOP oracle submission routines	[             ]	(0.3138s x1.00 from start)
    (leave) Call IOP oracle submission routines	[0.0000s x1.05]	(0.3138s x1.00 from start)
  (leave) Submit witness oracles             	[0.0709s x1.00]	(0.3138s x1.00 from start)
  (enter) LDT Reducer: Submit masking polynomial	[             ]	(0.3138s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.3652s x1.00 from start)
      * Vector size: 4096
      * Subgroup size: 32768
    (leave) Call to multiplicative_FFT_wrapper 	[0.0086s x1.00]	(0.3738s x1.00 from start)
  (leave) LDT Reducer: Submit masking polynomial	[0.0600s x1.00]	(0.3738s x1.00 from start)
  (enter) Finish prover round                	[             ]	(0.3738s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(0.3738s x1.00 from start)
      (enter) BCS: Sample randomness             	[             ]	(0.3739s x1.00 from start)
      (leave) BCS: Sample randomness             	[0.0116s x1.00]	(0.3855s x1.00 from start)
    (leave) Construct Merkle tree              	[0.0301s x1.00]	(0.4040s x1.00 from start)
  (leave) Finish prover round                	[0.0302s x1.00]	(0.4040s x1.00 from start)
  (enter) pow                                	[             ]	(0.4040s x1.00 from start)
  (leave) pow                                	[0.0000s x1.03]	(0.4040s x1.00 from start)
  (enter) multi_lincheck: Calculate and submit proof	[             ]	(0.4040s x1.00 from start)
    (enter) multi_lincheck compute alpha powers	[             ]	(0.4040s x1.00 from start)
    (leave) multi_lincheck compute alpha powers	[0.0000s x1.01]	(0.4041s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_prime	[             ]	(0.4041s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_prime	[0.0000s x1.01]	(0.4041s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_ABC 	[             ]	(0.4041s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_ABC 	[0.0003s x1.00]	(0.4044s x1.00 from start)
    (enter) multi_lincheck IFFT p_alphas       	[             ]	(0.4044s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.4044s x1.00 from start)
        * Vector size: 1024
        * Coset size: 1024
      (leave) Call to multiplicative_IFFT_wrapper	[0.0004s x1.00]	(0.4048s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.4049s x1.00 from start)
        * Vector size: 1024
        * Coset size: 1024
      (leave) Call to multiplicative_IFFT_wrapper	[0.0004s x1.00]	(0.4052s x1.00 from start)
    (leave) multi_lincheck IFFT p_alphas       	[0.0009s x1.00]	(0.4053s x1.00 from start)
    (enter) fz evaluated contents              	[             ]	(0.4053s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.4058s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.00]	(0.4059s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.4059s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 32768
      (leave) Call to multiplicative_FFT_wrapper 	[0.0030s x1.00]	(0.4088s x1.00 from start)
    (leave) fz evaluated contents              	[0.0050s x1.00]	(0.4102s x1.00 from start)
    (enter) multi_lincheck evaluated contents  	[             ]	(0.4103s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.4104s x1.00 from start)
        * Vector size: 1024
        * Subgroup size: 32768
      (leave) Call to multiplicative_FFT_wrapper 	[0.0070s x1.00]	(0.4174s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.4174s x1.00 from start)
        * Vector size: 1024
        * Subgroup size: 32768
      (leave) Call to multiplicative_FFT_wrapper 	[0.0070s x1.00]	(0.4244s x1.00 from start)
    (leave) multi_lincheck evaluated contents  	[0.0198s x1.00]	(0.4301s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.4324s x1.00 from start)
      * Vector size: 4096
      * Coset size: 4096
    (leave) Call to multiplicative_IFFT_wrapper	[0.0020s x1.00]	(0.4343s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.4345s x1.00 from start)
      * Vector size: 1102
      * Subgroup size: 32768
    (leave) Call to multiplicative_FFT_wrapper 	[0.0072s x1.00]	(0.4417s x1.00 from start)
  (leave) multi_lincheck: Calculate and submit proof	[0.0376s x1.00]	(0.4417s x1.00 from start)
  (enter) Finish prover round                	[             ]	(0.4417s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(0.4417s x1.00 from start)
    (leave) Construct Merkle tree              	[0.0095s x1.00]	(0.4512s x1.00 from start)
  (leave) Finish prover round                	[0.0096s x1.00]	(0.4512s x1.00 from start)
  (enter) pow                                	[             ]	(0.4512s x1.00 from start)
  (leave) pow                                	[0.0000s x1.03]	(0.4512s x1.00 from start)
  (enter) LDT Reducer: Calculate and submit proof	[             ]	(0.4513s x1.00 from start)
    (enter) Sumcheck: g evaluated contents     	[             ]	(0.4513s x1.00 from start)
    (leave) Sumcheck: g evaluated contents     	[0.0033s x1.00]	(0.4545s x1.00 from start)
    (enter) rowcheck evaluated contents        	[             ]	(0.4545s x1.00 from start)
    (leave) rowcheck evaluated contents        	[0.0020s x1.00]	(0.4565s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.4731s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0049s x1.00]	(0.4779s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(0.4780s x1.00 from start)
      (enter) Finish prover round                	[             ]	(0.4780s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(0.4780s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0023s x1.00]	(0.4803s x1.00 from start)
      (leave) Finish prover round                	[0.0023s x1.00]	(0.4803s x1.00 from start)
      (enter) pow                                	[             ]	(0.4803s x1.00 from start)
      (leave) pow                                	[0.0000s x1.05]	(0.4803s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0024s x1.00]	(0.4803s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.4803s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0019s x1.00]	(0.4823s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(0.4823s x1.00 from start)
      (enter) Finish prover round                	[             ]	(0.4823s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(0.4823s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0006s x1.00]	(0.4829s x1.00 from start)
      (leave) Finish prover round                	[0.0006s x1.00]	(0.4829s x1.00 from start)
      (enter) pow                                	[             ]	(0.4829s x1.00 from start)
      (leave) pow                                	[0.0000s x1.06]	(0.4829s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0006s x1.00]	(0.4829s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.4829s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0005s x1.00]	(0.4834s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(0.4834s x1.00 from start)
      (enter) Finish prover round                	[             ]	(0.4834s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(0.4834s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0002s x1.01]	(0.4836s x1.00 from start)
      (leave) Finish prover round                	[0.0002s x1.00]	(0.4836s x1.00 from start)
      (enter) pow                                	[             ]	(0.4836s x1.00 from start)
      (leave) pow                                	[0.0000s x1.04]	(0.4836s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0002s x1.00]	(0.4836s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.4837s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0001s x1.00]	(0.4838s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(0.4838s x1.00 from start)
      (enter) Finish prover round                	[             ]	(0.4838s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(0.4838s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0000s x1.00]	(0.4839s x1.00 from start)
      (leave) Finish prover round                	[0.0001s x1.00]	(0.4839s x1.00 from start)
      (enter) pow                                	[             ]	(0.4839s x1.00 from start)
      (leave) pow                                	[0.0000s x1.02]	(0.4839s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(0.4839s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.4839s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0000s x1.00]	(0.4839s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(0.4840s x1.00 from start)
      (enter) Finish prover round                	[             ]	(0.4840s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(0.4840s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0000s x1.01]	(0.4840s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.01]	(0.4840s x1.00 from start)
      (enter) pow                                	[             ]	(0.4840s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(0.4840s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(0.4840s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.4840s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0000s x1.01]	(0.4840s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.4840s x1.00 from start)
      * Vector size: 16
      * Coset size: 16
    (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.02]	(0.4841s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(0.4841s x1.00 from start)
      (enter) Finish prover round                	[             ]	(0.4841s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.01]	(0.4841s x1.00 from start)
      (enter) pow                                	[             ]	(0.4841s x1.00 from start)
      (leave) pow                                	[0.0074s x1.00]	(0.4915s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0074s x1.00]	(0.4915s x1.00 from start)
  (leave) LDT Reducer: Calculate and submit proof	[0.0404s x1.00]	(0.4916s x1.00 from start)
  (enter) Obtain transcript                  	[             ]	(0.4916s x1.00 from start)
  (leave) Obtain transcript                  	[0.0065s x1.00]	(0.4981s x1.00 from start)
  * Total size of proof oracles (bytes): 6028800
  * Total size of Merkle tree (bytes): 2446112
  * Total size of prover state (bytes): 8474912
(leave) Aurora SNARK prover                	[0.2558s x1.00]	(0.4981s x1.00 from start)

BCS parameters
* digest_len (bytes) = 32
* digest_len (bits) = 256
* hash_type = blake2b
(enter) verifier_seal_interaction_registrations	[             ]	(0.5008s x1.00 from start)
(leave) verifier_seal_interaction_registrations	[0.0008s x1.00]	(0.5015s x1.00 from start)

* Argument size in bytes (IOP): 27600
* Argument size in bytes (BCS): 35936
* Argument size in bytes (total): 63536

If we were to remove pruning of authentication paths in BCS,
the argument would have the following sizes:
* Argument size in bytes (BCS, no pruning): 80512
* Argument size in bytes (total, no pruning): 108112

total prover messages size: 46
total two to one hashes: 1310
total leaves hashed: 1198
total hashes: 2586

Transcript info by round
Per round IOP sizes don't include prover messages

round 0
MT_depth 14
IOP size: 10764 bytes
BCS size: 10848 bytes
number of two to one hashes: 337
number of leaves hashed: 468
number of zk hashes: 78
oracles in round: fw, fAz, fBz, fCz, sumcheck_mask, TODO: Fill in this name (batching.tcc), 

round 1
MT_depth 14
IOP size: 1794 bytes
BCS size: 9600 bytes
number of two to one hashes: 337
number of leaves hashed: 78
oracles in round: sumcheck h, 

round 2
MT_depth 12
IOP size: 3588 bytes
BCS size: 7008 bytes
number of two to one hashes: 256
number of leaves hashed: 156
oracles in round: TODO: Fill in this name (batching.tcc), 

round 3
MT_depth 10
IOP size: 3588 bytes
BCS size: 4800 bytes
number of two to one hashes: 187
number of leaves hashed: 156
oracles in round: TODO: Fill in this name (batching.tcc), 

round 4
MT_depth 8
IOP size: 3588 bytes
BCS size: 2688 bytes
number of two to one hashes: 121
number of leaves hashed: 156
oracles in round: TODO: Fill in this name (batching.tcc), 

round 5
MT_depth 6
IOP size: 2852 bytes
BCS size: 896 bytes
number of two to one hashes: 57
number of leaves hashed: 124
oracles in round: TODO: Fill in this name (batching.tcc), 

round 6
MT_depth 4
IOP size: 1380 bytes
BCS size: 64 bytes
number of two to one hashes: 15
number of leaves hashed: 60
oracles in round: TODO: Fill in this name (batching.tcc), 


(enter) Aurora SNARK verifier              	[             ]	(0.5022s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 117.0
  * RS extra dimensions = 3
  * codeword domain dim = 15
  * constraint domain dim = 10
  * variable domain dim = 10
  * query bound = 79
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 170.0
  * interactive repetitions = 1
  * constraint domain dim = 10
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 165.0
  * codeword domain dim = 15
  * max tested degree bound = 4096
  * max constraint degree bound = 2205
  * absolute proximity parameter = 28671
  * fractional proximity parameter = 0.874969
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 116
  * achieved query soundness error (bits) = 117.0
  * codeword domain dim = 15
  * effective proximity parameter = 0.874969
  * number of interactive repetitions = 1
  * number of query repetitions = 39
  * localization parameter array = { 1 2 2 2 2 2 }
  * number of reductions = 6

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Aurora IOP protocol initialization and registration	[             ](0.5025s x1.00 from start)
    (enter) verifier_seal_interaction_registrations	[             ]	(0.5028s x1.00 from start)
    (leave) verifier_seal_interaction_registrations	[0.0008s x1.00]	(0.5036s x1.00 from start)
  (leave) Aurora IOP protocol initialization and registration	[0.0012s x1.00](0.5037s x1.00 from start)
  (enter) Check semantic validity of IOP transcript	[             ]	(0.5037s x1.00 from start)
  (leave) Check semantic validity of IOP transcript	[0.0000s x1.05]	(0.5037s x1.00 from start)
  (enter) Construct R1CS verifier state      	[             ]	(0.5037s x1.00 from start)
    (enter) multi_lincheck compute alpha powers	[             ]	(0.5037s x1.00 from start)
    (leave) multi_lincheck compute alpha powers	[0.0000s x1.01]	(0.5038s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_prime	[             ]	(0.5038s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_prime	[0.0000s x1.01]	(0.5038s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_ABC 	[             ]	(0.5038s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_ABC 	[0.0003s x1.00]	(0.5041s x1.00 from start)
    (enter) multi_lincheck IFFT p_alphas       	[             ]	(0.5041s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.5041s x1.00 from start)
        * Vector size: 1024
        * Coset size: 1024
      (leave) Call to multiplicative_IFFT_wrapper	[0.0004s x1.00]	(0.5045s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.5045s x1.00 from start)
        * Vector size: 1024
        * Coset size: 1024
      (leave) Call to multiplicative_IFFT_wrapper	[0.0004s x1.00]	(0.5049s x1.00 from start)
    (leave) multi_lincheck IFFT p_alphas       	[0.0008s x1.00]	(0.5049s x1.00 from start)
  (leave) Construct R1CS verifier state      	[0.0012s x1.00]	(0.5049s x1.00 from start)
  (enter) Check LDT verifier predicate       	[             ]	(0.5049s x1.00 from start)
    * Number of FRI interactions: 1
    * Number of FRI query sets per interaction: 39
    * Total number of FRI queries over all query sets (incl. repeated queries): 858
  (leave) Check LDT verifier predicate       	[0.0070s x1.00]	(0.5119s x1.00 from start)
  * IOP transcript valid: true
  * Full protocol decision predicate satisfied: true
(leave) Aurora SNARK verifier              	[0.0097s x1.00]	(0.5119s x1.00 from start)


* Verifier satisfied: true

================================================================================

(enter) Check satisfiability of R1CS example	[             ]	(0.5401s x1.00 from start)
(leave) Check satisfiability of R1CS example	[0.0002s x1.00]	(0.5403s x1.00 from start)

* R1CS number of constraints: 2048
* R1CS number of variables: 2047
* R1CS number of variables for primary input: 15
* R1CS number of variables for auxiliary input: 2032
* R1CS size of constraint system (bytes): 156672
* R1CS size of primary input (bytes): 360
* R1CS size of auxiliary input (bytes): 48768

(enter) Aurora SNARK prover                	[             ]	(0.5404s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 117.0
  * RS extra dimensions = 3
  * codeword domain dim = 16
  * constraint domain dim = 11
  * variable domain dim = 11
  * query bound = 79
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 169.0
  * interactive repetitions = 1
  * constraint domain dim = 11
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 164.0
  * codeword domain dim = 16
  * max tested degree bound = 8192
  * max constraint degree bound = 4253
  * absolute proximity parameter = 57343
  * fractional proximity parameter = 0.874985
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 115
  * achieved query soundness error (bits) = 117.0
  * codeword domain dim = 16
  * effective proximity parameter = 0.874985
  * number of interactive repetitions = 1
  * number of query repetitions = 39
  * localization parameter array = { 1 2 2 2 2 2 2 }
  * number of reductions = 7

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Submit witness oracles             	[             ]	(0.5411s x1.00 from start)
    (enter) Sumcheck: sample masking polynomial components	[             ](0.5411s x1.00 from start)
    (leave) Sumcheck: sample masking polynomial components	[0.0517s x1.00](0.5928s x1.00 from start)
    (enter) Sumcheck: compute masking polynomial codeword	[             ](0.5928s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.5930s x1.00 from start)
        * Vector size: 4174
        * Subgroup size: 65536
      (leave) Call to multiplicative_FFT_wrapper 	[0.0184s x1.00]	(0.6114s x1.00 from start)
    (leave) Sumcheck: compute masking polynomial codeword	[0.0186s x1.00](0.6114s x1.00 from start)
    (enter) Compute randomized f_w             	[             ]	(0.6114s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.6144s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.02]	(0.6144s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.6144s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 2048
      (leave) Call to multiplicative_FFT_wrapper 	[0.0002s x1.00]	(0.6147s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.6147s x1.00 from start)
        * Vector size: 2048
        * Coset size: 2048
      (leave) Call to multiplicative_IFFT_wrapper	[0.0008s x1.00]	(0.6155s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.6168s x1.00 from start)
        * Vector size: 2111
        * Subgroup size: 65536
      (leave) Call to multiplicative_FFT_wrapper 	[0.0158s x1.00]	(0.6326s x1.00 from start)
    (leave) Compute randomized f_w             	[0.0211s x1.00]	(0.6326s x1.00 from start)
    (enter) Compute A/B/Cz                     	[             ]	(0.6326s x1.00 from start)
    (leave) Compute A/B/Cz                     	[0.0002s x1.00]	(0.6328s x1.00 from start)
    (enter) Compute f_{A/B/Cz} over codeword domain	[             ]	(0.6328s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.6328s x1.00 from start)
        * Vector size: 2048
        * Coset size: 2048
      (leave) Call to multiplicative_IFFT_wrapper	[0.0008s x1.00]	(0.6336s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.6336s x1.00 from start)
        * Vector size: 2048
        * Coset size: 2048
      (leave) Call to multiplicative_IFFT_wrapper	[0.0008s x1.00]	(0.6345s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.6345s x1.00 from start)
        * Vector size: 2048
        * Coset size: 2048
      (leave) Call to multiplicative_IFFT_wrapper	[0.0008s x1.00]	(0.6353s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.6354s x1.00 from start)
        * Vector size: 2127
        * Subgroup size: 65536
      (leave) Call to multiplicative_FFT_wrapper 	[0.0163s x1.00]	(0.6517s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.6517s x1.00 from start)
        * Vector size: 2127
        * Subgroup size: 65536
      (leave) Call to multiplicative_FFT_wrapper 	[0.0163s x1.00]	(0.6679s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.6679s x1.00 from start)
        * Vector size: 2127
        * Subgroup size: 65536
      (leave) Call to multiplicative_FFT_wrapper 	[0.0163s x1.00]	(0.6842s x1.00 from start)
    (leave) Compute f_{A/B/Cz} over codeword domain	[0.0514s x1.00]	(0.6842s x1.00 from start)
    (enter) Call IOP oracle submission routines	[             ]	(0.6842s x1.00 from start)
    (leave) Call IOP oracle submission routines	[0.0000s x1.04]	(0.6842s x1.00 from start)
  (leave) Submit witness oracles             	[0.1432s x1.00]	(0.6842s x1.00 from start)
  (enter) LDT Reducer: Submit masking polynomial	[             ]	(0.6842s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.7873s x1.00 from start)
      * Vector size: 8192
      * Subgroup size: 65536
    (leave) Call to multiplicative_FFT_wrapper 	[0.0185s x1.00]	(0.8058s x1.00 from start)
  (leave) LDT Reducer: Submit masking polynomial	[0.1215s x1.00]	(0.8058s x1.00 from start)
  (enter) Finish prover round                	[             ]	(0.8058s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(0.8058s x1.00 from start)
      (enter) BCS: Sample randomness             	[             ]	(0.8058s x1.00 from start)
      (leave) BCS: Sample randomness             	[0.0068s x1.00]	(0.8126s x1.00 from start)
    (leave) Construct Merkle tree              	[0.0441s x1.00]	(0.8499s x1.00 from start)
  (leave) Finish prover round                	[0.0442s x1.00]	(0.8499s x1.00 from start)
  (enter) pow                                	[             ]	(0.8500s x1.00 from start)
  (leave) pow                                	[0.0000s x1.04]	(0.8500s x1.00 from start)
  (enter) multi_lincheck: Calculate and submit proof	[             ]	(0.8500s x1.00 from start)
    (enter) multi_lincheck compute alpha powers	[             ]	(0.8500s x1.00 from start)
    (leave) multi_lincheck compute alpha powers	[0.0001s x1.00]	(0.8500s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_prime	[             ]	(0.8500s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_prime	[0.0001s x1.01]	(0.8501s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_ABC 	[             ]	(0.8501s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_ABC 	[0.0006s x1.00]	(0.8507s x1.00 from start)
    (enter) multi_lincheck IFFT p_alphas       	[             ]	(0.8507s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.8507s x1.00 from start)
        * Vector size: 2048
        * Coset size: 2048
      (leave) Call to multiplicative_IFFT_wrapper	[0.0009s x1.00]	(0.8516s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.8516s x1.00 from start)
        * Vector size: 2048
        * Coset size: 2048
      (leave) Call to multiplicative_IFFT_wrapper	[0.0008s x1.00]	(0.8525s x1.00 from start)
    (leave) multi_lincheck IFFT p_alphas       	[0.0018s x1.00]	(0.8525s x1.00 from start)
    (enter) fz evaluated contents              	[             ]	(0.8525s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.8535s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.00]	(0.8535s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.8535s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 65536
      (leave) Call to multiplicative_FFT_wrapper 	[0.0060s x1.00]	(0.8595s x1.00 from start)
    (leave) fz evaluated contents              	[0.0098s x1.00]	(0.8623s x1.00 from start)
    (enter) multi_lincheck evaluated contents  	[             ]	(0.8625s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.8625s x1.00 from start)
        * Vector size: 2048
        * Subgroup size: 65536
      (leave) Call to multiplicative_FFT_wrapper 	[0.0154s x1.00]	(0.8779s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.8779s x1.00 from start)
        * Vector size: 2048
        * Subgroup size: 65536
      (leave) Call to multiplicative_FFT_wrapper 	[0.0154s x1.00]	(0.8933s x1.00 from start)
    (leave) multi_lincheck evaluated contents  	[0.0423s x1.00]	(0.9048s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.9092s x1.00 from start)
      * Vector size: 8192
      * Coset size: 8192
    (leave) Call to multiplicative_IFFT_wrapper	[0.0042s x1.00]	(0.9134s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.9137s x1.00 from start)
      * Vector size: 2126
      * Subgroup size: 65536
    (leave) Call to multiplicative_FFT_wrapper 	[0.0157s x1.00]	(0.9293s x1.00 from start)
  (leave) multi_lincheck: Calculate and submit proof	[0.0794s x1.00]	(0.9293s x1.00 from start)
  (enter) Finish prover round                	[             ]	(0.9293s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(0.9293s x1.00 from start)
    (leave) Construct Merkle tree              	[0.0192s x1.00]	(0.9485s x1.00 from start)
  (leave) Finish prover round                	[0.0192s x1.00]	(0.9485s x1.00 from start)
  (enter) pow                                	[             ]	(0.9485s x1.00 from start)
  (leave) pow                                	[0.0000s x1.06]	(0.9485s x1.00 from start)
  (enter) LDT Reducer: Calculate and submit proof	[             ]	(0.9485s x1.00 from start)
    (enter) Sumcheck: g evaluated contents     	[             ]	(0.9486s x1.00 from start)
    (leave) Sumcheck: g evaluated contents     	[0.0065s x1.00]	(0.9550s x1.00 from start)
    (enter) rowcheck evaluated contents        	[             ]	(0.9550s x1.00 from start)
    (leave) rowcheck evaluated contents        	[0.0039s x1.00]	(0.9590s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(0.9920s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0098s x1.00]	(1.0018s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(1.0018s x1.00 from start)
      (enter) Finish prover round                	[             ]	(1.0018s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(1.0018s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0046s x1.00]	(1.0065s x1.00 from start)
      (leave) Finish prover round                	[0.0047s x1.00]	(1.0065s x1.00 from start)
      (enter) pow                                	[             ]	(1.0065s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(1.0065s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0047s x1.00]	(1.0065s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(1.0065s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0038s x1.00]	(1.0104s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(1.0104s x1.00 from start)
      (enter) Finish prover round                	[             ]	(1.0104s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(1.0104s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0012s x1.00]	(1.0116s x1.00 from start)
      (leave) Finish prover round                	[0.0012s x1.00]	(1.0116s x1.00 from start)
      (enter) pow                                	[             ]	(1.0116s x1.00 from start)
      (leave) pow                                	[0.0000s x1.04]	(1.0116s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0012s x1.00]	(1.0116s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(1.0116s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0010s x1.00]	(1.0126s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(1.0126s x1.00 from start)
      (enter) Finish prover round                	[             ]	(1.0126s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(1.0126s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0003s x1.00]	(1.0129s x1.00 from start)
      (leave) Finish prover round                	[0.0003s x1.00]	(1.0129s x1.00 from start)
      (enter) pow                                	[             ]	(1.0129s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(1.0130s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0003s x1.00]	(1.0130s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(1.0130s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0003s x1.00]	(1.0132s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(1.0132s x1.00 from start)
      (enter) Finish prover round                	[             ]	(1.0132s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(1.0132s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0001s x1.00]	(1.0133s x1.00 from start)
      (leave) Finish prover round                	[0.0001s x1.00]	(1.0133s x1.00 from start)
      (enter) pow                                	[             ]	(1.0133s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(1.0133s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(1.0134s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(1.0134s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0001s x1.00]	(1.0134s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(1.0134s x1.00 from start)
      (enter) Finish prover round                	[             ]	(1.0134s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(1.0135s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0000s x1.00]	(1.0135s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.00]	(1.0135s x1.00 from start)
      (enter) pow                                	[             ]	(1.0135s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(1.0135s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(1.0135s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(1.0135s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0000s x1.00]	(1.0136s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(1.0136s x1.00 from start)
      (enter) Finish prover round                	[             ]	(1.0136s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(1.0136s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0000s x1.01]	(1.0136s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.00]	(1.0136s x1.00 from start)
      (enter) pow                                	[             ]	(1.0136s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(1.0136s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(1.0136s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(1.0136s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0000s x1.00]	(1.0137s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(1.0137s x1.00 from start)
      * Vector size: 8
      * Coset size: 8
    (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.02]	(1.0137s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(1.0137s x1.00 from start)
      (enter) Finish prover round                	[             ]	(1.0137s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.01]	(1.0137s x1.00 from start)
      (enter) pow                                	[             ]	(1.0137s x1.00 from start)
      (leave) pow                                	[0.0023s x1.00]	(1.0161s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0024s x1.00]	(1.0161s x1.00 from start)
  (leave) LDT Reducer: Calculate and submit proof	[0.0677s x1.00]	(1.0163s x1.00 from start)
  (enter) Obtain transcript                  	[             ]	(1.0163s x1.00 from start)
  (leave) Obtain transcript                  	[0.0110s x1.00]	(1.0273s x1.00 from start)
  * Total size of proof oracles (bytes): 12058368
  * Total size of Merkle tree (bytes): 4892928
  * Total size of prover state (bytes): 16951296
(leave) Aurora SNARK prover                	[0.4870s x1.00]	(1.0274s x1.00 from start)

BCS parameters
* digest_len (bytes) = 32
* digest_len (bits) = 256
* hash_type = blake2b
(enter) verifier_seal_interaction_registrations	[             ]	(1.0321s x1.00 from start)
(leave) verifier_seal_interaction_registrations	[0.0009s x1.00]	(1.0331s x1.00 from start)

* Argument size in bytes (IOP): 29049
* Argument size in bytes (BCS): 43360
* Argument size in bytes (total): 72409

If we were to remove pruning of authentication paths in BCS,
the argument would have the following sizes:
* Argument size in bytes (BCS, no pruning): 90240
* Argument size in bytes (total, no pruning): 119289

total prover messages size: 23
total two to one hashes: 1556
total leaves hashed: 1262
total hashes: 2896

Transcript info by round
Per round IOP sizes don't include prover messages

round 0
MT_depth 15
IOP size: 10764 bytes
BCS size: 12160 bytes
number of two to one hashes: 378
number of leaves hashed: 468
number of zk hashes: 78
oracles in round: fw, fAz, fBz, fCz, sumcheck_mask, TODO: Fill in this name (batching.tcc), 

round 1
MT_depth 15
IOP size: 1794 bytes
BCS size: 10912 bytes
number of two to one hashes: 378
number of leaves hashed: 78
oracles in round: sumcheck h, 

round 2
MT_depth 13
IOP size: 3588 bytes
BCS size: 8544 bytes
number of two to one hashes: 304
number of leaves hashed: 156
oracles in round: TODO: Fill in this name (batching.tcc), 

round 3
MT_depth 11
IOP size: 3496 bytes
BCS size: 5792 bytes
number of two to one hashes: 217
number of leaves hashed: 152
oracles in round: TODO: Fill in this name (batching.tcc), 

round 4
MT_depth 9
IOP size: 3496 bytes
BCS size: 3968 bytes
number of two to one hashes: 160
number of leaves hashed: 152
oracles in round: TODO: Fill in this name (batching.tcc), 

round 5
MT_depth 7
IOP size: 3220 bytes
BCS size: 1568 bytes
number of two to one hashes: 82
number of leaves hashed: 140
oracles in round: TODO: Fill in this name (batching.tcc), 

round 6
MT_depth 5
IOP size: 1932 bytes
BCS size: 352 bytes
number of two to one hashes: 30
number of leaves hashed: 84
oracles in round: TODO: Fill in this name (batching.tcc), 

round 7
MT_depth 3
IOP size: 736 bytes
BCS size: 32 bytes
number of two to one hashes: 7
number of leaves hashed: 32
oracles in round: TODO: Fill in this name (batching.tcc), 


(enter) Aurora SNARK verifier              	[             ]	(1.0340s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 117.0
  * RS extra dimensions = 3
  * codeword domain dim = 16
  * constraint domain dim = 11
  * variable domain dim = 11
  * query bound = 79
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 169.0
  * interactive repetitions = 1
  * constraint domain dim = 11
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 164.0
  * codeword domain dim = 16
  * max tested degree bound = 8192
  * max constraint degree bound = 4253
  * absolute proximity parameter = 57343
  * fractional proximity parameter = 0.874985
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 115
  * achieved query soundness error (bits) = 117.0
  * codeword domain dim = 16
  * effective proximity parameter = 0.874985
  * number of interactive repetitions = 1
  * number of query repetitions = 39
  * localization parameter array = { 1 2 2 2 2 2 2 }
  * number of reductions = 7

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Aurora IOP protocol initialization and registration	[             ](1.0342s x1.00 from start)
    (enter) verifier_seal_interaction_registrations	[             ]	(1.0346s x1.00 from start)
    (leave) verifier_seal_interaction_registrations	[0.0009s x1.00]	(1.0355s x1.00 from start)
  (leave) Aurora IOP protocol initialization and registration	[0.0015s x1.00](1.0357s x1.00 from start)
  (enter) Check semantic validity of IOP transcript	[             ]	(1.0357s x1.00 from start)
  (leave) Check semantic validity of IOP transcript	[0.0000s x1.07]	(1.0357s x1.00 from start)
  (enter) Construct R1CS verifier state      	[             ]	(1.0357s x1.00 from start)
    (enter) multi_lincheck compute alpha powers	[             ]	(1.0357s x1.00 from start)
    (leave) multi_lincheck compute alpha powers	[0.0000s x1.01]	(1.0357s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_prime	[             ]	(1.0357s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_prime	[0.0000s x1.01]	(1.0358s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_ABC 	[             ]	(1.0358s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_ABC 	[0.0005s x1.00]	(1.0363s x1.00 from start)
    (enter) multi_lincheck IFFT p_alphas       	[             ]	(1.0363s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(1.0363s x1.00 from start)
        * Vector size: 2048
        * Coset size: 2048
      (leave) Call to multiplicative_IFFT_wrapper	[0.0008s x1.00]	(1.0372s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(1.0372s x1.00 from start)
        * Vector size: 2048
        * Coset size: 2048
      (leave) Call to multiplicative_IFFT_wrapper	[0.0008s x1.00]	(1.0380s x1.00 from start)
    (leave) multi_lincheck IFFT p_alphas       	[0.0017s x1.00]	(1.0381s x1.00 from start)
  (leave) Construct R1CS verifier state      	[0.0024s x1.00]	(1.0381s x1.00 from start)
  (enter) Check LDT verifier predicate       	[             ]	(1.0381s x1.00 from start)
    * Number of FRI interactions: 1
    * Number of FRI query sets per interaction: 39
    * Total number of FRI queries over all query sets (incl. repeated queries): 1014
  (leave) Check LDT verifier predicate       	[0.0116s x1.00]	(1.0496s x1.00 from start)
  * IOP transcript valid: true
  * Full protocol decision predicate satisfied: true
(leave) Aurora SNARK verifier              	[0.0157s x1.00]	(1.0497s x1.00 from start)


* Verifier satisfied: true

================================================================================

(enter) Check satisfiability of R1CS example	[             ]	(1.1068s x1.00 from start)
(leave) Check satisfiability of R1CS example	[0.0004s x1.00]	(1.1072s x1.00 from start)

* R1CS number of constraints: 4096
* R1CS number of variables: 4095
* R1CS number of variables for primary input: 15
* R1CS number of variables for auxiliary input: 4080
* R1CS size of constraint system (bytes): 314880
* R1CS size of primary input (bytes): 360
* R1CS size of auxiliary input (bytes): 97920

(enter) Aurora SNARK prover                	[             ]	(1.1073s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 117.0
  * RS extra dimensions = 3
  * codeword domain dim = 17
  * constraint domain dim = 12
  * variable domain dim = 12
  * query bound = 79
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 168.0
  * interactive repetitions = 1
  * constraint domain dim = 12
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 163.0
  * codeword domain dim = 17
  * max tested degree bound = 16384
  * max constraint degree bound = 8349
  * absolute proximity parameter = 114687
  * fractional proximity parameter = 0.874992
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 114
  * achieved query soundness error (bits) = 117.0
  * codeword domain dim = 17
  * effective proximity parameter = 0.874992
  * number of interactive repetitions = 1
  * number of query repetitions = 39
  * localization parameter array = { 1 2 2 2 2 2 2 }
  * number of reductions = 7

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Submit witness oracles             	[             ]	(1.1082s x1.00 from start)
    (enter) Sumcheck: sample masking polynomial components	[             ](1.1082s x1.00 from start)
    (leave) Sumcheck: sample masking polynomial components	[0.1043s x1.00](1.2125s x1.00 from start)
    (enter) Sumcheck: compute masking polynomial codeword	[             ](1.2125s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(1.2128s x1.00 from start)
        * Vector size: 8270
        * Subgroup size: 131072
      (leave) Call to multiplicative_FFT_wrapper 	[0.0396s x1.00]	(1.2524s x1.00 from start)
    (leave) Sumcheck: compute masking polynomial codeword	[0.0399s x1.00](1.2524s x1.00 from start)
    (enter) Compute randomized f_w             	[             ]	(1.2524s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(1.2555s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.02]	(1.2555s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(1.2555s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 4096
      (leave) Call to multiplicative_FFT_wrapper 	[0.0004s x1.00]	(1.2559s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(1.2560s x1.00 from start)
        * Vector size: 4096
        * Coset size: 4096
      (leave) Call to multiplicative_IFFT_wrapper	[0.0018s x1.00]	(1.2578s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(1.2591s x1.00 from start)
        * Vector size: 4159
        * Subgroup size: 131072
      (leave) Call to multiplicative_FFT_wrapper 	[0.0343s x1.00]	(1.2934s x1.00 from start)
    (leave) Compute randomized f_w             	[0.0410s x1.00]	(1.2934s x1.00 from start)
    (enter) Compute A/B/Cz                     	[             ]	(1.2934s x1.00 from start)
    (leave) Compute A/B/Cz                     	[0.0004s x1.00]	(1.2938s x1.00 from start)
    (enter) Compute f_{A/B/Cz} over codeword domain	[             ]	(1.2938s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(1.2938s x1.00 from start)
        * Vector size: 4096
        * Coset size: 4096
      (leave) Call to multiplicative_IFFT_wrapper	[0.0018s x1.00]	(1.2956s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(1.2957s x1.00 from start)
        * Vector size: 4096
        * Coset size: 4096
      (leave) Call to multiplicative_IFFT_wrapper	[0.0018s x1.00]	(1.2975s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(1.2975s x1.00 from start)
        * Vector size: 4096
        * Coset size: 4096
      (leave) Call to multiplicative_IFFT_wrapper	[0.0018s x1.00]	(1.2993s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(1.2994s x1.00 from start)
        * Vector size: 4175
        * Subgroup size: 131072
      (leave) Call to multiplicative_FFT_wrapper 	[0.0352s x1.00]	(1.3346s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(1.3346s x1.00 from start)
        * Vector size: 4175
        * Subgroup size: 131072
      (leave) Call to multiplicative_FFT_wrapper 	[0.0352s x1.00]	(1.3698s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(1.3698s x1.00 from start)
        * Vector size: 4175
        * Subgroup size: 131072
      (leave) Call to multiplicative_FFT_wrapper 	[0.0352s x1.00]	(1.4050s x1.00 from start)
    (leave) Compute f_{A/B/Cz} over codeword domain	[0.1112s x1.00]	(1.4050s x1.00 from start)
    (enter) Call IOP oracle submission routines	[             ]	(1.4050s x1.00 from start)
    (leave) Call IOP oracle submission routines	[0.0000s x1.04]	(1.4050s x1.00 from start)
  (leave) Submit witness oracles             	[0.2969s x1.00]	(1.4050s x1.00 from start)
  (enter) LDT Reducer: Submit masking polynomial	[             ]	(1.4050s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(1.6119s x1.00 from start)
      * Vector size: 16384
      * Subgroup size: 131072
    (leave) Call to multiplicative_FFT_wrapper 	[0.0397s x1.00]	(1.6516s x1.00 from start)
  (leave) LDT Reducer: Submit masking polynomial	[0.2466s x1.00]	(1.6516s x1.00 from start)
  (enter) Finish prover round                	[             ]	(1.6516s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(1.6516s x1.00 from start)
      (enter) BCS: Sample randomness             	[             ]	(1.6517s x1.00 from start)
      (leave) BCS: Sample randomness             	[0.0126s x1.00]	(1.6643s x1.00 from start)
    (leave) Construct Merkle tree              	[0.0872s x1.00]	(1.7389s x1.00 from start)
  (leave) Finish prover round                	[0.0873s x1.00]	(1.7389s x1.00 from start)
  (enter) pow                                	[             ]	(1.7389s x1.00 from start)
  (leave) pow                                	[0.0000s x1.02]	(1.7389s x1.00 from start)
  (enter) multi_lincheck: Calculate and submit proof	[             ]	(1.7389s x1.00 from start)
    (enter) multi_lincheck compute alpha powers	[             ]	(1.7389s x1.00 from start)
    (leave) multi_lincheck compute alpha powers	[0.0001s x1.00]	(1.7391s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_prime	[             ]	(1.7391s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_prime	[0.0001s x1.00]	(1.7392s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_ABC 	[             ]	(1.7392s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_ABC 	[0.0012s x1.00]	(1.7403s x1.00 from start)
    (enter) multi_lincheck IFFT p_alphas       	[             ]	(1.7404s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(1.7404s x1.00 from start)
        * Vector size: 4096
        * Coset size: 4096
      (leave) Call to multiplicative_IFFT_wrapper	[0.0019s x1.00]	(1.7423s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(1.7423s x1.00 from start)
        * Vector size: 4096
        * Coset size: 4096
      (leave) Call to multiplicative_IFFT_wrapper	[0.0018s x1.00]	(1.7441s x1.00 from start)
    (leave) multi_lincheck IFFT p_alphas       	[0.0038s x1.00]	(1.7442s x1.00 from start)
    (enter) fz evaluated contents              	[             ]	(1.7442s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(1.7463s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.00]	(1.7463s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(1.7463s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 131072
      (leave) Call to multiplicative_FFT_wrapper 	[0.0119s x1.00]	(1.7582s x1.00 from start)
    (leave) fz evaluated contents              	[0.0195s x1.00]	(1.7637s x1.00 from start)
    (enter) multi_lincheck evaluated contents  	[             ]	(1.7641s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(1.7641s x1.00 from start)
        * Vector size: 4096
        * Subgroup size: 131072
      (leave) Call to multiplicative_FFT_wrapper 	[0.0334s x1.00]	(1.7975s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(1.7976s x1.00 from start)
        * Vector size: 4096
        * Subgroup size: 131072
      (leave) Call to multiplicative_FFT_wrapper 	[0.0334s x1.00]	(1.8310s x1.00 from start)
    (leave) multi_lincheck evaluated contents  	[0.0896s x1.00]	(1.8537s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(1.8628s x1.00 from start)
      * Vector size: 16384
      * Coset size: 16384
    (leave) Call to multiplicative_IFFT_wrapper	[0.0090s x1.00]	(1.8717s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(1.8722s x1.00 from start)
      * Vector size: 4174
      * Subgroup size: 131072
    (leave) Call to multiplicative_FFT_wrapper 	[0.0340s x1.00]	(1.9062s x1.00 from start)
  (leave) multi_lincheck: Calculate and submit proof	[0.1673s x1.00]	(1.9062s x1.00 from start)
  (enter) Finish prover round                	[             ]	(1.9062s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(1.9062s x1.00 from start)
    (leave) Construct Merkle tree              	[0.0381s x1.00]	(1.9443s x1.00 from start)
  (leave) Finish prover round                	[0.0381s x1.00]	(1.9444s x1.00 from start)
  (enter) pow                                	[             ]	(1.9444s x1.00 from start)
  (leave) pow                                	[0.0000s x1.07]	(1.9444s x1.00 from start)
  (enter) LDT Reducer: Calculate and submit proof	[             ]	(1.9444s x1.00 from start)
    (enter) Sumcheck: g evaluated contents     	[             ]	(1.9444s x1.00 from start)
    (leave) Sumcheck: g evaluated contents     	[0.0130s x1.00]	(1.9573s x1.00 from start)
    (enter) rowcheck evaluated contents        	[             ]	(1.9574s x1.00 from start)
    (leave) rowcheck evaluated contents        	[0.0078s x1.00]	(1.9652s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(2.0314s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0194s x1.00]	(2.0508s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(2.0508s x1.00 from start)
      (enter) Finish prover round                	[             ]	(2.0509s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(2.0509s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0092s x1.00]	(2.0601s x1.00 from start)
      (leave) Finish prover round                	[0.0092s x1.00]	(2.0601s x1.00 from start)
      (enter) pow                                	[             ]	(2.0601s x1.00 from start)
      (leave) pow                                	[0.0000s x1.05]	(2.0601s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0093s x1.00]	(2.0601s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(2.0601s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0077s x1.00]	(2.0678s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(2.0678s x1.00 from start)
      (enter) Finish prover round                	[             ]	(2.0678s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(2.0678s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0023s x1.00]	(2.0702s x1.00 from start)
      (leave) Finish prover round                	[0.0023s x1.00]	(2.0702s x1.00 from start)
      (enter) pow                                	[             ]	(2.0702s x1.00 from start)
      (leave) pow                                	[0.0000s x1.06]	(2.0702s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0024s x1.00]	(2.0702s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(2.0702s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0019s x1.00]	(2.0721s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(2.0721s x1.00 from start)
      (enter) Finish prover round                	[             ]	(2.0721s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(2.0721s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0006s x1.00]	(2.0727s x1.00 from start)
      (leave) Finish prover round                	[0.0006s x1.00]	(2.0728s x1.00 from start)
      (enter) pow                                	[             ]	(2.0728s x1.00 from start)
      (leave) pow                                	[0.0000s x1.05]	(2.0728s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0006s x1.00]	(2.0728s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(2.0728s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0005s x1.00]	(2.0733s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(2.0733s x1.00 from start)
      (enter) Finish prover round                	[             ]	(2.0733s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(2.0733s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0002s x1.00]	(2.0734s x1.00 from start)
      (leave) Finish prover round                	[0.0002s x1.00]	(2.0735s x1.00 from start)
      (enter) pow                                	[             ]	(2.0735s x1.00 from start)
      (leave) pow                                	[0.0000s x1.02]	(2.0735s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0002s x1.00]	(2.0735s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(2.0735s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0002s x1.00]	(2.0736s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(2.0736s x1.00 from start)
      (enter) Finish prover round                	[             ]	(2.0736s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(2.0737s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0001s x1.00]	(2.0737s x1.00 from start)
      (leave) Finish prover round                	[0.0001s x1.00]	(2.0737s x1.00 from start)
      (enter) pow                                	[             ]	(2.0737s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(2.0737s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(2.0737s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(2.0737s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0001s x1.01]	(2.0738s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(2.0738s x1.00 from start)
      (enter) Finish prover round                	[             ]	(2.0738s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(2.0738s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0000s x1.01]	(2.0738s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.00]	(2.0738s x1.00 from start)
      (enter) pow                                	[             ]	(2.0738s x1.00 from start)
      (leave) pow                                	[0.0000s x1.02]	(2.0738s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(2.0739s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(2.0739s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0000s x1.01]	(2.0739s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(2.0739s x1.00 from start)
      * Vector size: 16
      * Coset size: 16
    (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.01]	(2.0739s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(2.0739s x1.00 from start)
      (enter) Finish prover round                	[             ]	(2.0739s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.01]	(2.0739s x1.00 from start)
      (enter) pow                                	[             ]	(2.0739s x1.00 from start)
      (leave) pow                                	[0.0062s x1.00]	(2.0802s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0063s x1.00]	(2.0802s x1.00 from start)
  (leave) LDT Reducer: Calculate and submit proof	[0.1363s x1.00]	(2.0807s x1.00 from start)
  (enter) Obtain transcript                  	[             ]	(2.0807s x1.00 from start)
  (leave) Obtain transcript                  	[0.0199s x1.00]	(2.1006s x1.00 from start)
  * Total size of proof oracles (bytes): 24116736
  * Total size of Merkle tree (bytes): 9786112
  * Total size of prover state (bytes): 33902848
(leave) Aurora SNARK prover                	[0.9934s x1.00]	(2.1006s x1.00 from start)

BCS parameters
* digest_len (bytes) = 32
* digest_len (bits) = 256
* hash_type = blake2b
(enter) verifier_seal_interaction_registrations	[             ]	(2.1097s x1.00 from start)
(leave) verifier_seal_interaction_registrations	[0.0010s x1.00]	(2.1107s x1.00 from start)

* Argument size in bytes (IOP): 30360
* Argument size in bytes (BCS): 51296
* Argument size in bytes (total): 81656

If we were to remove pruning of authentication paths in BCS,
the argument would have the following sizes:
* Argument size in bytes (BCS, no pruning): 100960
* Argument size in bytes (total, no pruning): 131320

total prover messages size: 46
total two to one hashes: 1818
total leaves hashed: 1318
total hashes: 3214

Transcript info by round
Per round IOP sizes don't include prover messages

round 0
MT_depth 16
IOP size: 10764 bytes
BCS size: 13536 bytes
number of two to one hashes: 421
number of leaves hashed: 468
number of zk hashes: 78
oracles in round: fw, fAz, fBz, fCz, sumcheck_mask, TODO: Fill in this name (batching.tcc), 

round 1
MT_depth 16
IOP size: 1794 bytes
BCS size: 12288 bytes
number of two to one hashes: 421
number of leaves hashed: 78
oracles in round: sumcheck h, 

round 2
MT_depth 14
IOP size: 3588 bytes
BCS size: 9632 bytes
number of two to one hashes: 338
number of leaves hashed: 156
oracles in round: TODO: Fill in this name (batching.tcc), 

round 3
MT_depth 12
IOP size: 3588 bytes
BCS size: 7264 bytes
number of two to one hashes: 264
number of leaves hashed: 156
oracles in round: TODO: Fill in this name (batching.tcc), 

round 4
MT_depth 10
IOP size: 3496 bytes
BCS size: 4832 bytes
number of two to one hashes: 187
number of leaves hashed: 152
oracles in round: TODO: Fill in this name (batching.tcc), 

round 5
MT_depth 8
IOP size: 3220 bytes
BCS size: 2720 bytes
number of two to one hashes: 118
number of leaves hashed: 140
oracles in round: TODO: Fill in this name (batching.tcc), 

round 6
MT_depth 6
IOP size: 2576 bytes
BCS size: 896 bytes
number of two to one hashes: 54
number of leaves hashed: 112
oracles in round: TODO: Fill in this name (batching.tcc), 

round 7
MT_depth 4
IOP size: 1288 bytes
BCS size: 96 bytes
number of two to one hashes: 15
number of leaves hashed: 56
oracles in round: TODO: Fill in this name (batching.tcc), 


(enter) Aurora SNARK verifier              	[             ]	(2.1119s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 117.0
  * RS extra dimensions = 3
  * codeword domain dim = 17
  * constraint domain dim = 12
  * variable domain dim = 12
  * query bound = 79
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 168.0
  * interactive repetitions = 1
  * constraint domain dim = 12
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 163.0
  * codeword domain dim = 17
  * max tested degree bound = 16384
  * max constraint degree bound = 8349
  * absolute proximity parameter = 114687
  * fractional proximity parameter = 0.874992
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 114
  * achieved query soundness error (bits) = 117.0
  * codeword domain dim = 17
  * effective proximity parameter = 0.874992
  * number of interactive repetitions = 1
  * number of query repetitions = 39
  * localization parameter array = { 1 2 2 2 2 2 2 }
  * number of reductions = 7

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Aurora IOP protocol initialization and registration	[             ](2.1121s x1.00 from start)
    (enter) verifier_seal_interaction_registrations	[             ]	(2.1127s x1.00 from start)
    (leave) verifier_seal_interaction_registrations	[0.0010s x1.00]	(2.1137s x1.00 from start)
  (leave) Aurora IOP protocol initialization and registration	[0.0017s x1.00](2.1138s x1.00 from start)
  (enter) Check semantic validity of IOP transcript	[             ]	(2.1138s x1.00 from start)
  (leave) Check semantic validity of IOP transcript	[0.0000s x1.04]	(2.1138s x1.00 from start)
  (enter) Construct R1CS verifier state      	[             ]	(2.1138s x1.00 from start)
    (enter) multi_lincheck compute alpha powers	[             ]	(2.1138s x1.00 from start)
    (leave) multi_lincheck compute alpha powers	[0.0001s x1.00]	(2.1139s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_prime	[             ]	(2.1139s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_prime	[0.0001s x1.00]	(2.1140s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_ABC 	[             ]	(2.1140s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_ABC 	[0.0011s x1.00]	(2.1151s x1.00 from start)
    (enter) multi_lincheck IFFT p_alphas       	[             ]	(2.1151s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(2.1151s x1.00 from start)
        * Vector size: 4096
        * Coset size: 4096
      (leave) Call to multiplicative_IFFT_wrapper	[0.0018s x1.00]	(2.1170s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(2.1170s x1.00 from start)
        * Vector size: 4096
        * Coset size: 4096
      (leave) Call to multiplicative_IFFT_wrapper	[0.0018s x1.00]	(2.1188s x1.00 from start)
    (leave) multi_lincheck IFFT p_alphas       	[0.0037s x1.00]	(2.1188s x1.00 from start)
  (leave) Construct R1CS verifier state      	[0.0050s x1.00]	(2.1188s x1.00 from start)
  (enter) Check LDT verifier predicate       	[             ]	(2.1188s x1.00 from start)
    * Number of FRI interactions: 1
    * Number of FRI query sets per interaction: 39
    * Total number of FRI queries over all query sets (incl. repeated queries): 1014
  (leave) Check LDT verifier predicate       	[0.0204s x1.00]	(2.1392s x1.00 from start)
  * IOP transcript valid: true
  * Full protocol decision predicate satisfied: true
(leave) Aurora SNARK verifier              	[0.0273s x1.00]	(2.1392s x1.00 from start)


* Verifier satisfied: true

================================================================================

(enter) Check satisfiability of R1CS example	[             ]	(2.2516s x1.00 from start)
(leave) Check satisfiability of R1CS example	[0.0009s x1.00]	(2.2524s x1.00 from start)

* R1CS number of constraints: 8192
* R1CS number of variables: 8191
* R1CS number of variables for primary input: 15
* R1CS number of variables for auxiliary input: 8176
* R1CS size of constraint system (bytes): 632832
* R1CS size of primary input (bytes): 360
* R1CS size of auxiliary input (bytes): 196224

(enter) Aurora SNARK prover                	[             ]	(2.2525s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 114.0
  * RS extra dimensions = 3
  * codeword domain dim = 18
  * constraint domain dim = 13
  * variable domain dim = 13
  * query bound = 77
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 167.0
  * interactive repetitions = 1
  * constraint domain dim = 13
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 162.0
  * codeword domain dim = 18
  * max tested degree bound = 32768
  * max constraint degree bound = 16537
  * absolute proximity parameter = 229375
  * fractional proximity parameter = 0.874996
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 113
  * achieved query soundness error (bits) = 114.0
  * codeword domain dim = 18
  * effective proximity parameter = 0.874996
  * number of interactive repetitions = 1
  * number of query repetitions = 38
  * localization parameter array = { 1 2 2 2 2 2 2 2 }
  * number of reductions = 8

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Submit witness oracles             	[             ]	(2.2538s x1.00 from start)
    (enter) Sumcheck: sample masking polynomial components	[             ](2.2538s x1.00 from start)
    (leave) Sumcheck: sample masking polynomial components	[0.2077s x1.00](2.4615s x1.00 from start)
    (enter) Sumcheck: compute masking polynomial codeword	[             ](2.4615s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(2.4620s x1.00 from start)
        * Vector size: 16460
        * Subgroup size: 262144
      (leave) Call to multiplicative_FFT_wrapper 	[0.0846s x1.00]	(2.5466s x1.00 from start)
    (leave) Sumcheck: compute masking polynomial codeword	[0.0851s x1.00](2.5466s x1.00 from start)
    (enter) Compute randomized f_w             	[             ]	(2.5466s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(2.5495s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.02]	(2.5496s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(2.5496s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 8192
      (leave) Call to multiplicative_FFT_wrapper 	[0.0008s x1.00]	(2.5504s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(2.5506s x1.00 from start)
        * Vector size: 8192
        * Coset size: 8192
      (leave) Call to multiplicative_IFFT_wrapper	[0.0039s x1.00]	(2.5545s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(2.5561s x1.00 from start)
        * Vector size: 8253
        * Subgroup size: 262144
      (leave) Call to multiplicative_FFT_wrapper 	[0.0740s x1.00]	(2.6300s x1.00 from start)
    (leave) Compute randomized f_w             	[0.0834s x1.00]	(2.6300s x1.00 from start)
    (enter) Compute A/B/Cz                     	[             ]	(2.6300s x1.00 from start)
    (leave) Compute A/B/Cz                     	[0.0007s x1.00]	(2.6308s x1.00 from start)
    (enter) Compute f_{A/B/Cz} over codeword domain	[             ]	(2.6308s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(2.6308s x1.00 from start)
        * Vector size: 8192
        * Coset size: 8192
      (leave) Call to multiplicative_IFFT_wrapper	[0.0039s x1.00]	(2.6347s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(2.6347s x1.00 from start)
        * Vector size: 8192
        * Coset size: 8192
      (leave) Call to multiplicative_IFFT_wrapper	[0.0039s x1.00]	(2.6386s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(2.6386s x1.00 from start)
        * Vector size: 8192
        * Coset size: 8192
      (leave) Call to multiplicative_IFFT_wrapper	[0.0039s x1.00]	(2.6425s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(2.6426s x1.00 from start)
        * Vector size: 8269
        * Subgroup size: 262144
      (leave) Call to multiplicative_FFT_wrapper 	[0.0759s x1.00]	(2.7186s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(2.7186s x1.00 from start)
        * Vector size: 8269
        * Subgroup size: 262144
      (leave) Call to multiplicative_FFT_wrapper 	[0.0761s x1.00]	(2.7947s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(2.7947s x1.00 from start)
        * Vector size: 8269
        * Subgroup size: 262144
      (leave) Call to multiplicative_FFT_wrapper 	[0.0759s x1.00]	(2.8706s x1.00 from start)
    (leave) Compute f_{A/B/Cz} over codeword domain	[0.2399s x1.00]	(2.8707s x1.00 from start)
    (enter) Call IOP oracle submission routines	[             ]	(2.8707s x1.00 from start)
    (leave) Call IOP oracle submission routines	[0.0000s x1.03]	(2.8707s x1.00 from start)
  (leave) Submit witness oracles             	[0.6169s x1.00]	(2.8707s x1.00 from start)
  (enter) LDT Reducer: Submit masking polynomial	[             ]	(2.8707s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(3.2842s x1.00 from start)
      * Vector size: 32768
      * Subgroup size: 262144
    (leave) Call to multiplicative_FFT_wrapper 	[0.0851s x1.00]	(3.3693s x1.00 from start)
  (leave) LDT Reducer: Submit masking polynomial	[0.4986s x1.00]	(3.3693s x1.00 from start)
  (enter) Finish prover round                	[             ]	(3.3693s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(3.3693s x1.00 from start)
      (enter) BCS: Sample randomness             	[             ]	(3.3693s x1.00 from start)
      (leave) BCS: Sample randomness             	[0.0252s x1.00]	(3.3945s x1.00 from start)
    (leave) Construct Merkle tree              	[0.1738s x1.00]	(3.5431s x1.00 from start)
  (leave) Finish prover round                	[0.1738s x1.00]	(3.5431s x1.00 from start)
  (enter) pow                                	[             ]	(3.5431s x1.00 from start)
  (leave) pow                                	[0.0000s x1.06]	(3.5431s x1.00 from start)
  (enter) multi_lincheck: Calculate and submit proof	[             ]	(3.5432s x1.00 from start)
    (enter) multi_lincheck compute alpha powers	[             ]	(3.5432s x1.00 from start)
    (leave) multi_lincheck compute alpha powers	[0.0002s x1.00]	(3.5434s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_prime	[             ]	(3.5434s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_prime	[0.0002s x1.00]	(3.5436s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_ABC 	[             ]	(3.5436s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_ABC 	[0.0023s x1.00]	(3.5460s x1.00 from start)
    (enter) multi_lincheck IFFT p_alphas       	[             ]	(3.5460s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(3.5461s x1.00 from start)
        * Vector size: 8192
        * Coset size: 8192
      (leave) Call to multiplicative_IFFT_wrapper	[0.0040s x1.00]	(3.5500s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(3.5504s x1.00 from start)
        * Vector size: 8192
        * Coset size: 8192
      (leave) Call to multiplicative_IFFT_wrapper	[0.0039s x1.00]	(3.5542s x1.00 from start)
    (leave) multi_lincheck IFFT p_alphas       	[0.0084s x1.00]	(3.5543s x1.00 from start)
    (enter) fz evaluated contents              	[             ]	(3.5544s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(3.5582s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x0.99]	(3.5582s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(3.5582s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 262144
      (leave) Call to multiplicative_FFT_wrapper 	[0.0236s x1.00]	(3.5818s x1.00 from start)
    (leave) fz evaluated contents              	[0.0385s x1.00]	(3.5928s x1.00 from start)
    (enter) multi_lincheck evaluated contents  	[             ]	(3.5936s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(3.5936s x1.00 from start)
        * Vector size: 8192
        * Subgroup size: 262144
      (leave) Call to multiplicative_FFT_wrapper 	[0.0724s x1.00]	(3.6660s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(3.6660s x1.00 from start)
        * Vector size: 8192
        * Subgroup size: 262144
      (leave) Call to multiplicative_FFT_wrapper 	[0.0723s x1.00]	(3.7383s x1.00 from start)
    (leave) multi_lincheck evaluated contents  	[0.1898s x1.00]	(3.7834s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(3.8016s x1.00 from start)
      * Vector size: 32768
      * Coset size: 32768
    (leave) Call to multiplicative_IFFT_wrapper	[0.0191s x1.00]	(3.8207s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(3.8216s x1.00 from start)
      * Vector size: 8268
      * Subgroup size: 262144
    (leave) Call to multiplicative_FFT_wrapper 	[0.0734s x1.00]	(3.8949s x1.00 from start)
  (leave) multi_lincheck: Calculate and submit proof	[0.3518s x1.00]	(3.8950s x1.00 from start)
  (enter) Finish prover round                	[             ]	(3.8950s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(3.8950s x1.00 from start)
    (leave) Construct Merkle tree              	[0.0763s x1.00]	(3.9713s x1.00 from start)
  (leave) Finish prover round                	[0.0764s x1.00]	(3.9713s x1.00 from start)
  (enter) pow                                	[             ]	(3.9713s x1.00 from start)
  (leave) pow                                	[0.0000s x1.01]	(3.9713s x1.00 from start)
  (enter) LDT Reducer: Calculate and submit proof	[             ]	(3.9714s x1.00 from start)
    (enter) Sumcheck: g evaluated contents     	[             ]	(3.9714s x1.00 from start)
    (leave) Sumcheck: g evaluated contents     	[0.0260s x1.00]	(3.9973s x1.00 from start)
    (enter) rowcheck evaluated contents        	[             ]	(3.9973s x1.00 from start)
    (leave) rowcheck evaluated contents        	[0.0157s x1.00]	(4.0131s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(4.1446s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0389s x1.00]	(4.1834s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(4.1836s x1.00 from start)
      (enter) Finish prover round                	[             ]	(4.1836s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(4.1836s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0183s x1.00]	(4.2020s x1.00 from start)
      (leave) Finish prover round                	[0.0184s x1.00]	(4.2020s x1.00 from start)
      (enter) pow                                	[             ]	(4.2020s x1.00 from start)
      (leave) pow                                	[0.0000s x1.05]	(4.2020s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0184s x1.00]	(4.2020s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(4.2020s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0153s x1.00]	(4.2173s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(4.2173s x1.00 from start)
      (enter) Finish prover round                	[             ]	(4.2173s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(4.2173s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0046s x1.00]	(4.2219s x1.00 from start)
      (leave) Finish prover round                	[0.0046s x1.00]	(4.2219s x1.00 from start)
      (enter) pow                                	[             ]	(4.2220s x1.00 from start)
      (leave) pow                                	[0.0000s x1.06]	(4.2220s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0047s x1.00]	(4.2220s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(4.2220s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0038s x1.00]	(4.2258s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(4.2258s x1.00 from start)
      (enter) Finish prover round                	[             ]	(4.2258s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(4.2258s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0012s x1.00]	(4.2270s x1.00 from start)
      (leave) Finish prover round                	[0.0012s x1.00]	(4.2270s x1.00 from start)
      (enter) pow                                	[             ]	(4.2270s x1.00 from start)
      (leave) pow                                	[0.0000s x1.06]	(4.2270s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0012s x1.00]	(4.2270s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(4.2270s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0010s x1.00]	(4.2280s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(4.2280s x1.00 from start)
      (enter) Finish prover round                	[             ]	(4.2280s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(4.2280s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0003s x1.00]	(4.2283s x1.00 from start)
      (leave) Finish prover round                	[0.0003s x1.00]	(4.2283s x1.00 from start)
      (enter) pow                                	[             ]	(4.2283s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(4.2283s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0003s x1.00]	(4.2283s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(4.2283s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0003s x1.00]	(4.2286s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(4.2286s x1.00 from start)
      (enter) Finish prover round                	[             ]	(4.2286s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(4.2286s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0001s x1.01]	(4.2287s x1.00 from start)
      (leave) Finish prover round                	[0.0001s x1.00]	(4.2287s x1.00 from start)
      (enter) pow                                	[             ]	(4.2287s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(4.2287s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(4.2288s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(4.2288s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0001s x1.00]	(4.2288s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(4.2288s x1.00 from start)
      (enter) Finish prover round                	[             ]	(4.2288s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(4.2289s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0000s x1.00]	(4.2289s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.00]	(4.2289s x1.00 from start)
      (enter) pow                                	[             ]	(4.2289s x1.00 from start)
      (leave) pow                                	[0.0000s x1.02]	(4.2289s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(4.2289s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(4.2289s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0000s x1.00]	(4.2290s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(4.2290s x1.00 from start)
      (enter) Finish prover round                	[             ]	(4.2290s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(4.2290s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0000s x1.00]	(4.2290s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.00]	(4.2290s x1.00 from start)
      (enter) pow                                	[             ]	(4.2290s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(4.2290s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(4.2290s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(4.2290s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0000s x1.01]	(4.2291s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(4.2291s x1.00 from start)
      * Vector size: 8
      * Coset size: 8
    (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.01]	(4.2291s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(4.2291s x1.00 from start)
      (enter) Finish prover round                	[             ]	(4.2291s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.01]	(4.2291s x1.00 from start)
      (enter) pow                                	[             ]	(4.2291s x1.00 from start)
      (leave) pow                                	[0.0178s x1.00]	(4.2470s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0179s x1.00]	(4.2470s x1.00 from start)
  (leave) LDT Reducer: Calculate and submit proof	[0.2766s x1.00]	(4.2479s x1.00 from start)
  (enter) Obtain transcript                  	[             ]	(4.2479s x1.00 from start)
  (leave) Obtain transcript                  	[0.0368s x1.00]	(4.2847s x1.00 from start)
  * Total size of proof oracles (bytes): 48234240
  * Total size of Merkle tree (bytes): 19572960
  * Total size of prover state (bytes): 67807200
(leave) Aurora SNARK prover                	[2.0323s x1.00]	(4.2848s x1.00 from start)

BCS parameters
* digest_len (bytes) = 32
* digest_len (bits) = 256
* hash_type = blake2b
(enter) verifier_seal_interaction_registrations	[             ]	(4.3023s x1.00 from start)
(leave) verifier_seal_interaction_registrations	[0.0011s x1.00]	(4.3034s x1.00 from start)

* Argument size in bytes (IOP): 32039
* Argument size in bytes (BCS): 58784
* Argument size in bytes (total): 90823

If we were to remove pruning of authentication paths in BCS,
the argument would have the following sizes:
* Argument size in bytes (BCS, no pruning): 111456
* Argument size in bytes (total, no pruning): 143495

total prover messages size: 23
total two to one hashes: 2071
total leaves hashed: 1392
total hashes: 3539

Transcript info by round
Per round IOP sizes don't include prover messages

round 0
MT_depth 17
IOP size: 10488 bytes
BCS size: 14656 bytes
number of two to one hashes: 456
number of leaves hashed: 456
number of zk hashes: 76
oracles in round: fw, fAz, fBz, fCz, sumcheck_mask, TODO: Fill in this name (batching.tcc), 

round 1
MT_depth 17
IOP size: 1748 bytes
BCS size: 13440 bytes
number of two to one hashes: 456
number of leaves hashed: 76
oracles in round: sumcheck h, 

round 2
MT_depth 15
IOP size: 3496 bytes
BCS size: 10784 bytes
number of two to one hashes: 373
number of leaves hashed: 152
oracles in round: TODO: Fill in this name (batching.tcc), 

round 3
MT_depth 13
IOP size: 3496 bytes
BCS size: 8160 bytes
number of two to one hashes: 291
number of leaves hashed: 152
oracles in round: TODO: Fill in this name (batching.tcc), 

round 4
MT_depth 11
IOP size: 3496 bytes
BCS size: 5856 bytes
number of two to one hashes: 219
number of leaves hashed: 152
oracles in round: TODO: Fill in this name (batching.tcc), 

round 5
MT_depth 9
IOP size: 3312 bytes
BCS size: 3872 bytes
number of two to one hashes: 155
number of leaves hashed: 144
oracles in round: TODO: Fill in this name (batching.tcc), 

round 6
MT_depth 7
IOP size: 3036 bytes
BCS size: 1664 bytes
number of two to one hashes: 83
number of leaves hashed: 132
oracles in round: TODO: Fill in this name (batching.tcc), 

round 7
MT_depth 5
IOP size: 2208 bytes
BCS size: 288 bytes
number of two to one hashes: 31
number of leaves hashed: 96
oracles in round: TODO: Fill in this name (batching.tcc), 

round 8
MT_depth 3
IOP size: 736 bytes
BCS size: 32 bytes
number of two to one hashes: 7
number of leaves hashed: 32
oracles in round: TODO: Fill in this name (batching.tcc), 


(enter) Aurora SNARK verifier              	[             ]	(4.3050s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 114.0
  * RS extra dimensions = 3
  * codeword domain dim = 18
  * constraint domain dim = 13
  * variable domain dim = 13
  * query bound = 77
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 167.0
  * interactive repetitions = 1
  * constraint domain dim = 13
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 162.0
  * codeword domain dim = 18
  * max tested degree bound = 32768
  * max constraint degree bound = 16537
  * absolute proximity parameter = 229375
  * fractional proximity parameter = 0.874996
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 113
  * achieved query soundness error (bits) = 114.0
  * codeword domain dim = 18
  * effective proximity parameter = 0.874996
  * number of interactive repetitions = 1
  * number of query repetitions = 38
  * localization parameter array = { 1 2 2 2 2 2 2 2 }
  * number of reductions = 8

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Aurora IOP protocol initialization and registration	[             ](4.3053s x1.00 from start)
    (enter) verifier_seal_interaction_registrations	[             ]	(4.3062s x1.00 from start)
    (leave) verifier_seal_interaction_registrations	[0.0011s x1.00]	(4.3073s x1.00 from start)
  (leave) Aurora IOP protocol initialization and registration	[0.0022s x1.00](4.3075s x1.00 from start)
  (enter) Check semantic validity of IOP transcript	[             ]	(4.3075s x1.00 from start)
  (leave) Check semantic validity of IOP transcript	[0.0000s x1.11]	(4.3075s x1.00 from start)
  (enter) Construct R1CS verifier state      	[             ]	(4.3075s x1.00 from start)
    (enter) multi_lincheck compute alpha powers	[             ]	(4.3075s x1.00 from start)
    (leave) multi_lincheck compute alpha powers	[0.0002s x1.00]	(4.3077s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_prime	[             ]	(4.3077s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_prime	[0.0001s x1.00]	(4.3078s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_ABC 	[             ]	(4.3078s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_ABC 	[0.0022s x1.00]	(4.3100s x1.00 from start)
    (enter) multi_lincheck IFFT p_alphas       	[             ]	(4.3101s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(4.3101s x1.00 from start)
        * Vector size: 8192
        * Coset size: 8192
      (leave) Call to multiplicative_IFFT_wrapper	[0.0039s x1.00]	(4.3140s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(4.3140s x1.00 from start)
        * Vector size: 8192
        * Coset size: 8192
      (leave) Call to multiplicative_IFFT_wrapper	[0.0039s x1.00]	(4.3179s x1.00 from start)
    (leave) multi_lincheck IFFT p_alphas       	[0.0078s x1.00]	(4.3179s x1.00 from start)
  (leave) Construct R1CS verifier state      	[0.0104s x1.00]	(4.3179s x1.00 from start)
  (enter) Check LDT verifier predicate       	[             ]	(4.3179s x1.00 from start)
    * Number of FRI interactions: 1
    * Number of FRI query sets per interaction: 38
    * Total number of FRI queries over all query sets (incl. repeated queries): 1140
  (leave) Check LDT verifier predicate       	[0.0372s x1.00]	(4.3551s x1.00 from start)
  * IOP transcript valid: true
  * Full protocol decision predicate satisfied: true
(leave) Aurora SNARK verifier              	[0.0501s x1.00]	(4.3551s x1.00 from start)


* Verifier satisfied: true

================================================================================

(enter) Check satisfiability of R1CS example	[             ]	(4.5822s x1.00 from start)
(leave) Check satisfiability of R1CS example	[0.0017s x1.00]	(4.5839s x1.00 from start)

* R1CS number of constraints: 16384
* R1CS number of variables: 16383
* R1CS number of variables for primary input: 15
* R1CS number of variables for auxiliary input: 16368
* R1CS size of constraint system (bytes): 1271808
* R1CS size of primary input (bytes): 360
* R1CS size of auxiliary input (bytes): 392832

(enter) Aurora SNARK prover                	[             ]	(4.5840s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 114.0
  * RS extra dimensions = 3
  * codeword domain dim = 19
  * constraint domain dim = 14
  * variable domain dim = 14
  * query bound = 77
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 166.0
  * interactive repetitions = 1
  * constraint domain dim = 14
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 161.0
  * codeword domain dim = 19
  * max tested degree bound = 65536
  * max constraint degree bound = 32921
  * absolute proximity parameter = 458751
  * fractional proximity parameter = 0.874998
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 112
  * achieved query soundness error (bits) = 114.0
  * codeword domain dim = 19
  * effective proximity parameter = 0.874998
  * number of interactive repetitions = 1
  * number of query repetitions = 38
  * localization parameter array = { 1 2 2 2 2 2 2 2 }
  * number of reductions = 8

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Submit witness oracles             	[             ]	(4.5859s x1.00 from start)
    (enter) Sumcheck: sample masking polynomial components	[             ](4.5859s x1.00 from start)
    (leave) Sumcheck: sample masking polynomial components	[0.4120s x1.00](4.9979s x1.00 from start)
    (enter) Sumcheck: compute masking polynomial codeword	[             ](4.9979s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(4.9989s x1.00 from start)
        * Vector size: 32844
        * Subgroup size: 524288
      (leave) Call to multiplicative_FFT_wrapper 	[0.1808s x1.00]	(5.1797s x1.00 from start)
    (leave) Sumcheck: compute masking polynomial codeword	[0.1817s x1.00](5.1797s x1.00 from start)
    (enter) Compute randomized f_w             	[             ]	(5.1797s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(5.1827s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.03]	(5.1828s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(5.1828s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 16384
      (leave) Call to multiplicative_FFT_wrapper 	[0.0017s x1.00]	(5.1845s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(5.1848s x1.00 from start)
        * Vector size: 16384
        * Coset size: 16384
      (leave) Call to multiplicative_IFFT_wrapper	[0.0083s x1.00]	(5.1931s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(5.1952s x1.00 from start)
        * Vector size: 16445
        * Subgroup size: 524288
      (leave) Call to multiplicative_FFT_wrapper 	[0.1596s x1.00]	(5.3548s x1.00 from start)
    (leave) Compute randomized f_w             	[0.1751s x1.00]	(5.3548s x1.00 from start)
    (enter) Compute A/B/Cz                     	[             ]	(5.3548s x1.00 from start)
    (leave) Compute A/B/Cz                     	[0.0015s x1.00]	(5.3563s x1.00 from start)
    (enter) Compute f_{A/B/Cz} over codeword domain	[             ]	(5.3563s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(5.3563s x1.00 from start)
        * Vector size: 16384
        * Coset size: 16384
      (leave) Call to multiplicative_IFFT_wrapper	[0.0083s x1.00]	(5.3647s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(5.3647s x1.00 from start)
        * Vector size: 16384
        * Coset size: 16384
      (leave) Call to multiplicative_IFFT_wrapper	[0.0083s x1.00]	(5.3730s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(5.3731s x1.00 from start)
        * Vector size: 16384
        * Coset size: 16384
      (leave) Call to multiplicative_IFFT_wrapper	[0.0083s x1.00]	(5.3814s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(5.3816s x1.00 from start)
        * Vector size: 16461
        * Subgroup size: 524288
      (leave) Call to multiplicative_FFT_wrapper 	[0.1630s x1.00]	(5.5447s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(5.5447s x1.00 from start)
        * Vector size: 16461
        * Subgroup size: 524288
      (leave) Call to multiplicative_FFT_wrapper 	[0.1630s x1.00]	(5.7078s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(5.7078s x1.00 from start)
        * Vector size: 16461
        * Subgroup size: 524288
      (leave) Call to multiplicative_FFT_wrapper 	[0.1629s x1.00]	(5.8707s x1.00 from start)
    (leave) Compute f_{A/B/Cz} over codeword domain	[0.5144s x1.00]	(5.8708s x1.00 from start)
    (enter) Call IOP oracle submission routines	[             ]	(5.8708s x1.00 from start)
    (leave) Call IOP oracle submission routines	[0.0000s x1.03]	(5.8708s x1.00 from start)
  (leave) Submit witness oracles             	[1.2849s x1.00]	(5.8708s x1.00 from start)
  (enter) LDT Reducer: Submit masking polynomial	[             ]	(5.8708s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(6.6942s x1.00 from start)
      * Vector size: 65536
      * Subgroup size: 524288
    (leave) Call to multiplicative_FFT_wrapper 	[0.1819s x1.00]	(6.8761s x1.00 from start)
  (leave) LDT Reducer: Submit masking polynomial	[1.0053s x1.00]	(6.8761s x1.00 from start)
  (enter) Finish prover round                	[             ]	(6.8761s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(6.8761s x1.00 from start)
      (enter) BCS: Sample randomness             	[             ]	(6.8761s x1.00 from start)
      (leave) BCS: Sample randomness             	[0.0503s x1.00]	(6.9264s x1.00 from start)
    (leave) Construct Merkle tree              	[0.3469s x1.00]	(7.2230s x1.00 from start)
  (leave) Finish prover round                	[0.3470s x1.00]	(7.2231s x1.00 from start)
  (enter) pow                                	[             ]	(7.2231s x1.00 from start)
  (leave) pow                                	[0.0000s x1.04]	(7.2231s x1.00 from start)
  (enter) multi_lincheck: Calculate and submit proof	[             ]	(7.2231s x1.00 from start)
    (enter) multi_lincheck compute alpha powers	[             ]	(7.2231s x1.00 from start)
    (leave) multi_lincheck compute alpha powers	[0.0005s x1.00]	(7.2236s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_prime	[             ]	(7.2236s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_prime	[0.0004s x1.00]	(7.2240s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_ABC 	[             ]	(7.2240s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_ABC 	[0.0047s x1.00]	(7.2287s x1.00 from start)
    (enter) multi_lincheck IFFT p_alphas       	[             ]	(7.2287s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(7.2289s x1.00 from start)
        * Vector size: 16384
        * Coset size: 16384
      (leave) Call to multiplicative_IFFT_wrapper	[0.0085s x1.00]	(7.2374s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(7.2376s x1.00 from start)
        * Vector size: 16384
        * Coset size: 16384
      (leave) Call to multiplicative_IFFT_wrapper	[0.0083s x1.00]	(7.2459s x1.00 from start)
    (leave) multi_lincheck IFFT p_alphas       	[0.0174s x1.00]	(7.2461s x1.00 from start)
    (enter) fz evaluated contents              	[             ]	(7.2461s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(7.2535s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x0.99]	(7.2535s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(7.2536s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 524288
      (leave) Call to multiplicative_FFT_wrapper 	[0.0472s x1.00]	(7.3008s x1.00 from start)
    (leave) fz evaluated contents              	[0.0765s x1.00]	(7.3226s x1.00 from start)
    (enter) multi_lincheck evaluated contents  	[             ]	(7.3241s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(7.3241s x1.00 from start)
        * Vector size: 16384
        * Subgroup size: 524288
      (leave) Call to multiplicative_FFT_wrapper 	[0.1560s x1.00]	(7.4801s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(7.4802s x1.00 from start)
        * Vector size: 16384
        * Subgroup size: 524288
      (leave) Call to multiplicative_FFT_wrapper 	[0.1565s x1.00]	(7.6367s x1.00 from start)
    (leave) multi_lincheck evaluated contents  	[0.4028s x1.00]	(7.7269s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(7.7636s x1.00 from start)
      * Vector size: 65536
      * Coset size: 65536
    (leave) Call to multiplicative_IFFT_wrapper	[0.0406s x1.00]	(7.8042s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(7.8059s x1.00 from start)
      * Vector size: 16460
      * Subgroup size: 524288
    (leave) Call to multiplicative_FFT_wrapper 	[0.1580s x1.00]	(7.9639s x1.00 from start)
  (leave) multi_lincheck: Calculate and submit proof	[0.7408s x1.00]	(7.9639s x1.00 from start)
  (enter) Finish prover round                	[             ]	(7.9639s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(7.9639s x1.00 from start)
    (leave) Construct Merkle tree              	[0.1524s x1.00]	(8.1163s x1.00 from start)
  (leave) Finish prover round                	[0.1525s x1.00]	(8.1164s x1.00 from start)
  (enter) pow                                	[             ]	(8.1164s x1.00 from start)
  (leave) pow                                	[0.0000s x0.96]	(8.1164s x1.00 from start)
  (enter) LDT Reducer: Calculate and submit proof	[             ]	(8.1164s x1.00 from start)
    (enter) Sumcheck: g evaluated contents     	[             ]	(8.1164s x1.00 from start)
    (leave) Sumcheck: g evaluated contents     	[0.0514s x1.00]	(8.1678s x1.00 from start)
    (enter) rowcheck evaluated contents        	[             ]	(8.1678s x1.00 from start)
    (leave) rowcheck evaluated contents        	[0.0314s x1.00]	(8.1992s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(8.4619s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0773s x1.00]	(8.5392s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(8.5397s x1.00 from start)
      (enter) Finish prover round                	[             ]	(8.5397s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(8.5397s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0368s x1.00]	(8.5765s x1.00 from start)
      (leave) Finish prover round                	[0.0368s x1.00]	(8.5765s x1.00 from start)
      (enter) pow                                	[             ]	(8.5765s x1.00 from start)
      (leave) pow                                	[0.0000s x0.90]	(8.5765s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0369s x1.00]	(8.5765s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(8.5765s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0305s x1.00]	(8.6070s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(8.6071s x1.00 from start)
      (enter) Finish prover round                	[             ]	(8.6071s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(8.6072s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0092s x1.00]	(8.6164s x1.00 from start)
      (leave) Finish prover round                	[0.0092s x1.00]	(8.6164s x1.00 from start)
      (enter) pow                                	[             ]	(8.6164s x1.00 from start)
      (leave) pow                                	[0.0000s x1.04]	(8.6164s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0093s x1.00]	(8.6164s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(8.6164s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0076s x1.00]	(8.6240s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(8.6241s x1.00 from start)
      (enter) Finish prover round                	[             ]	(8.6241s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(8.6241s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0023s x1.00]	(8.6264s x1.00 from start)
      (leave) Finish prover round                	[0.0023s x1.00]	(8.6264s x1.00 from start)
      (enter) pow                                	[             ]	(8.6264s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(8.6264s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0024s x1.00]	(8.6264s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(8.6264s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0019s x1.00]	(8.6284s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(8.6284s x1.00 from start)
      (enter) Finish prover round                	[             ]	(8.6284s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(8.6284s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0006s x1.00]	(8.6290s x1.00 from start)
      (leave) Finish prover round                	[0.0006s x1.00]	(8.6290s x1.00 from start)
      (enter) pow                                	[             ]	(8.6290s x1.00 from start)
      (leave) pow                                	[0.0000s x1.02]	(8.6290s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0006s x1.00]	(8.6290s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(8.6290s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0005s x1.00]	(8.6295s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(8.6295s x1.00 from start)
      (enter) Finish prover round                	[             ]	(8.6295s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(8.6295s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0002s x1.00]	(8.6297s x1.00 from start)
      (leave) Finish prover round                	[0.0002s x1.00]	(8.6297s x1.00 from start)
      (enter) pow                                	[             ]	(8.6297s x1.00 from start)
      (leave) pow                                	[0.0000s x1.02]	(8.6297s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0002s x1.00]	(8.6297s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(8.6297s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0001s x1.01]	(8.6299s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(8.6299s x1.00 from start)
      (enter) Finish prover round                	[             ]	(8.6299s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(8.6299s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0000s x1.00]	(8.6299s x1.00 from start)
      (leave) Finish prover round                	[0.0001s x1.00]	(8.6299s x1.00 from start)
      (enter) pow                                	[             ]	(8.6300s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(8.6300s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(8.6300s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(8.6300s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0000s x1.00]	(8.6300s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(8.6300s x1.00 from start)
      (enter) Finish prover round                	[             ]	(8.6300s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(8.6300s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0000s x1.00]	(8.6301s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.00]	(8.6301s x1.00 from start)
      (enter) pow                                	[             ]	(8.6301s x1.00 from start)
      (leave) pow                                	[0.0000s x1.02]	(8.6301s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(8.6301s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(8.6301s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0000s x1.00]	(8.6301s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(8.6301s x1.00 from start)
      * Vector size: 16
      * Coset size: 16
    (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.02]	(8.6301s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(8.6301s x1.00 from start)
      (enter) Finish prover round                	[             ]	(8.6301s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.01]	(8.6302s x1.00 from start)
      (enter) pow                                	[             ]	(8.6302s x1.00 from start)
      (leave) pow                                	[0.0178s x1.00]	(8.6480s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0178s x1.00]	(8.6480s x1.00 from start)
  (leave) LDT Reducer: Calculate and submit proof	[0.5334s x1.00]	(8.6498s x1.00 from start)
  (enter) Obtain transcript                  	[             ]	(8.6498s x1.00 from start)
  (leave) Obtain transcript                  	[0.0710s x1.00]	(8.7208s x1.00 from start)
  * Total size of proof oracles (bytes): 96468480
  * Total size of Merkle tree (bytes): 39146208
  * Total size of prover state (bytes): 135614688
(leave) Aurora SNARK prover                	[4.1369s x1.00]	(8.7208s x1.00 from start)

BCS parameters
* digest_len (bytes) = 32
* digest_len (bits) = 256
* hash_type = blake2b
(enter) verifier_seal_interaction_registrations	[             ]	(8.7547s x1.00 from start)
(leave) verifier_seal_interaction_registrations	[0.0012s x1.00]	(8.7559s x1.00 from start)

* Argument size in bytes (IOP): 33902
* Argument size in bytes (BCS): 67808
* Argument size in bytes (total): 101710

If we were to remove pruning of authentication paths in BCS,
the argument would have the following sizes:
* Argument size in bytes (BCS, no pruning): 124480
* Argument size in bytes (total, no pruning): 158382

total prover messages size: 46
total two to one hashes: 2373
total leaves hashed: 1472
total hashes: 3921

Transcript info by round
Per round IOP sizes don't include prover messages

round 0
MT_depth 18
IOP size: 10488 bytes
BCS size: 15616 bytes
number of two to one hashes: 486
number of leaves hashed: 456
number of zk hashes: 76
oracles in round: fw, fAz, fBz, fCz, sumcheck_mask, TODO: Fill in this name (batching.tcc), 

round 1
MT_depth 18
IOP size: 1748 bytes
BCS size: 14400 bytes
number of two to one hashes: 486
number of leaves hashed: 76
oracles in round: sumcheck h, 

round 2
MT_depth 16
IOP size: 3496 bytes
BCS size: 12448 bytes
number of two to one hashes: 425
number of leaves hashed: 152
oracles in round: TODO: Fill in this name (batching.tcc), 

round 3
MT_depth 14
IOP size: 3496 bytes
BCS size: 9856 bytes
number of two to one hashes: 344
number of leaves hashed: 152
oracles in round: TODO: Fill in this name (batching.tcc), 

round 4
MT_depth 12
IOP size: 3496 bytes
BCS size: 6912 bytes
number of two to one hashes: 252
number of leaves hashed: 152
oracles in round: TODO: Fill in this name (batching.tcc), 

round 5
MT_depth 10
IOP size: 3496 bytes
BCS size: 4896 bytes
number of two to one hashes: 189
number of leaves hashed: 152
oracles in round: TODO: Fill in this name (batching.tcc), 

round 6
MT_depth 8
IOP size: 3220 bytes
BCS size: 2752 bytes
number of two to one hashes: 119
number of leaves hashed: 140
oracles in round: TODO: Fill in this name (batching.tcc), 

round 7
MT_depth 6
IOP size: 2944 bytes
BCS size: 864 bytes
number of two to one hashes: 57
number of leaves hashed: 128
oracles in round: TODO: Fill in this name (batching.tcc), 

round 8
MT_depth 4
IOP size: 1472 bytes
BCS size: 32 bytes
number of two to one hashes: 15
number of leaves hashed: 64
oracles in round: TODO: Fill in this name (batching.tcc), 


(enter) Aurora SNARK verifier              	[             ]	(8.7584s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 114.0
  * RS extra dimensions = 3
  * codeword domain dim = 19
  * constraint domain dim = 14
  * variable domain dim = 14
  * query bound = 77
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 166.0
  * interactive repetitions = 1
  * constraint domain dim = 14
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 161.0
  * codeword domain dim = 19
  * max tested degree bound = 65536
  * max constraint degree bound = 32921
  * absolute proximity parameter = 458751
  * fractional proximity parameter = 0.874998
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 112
  * achieved query soundness error (bits) = 114.0
  * codeword domain dim = 19
  * effective proximity parameter = 0.874998
  * number of interactive repetitions = 1
  * number of query repetitions = 38
  * localization parameter array = { 1 2 2 2 2 2 2 2 }
  * number of reductions = 8

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Aurora IOP protocol initialization and registration	[             ](8.7587s x1.00 from start)
    (enter) verifier_seal_interaction_registrations	[             ]	(8.7602s x1.00 from start)
    (leave) verifier_seal_interaction_registrations	[0.0012s x1.00]	(8.7615s x1.00 from start)
  (leave) Aurora IOP protocol initialization and registration	[0.0030s x1.00](8.7616s x1.00 from start)
  (enter) Check semantic validity of IOP transcript	[             ]	(8.7616s x1.00 from start)
  (leave) Check semantic validity of IOP transcript	[0.0000s x1.04]	(8.7617s x1.00 from start)
  (enter) Construct R1CS verifier state      	[             ]	(8.7617s x1.00 from start)
    (enter) multi_lincheck compute alpha powers	[             ]	(8.7617s x1.00 from start)
    (leave) multi_lincheck compute alpha powers	[0.0003s x1.00]	(8.7620s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_prime	[             ]	(8.7620s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_prime	[0.0003s x1.00]	(8.7623s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_ABC 	[             ]	(8.7623s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_ABC 	[0.0046s x1.00]	(8.7668s x1.00 from start)
    (enter) multi_lincheck IFFT p_alphas       	[             ]	(8.7668s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(8.7669s x1.00 from start)
        * Vector size: 16384
        * Coset size: 16384
      (leave) Call to multiplicative_IFFT_wrapper	[0.0083s x1.00]	(8.7752s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(8.7752s x1.00 from start)
        * Vector size: 16384
        * Coset size: 16384
      (leave) Call to multiplicative_IFFT_wrapper	[0.0083s x1.00]	(8.7835s x1.00 from start)
    (leave) multi_lincheck IFFT p_alphas       	[0.0167s x1.00]	(8.7836s x1.00 from start)
  (leave) Construct R1CS verifier state      	[0.0219s x1.00]	(8.7836s x1.00 from start)
  (enter) Check LDT verifier predicate       	[             ]	(8.7836s x1.00 from start)
    * Number of FRI interactions: 1
    * Number of FRI query sets per interaction: 38
    * Total number of FRI queries over all query sets (incl. repeated queries): 1140
  (leave) Check LDT verifier predicate       	[0.0712s x1.00]	(8.8547s x1.00 from start)
  * IOP transcript valid: true
  * Full protocol decision predicate satisfied: true
(leave) Aurora SNARK verifier              	[0.0963s x1.00]	(8.8548s x1.00 from start)


* Verifier satisfied: true

================================================================================

(enter) Check satisfiability of R1CS example	[             ]	(9.3054s x1.00 from start)
(leave) Check satisfiability of R1CS example	[0.0034s x1.00]	(9.3088s x1.00 from start)

* R1CS number of constraints: 32768
* R1CS number of variables: 32767
* R1CS number of variables for primary input: 15
* R1CS number of variables for auxiliary input: 32752
* R1CS size of constraint system (bytes): 2555904
* R1CS size of primary input (bytes): 360
* R1CS size of auxiliary input (bytes): 786048

(enter) Aurora SNARK prover                	[             ]	(9.3089s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 114.0
  * RS extra dimensions = 3
  * codeword domain dim = 20
  * constraint domain dim = 15
  * variable domain dim = 15
  * query bound = 77
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 165.0
  * interactive repetitions = 1
  * constraint domain dim = 15
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 160.0
  * codeword domain dim = 20
  * max tested degree bound = 131072
  * max constraint degree bound = 65689
  * absolute proximity parameter = 917503
  * fractional proximity parameter = 0.874999
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 111
  * achieved query soundness error (bits) = 114.0
  * codeword domain dim = 20
  * effective proximity parameter = 0.874999
  * number of interactive repetitions = 1
  * number of query repetitions = 38
  * localization parameter array = { 1 2 2 2 2 2 2 2 2 }
  * number of reductions = 9

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Submit witness oracles             	[             ]	(9.3121s x1.00 from start)
    (enter) Sumcheck: sample masking polynomial components	[             ](9.3121s x1.00 from start)
    (leave) Sumcheck: sample masking polynomial components	[0.8241s x1.00](10.1362s x1.00 from start)
    (enter) Sumcheck: compute masking polynomial codeword	[             ](10.1363s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(10.1382s x1.00 from start)
        * Vector size: 65612
        * Subgroup size: 1048576
      (leave) Call to multiplicative_FFT_wrapper 	[0.3865s x1.00]	(10.5247s x1.00 from start)
    (leave) Sumcheck: compute masking polynomial codeword	[0.3885s x1.00](10.5247s x1.00 from start)
    (enter) Compute randomized f_w             	[             ]	(10.5247s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(10.5279s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.04]	(10.5279s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(10.5279s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 32768
      (leave) Call to multiplicative_FFT_wrapper 	[0.0034s x1.00]	(10.5313s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(10.5320s x1.00 from start)
        * Vector size: 32768
        * Coset size: 32768
      (leave) Call to multiplicative_IFFT_wrapper	[0.0179s x1.00]	(10.5499s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(10.5530s x1.00 from start)
        * Vector size: 32829
        * Subgroup size: 1048576
      (leave) Call to multiplicative_FFT_wrapper 	[0.3427s x1.00]	(10.8957s x1.00 from start)
    (leave) Compute randomized f_w             	[0.3710s x1.00]	(10.8957s x1.00 from start)
    (enter) Compute A/B/Cz                     	[             ]	(10.8957s x1.00 from start)
    (leave) Compute A/B/Cz                     	[0.0030s x1.00]	(10.8987s x1.00 from start)
    (enter) Compute f_{A/B/Cz} over codeword domain	[             ]	(10.8988s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(10.8988s x1.00 from start)
        * Vector size: 32768
        * Coset size: 32768
      (leave) Call to multiplicative_IFFT_wrapper	[0.0178s x1.00]	(10.9166s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(10.9167s x1.00 from start)
        * Vector size: 32768
        * Coset size: 32768
      (leave) Call to multiplicative_IFFT_wrapper	[0.0178s x1.00]	(10.9345s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(10.9346s x1.00 from start)
        * Vector size: 32768
        * Coset size: 32768
      (leave) Call to multiplicative_IFFT_wrapper	[0.0178s x1.00]	(10.9524s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(10.9529s x1.00 from start)
        * Vector size: 32845
        * Subgroup size: 1048576
      (leave) Call to multiplicative_FFT_wrapper 	[0.3493s x1.00]	(11.3022s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(11.3023s x1.00 from start)
        * Vector size: 32845
        * Subgroup size: 1048576
      (leave) Call to multiplicative_FFT_wrapper 	[0.3493s x1.00]	(11.6516s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(11.6517s x1.00 from start)
        * Vector size: 32845
        * Subgroup size: 1048576
      (leave) Call to multiplicative_FFT_wrapper 	[0.3488s x1.00]	(12.0004s x1.00 from start)
    (leave) Compute f_{A/B/Cz} over codeword domain	[1.1017s x1.00]	(12.0005s x1.00 from start)
    (enter) Call IOP oracle submission routines	[             ]	(12.0005s x1.00 from start)
    (leave) Call IOP oracle submission routines	[0.0000s x1.03]	(12.0005s x1.00 from start)
  (leave) Submit witness oracles             	[2.6884s x1.00]	(12.0005s x1.00 from start)
  (enter) LDT Reducer: Submit masking polynomial	[             ]	(12.0005s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(13.6514s x1.00 from start)
      * Vector size: 131072
      * Subgroup size: 1048576
    (leave) Call to multiplicative_FFT_wrapper 	[0.3909s x1.00]	(14.0423s x1.00 from start)
  (leave) LDT Reducer: Submit masking polynomial	[2.0418s x1.00]	(14.0424s x1.00 from start)
  (enter) Finish prover round                	[             ]	(14.0424s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(14.0424s x1.00 from start)
      (enter) BCS: Sample randomness             	[             ]	(14.0424s x1.00 from start)
      (leave) BCS: Sample randomness             	[0.1007s x1.00]	(14.1431s x1.00 from start)
    (leave) Construct Merkle tree              	[0.6931s x1.00]	(14.7355s x1.00 from start)
  (leave) Finish prover round                	[0.6931s x1.00]	(14.7355s x1.00 from start)
  (enter) pow                                	[             ]	(14.7355s x1.00 from start)
  (leave) pow                                	[0.0000s x1.01]	(14.7355s x1.00 from start)
  (enter) multi_lincheck: Calculate and submit proof	[             ]	(14.7355s x1.00 from start)
    (enter) multi_lincheck compute alpha powers	[             ]	(14.7355s x1.00 from start)
    (leave) multi_lincheck compute alpha powers	[0.0010s x1.00]	(14.7365s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_prime	[             ]	(14.7365s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_prime	[0.0008s x1.00]	(14.7373s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_ABC 	[             ]	(14.7373s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_ABC 	[0.0094s x1.00]	(14.7467s x1.00 from start)
    (enter) multi_lincheck IFFT p_alphas       	[             ]	(14.7468s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(14.7472s x1.00 from start)
        * Vector size: 32768
        * Coset size: 32768
      (leave) Call to multiplicative_IFFT_wrapper	[0.0181s x1.00]	(14.7653s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(14.7657s x1.00 from start)
        * Vector size: 32768
        * Coset size: 32768
      (leave) Call to multiplicative_IFFT_wrapper	[0.0178s x1.00]	(14.7835s x1.00 from start)
    (leave) multi_lincheck IFFT p_alphas       	[0.0371s x1.00]	(14.7838s x1.00 from start)
    (enter) fz evaluated contents              	[             ]	(14.7838s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(14.7986s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.01]	(14.7987s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(14.7987s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 1048576
      (leave) Call to multiplicative_FFT_wrapper 	[0.0947s x1.00]	(14.8934s x1.00 from start)
    (leave) fz evaluated contents              	[0.1538s x1.00]	(14.9376s x1.00 from start)
    (enter) multi_lincheck evaluated contents  	[             ]	(14.9405s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(14.9406s x1.00 from start)
        * Vector size: 32768
        * Subgroup size: 1048576
      (leave) Call to multiplicative_FFT_wrapper 	[0.3363s x1.00]	(15.2769s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(15.2770s x1.00 from start)
        * Vector size: 32768
        * Subgroup size: 1048576
      (leave) Call to multiplicative_FFT_wrapper 	[0.3375s x1.00]	(15.6145s x1.00 from start)
    (leave) multi_lincheck evaluated contents  	[0.8529s x1.00]	(15.7934s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(15.8672s x1.00 from start)
      * Vector size: 131072
      * Coset size: 131072
    (leave) Call to multiplicative_IFFT_wrapper	[0.0856s x1.00]	(15.9528s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(15.9561s x1.00 from start)
      * Vector size: 32844
      * Subgroup size: 1048576
    (leave) Call to multiplicative_FFT_wrapper 	[0.3405s x1.00]	(16.2966s x1.00 from start)
  (leave) multi_lincheck: Calculate and submit proof	[1.5612s x1.00]	(16.2967s x1.00 from start)
  (enter) Finish prover round                	[             ]	(16.2967s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(16.2967s x1.00 from start)
    (leave) Construct Merkle tree              	[0.3047s x1.00]	(16.6014s x1.00 from start)
  (leave) Finish prover round                	[0.3048s x1.00]	(16.6015s x1.00 from start)
  (enter) pow                                	[             ]	(16.6015s x1.00 from start)
  (leave) pow                                	[0.0000s x1.02]	(16.6015s x1.00 from start)
  (enter) LDT Reducer: Calculate and submit proof	[             ]	(16.6015s x1.00 from start)
    (enter) Sumcheck: g evaluated contents     	[             ]	(16.6015s x1.00 from start)
    (leave) Sumcheck: g evaluated contents     	[0.1026s x1.00]	(16.7041s x1.00 from start)
    (enter) rowcheck evaluated contents        	[             ]	(16.7042s x1.00 from start)
    (leave) rowcheck evaluated contents        	[0.0628s x1.00]	(16.7669s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(17.2920s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.1547s x1.00]	(17.4468s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(17.4478s x1.00 from start)
      (enter) Finish prover round                	[             ]	(17.4479s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(17.4479s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0737s x1.00]	(17.5216s x1.00 from start)
      (leave) Finish prover round                	[0.0737s x1.00]	(17.5216s x1.00 from start)
      (enter) pow                                	[             ]	(17.5216s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(17.5216s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0738s x1.00]	(17.5216s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(17.5216s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0611s x1.00]	(17.5827s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(17.5829s x1.00 from start)
      (enter) Finish prover round                	[             ]	(17.5829s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(17.5829s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0185s x1.00]	(17.6014s x1.00 from start)
      (leave) Finish prover round                	[0.0185s x1.00]	(17.6014s x1.00 from start)
      (enter) pow                                	[             ]	(17.6014s x1.00 from start)
      (leave) pow                                	[0.0000s x1.01]	(17.6014s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0185s x1.00]	(17.6014s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(17.6014s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0152s x1.00]	(17.6167s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(17.6167s x1.00 from start)
      (enter) Finish prover round                	[             ]	(17.6167s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(17.6167s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0046s x1.00]	(17.6213s x1.00 from start)
      (leave) Finish prover round                	[0.0046s x1.00]	(17.6214s x1.00 from start)
      (enter) pow                                	[             ]	(17.6214s x1.00 from start)
      (leave) pow                                	[0.0000s x1.04]	(17.6214s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0046s x1.00]	(17.6214s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(17.6214s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0038s x1.00]	(17.6252s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(17.6252s x1.00 from start)
      (enter) Finish prover round                	[             ]	(17.6252s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(17.6252s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0012s x1.00]	(17.6264s x1.00 from start)
      (leave) Finish prover round                	[0.0012s x1.00]	(17.6264s x1.00 from start)
      (enter) pow                                	[             ]	(17.6264s x1.00 from start)
      (leave) pow                                	[0.0000s x1.04]	(17.6264s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0012s x1.00]	(17.6264s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(17.6264s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0010s x1.00]	(17.6274s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(17.6274s x1.00 from start)
      (enter) Finish prover round                	[             ]	(17.6274s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(17.6274s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0003s x1.00]	(17.6277s x1.00 from start)
      (leave) Finish prover round                	[0.0003s x1.00]	(17.6278s x1.00 from start)
      (enter) pow                                	[             ]	(17.6278s x1.00 from start)
      (leave) pow                                	[0.0000s x1.02]	(17.6278s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0003s x1.00]	(17.6278s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(17.6278s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0003s x1.00]	(17.6280s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(17.6280s x1.00 from start)
      (enter) Finish prover round                	[             ]	(17.6280s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(17.6281s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0001s x1.00]	(17.6281s x1.00 from start)
      (leave) Finish prover round                	[0.0001s x1.00]	(17.6282s x1.00 from start)
      (enter) pow                                	[             ]	(17.6282s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(17.6282s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(17.6282s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(17.6282s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0001s x1.00]	(17.6283s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(17.6283s x1.00 from start)
      (enter) Finish prover round                	[             ]	(17.6283s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(17.6283s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0000s x1.00]	(17.6283s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.00]	(17.6283s x1.00 from start)
      (enter) pow                                	[             ]	(17.6283s x1.00 from start)
      (leave) pow                                	[0.0000s x1.02]	(17.6283s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(17.6283s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(17.6283s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0000s x1.01]	(17.6284s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(17.6284s x1.00 from start)
      (enter) Finish prover round                	[             ]	(17.6284s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(17.6284s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0000s x1.01]	(17.6284s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.00]	(17.6284s x1.00 from start)
      (enter) pow                                	[             ]	(17.6284s x1.00 from start)
      (leave) pow                                	[0.0000s x1.02]	(17.6284s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(17.6284s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(17.6284s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0000s x1.01]	(17.6285s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(17.6285s x1.00 from start)
      * Vector size: 8
      * Coset size: 8
    (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.00]	(17.6285s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(17.6285s x1.00 from start)
      (enter) Finish prover round                	[             ]	(17.6285s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.01]	(17.6285s x1.00 from start)
      (enter) pow                                	[             ]	(17.6285s x1.00 from start)
      (leave) pow                                	[0.1241s x1.00]	(17.7527s x1.00 from start)
    (leave) LDT signal prover round done       	[0.1242s x1.00]	(17.7527s x1.00 from start)
  (leave) LDT Reducer: Calculate and submit proof	[1.1546s x1.00]	(17.7561s x1.00 from start)
  (enter) Obtain transcript                  	[             ]	(17.7561s x1.00 from start)
  (leave) Obtain transcript                  	[0.1390s x1.00]	(17.8951s x1.00 from start)
  * Total size of proof oracles (bytes): 192937728
  * Total size of Merkle tree (bytes): 78293184
  * Total size of prover state (bytes): 271230912
(leave) Aurora SNARK prover                	[8.5862s x1.00]	(17.8951s x1.00 from start)

BCS parameters
* digest_len (bytes) = 32
* digest_len (bits) = 256
* hash_type = blake2b
(enter) verifier_seal_interaction_registrations	[             ]	(17.9617s x1.00 from start)
(leave) verifier_seal_interaction_registrations	[0.0014s x1.00]	(17.9631s x1.00 from start)

* Argument size in bytes (IOP): 35627
* Argument size in bytes (BCS): 76448
* Argument size in bytes (total): 112075

If we were to remove pruning of authentication paths in BCS,
the argument would have the following sizes:
* Argument size in bytes (BCS, no pruning): 137440
* Argument size in bytes (total, no pruning): 173067

total prover messages size: 23
total two to one hashes: 2660
total leaves hashed: 1548
total hashes: 4284

Transcript info by round
Per round IOP sizes don't include prover messages

round 0
MT_depth 19
IOP size: 10488 bytes
BCS size: 16480 bytes
number of two to one hashes: 513
number of leaves hashed: 456
number of zk hashes: 76
oracles in round: fw, fAz, fBz, fCz, sumcheck_mask, TODO: Fill in this name (batching.tcc), 

round 1
MT_depth 19
IOP size: 1748 bytes
BCS size: 15264 bytes
number of two to one hashes: 513
number of leaves hashed: 76
oracles in round: sumcheck h, 

round 2
MT_depth 17
IOP size: 3496 bytes
BCS size: 13344 bytes
number of two to one hashes: 453
number of leaves hashed: 152
oracles in round: TODO: Fill in this name (batching.tcc), 

round 3
MT_depth 15
IOP size: 3496 bytes
BCS size: 10944 bytes
number of two to one hashes: 378
number of leaves hashed: 152
oracles in round: TODO: Fill in this name (batching.tcc), 

round 4
MT_depth 13
IOP size: 3496 bytes
BCS size: 8736 bytes
number of two to one hashes: 309
number of leaves hashed: 152
oracles in round: TODO: Fill in this name (batching.tcc), 

round 5
MT_depth 11
IOP size: 3496 bytes
BCS size: 5984 bytes
number of two to one hashes: 223
number of leaves hashed: 152
oracles in round: TODO: Fill in this name (batching.tcc), 

round 6
MT_depth 9
IOP size: 3404 bytes
BCS size: 3616 bytes
number of two to one hashes: 148
number of leaves hashed: 148
oracles in round: TODO: Fill in this name (batching.tcc), 

round 7
MT_depth 7
IOP size: 3220 bytes
BCS size: 1728 bytes
number of two to one hashes: 87
number of leaves hashed: 140
oracles in round: TODO: Fill in this name (batching.tcc), 

round 8
MT_depth 5
IOP size: 2024 bytes
BCS size: 288 bytes
number of two to one hashes: 29
number of leaves hashed: 88
oracles in round: TODO: Fill in this name (batching.tcc), 

round 9
MT_depth 3
IOP size: 736 bytes
BCS size: 32 bytes
number of two to one hashes: 7
number of leaves hashed: 32
oracles in round: TODO: Fill in this name (batching.tcc), 


(enter) Aurora SNARK verifier              	[             ]	(17.9673s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 114.0
  * RS extra dimensions = 3
  * codeword domain dim = 20
  * constraint domain dim = 15
  * variable domain dim = 15
  * query bound = 77
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 165.0
  * interactive repetitions = 1
  * constraint domain dim = 15
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 160.0
  * codeword domain dim = 20
  * max tested degree bound = 131072
  * max constraint degree bound = 65689
  * absolute proximity parameter = 917503
  * fractional proximity parameter = 0.874999
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 111
  * achieved query soundness error (bits) = 114.0
  * codeword domain dim = 20
  * effective proximity parameter = 0.874999
  * number of interactive repetitions = 1
  * number of query repetitions = 38
  * localization parameter array = { 1 2 2 2 2 2 2 2 2 }
  * number of reductions = 9

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Aurora IOP protocol initialization and registration	[             ](17.9676s x1.00 from start)
    (enter) verifier_seal_interaction_registrations	[             ]	(17.9704s x1.00 from start)
    (leave) verifier_seal_interaction_registrations	[0.0014s x1.00]	(17.9718s x1.00 from start)
  (leave) Aurora IOP protocol initialization and registration	[0.0044s x1.00](17.9720s x1.00 from start)
  (enter) Check semantic validity of IOP transcript	[             ]	(17.9720s x1.00 from start)
  (leave) Check semantic validity of IOP transcript	[0.0000s x1.06]	(17.9720s x1.00 from start)
  (enter) Construct R1CS verifier state      	[             ]	(17.9720s x1.00 from start)
    (enter) multi_lincheck compute alpha powers	[             ]	(17.9720s x1.00 from start)
    (leave) multi_lincheck compute alpha powers	[0.0007s x1.00]	(17.9727s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_prime	[             ]	(17.9727s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_prime	[0.0006s x1.00]	(17.9732s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_ABC 	[             ]	(17.9733s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_ABC 	[0.0091s x1.00]	(17.9824s x1.00 from start)
    (enter) multi_lincheck IFFT p_alphas       	[             ]	(17.9824s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(17.9824s x1.00 from start)
        * Vector size: 32768
        * Coset size: 32768
      (leave) Call to multiplicative_IFFT_wrapper	[0.0178s x1.00]	(18.0002s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(18.0003s x1.00 from start)
        * Vector size: 32768
        * Coset size: 32768
      (leave) Call to multiplicative_IFFT_wrapper	[0.0178s x1.00]	(18.0181s x1.00 from start)
    (leave) multi_lincheck IFFT p_alphas       	[0.0358s x1.00]	(18.0182s x1.00 from start)
  (leave) Construct R1CS verifier state      	[0.0461s x1.00]	(18.0182s x1.00 from start)
  (enter) Check LDT verifier predicate       	[             ]	(18.0182s x1.00 from start)
    * Number of FRI interactions: 1
    * Number of FRI query sets per interaction: 38
    * Total number of FRI queries over all query sets (incl. repeated queries): 1292
  (leave) Check LDT verifier predicate       	[0.1392s x1.00]	(18.1573s x1.00 from start)
  * IOP transcript valid: true
  * Full protocol decision predicate satisfied: true
(leave) Aurora SNARK verifier              	[0.1900s x1.00]	(18.1573s x1.00 from start)


* Verifier satisfied: true

================================================================================

(enter) Check satisfiability of R1CS example	[             ]	(19.0576s x1.00 from start)
(leave) Check satisfiability of R1CS example	[0.0067s x1.00]	(19.0643s x1.00 from start)

* R1CS number of constraints: 65536
* R1CS number of variables: 65535
* R1CS number of variables for primary input: 15
* R1CS number of variables for auxiliary input: 65520
* R1CS size of constraint system (bytes): 5136384
* R1CS size of primary input (bytes): 360
* R1CS size of auxiliary input (bytes): 1572480

(enter) Aurora SNARK prover                	[             ]	(19.0644s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 111.0
  * RS extra dimensions = 3
  * codeword domain dim = 21
  * constraint domain dim = 16
  * variable domain dim = 16
  * query bound = 75
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 164.0
  * interactive repetitions = 1
  * constraint domain dim = 16
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 159.0
  * codeword domain dim = 21
  * max tested degree bound = 262144
  * max constraint degree bound = 131221
  * absolute proximity parameter = 1835007
  * fractional proximity parameter = 0.875000
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 110
  * achieved query soundness error (bits) = 111.0
  * codeword domain dim = 21
  * effective proximity parameter = 0.875000
  * number of interactive repetitions = 1
  * number of query repetitions = 37
  * localization parameter array = { 1 2 2 2 2 2 2 2 2 }
  * number of reductions = 9

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Submit witness oracles             	[             ]	(19.0703s x1.00 from start)
    (enter) Sumcheck: sample masking polynomial components	[             ](19.0703s x1.00 from start)
    (leave) Sumcheck: sample masking polynomial components	[1.6508s x1.00](20.7211s x1.00 from start)
    (enter) Sumcheck: compute masking polynomial codeword	[             ](20.7212s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(20.7250s x1.00 from start)
        * Vector size: 131146
        * Subgroup size: 2097152
      (leave) Call to multiplicative_FFT_wrapper 	[0.8212s x1.00]	(21.5462s x1.00 from start)
    (leave) Sumcheck: compute masking polynomial codeword	[0.8251s x1.00](21.5462s x1.00 from start)
    (enter) Compute randomized f_w             	[             ]	(21.5462s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(21.5492s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.03]	(21.5493s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(21.5493s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 65536
      (leave) Call to multiplicative_FFT_wrapper 	[0.0067s x1.00]	(21.5560s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(21.5576s x1.00 from start)
        * Vector size: 65536
        * Coset size: 65536
      (leave) Call to multiplicative_IFFT_wrapper	[0.0385s x1.00]	(21.5960s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(21.6012s x1.00 from start)
        * Vector size: 65595
        * Subgroup size: 2097152
      (leave) Call to multiplicative_FFT_wrapper 	[0.7323s x1.00]	(22.3335s x1.00 from start)
    (leave) Compute randomized f_w             	[0.7873s x1.00]	(22.3335s x1.00 from start)
    (enter) Compute A/B/Cz                     	[             ]	(22.3336s x1.00 from start)
    (leave) Compute A/B/Cz                     	[0.0060s x1.00]	(22.3395s x1.00 from start)
    (enter) Compute f_{A/B/Cz} over codeword domain	[             ]	(22.3395s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(22.3397s x1.00 from start)
        * Vector size: 65536
        * Coset size: 65536
      (leave) Call to multiplicative_IFFT_wrapper	[0.0382s x1.00]	(22.3779s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(22.3781s x1.00 from start)
        * Vector size: 65536
        * Coset size: 65536
      (leave) Call to multiplicative_IFFT_wrapper	[0.0379s x1.00]	(22.4159s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(22.4161s x1.00 from start)
        * Vector size: 65536
        * Coset size: 65536
      (leave) Call to multiplicative_IFFT_wrapper	[0.0379s x1.00]	(22.4540s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(22.4550s x1.00 from start)
        * Vector size: 65611
        * Subgroup size: 2097152
      (leave) Call to multiplicative_FFT_wrapper 	[0.7486s x1.00]	(23.2036s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(23.2038s x1.00 from start)
        * Vector size: 65611
        * Subgroup size: 2097152
      (leave) Call to multiplicative_FFT_wrapper 	[0.7537s x1.00]	(23.9574s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(23.9576s x1.00 from start)
        * Vector size: 65611
        * Subgroup size: 2097152
      (leave) Call to multiplicative_FFT_wrapper 	[0.7546s x1.00]	(24.7122s x1.00 from start)
    (leave) Compute f_{A/B/Cz} over codeword domain	[2.3727s x1.00]	(24.7122s x1.00 from start)
    (enter) Call IOP oracle submission routines	[             ]	(24.7122s x1.00 from start)
    (leave) Call IOP oracle submission routines	[0.0000s x1.03]	(24.7122s x1.00 from start)
  (leave) Submit witness oracles             	[5.6419s x1.00]	(24.7122s x1.00 from start)
  (enter) LDT Reducer: Submit masking polynomial	[             ]	(24.7122s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(28.0033s x1.00 from start)
      * Vector size: 262144
      * Subgroup size: 2097152
    (leave) Call to multiplicative_FFT_wrapper 	[0.8372s x1.00]	(28.8405s x1.00 from start)
  (leave) LDT Reducer: Submit masking polynomial	[4.1283s x1.00]	(28.8406s x1.00 from start)
  (enter) Finish prover round                	[             ]	(28.8406s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(28.8406s x1.00 from start)
      (enter) BCS: Sample randomness             	[             ]	(28.8406s x1.00 from start)
      (leave) BCS: Sample randomness             	[0.2010s x1.00]	(29.0416s x1.00 from start)
    (leave) Construct Merkle tree              	[1.3834s x1.00]	(30.2239s x1.00 from start)
  (leave) Finish prover round                	[1.3834s x1.00]	(30.2240s x1.00 from start)
  (enter) pow                                	[             ]	(30.2240s x1.00 from start)
  (leave) pow                                	[0.0000s x1.05]	(30.2240s x1.00 from start)
  (enter) multi_lincheck: Calculate and submit proof	[             ]	(30.2240s x1.00 from start)
    (enter) multi_lincheck compute alpha powers	[             ]	(30.2240s x1.00 from start)
    (leave) multi_lincheck compute alpha powers	[0.0019s x1.00]	(30.2259s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_prime	[             ]	(30.2259s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_prime	[0.0017s x1.01]	(30.2276s x1.00 from start)
    (enter) multi_lincheck compute p_alpha_ABC 	[             ]	(30.2276s x1.00 from start)
    (leave) multi_lincheck compute p_alpha_ABC 	[0.0191s x1.00]	(30.2467s x1.00 from start)
    (enter) multi_lincheck IFFT p_alphas       	[             ]	(30.2467s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(30.2474s x1.00 from start)
        * Vector size: 65536
        * Coset size: 65536
      (leave) Call to multiplicative_IFFT_wrapper	[0.0386s x1.00]	(30.2860s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(30.2868s x1.00 from start)
        * Vector size: 65536
        * Coset size: 65536
      (leave) Call to multiplicative_IFFT_wrapper	[0.0379s x1.00]	(30.3247s x1.00 from start)
    (leave) multi_lincheck IFFT p_alphas       	[0.0787s x1.00]	(30.3253s x1.00 from start)
    (enter) fz evaluated contents              	[             ]	(30.3254s x1.00 from start)
      (enter) Call to multiplicative_IFFT_wrapper	[             ]	(30.3547s x1.00 from start)
        * Vector size: 16
        * Coset size: 16
      (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x0.97]	(30.3547s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(30.3547s x1.00 from start)
        * Vector size: 16
        * Subgroup size: 2097152
      (leave) Call to multiplicative_FFT_wrapper 	[0.1905s x1.00]	(30.5452s x1.00 from start)
    (leave) fz evaluated contents              	[0.3071s x1.00]	(30.6324s x1.00 from start)
    (enter) multi_lincheck evaluated contents  	[             ]	(30.6377s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(30.6379s x1.00 from start)
        * Vector size: 65536
        * Subgroup size: 2097152
      (leave) Call to multiplicative_FFT_wrapper 	[0.7216s x1.00]	(31.3594s x1.00 from start)
      (enter) Call to multiplicative_FFT_wrapper 	[             ]	(31.3596s x1.00 from start)
        * Vector size: 65536
        * Subgroup size: 2097152
      (leave) Call to multiplicative_FFT_wrapper 	[0.7224s x1.00]	(32.0821s x1.00 from start)
    (leave) multi_lincheck evaluated contents  	[1.8075s x1.00]	(32.4453s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(32.6142s x1.00 from start)
      * Vector size: 262144
      * Coset size: 262144
    (leave) Call to multiplicative_IFFT_wrapper	[0.1810s x1.00]	(32.7951s x1.00 from start)
    (enter) Call to multiplicative_FFT_wrapper 	[             ]	(32.8045s x1.00 from start)
      * Vector size: 65610
      * Subgroup size: 2097152
    (leave) Call to multiplicative_FFT_wrapper 	[0.7483s x1.00]	(33.5527s x1.00 from start)
  (leave) multi_lincheck: Calculate and submit proof	[3.3288s x1.00]	(33.5528s x1.00 from start)
  (enter) Finish prover round                	[             ]	(33.5528s x1.00 from start)
    (enter) Construct Merkle tree              	[             ]	(33.5528s x1.00 from start)
    (leave) Construct Merkle tree              	[0.6088s x1.00]	(34.1615s x1.00 from start)
  (leave) Finish prover round                	[0.6088s x1.00]	(34.1616s x1.00 from start)
  (enter) pow                                	[             ]	(34.1616s x1.00 from start)
  (leave) pow                                	[0.0000s x0.99]	(34.1616s x1.00 from start)
  (enter) LDT Reducer: Calculate and submit proof	[             ]	(34.1616s x1.00 from start)
    (enter) Sumcheck: g evaluated contents     	[             ]	(34.1616s x1.00 from start)
    (leave) Sumcheck: g evaluated contents     	[0.2038s x1.00]	(34.3655s x1.00 from start)
    (enter) rowcheck evaluated contents        	[             ]	(34.3681s x1.00 from start)
    (leave) rowcheck evaluated contents        	[0.1451s x1.00]	(34.5133s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(35.5693s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.3427s x1.00]	(35.9120s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(35.9139s x1.00 from start)
      (enter) Finish prover round                	[             ]	(35.9140s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(35.9140s x1.00 from start)
        (leave) Construct Merkle tree              	[0.1630s x1.00]	(36.0770s x1.00 from start)
      (leave) Finish prover round                	[0.1630s x1.00]	(36.0770s x1.00 from start)
      (enter) pow                                	[             ]	(36.0770s x1.00 from start)
      (leave) pow                                	[0.0000s x1.00]	(36.0770s x1.00 from start)
    (leave) LDT signal prover round done       	[0.1631s x1.00]	(36.0770s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(36.0770s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.1487s x1.00]	(36.2258s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(36.2262s x1.00 from start)
      (enter) Finish prover round                	[             ]	(36.2262s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(36.2262s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0369s x1.00]	(36.2631s x1.00 from start)
      (leave) Finish prover round                	[0.0369s x1.00]	(36.2631s x1.00 from start)
      (enter) pow                                	[             ]	(36.2631s x1.00 from start)
      (leave) pow                                	[0.0000s x1.06]	(36.2632s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0369s x1.00]	(36.2632s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(36.2632s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0335s x1.00]	(36.2967s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(36.2968s x1.00 from start)
      (enter) Finish prover round                	[             ]	(36.2968s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(36.2968s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0092s x1.00]	(36.3060s x1.00 from start)
      (leave) Finish prover round                	[0.0092s x1.00]	(36.3060s x1.00 from start)
      (enter) pow                                	[             ]	(36.3060s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(36.3060s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0093s x1.00]	(36.3060s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(36.3060s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0077s x1.00]	(36.3137s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(36.3137s x1.00 from start)
      (enter) Finish prover round                	[             ]	(36.3137s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(36.3137s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0023s x1.00]	(36.3161s x1.00 from start)
      (leave) Finish prover round                	[0.0023s x1.00]	(36.3161s x1.00 from start)
      (enter) pow                                	[             ]	(36.3161s x1.00 from start)
      (leave) pow                                	[0.0000s x1.04]	(36.3161s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0024s x1.00]	(36.3161s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(36.3161s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0019s x1.00]	(36.3180s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(36.3180s x1.00 from start)
      (enter) Finish prover round                	[             ]	(36.3180s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(36.3181s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0006s x1.00]	(36.3187s x1.00 from start)
      (leave) Finish prover round                	[0.0006s x1.00]	(36.3187s x1.00 from start)
      (enter) pow                                	[             ]	(36.3187s x1.00 from start)
      (leave) pow                                	[0.0000s x1.05]	(36.3187s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0006s x1.00]	(36.3187s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(36.3187s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0005s x1.00]	(36.3192s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(36.3192s x1.00 from start)
      (enter) Finish prover round                	[             ]	(36.3192s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(36.3192s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0002s x1.00]	(36.3193s x1.00 from start)
      (leave) Finish prover round                	[0.0002s x1.00]	(36.3194s x1.00 from start)
      (enter) pow                                	[             ]	(36.3194s x1.00 from start)
      (leave) pow                                	[0.0000s x1.03]	(36.3194s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0002s x1.00]	(36.3194s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(36.3194s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0001s x1.00]	(36.3195s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(36.3195s x1.00 from start)
      (enter) Finish prover round                	[             ]	(36.3195s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(36.3195s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0001s x1.01]	(36.3196s x1.00 from start)
      (leave) Finish prover round                	[0.0001s x1.00]	(36.3196s x1.00 from start)
      (enter) pow                                	[             ]	(36.3196s x1.00 from start)
      (leave) pow                                	[0.0000s x1.02]	(36.3196s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(36.3196s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(36.3196s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0000s x1.00]	(36.3197s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(36.3197s x1.00 from start)
      (enter) Finish prover round                	[             ]	(36.3197s x1.00 from start)
        (enter) Construct Merkle tree              	[             ]	(36.3197s x1.00 from start)
        (leave) Construct Merkle tree              	[0.0000s x1.01]	(36.3197s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.00]	(36.3197s x1.00 from start)
      (enter) pow                                	[             ]	(36.3197s x1.00 from start)
      (leave) pow                                	[0.0000s x1.02]	(36.3198s x1.00 from start)
    (leave) LDT signal prover round done       	[0.0001s x1.00]	(36.3198s x1.00 from start)
    (enter) evaluating next FRI codeword       	[             ]	(36.3198s x1.00 from start)
    (leave) evaluating next FRI codeword       	[0.0000s x1.01]	(36.3198s x1.00 from start)
    (enter) Call to multiplicative_IFFT_wrapper	[             ]	(36.3198s x1.00 from start)
      * Vector size: 16
      * Coset size: 16
    (leave) Call to multiplicative_IFFT_wrapper	[0.0000s x1.02]	(36.3198s x1.00 from start)
    (enter) LDT signal prover round done       	[             ]	(36.3198s x1.00 from start)
      (enter) Finish prover round                	[             ]	(36.3198s x1.00 from start)
      (leave) Finish prover round                	[0.0000s x1.01]	(36.3199s x1.00 from start)
      (enter) pow                                	[             ]	(36.3199s x1.00 from start)
      (leave) pow                                	[0.3441s x1.00]	(36.6639s x1.00 from start)
    (leave) LDT signal prover round done       	[0.3441s x1.00]	(36.6639s x1.00 from start)
  (leave) LDT Reducer: Calculate and submit proof	[2.5049s x1.00]	(36.6666s x1.00 from start)
  (enter) Obtain transcript                  	[             ]	(36.6666s x1.00 from start)
  (leave) Obtain transcript                  	[0.2678s x1.00]	(36.9344s x1.00 from start)
  * Total size of proof oracles (bytes): 385875456
  * Total size of Merkle tree (bytes): 156586688
  * Total size of prover state (bytes): 542462144
(leave) Aurora SNARK prover                	[17.8700s x1.00]	(36.9344s x1.00 from start)

BCS parameters
* digest_len (bytes) = 32
* digest_len (bits) = 256
* hash_type = blake2b
(enter) verifier_seal_interaction_registrations	[             ]	(37.0761s x1.00 from start)
(leave) verifier_seal_interaction_registrations	[0.0015s x1.00]	(37.0776s x1.00 from start)

* Argument size in bytes (IOP): 36156
* Argument size in bytes (BCS): 85024
* Argument size in bytes (total): 121180

If we were to remove pruning of authentication paths in BCS,
the argument would have the following sizes:
* Argument size in bytes (BCS, no pruning): 146656
* Argument size in bytes (total, no pruning): 182812

total prover messages size: 46
total two to one hashes: 2936
total leaves hashed: 1570
total hashes: 4580

Transcript info by round
Per round IOP sizes don't include prover messages

round 0
MT_depth 20
IOP size: 10212 bytes
BCS size: 17600 bytes
number of two to one hashes: 548
number of leaves hashed: 444
number of zk hashes: 74
oracles in round: fw, fAz, fBz, fCz, sumcheck_mask, TODO: Fill in this name (batching.tcc), 

round 1
MT_depth 20
IOP size: 1702 bytes
BCS size: 16416 bytes
number of two to one hashes: 548
number of leaves hashed: 74
oracles in round: sumcheck h, 

round 2
MT_depth 18
IOP size: 3404 bytes
BCS size: 14048 bytes
number of two to one hashes: 474
number of leaves hashed: 148
oracles in round: TODO: Fill in this name (batching.tcc), 

round 3
MT_depth 16
IOP size: 3404 bytes
BCS size: 11808 bytes
number of two to one hashes: 404
number of leaves hashed: 148
oracles in round: TODO: Fill in this name (batching.tcc), 

round 4
MT_depth 14
IOP size: 3404 bytes
BCS size: 9632 bytes
number of two to one hashes: 336
number of leaves hashed: 148
oracles in round: TODO: Fill in this name (batching.tcc), 

round 5
MT_depth 12
IOP size: 3404 bytes
BCS size: 7328 bytes
number of two to one hashes: 264
number of leaves hashed: 148
oracles in round: TODO: Fill in this name (batching.tcc), 

round 6
MT_depth 10
IOP size: 3312 bytes
BCS size: 4800 bytes
number of two to one hashes: 184
number of leaves hashed: 144
oracles in round: TODO: Fill in this name (batching.tcc), 

round 7
MT_depth 8
IOP size: 3128 bytes
BCS size: 2560 bytes
number of two to one hashes: 112
number of leaves hashed: 136
oracles in round: TODO: Fill in this name (batching.tcc), 

round 8
MT_depth 6
IOP size: 2760 bytes
BCS size: 736 bytes
number of two to one hashes: 51
number of leaves hashed: 120
oracles in round: TODO: Fill in this name (batching.tcc), 

round 9
MT_depth 4
IOP size: 1380 bytes
BCS size: 64 bytes
number of two to one hashes: 15
number of leaves hashed: 60
oracles in round: TODO: Fill in this name (batching.tcc), 


(enter) Aurora SNARK verifier              	[             ]	(37.0852s x1.00 from start)
  
Aurora SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Aurora IOP parameters
  * target security parameter = 128
  * achieved security parameter = 111.0
  * RS extra dimensions = 3
  * codeword domain dim = 21
  * constraint domain dim = 16
  * variable domain dim = 16
  * query bound = 75
  * make zk = true
  * domain type = multiplicative coset

Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 164.0
  * interactive repetitions = 1
  * constraint domain dim = 16
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 159.0
  * codeword domain dim = 21
  * max tested degree bound = 262144
  * max constraint degree bound = 131221
  * absolute proximity parameter = 1835007
  * fractional proximity parameter = 0.875000
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 110
  * achieved query soundness error (bits) = 111.0
  * codeword domain dim = 21
  * effective proximity parameter = 0.875000
  * number of interactive repetitions = 1
  * number of query repetitions = 37
  * localization parameter array = { 1 2 2 2 2 2 2 2 2 }
  * number of reductions = 9

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Aurora IOP protocol initialization and registration	[             ](37.0854s x1.00 from start)
    (enter) verifier_seal_interaction_registrations	[             ]	(37.0909s x1.00 from

root@ip-10-0-22-17:/data/libiop/build/libiop# 
root@ip-10-0-22-17:/data/libiop/build/libiop# ./instrument_fractal_snark --make_zk 1 --is_multiplicative 1 --field_size=181 --optimize_localization=1
Reset time counters for profiling
Selected parameters:
- log_n_min = 8
- log_n_max = 20
- security_level = 128
- LDT_reducer_soundness_type = heuristic
- FRI_soundness_type = heuristic
- is_multiplicative = true
- field_size = 181
- make_zk = true
- hash_enum = blake2b

================================================================================

(enter) Check satisfiability of R1CS example	[             ]	(0.0038s x1.00 from start)
(leave) Check satisfiability of R1CS example	[0.0000s x0.99]	(0.0039s x1.00 from start)

* R1CS number of constraints: 256
* R1CS number of variables: 255
* R1CS number of variables for primary input: 0
* R1CS number of variables for auxiliary input: 255
* R1CS size of constraint system (bytes): 19296
* R1CS size of primary input (bytes): 0
* R1CS size of auxiliary input (bytes): 6120

(enter) Fractal SNARK indexer              	[             ]	(0.0039s x1.00 from start)
  
Fractal SNARK parameters
  * security parameter (bits) = 128
  * RS extra dimensions = 3
  * LDT reducer soundness type = heuristic
  * FRI soundness type = heuristic
  * zero-knowledge = true
  * domain type = multiplicative coset

Fractal hIOP parameters
  * target security parameter = 128
  * achieved security parameter = 119.9
  * RS extra dimensions = 3
  * matrix domain dim = 8
  * index domain dim = 8
  * codeword domain dim = 13
  * query bound = 80
  * make zk = true
  * domain type = multiplicative coset

Holographic Multi lincheck parameters
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 171.0
  * interactive repetitions = 1
  * constraint domain dim = 8
  * make zk = true
  * domain type = multiplicative coset

LDT instance reducer parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 167.0
  * codeword domain dim = 13
  * max tested degree bound = 1024
  * max constraint degree bound = 1024
  * absolute proximity parameter = 7167
  * fractional proximity parameter = 0.874878
  * num output LDT instances = 1

FRI parameters
  * soundness type = heuristic
  * target interactive soundness error (bits) = 131
  * achieved interactive soundness error (bits) = 180.0
  * target query soundness error (bits) = 118
  * achieved query soundness error (bits) = 119.9
  * codeword domain dim = 13
  * effective proximity parameter = 0.874878
  * number of interactive repetitions = 1
  * number of query repetitions = 40
  * localization parameter array = { 1 2 2 2 2 }
  * number of reductions = 5

BCS parameters
  * digest_len (bytes) = 32
  * digest_len (bits) = 256
  * hash_type = blake2b
  (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.0048s x1.00 from start)
    * Vector size: 256
    * Coset size: 256
  (leave) Call to multiplicative_IFFT_wrapper	[0.0001s x1.00]	(0.0050s x1.00 from start)
  (enter) Call to multiplicative_FFT_wrapper 	[             ]	(0.0050s x1.00 from start)
    * Vector size: 256
    * Subgroup size: 8192
  (leave) Call to multiplicative_FFT_wrapper 	[0.0017s x1.00]	(0.0066s x1.00 from start)
  (enter) Call to multiplicative_IFFT_wrapper	[             ]	(0.0067s x1.00 from start)
    * Vector size: 256