Repro: Set thread-local data before SonobeNova::preprocess(), then prove and verify. Verify returns IVCVerificationFail with expected_u_i_x != u_i.x[0] at folding-schemes/src/folding/nova/mod.rs:974.
Root cause: The Poseidon pp_hash embedded in the verifier params loses consistency during the serialize/deserialize round-trip through vp_deserialize_with_mode. Verify recomputes U_i.hash(&sponge, num_steps, &z_0, &z_i) with a different pp_hash than prove used, producing a hash mismatch.
Workaround: Pre-seed thread-local data with a dummy entry before preprocess() so the R1CS shape stabilizes across serialization boundaries, then clear and set real data before proving.
Affected: Any circuit whose generate_step_constraints reads mutable state (thread-local, global, or self-mutating) with constraint shape depending on that state.
Repro: Set thread-local data before
SonobeNova::preprocess(), then prove and verify. Verify returnsIVCVerificationFail with expected_u_i_x != u_i.x[0] at folding-schemes/src/folding/nova/mod.rs:974.Root cause: The Poseidon pp_hash embedded in the verifier params loses consistency during the serialize/deserialize round-trip through
vp_deserialize_with_mode. Verify recomputesU_i.hash(&sponge, num_steps, &z_0, &z_i)with a differentpp_hashthan prove used, producing a hash mismatch.Workaround: Pre-seed thread-local data with a dummy entry before preprocess() so the R1CS shape stabilizes across serialization boundaries, then clear and set real data before proving.
Affected: Any circuit whose
generate_step_constraintsreads mutable state (thread-local, global, or self-mutating) with constraint shape depending on that state.