feat: append G2 point from SRS to transcript (#647)

* append G2 point from SRS to transcript

* use powers_of_h[1] instead of beta_h

plonk/src/transcript/mod.rs

@@ -67,6 +67,14 @@ pub trait PlonkTranscript<F> {
             vk.num_inputs.to_le_bytes().as_ref(),
         )?;
 
+        // include [x]_2 G2 point from SRS
+        // all G1 points from SRS are implicit reflected in committed polys
+        <Self as PlonkTranscript<F>>::append_message(
+            self,
+            b"SRS G2 element",
+            &to_bytes!(&vk.open_key.powers_of_h[1])?,
+        )?;
+
         for ki in vk.k.iter() {
             <Self as PlonkTranscript<F>>::append_message(
                 self,

plonk/src/transcript/solidity.rs

@@ -18,6 +18,7 @@ use ark_ec::{
 use ark_ff::{BigInteger, PrimeField};
 use ark_std::vec::Vec;
 use jf_pcs::prelude::Commitment;
+use jf_utils::to_bytes;
 use sha3::{Digest, Keccak256};
 
 /// Transcript with `keccak256` hash function.
@@ -117,6 +118,20 @@ impl<F: PrimeField> PlonkTranscript<F> for SolidityTranscript {
             vk.num_inputs.to_be_bytes().as_ref(),
         )?;
 
+        // include [x]_2 G2 point from SRS
+        // all G1 points from SRS are implicit reflected in committed polys
+        //
+        // Since this is a fixed value, we don't need solidity-efficient serialization,
+        // we simply append the `to_bytes!()` which uses compressed, little-endian form
+        // instead of other proof-dependent field like number of public inputs or
+        // concrete polynomial commitments which uses uncompressed, big-endian
+        // form.
+        <Self as PlonkTranscript<F>>::append_message(
+            self,
+            b"SRS G2 element",
+            &to_bytes!(&vk.open_key.powers_of_h[1])?,
+        )?;
+
         for ki in vk.k.iter() {
             <Self as PlonkTranscript<F>>::append_message(
                 self,