From 7f29ab913d115d4a4a242ab60f869000a3b6202f Mon Sep 17 00:00:00 2001
From: Jack Grigg <jack@electriccoin.co>
Date: Wed, 21 Oct 2020 16:03:42 +0100
Subject: [PATCH] Simplify h(x_3) computation in verifier using Horner's rule

Closes zcash/halo2#45
---
 src/plonk/verifier.rs | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/src/plonk/verifier.rs b/src/plonk/verifier.rs
index 23fd8f6..e617c39 100644
--- a/src/plonk/verifier.rs
+++ b/src/plonk/verifier.rs
@@ -315,12 +315,11 @@ impl<'a, C: CurveAffine> Proof<C> {
             .fold(C::Scalar::zero(), |h_eval, v| h_eval * &x_2 + &v);
 
         // Compute h(x_3) from the prover
-        let (_, h_eval) = self
+        let h_eval = self
             .h_evals
             .iter()
-            .fold((C::Scalar::one(), C::Scalar::zero()), |(cur, acc), eval| {
-                (cur * &x_3n, acc + &(cur * eval))
-            });
+            .rev()
+            .fold(C::Scalar::zero(), |acc, eval| acc * &x_3n + eval);
 
         // Did the prover commit to the correct polynomial?
         if expected_h_eval != (h_eval * &(x_3n - &C::Scalar::one())) {