Hash Table
The instruction hash
hashes the OpStack's 10 topmost elements in one cycle.
Similarly, the Sponge instructions absorb_init
, absorb
, and squeeze
all complete in one cycle.
The main processor achieves this by using a hash coprocessor.
The Hash Table is part of the arithmetization of that coprocessor, the other two parts being the Cascade Table and the Lookup Table.
Instruction hash
and the Sponge instructions absorb_init
, absorb
, and squeeze
are quite similar.
The main differences are in updates to the state
registers between executions of the pseudorandom permutation used in Triton VM, the permutation of Tip5.
A summary of the four instructions' mechanics:
 Instruction
hash
 sets all the hash coprocessor's rate registers (
state0
throughstate9
) to equal the processor's stack registersst0
throughst9
,  sets all the hash coprocessor's capacity registers (
state10
throughstate15
) to 1,  executes the 5 rounds of the Tip5 permutation,
 overwrites the processor's stack registers
st0
throughst4
with 0, and  overwrites the processor's stack registers
st5
throughst9
with the hash coprocessor's registersstate0
throughstate4
.
 sets all the hash coprocessor's rate registers (
 Instruction
absorb_init
 sets all the hash coprocessor's rate registers (
state0
throughstate9
) to equal the processor's stack registersst0
throughst9
,  sets all the hash coprocessor's capacity registers (
state10
throughstate15
) to 0, and  executes the 5 rounds of the Tip5 permutation.
 sets all the hash coprocessor's rate registers (
 Instruction
absorb
 overwrites the hash coprocessor's rate registers (
state0
throughstate9
) with the processor's stack registersst0
throughst9
, and  executes the 5 rounds of the Tip5 permutation.
 overwrites the hash coprocessor's rate registers (
 Instruction
squeeze
 overwrites the processor's stack registers
st0
throughst9
with the hash coprocessor's rate registers (state0
throughstate9
), and  executes the 5 rounds of the Tip5 permutation.
 overwrites the processor's stack registers
The Hash Table first records all Sponge instructions in the order the processor executed them.
Then, the Hash Table records all hash
instructions in the order the processor executed them.
This allows the processor to execute hash
instructions without affecting the Sponge's state.
Note that state0
through state3
, corresponding to those states that are being splitandlookedup in the Tip permutation, are not stored as a single field element.
Instead, four limbs “highest”, “mid high”, “mid low”, and “lowest” are recorded in the Hash Table.
This (basically) corresponds to storing the result of \sigma(R \cdot \texttt{state_element}), except that the limbs resulting from $σ$ are 16 bit wide, and hence, there are only 4 limbs;
the split into 8bit limbs happens in the Cascade Table.
Base Columns
The Hash Table has 66 base columns:
 Round number indicator
round_no
, which can be one of ${−1,0,…,5}$. The Tip5 permutation has 5 rounds, indexed ${0,…,4}$. The round number 1 indicates a padding row. The round number 5 indicates that the Tip5 permutation has been applied in full.  Current instruction
CI
, holding the instruction the processor is currently executing.  16 columns
state_i_highest_lkin
,state_i_midhigh_lkin
,state_i_midlow_lkin
,state_i_lowest_lkin
for the tobelookedup value ofstate0
throughstate4
, each of which holds one 16bit wide limb.  16 columns
state_i_highest_lkout
,state_i_midhigh_lkout
,state_i_midlow_lkout
,state_i_lowest_lkout
for the lookedup value ofstate0
throughstate4
, each of which holds one 16bit wide limb.  12 columns
state5
throughstate15
.  4 columns
state_i_inv
establishing correct decomposition ofstate_0_*_lkin
throughstate_4_*_lkin
into 16bit wide limbs.  16 columns
constant_i
, which hold the round constant for the round indicated byRoundNumber
, or 0 if no round with this round number exists.
Extension Columns
The Hash Table has 19 extension columns:
RunningEvaluationHashInput
for the Evaluation Argument for copying the input to the hash function from the processor to the hash coprocessor,RunningEvaluationHashDigest
for the Evaluation Argument for copying the hash digest from the hash coprocessor to the processor,RunningEvaluationSponge
for the Evaluation Argument for copying the 10 next tobeabsorbed elements from the processor to the hash coprocessor or the 10 next squeezed elements from the hash coprocessor to the processor, depending on the instruction, 16 columns
state_i_limb_LookupClientLogDerivative
(fori
$∈{0,…,3}$,limb
$∈{$highest
,midhigh
,midlow
,lowest
$}$) establishing correct lookup of the respective limbs in the Cascade Table.
Padding
Each padding row is the allzero row with the exception of
round_no
, which is 1,CI
, which is the opcode of instructionhash
, andstate_i_inv
fori
$∈{0,…,3}$, which is $(2_{32}−1)_{−1}$.
Arithmetic Intermediate Representation
Let all household items (🪥, 🛁, etc.) be challenges, concretely evaluation points, supplied by the verifier. Let all fruit & vegetables (🥝, 🥥, etc.) be challenges, concretely weights to compress rows, supplied by the verifier. Both types of challenges are Xfield elements, i.e., elements of $F_{p_{3}}$.
Initial Constraints
 The round number is 1 or 0.
 The current instruction is
hash
orabsorb_init
.  If the current instruction is
hash
and the round number is 0, thenRunningEvaluationHashInput
has accumulated the first row with respect to challenges 🧄₀ through 🧄₉ and indeterminate 🚪. Otherwise,RunningEvaluationHashInput
is 1. RunningEvaluationHashDigest
is 1. If the current instruction is
absorb_init
, thenRunningEvaluationSponge
has accumulated the first row with respect to challenges 🧅 and 🧄₀ through 🧄₉ and indeterminate 🧽. Otherwise,RunningEvaluationSponge
is 1.  For
i
$∈{0,…,3}$,limb
$∈{$highest
,midhigh
,midlow
,lowest
$}$:
If the round number is 0, thenstate_i_limb_LookupClientLogDerivative
has accumulatedstate_i_limb_lkin
andstate_i_limb_lkout
with respect to challenges 🍒, 🍓 and indeterminate 🧺. Otherwise,state_i_limb_LookupClientLogDerivative
is 0.
Written as Disjunctive Normal Form, the same constraints can be expressed as:
round_no
is 1 or 0.CI
is the opcode ofhash
or ofabsorb_init
. (
CI
is the opcode ofabsorb_init
orround_no
is 1 orRunningEvaluationHashInput
has accumulated the first row with respect to challenges 🧄₀ through 🧄₉ and indeterminate 🚪)
and (CI
is the opcode ofhash
orRunningEvaluationHashInput
is 1)
and (round_no
is 0 orRunningEvaluationHashInput
is 1).  (
CI
is the opcode ofhash
orRunningEvaluationSponge
has accumulated the first row with respect to challenges 🧅 and 🧄₀ through 🧄₉ and indeterminate 🧽)
and (CI
is the opcode ofabsorb_init
orRunningEvaluationSponge
is 1).  For
i
$∈{0,…,3}$,limb
$∈{$highest
,midhigh
,midlow
,lowest
$}$:
(round_no
is 1 orstate_i_limb_LookupClientLogDerivative
has accumulated the first row)
and (round_no
is 0 orstate_i_limb_LookupClientLogDerivative
is the default initial).
Initial Constraints as Polynomials
(round_no + 1)·round_no
(CI  opcode(hash))·(CI  opcode(absorb_init))
(CI  opcode(absorb_init))·(round_no + 1)·(RunningEvaluationHashInput  🚪  🧄₀·st0  🧄₁·st1  🧄₂·st2  🧄₃·st3  🧄₄·st4  🧄₅·st5  🧄₆·st6  🧄₇·st7  🧄₈·st8  🧄₉·st9)
+ (CI  opcode(hash))·(RunningEvaluationHashInput  1)
+ round_no·(RunningEvaluationHashInput  1)
RunningEvaluationHashDigest  1
(CI  opcode(hash))·(RunningEvaluationSponge  🧽  🧅·CI  🧄₀·st0  🧄₁·st1  🧄₂·st2  🧄₃·st3  🧄₄·st4  🧄₅·st5  🧄₆·st6  🧄₇·st7  🧄₈·st8  🧄₉·st9)
+ (CI  opcode(absorb_init))·(RunningEvaluationSponge  1)
 For
i
$∈{0,…,3}$,limb
$∈{$highest
,midhigh
,midlow
,lowest
$}$:
(round_no + 1)·(state_i_limb_LookupClientLogDerivative·(🧺  🍒·state_i_limb_lkin  🍓·state_i_limb_lkout)  1)
+ round_no·state_i_limb_LookupClientLogDerivative
Consistency Constraints
 If the round number is 1, then the current instruction is
hash
.  If the round number is 0 and the current instruction is
hash
, then registerstate10
is 1.  If the round number is 0 and the current instruction is
hash
, then registerstate11
is 1.  If the round number is 0 and the current instruction is
hash
, then registerstate12
is 1.  If the round number is 0 and the current instruction is
hash
, then registerstate13
is 1.  If the round number is 0 and the current instruction is
hash
, then registerstate14
is 1.  If the round number is 0 and the current instruction is
hash
, then registerstate15
is 1.  If the round number is 0 and the current instruction is
absorb_init
, then registerstate10
is 0.  If the round number is 0 and the current instruction is
absorb_init
, then registerstate11
is 0.  If the round number is 0 and the current instruction is
absorb_init
, then registerstate12
is 0.  If the round number is 0 and the current instruction is
absorb_init
, then registerstate13
is 0.  If the round number is 0 and the current instruction is
absorb_init
, then registerstate14
is 0.  If the round number is 0 and the current instruction is
absorb_init
, then registerstate15
is 0.  If the round number is 0 and the current instruction is
absorb_init
, then registerstate10
is 0.  The round constants adhere to the specification of Tip5.
Written as Disjunctive Normal Form, the same constraints can be expressed as:
 The round number is 0 or 1 or 2 or 3 or 4 or 5 or
CI
is the opcode ofhash
.  The round number is 1 or 1 or 2 or 3 or 4 or 5 or
CI
is the opcode ofabsorb_init
orabsorb
orsqueeze
orstate10
is 1.  The round number is 1 or 1 or 2 or 3 or 4 or 5 or
CI
is the opcode ofabsorb_init
orabsorb
orsqueeze
orstate11
is 1.  The round number is 1 or 1 or 2 or 3 or 4 or 5 or
CI
is the opcode ofabsorb_init
orabsorb
orsqueeze
orstate12
is 1.  The round number is 1 or 1 or 2 or 3 or 4 or 5 or
CI
is the opcode ofabsorb_init
orabsorb
orsqueeze
orstate13
is 1.  The round number is 1 or 1 or 2 or 3 or 4 or 5 or
CI
is the opcode ofabsorb_init
orabsorb
orsqueeze
orstate14
is 1.  The round number is 1 or 1 or 2 or 3 or 4 or 5 or
CI
is the opcode ofabsorb_init
orabsorb
orsqueeze
orstate15
is 1.  The round number is 1 or 1 or 2 or 3 or 4 or 5 or
CI
is the opcode ofhash
orabsorb
orsqueeze
orstate10
is 0.  The round number is 1 or 1 or 2 or 3 or 4 or 5 or
CI
is the opcode ofhash
orabsorb
orsqueeze
orstate11
is 0.  The round number is 1 or 1 or 2 or 3 or 4 or 5 or
CI
is the opcode ofhash
orabsorb
orsqueeze
orstate12
is 0.  The round number is 1 or 1 or 2 or 3 or 4 or 5 or
CI
is the opcode ofhash
orabsorb
orsqueeze
orstate13
is 0.  The round number is 1 or 1 or 2 or 3 or 4 or 5 or
CI
is the opcode ofhash
orabsorb
orsqueeze
orstate14
is 0.  The round number is 1 or 1 or 2 or 3 or 4 or 5 or
CI
is the opcode ofhash
orabsorb
orsqueeze
orstate15
is 0.  The
constant_i
equals interpolant(round_no
), where “interpolant” is the lowestdegree interpolant through (i,constant_i
) for $−1⩽i⩽5$.
Consistency Constraints as Polynomials
(round_no  0)·(round_no  1)·(round_no  2)·(round_no  3)·(round_no  4)·(round_no  5)
·(CI  opcode(hash))
(round_no + 1)·(round_no  1)·(round_no  2)·(round_no  3)·(round_no  4)·(round_no  5)
·(CI  opcode(absorb_init))·(CI  opcode(absorb))·(CI  opcode(squeeze))
·(state10  1)
(round_no + 1)·(round_no  1)·(round_no  2)·(round_no  3)·(round_no  4)·(round_no  5)
·(CI  opcode(absorb_init))·(CI  opcode(absorb))·(CI  opcode(squeeze))
·(state11  1)
(round_no + 1)·(round_no  1)·(round_no  2)·(round_no  3)·(round_no  4)·(round_no  5)
·(CI  opcode(absorb_init))·(CI  opcode(absorb))·(CI  opcode(squeeze))
·(state12  1)
(round_no + 1)·(round_no  1)·(round_no  2)·(round_no  3)·(round_no  4)·(round_no  5)
·(CI  opcode(absorb_init))·(CI  opcode(absorb))·(CI  opcode(squeeze))
·(state13  1)
(round_no + 1)·(round_no  1)·(round_no  2)·(round_no  3)·(round_no  4)·(round_no  5)
·(CI  opcode(absorb_init))·(CI  opcode(absorb))·(CI  opcode(squeeze))
·(state14  1)
(round_no + 1)·(round_no  1)·(round_no  2)·(round_no  3)·(round_no  4)·(round_no  5)
·(CI  opcode(absorb_init))·(CI  opcode(absorb))·(CI  opcode(squeeze))
·(state15  1)
(round_no + 1)·(round_no  1)·(round_no  2)·(round_no  3)·(round_no  4)·(round_no  5)
·(CI  opcode(hash))·(CI  opcode(absorb))·(CI  opcode(squeeze))
·state10
(round_no + 1)·(round_no  1)·(round_no  2)·(round_no  3)·(round_no  4)·(round_no  5)
·(CI  opcode(hash))·(CI  opcode(absorb))·(CI  opcode(squeeze))
·state11
(round_no + 1)·(round_no  1)·(round_no  2)·(round_no  3)·(round_no  4)·(round_no  5)
·(CI  opcode(hash))·(CI  opcode(absorb))·(CI  opcode(squeeze))
·state12
(round_no + 1)·(round_no  1)·(round_no  2)·(round_no  3)·(round_no  4)·(round_no  5)
·(CI  opcode(hash))·(CI  opcode(absorb))·(CI  opcode(squeeze))
·state13
(round_no + 1)·(round_no  1)·(round_no  2)·(round_no  3)·(round_no  4)·(round_no  5)
·(CI  opcode(hash))·(CI  opcode(absorb))·(CI  opcode(squeeze))
·state14
(round_no + 1)·(round_no  1)·(round_no  2)·(round_no  3)·(round_no  4)·(round_no  5)
·(CI  opcode(hash))·(CI  opcode(absorb))·(CI  opcode(squeeze))
·state15
Transition Constraints
 If the round number is 1, then the round number in the next row is 1.
 If the round number is 1, 2, 3, or 4, then the round number in the next row is incremented by 1.
 If the round number is 5, then the round number in the next row is either 1 or 0.
 If the current instruction is
hash
, then the current instruction in the next row ishash
.  If the round number is not 5, the current instruction in the next row is the current instruction in the current row.
 If the round number in the next row is 0 and the current instruction in the next row is
absorb
, then the capacity's state registers don't change.  If the round number in the next row is 0 and the current instruction in the next row is
squeeze
, then none of the state registers change.  If the round number in the next row is 0 and the current instruction in the next row is
hash
, thenRunningEvaluationHashInput
accumulates the next row with respect to challenges 🧄₀ through 🧄₉ and indeterminate 🚪. Otherwise, it remains unchanged.  If the round number in the next row is 5 and the current instruction in the next row is
hash
, thenRunningEvaluationHashDigest
accumulates the next row with respect to challenges 🧄₀ through 🧄₄ and indeterminate 🪟. Otherwise, it remains unchanged. 
 If the round number in the next row is 0 and the current instruction in the next row is
absorb_init
,absorb
, orsqueeze
, thenRunningEvaluationSponge
accumulates the next row with respect to challenges 🧅 and 🧄₀ through 🧄₉ and indeterminate 🧽.  If the round number in the next row is not 0, then
RunningEvaluationSponge
remains unchanged.  If the current instruction in the next row is
hash
, thenRunningEvaluationSponge
remains unchanged.
 If the round number in the next row is 0 and the current instruction in the next row is
 If the round number is 0, the
state
registers adhere to the rules of applying round 0 of the Tip5 permutation.  If the round number is 1, the
state
registers adhere to the rules of applying round 1 of the Tip5 permutation.  If the round number is 2, the
state
registers adhere to the rules of applying round 2 of the Tip5 permutation.  If the round number is 3, the
state
registers adhere to the rules of applying round 3 of the Tip5 permutation.  If the round number is 4, the
state
registers adhere to the rules of applying round 4 of the Tip5 permutation.  For
i
$∈{0,…,3}$,limb
$∈{$highest
,midhigh
,midlow
,lowest
$}$:
If the next round number is 0, 1, 2, 3, or 4, thenstate_i_limb_LookupClientLogDerivative
has accumulatedstate_i_limb_lkin'
andstate_i_limb_lkout'
with respect to challenges 🍒, 🍓 and indeterminate 🧺. Otherwise,state_i_limb_LookupClientLogDerivative
remains unchanged.
Written as Disjunctive Normal Form, the same constraints can be expressed as:

round_no
is 0 or 1 or 2 or 3 or 4 or 5 orround_no'
is 1. 
round_no
is 1 or 5 orround_no'
isround_no
+ 1. 
round_no
is 1 or 0 or 1 or 2 or 3 or 4 orround_no'
is 1 or 0. 
CI
is the opcode ofabsorb_init
orabsorb
orsqueeze
orCI'
is the opcode ofhash
. 
round_no
is 5 orCI'
isCI
. 
round_no'
is 1 or 1 or 2 or 3 or 4 or 5 orCI'
is the opcode ofhash
orabsorb_init
orsqueeze
or the $🧄_{i}$randomized sum of differences of the state registersstate10
throughstate15
in the next row and the current row is 0. 
round_no'
is 1 or 1 or 2 or 3 or 4 or 5 orCI'
is the opcode ofhash
orabsorb_init
orabsorb
or the $🧄_{i}$randomized sum of differences of all state registers in the next row and the current row is 0. 
(
round_no'
is 1 or 1 or 2 or 3 or 4 or 5 orCI'
is the opcode ofabsorb_init
orabsorb
orsqueeze
orRunningEvaluationHashInput
accumulates the next row)
and (round_no'
is 0 orRunningEvaluationHashInput
remains unchanged)
and (CI'
is the opcode ofhash
orRunningEvaluationHashInput
remains unchanged). 
(
round_no'
is 1 or 0 or 1 or 2 or 3 or 4 orCI'
is the opcode ofabsorb_init
orabsorb
orsqueeze
orRunningEvaluationHashDigest
accumulates the next row)
and (round_no'
is 5 orRunningEvaluationHashDigest
remains unchanged)
and (CI'
is the opcode ofhash
orRunningEvaluationHashDigest
remains unchanged). 
 (
round_no'
is 1 or 1 or 2 or 3 or 4 or 5 orCI'
is the opcode ofhash
orRunningEvaluationSponge
accumulates the next row)  and (
round_no'
is 0 orRunningEvaluationSponge
remains unchanged)  and (
CI'
is the opcode ofabsorb_init
orabsorb
orsqueeze
orRunningEvaluationSponge
remains unchanged).
 (

round_no
is 1 or 1 or 2 or 3 or 4 or 5 or thestate
registers adhere to the rules of applying round 0 of the Tip5 permutation. 
round_no
is 1 or 0 or 2 or 3 or 4 or 5 or thestate
registers adhere to the rules of applying round 1 of the Tip5 permutation. 
round_no
is 1 or 0 or 1 or 3 or 4 or 5 or thestate
registers adhere to the rules of applying round 2 of the Tip5 permutation. 
round_no
is 1 or 0 or 1 or 2 or 4 or 5 or thestate
registers adhere to the rules of applying round 3 of the Tip5 permutation. 
round_no
is 1 or 0 or 1 or 2 or 3 or 5 or thestate
registers adhere to the rules of applying round 4 of the Tip5 permutation. 
For
i
$∈{0,…,3}$,limb
$∈{$highest
,midhigh
,midlow
,lowest
$}$:
(round_no'
is 1 or 5 orstate_i_limb_LookupClientLogDerivative
has accumulated the next row)
and (round_no
is 0 or 1 or 2 or 3 or 4 orstate_i_limb_LookupClientLogDerivative'
isstate_i_limb_LookupClientLogDerivative
).
Transition Constraints as Polynomials
(round_no  0)·(round_no  1)·(round_no  2)·(round_no  3)·(round_no  4)·(round_no' + 1)
(round_no + 1)·(round_no  5)·(round_no'  round_no  1)
(round_no + 1)·(round_no  0)·(round_no  1)·(round_no  2)·(round_no  3)·(round_no  4)·(round_no' + 1)·(round_no'  0)
(CI  opcode(absorb_init))·(CI  opcode(absorb))·(CI  opcode(squeeze))·(CI'  opcode(hash))
(round_no  5)·(CI'  CI)
(round_no' + 1)·(round_no'  1)·(round_no'  2)·(round_no'  3)·(round_no'  4)·(round_no'  5)
·(CI'  opcode(hash))·(CI'  opcode(absorb_init))·(CI'  opcode(squeeze))
·(🧄₁₀·(st10'  st10) + 🧄₁₁·(st11'  st11) + 🧄₁₂·(st12'  st12) + 🧄₁₃·(st13'  st13) + 🧄₁₄·(st14'  st14) + 🧄₁₅·(st15'  st15))
(round_no' + 1)·(round_no'  1)·(round_no'  2)·(round_no'  3)·(round_no'  4)·(round_no'  5)
·(CI'  opcode(hash))·(CI'  opcode(absorb_init))·(CI'  opcode(absorb))
·(🧄₀·(st0'  st0) + 🧄₁·(st1'  st1) + 🧄₂·(st2'  st2) + 🧄₃·(st3'  st3) + 🧄₄·(st4'  st4) + 🧄₅·(st5'  st5) + 🧄₆·(st6'  st6) + 🧄₇·(st7'  st7) + 🧄₈·(st8'  st8) + 🧄₉·(st9'  st9) + 🧄₁₀·(st10'  st10) + 🧄₁₁·(st11'  st11) + 🧄₁₂·(st12'  st12) + 🧄₁₃·(st13'  st13) + 🧄₁₄·(st14'  st14) + 🧄₁₅·(st15'  st15))
(round_no' + 1)·(round_no'  1)·(round_no'  2)·(round_no'  3)·(round_no'  4)·(round_no'  5)
·(CI'  opcode(absorb_init))·(CI'  opcode(absorb))·(CI'  opcode(squeeze))
·(RunningEvaluationHashInput'  🚪·RunningEvaluationHashInput  🧄₀·st0'  🧄₁·st1'  🧄₂·st2'  🧄₃·st3'  🧄₄·st4'  🧄₅·st5'  🧄₆·st6'  🧄₇·st7'  🧄₈·st8'  🧄₉·st9')
+ round_no'·(RunningEvaluationHashInput'  RunningEvaluationHashInput)
+ (CI'  opcode(hash))·(RunningEvaluationHashInput'  RunningEvaluationHashInput)
(round_no' + 1)·(round_no'  0)·(round_no'  1)·(round_no'  2)·(round_no'  3)·(round_no'  4)
·(CI'  opcode(absorb_init))·(CI'  opcode(absorb))·(CI'  opcode(squeeze))
·(RunningEvaluationHashDigest'  🪟·RunningEvaluationHashDigest  🧄₀·st0'  🧄₁·st1'  🧄₂·st2'  🧄₃·st3'  🧄₄·st4')
+ (round_no'  5)·(RunningEvaluationHashDigest'  RunningEvaluationHashDigest)
+ (CI'  opcode(hash))·(RunningEvaluationHashDigest'  RunningEvaluationHashDigest)

(round_no' + 1)·(round_no'  1)·(round_no'  2)·(round_no'  3)·(round_no'  4)·(round_no'  5)
·(CI'  opcode(hash))
·(RunningEvaluationSponge'  🧽·RunningEvaluationSponge  🧅·CI'  🧄₀·st0'  🧄₁·st1'  🧄₂·st2'  🧄₃·st3'  🧄₄·st4'  🧄₅·st5'  🧄₆·st6'  🧄₇·st7'  🧄₈·st8'  🧄₉·st9')
+ (round_no'  0)·(RunningEvaluationSponge'  RunningEvaluationSponge)
+ (CI'  opcode(absorb_init))·(CI'  opcode(absorb))·(CI'  opcode(squeeze))·(RunningEvaluationSponge'  RunningEvaluationSponge)
 For
i
$∈{0,…,3}$,limb
$∈{$highest
,midhigh
,midlow
,lowest
$}$:
(round_no + 1)·(round_no  5)·((state_i_limb_LookupClientLogDerivative'  state_i_limb_LookupClientLogDerivative)·(🧺  🍒·state_i_limb_lkin'  🍓·state_i_limb_lkout')  1)
+ (round_no  0)·(round_no  1)·(round_no  2)·(round_no  3)·(round_no  4)·(state_i_limb_LookupClientLogDerivative'  state_i_limb_LookupClientLogDerivative)
 The remaining constraints are left as an exercise to the reader. For hints, see the Tip5 paper.
Terminal Constraints
None.