snarkjs.min.js: Uncaught TypeError: bn.inherits is not a function

[biluochun]

Uncaught TypeError: bn.inherits is not a function
    at snarkjs.min.js:1:363114
    at snarkjs.min.js:9:50285

chrome 110.0.5481.100

'snarkjs': '0.6.4'

[sigmachirality]

To the maintainers:

Was able to reproduct this issue in [email protected]...

after some investigation I believe it is because the 'bfj' package is getting bundled into the IIFE package.

I would suggest to the maintainers to move away from ''bfj' ASAP as it has not been maintained for 3 years, and has been bundled in a way that makes it tricky to rebundle - rollup in particular now bundles it into every bundle as it cannot determine whether bfj's import has any needed side effects. See: webpack-contrib/webpack-bundle-analyzer#383 for more information.

For snarkjs, bfj is bundled into main.js even though it is only referenced in cli.js, and this is a problem because bfj depends on utils.inherits which has been depreciated since 2015. As such polyfills do not support it.

In my testing Vite is able to sidestep this problem by bundling the main.cjs to ESM itself, but this remains an issue for anyone not using Vite. I would suggest revisiting the rollup scripts and bundling snarkjs to both esm and cjs, and redefining the "exports" field in package.json to case on the "node" and/or "browser" conditions. In an ideal world snarkjs would distribute with a node-specific cjs/esm and a browser specific esm in addition to the current IIFE and minified file, or be rewritten such that runtime checks about the environment are safer/more conducive to code elimination and tree shaking.

I am working on a PR for this issue, but am having trouble with removing bfj from bundles targeting the browser because of the aforementioned side-effect static analysis/code elimination difficulty.

Though perhaps not as technically interesting, in my opinion browser-based proving remains the most philosophically necessary of ZKPs in terms of real world use cases where privacy is of utmost importance. Hopefully someone can provide insight/assistance/fixes into this problem.

[phated]

Thanks for the investigation @sigmachirality! We aren't going to remove bfj from the CLI because it is needed to not crash on processing JSON too big to fit in memory.

I can look into removing it from the browser package though. Regardless, we can always shim inherits using rollup

[sigmachirality]

I'm not suggesting removing bfj entirely, but probably migrating to another package or writing a custom serializer (which is the approach the webpack contributors took) would be best. Though I also recognize the contributors have a limited amount of time and bfj works, so may not be worth it.

I found a way to remove bfj from the browser build which I pushed as part of #339. What you do is add the following to rollup's config:

treeshake: { moduleSideEffects: false },

This removes bfj and fs from the generated bundle. You can whitelist packages that need to be imported for their side-effects manually by passing an array to this treeshake.moduleSideEffects property. Feel free to cherry-pick or patch with this change as needed.

[sigmachirality]

Would prefer against shimming inherits as it will increase bundle size for code that isn't used in the main bundle.

[yagnadeepxo]

Please fix the issue, unable to use snarkjs on the client-side

[phated]

We're waiting on a fastfile release.

Actually, I spent some time deep-diving here and found that the code was just written incorrectly for the browser.

I'll have a PR up soon.