GuthL

@HarryR is right. I got the wrong impression that what I was trying to do was possible using the precompiled pairing (aka BBS signature). This is misleading.

I don't see the problem of having a toBits256(x) with 0 padding for bits 255 and 256. The output being random, the overflow is just as random.

I do not see the use for such modification. The current implementation allows to write constraint in a pretty natural way. I just see this proposal as an overhead at...

After discussing with @Schaeff, I think you are right. Having an assert will allow the clear separation between Constraint and Boolean. Functions should be able to return Bool and Assert...