Someone mentioned that the subgroup membership check for the G2 element of the groth16 proof in the verifier program is not implemented. Relevant material: https://github.com/arkworks-rs/algebra/blob/master/curves/bn254/src/curves/g2.rs#L54 https://hackmd.io/@jpw/bn254#Subgroup-check-for-mathbb-G_2 https://github.com/ethereum/go-ethereum/blob/master/crypto/bn256/cloudflare/twist.go#L47