This is huge!<p>To improve efficiency, Pedersen Commitment(i.e. g^Ex*h^r) or exponentiation g^Ex (so 1-2 exponentiations in a finite group) could be used instead of SHA256.<p>Con: new opcode is needed<p>Pros: efficiency, and PC &#x2F; exponent could be proven itself in ZK in a very efficient way via Sigma protocols(can&#x27;t imagine an useful example though).