Omitting the specific scenario, in fact, the puzzle can be reduced to the following:
- There is a polynomial $f(X)$, the sum of its evaluations over a specific domain is not zero, namely $sum = \Sigma_{a\in H}f(a),\ sum\neq0$.
- How can the prover do to pass the following check?
$$
\begin{aligned}
s(X) + f(X) = h^*(X)·Z_H(X)+X·g(X)
\end{aligned}
$$
We list Fact 10.1[1] and Lemma 10.2[1] first:
Fact 10.1.
Let $F$ be a finite field and suppose that $H$ is a multiplicative subgroup of $F$ of size $n$. Then for
any polynomial $q$ of degree less than $|H| = n$, $\Sigma_{a\in H}q(a) = q(0)·|H|$. It follows that $\Sigma_{a\in H}q(a)$ is $0$ if and only if $q(0) = 0$.
Lemma 10.2.
$\Sigma_{a\in H}p(a)=0$ if and only if there exists polynomials $h^$ , $f$ with $deg(h^) ≤D−n$ and $deg(f)< n−1$ satisfying:
$$
\begin{aligned}
p(X) = h^*(X)·Z_H(X)+X·f(X)
\end{aligned}
$$
With the lemma, to solve the puzzle, we construct the $f^{'}(X) = f(X) - f(0)$. According to Fact 10.1:
$$
\begin{aligned}
\Sigma_{a\in H}f^{'}(a)
&= \Sigma_{a\in H}(f(a) - f(0))
&= \Sigma_{a\in H}f(a) - \Sigma_{a\in H}f(0) = 0
\end{aligned}
$$
So according to Lemma 10.2:
$$
\begin{aligned}
f^{'}(X) &= h^(X)·Z_H(X)+X·g(X) \Rightarrow\
f(X) - f(0) &= h^(X)·Z_H(X)+X·g(X)
\end{aligned}
$$
Because the verifier has no limits to $s(X)$, we could just let:
$$
\begin{aligned}
s(X) + f(X) = f(X) - f(0) = h^*(X)·Z_H(X)+X·g(X)
\end{aligned}
$$
So the $s(X)$ could be the following:
$$
\begin{aligned}
s(X) = \Sigma_{i}c_{i}X^{i} - f(0),\ c_i \in F
\end{aligned}
$$
Considering the $s(X)$ don't have to be a constant polynomial, so we construct $s(X)$ as:
$$
\begin{aligned}
s(X) = X - f(0) = X - real_sum/|H|
\end{aligned}
$$
After that, others will just be standard KZG commitment procedure.
[1]. ProofsArgsAndZK pages 148-149
