According to the paper, the output must come from the rate part of the final permutation box. But the implementation outputs the first state element which is in the capacity part
https://github.com/iden3/go-iden3-crypto/blob/master/poseidon/poseidon.go#L95