@lfdecentralizedtrust/zeto-contracts 0.2.1 → 0.5.0

package/contracts/zeto_anon_nullifier_qurrency.sol

@@ -15,406 +15,264 @@
 // limitations under the License.
 pragma solidity ^0.8.27;
 
-import {PoseidonUnit5L} from "@iden3/contracts/lib/Poseidon.sol";
-import {IZeto} from "./lib/interfaces/izeto.sol";
-import {MAX_BATCH} from "./lib/interfaces/izeto.sol";
-import {Groth16Verifier_Deposit} from "./verifiers/verifier_deposit.sol";
-import {Groth16Verifier_WithdrawNullifier} from "./verifiers/verifier_withdraw_nullifier.sol";
-import {Groth16Verifier_WithdrawNullifierBatch} from "./verifiers/verifier_withdraw_nullifier_batch.sol";
-import {Groth16Verifier_AnonNullifierQurrencyTransfer} from "./verifiers/verifier_anon_nullifier_qurrency_transfer.sol";
-// import {Groth16Verifier_AnonNullifierTransferLocked} from "./verifiers/verifier_anon_nullifier_transferLocked.sol";
-import {Groth16Verifier_AnonNullifierQurrencyTransferBatch} from "./verifiers/verifier_anon_nullifier_qurrency_transfer_batch.sol";
-// import {Groth16Verifier_AnonNullifierTransferLockedBatch} from "./verifiers/verifier_anon_nullifier_transferLocked_batch.sol";
-import {ZetoNullifier} from "./lib/zeto_nullifier.sol";
-import {ZetoFungibleWithdrawWithNullifiers} from "./lib/zeto_fungible_withdraw_nullifier.sol";
-import {Commonlib} from "./lib/common.sol";
-import {IZetoInitializable} from "./lib/interfaces/izeto_initializable.sol";
-import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
-import {console} from "hardhat/console.sol";
+import {Commonlib} from "./lib/common/common.sol";
+import {IZetoInitializable} from "./lib/interfaces/IZetoInitializable.sol";
+import {Zeto_AnonNullifier} from "./zeto_anon_nullifier.sol";
 
-uint256 constant INPUT_SIZE = 9;
-// uint256 constant INPUT_SIZE_LOCKED = 8;
-uint256 constant BATCH_INPUT_SIZE = 33;
-// uint256 constant BATCH_INPUT_SIZE_LOCKED = 32;
-
-/// @title A sample implementation of a Zeto based fungible token with anonymity and history masking
+/// @title A sample implementation of a Zeto based fungible token with
+///        anonymity, history masking via nullifiers, and post-quantum
+///        ML-KEM encryption envelopes for transferred values.
 /// @author Kaleido, Inc.
-/// @dev The proof has the following statements:
-///        - each value in the output commitments must be a positive number in the range 0 ~ (2\*\*40 - 1)
-///        - the sum of the nullified values match the sum of output values
-///        - the hashes in the input and output match the hash(value, salt, owner public key) formula
-///        - the sender possesses the private BabyJubjub key, whose public key is part of the pre-image of the input commitment hashes, which match the corresponding nullifiers
-///        - the nullifiers represent input commitments that are included in a Sparse Merkle Tree represented by the root hash
-contract Zeto_AnonNullifierQurrency is
-    IZeto,
-    IZetoInitializable,
-    ZetoNullifier,
-    ZetoFungibleWithdrawWithNullifiers,
-    UUPSUpgradeable
-{
-    Groth16Verifier_AnonNullifierQurrencyTransfer internal _verifier;
-    Groth16Verifier_AnonNullifierQurrencyTransferBatch internal _batchVerifier;
-    // Groth16Verifier_AnonNullifierTransferLocked internal _lockVerifier;
-    // Groth16Verifier_AnonNullifierTransferLockedBatch
-    //     internal _batchLockVerifier;
+/// @notice Decimals: this token uses **4** decimals, inherited from
+///         {ZetoCommon.decimals}. Indexers and UIs reading this contract
+///         directly should treat balances accordingly.
+/// @dev Replaces the BabyJubjub-based ECDH envelope used by
+///      {Zeto_AnonEncNullifier} with an ML-KEM (post-quantum)
+///      key-encapsulation envelope. The proof carries the
+///      `encapsulatedSharedSecret` (25 field elements -- the encoded
+///      KEM ciphertext) alongside the encrypted output values; the
+///      circuit asserts that the encrypted values were produced under
+///      the same shared secret derived from that ciphertext.
+///
+///      Locked-input circuit binding: this contract intentionally does
+///      NOT include `msg.sender` in the public-input vector for the
+///      locked-input flavour, even though `main` did. Lock-spender
+///      authorization is now enforced at the Zeto contract layer (via
+///      `ZetoFungible._locks[lockId].spender == msg.sender`) rather than
+///      inside the circuit. This matches how {Zeto_AnonNullifier}
+///      organises its locked-input proof; deployments that still want a
+///      circuit-level binding to the spender can override
+///      {constructPublicInputs} and append it.
+contract Zeto_AnonNullifierQurrency is Zeto_AnonNullifier {
+    /// @dev Proof decode + public-input assembly scratch lives in
+    ///      {ZetoAnonNullifierQurrencyStorage} (ERC-7201).
+
+    /// @dev Lock the implementation contract on construction. Restated at
+    ///      every leaf in the inheritance graph for H-2 robustness.
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
 
     function initialize(
-        string memory name,
-        string memory symbol,
+        string calldata name,
+        string calldata symbol,
         address initialOwner,
         IZetoInitializable.VerifiersInfo calldata verifiers
-    ) public initializer {
-        __ZetoNullifier_init(name, symbol, initialOwner);
-        __ZetoFungibleWithdrawWithNullifiers_init(
-            (Groth16Verifier_Deposit)(verifiers.depositVerifier),
-            (Groth16Verifier_WithdrawNullifier)(verifiers.withdrawVerifier),
-            (Groth16Verifier_WithdrawNullifierBatch)(
-                verifiers.batchWithdrawVerifier
-            )
-        );
-        _verifier = (Groth16Verifier_AnonNullifierQurrencyTransfer)(
-            verifiers.verifier
-        );
-        // _lockVerifier = (Groth16Verifier_AnonNullifierTransferLocked)(
-        //     verifiers.lockVerifier
-        // );
-        _batchVerifier = (Groth16Verifier_AnonNullifierQurrencyTransferBatch)(
-            verifiers.batchVerifier
-        );
-        // _batchLockVerifier = (Groth16Verifier_AnonNullifierTransferLockedBatch)(
-        //     verifiers.batchLockVerifier
-        // );
+    ) public override initializer {
+        __ZetoAnonNullifier_init(name, symbol, initialOwner, verifiers);
     }
 
-    function _authorizeUpgrade(address) internal override onlyOwner {}
-
-    function constructPublicInputs(
-        uint[2] memory computed_hashes,
+    function emitTransferEvent(
         uint256[] memory nullifiers,
         uint256[] memory outputs,
-        uint256 root,
-        uint256 size,
-        bool locked
-    ) internal view returns (uint256[] memory publicInputs) {
-        publicInputs = new uint256[](size);
-        // copy computed hashes
-        publicInputs[0] = computed_hashes[0];
-        publicInputs[1] = computed_hashes[1];
-        uint256 piIndex = 2;
-        // copy input commitments
-        for (uint256 i = 0; i < nullifiers.length; i++) {
-            publicInputs[piIndex++] = nullifiers[i];
-        }
-        // when verifying locked transfers, additional public input
-        // for the lock delegate
-        if (locked) {
-            publicInputs[piIndex++] = uint256(uint160(msg.sender));
-        }
-        // copy root
-        publicInputs[piIndex++] = root;
-
-        // populate enables
-        for (uint256 i = 0; i < nullifiers.length; i++) {
-            publicInputs[piIndex++] = (nullifiers[i] == 0) ? 0 : 1;
-        }
-
-        // copy output commitments
-        for (uint256 i = 0; i < outputs.length; i++) {
-            publicInputs[piIndex++] = outputs[i];
-        }
-
-        return publicInputs;
+        bytes memory proof,
+        bytes memory data
+    ) internal override {
+        ZetoAnonNullifierQurrencyStorage.DecodedProofQurrency memory dp;
+        (dp, ) = decodeProof_Qurrency(proof);
+        emit UTXOTransferWithMlkemEncryptedValues(
+            nullifiers,
+            outputs,
+            dp.encryptionNonce,
+            dp.encapsulatedSharedSecret,
+            dp.encryptedValues,
+            msg.sender,
+            data
+        );
     }
 
     /**
-     * @dev the main function of the contract.
+     * @dev Layout of `proof` (ABI-encoded tuple):
+     *        (uint256 root,
+     *         uint256 encryptionNonce,
+     *         uint256[] encryptedValues,
+     *         uint256[25] encapsulatedSharedSecret,
+     *         Commonlib.Proof groth16Proof)
+     *
+     *      Public-inputs layout (unlocked):
+     *        encapsulatedSharedSecret[25]
+     *          ++ encryptedValues
+     *          ++ nullifiers
+     *          ++ root
+     *          ++ enabled-flags
+     *          ++ outputs
      *
-     * @param nullifiers Array of nullifiers that are secretly bound to UTXOs to be spent by the transaction.
-     * @param outputs Array of new UTXOs to generate, for future transactions to spend.
-     * @param root The root hash of the Sparse Merkle Tree that contains the nullifiers.
-     * @param proof A zero knowledge proof that the submitter is authorized to spend the inputs, and
-     *      that the outputs are valid in terms of obeying mass conservation rules.
+     *      Locked variant drops the `root`/`enabled-flags` block (locked
+     *      inputs are raw UTXOs, not nullifiers, so the SMT-membership
+     *      block is not part of the witness) but keeps the encryption
+     *      commitments so the receiver can still decrypt the new outputs.
      *
-     * Emits a {UTXOTransfer} event.
+     *      Root validation is performed here for the unlocked path so the
+     *      proof bytes are decoded exactly once per transition.
      */
-    function transfer(
+    function constructPublicInputs(
         uint256[] memory nullifiers,
         uint256[] memory outputs,
-        uint256 root,
-        bytes memory ciphertext,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public returns (bool) {
-        nullifiers = checkAndPadCommitments(nullifiers);
-        outputs = checkAndPadCommitments(outputs);
-        validateTransactionProposal(nullifiers, outputs, root, false);
-        uint[2] memory computed_pubSignals = calculateHash(ciphertext);
-        verifyProof(computed_pubSignals, nullifiers, outputs, root, proof);
-        uint256[] memory empty;
-        processInputsAndOutputs(nullifiers, outputs, empty, address(0));
+        bytes memory proof,
+        bool inputsLocked
+    )
+        internal
+        virtual
+        override
+        returns (uint256[] memory, Commonlib.Proof memory)
+    {
+        (
+            ZetoAnonNullifierQurrencyStorage.DecodedProofQurrency memory dp,
+            Commonlib.Proof memory proofStruct
+        ) = decodeProof_Qurrency(proof);
 
-        uint256[] memory nullifierArray = new uint256[](nullifiers.length);
-        uint256[] memory outputArray = new uint256[](outputs.length);
-        for (uint256 i = 0; i < nullifiers.length; ++i) {
-            nullifierArray[i] = nullifiers[i];
-            outputArray[i] = outputs[i];
+        if (!inputsLocked) {
+            validateRoot(dp.root);
         }
-        emit UTXOTransfer(nullifierArray, outputArray, msg.sender, data);
-        return true;
-    }
 
-    // function transferLocked(
-    //     uint256[] memory nullifiers,
-    //     uint256[] memory outputs,
-    //     uint256 root,
-    //     Commonlib.Proof calldata proof,
-    //     bytes calldata data
-    // ) public returns (bool) {
-    //     nullifiers = checkAndPadCommitments(nullifiers);
-    //     outputs = checkAndPadCommitments(outputs);
-    //     validateTransactionProposal(nullifiers, outputs, root, true);
-    //     verifyProofLocked(nullifiers, outputs, root, proof);
-    //     uint256[] memory empty;
-    //     processInputsAndOutputs(nullifiers, outputs, empty, address(0));
+        ZetoAnonNullifierQurrencyStorage.layout().dpq = dp;
 
-    //     uint256[] memory nullifierArray = new uint256[](nullifiers.length);
-    //     uint256[] memory outputArray = new uint256[](outputs.length);
-    //     for (uint256 i = 0; i < nullifiers.length; ++i) {
-    //         nullifierArray[i] = nullifiers[i];
-    //         outputArray[i] = outputs[i];
-    //     }
-    //     emit UTXOTransfer(nullifierArray, outputArray, msg.sender, data);
-    //     return true;
-    // }
+        uint256 size = _calcSize_Qurrency(nullifiers, outputs, inputsLocked);
+        _fillPublicInputs_Qurrency(size, nullifiers, outputs, inputsLocked);
 
-    function deposit(
-        uint256 amount,
-        uint256[] memory outputs,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public {
-        _deposit(amount, outputs, proof);
-        _mint(outputs, data);
+        ZetoAnonNullifierQurrencyStorage.Layout storage $ = ZetoAnonNullifierQurrencyStorage
+            .layout();
+        uint256[] memory out = new uint256[]($.publicInputsBuf.length);
+        for (uint256 i = 0; i < out.length; ++i) {
+            out[i] = $.publicInputsBuf[i];
+        }
+        return (out, proofStruct);
     }
 
-    function withdraw(
-        uint256 amount,
-        uint256[] memory nullifiers,
-        uint256 output,
-        uint256 root,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public {
-        uint256[] memory outputs = new uint256[](nullifiers.length);
-        outputs[0] = output;
-        // Check and pad inputs and outputs based on the max size
-        nullifiers = checkAndPadCommitments(nullifiers);
-        outputs = checkAndPadCommitments(outputs);
-        validateTransactionProposal(nullifiers, outputs, root, false);
-        _withdrawWithNullifiers(amount, nullifiers, output, root, proof);
-        uint256[] memory empty;
-        processInputsAndOutputs(nullifiers, outputs, empty, address(0));
-        emit UTXOWithdraw(amount, nullifiers, output, msg.sender, data);
+    function decodeProof_Qurrency(
+        bytes memory proof
+    )
+        internal
+        pure
+        returns (
+            ZetoAnonNullifierQurrencyStorage.DecodedProofQurrency memory dp,
+            Commonlib.Proof memory proofStruct
+        )
+    {
+        (
+            dp.root,
+            dp.encryptionNonce,
+            dp.encryptedValues,
+            dp.encapsulatedSharedSecret,
+            proofStruct
+        ) = abi.decode(
+            proof,
+            (uint256, uint256, uint256[], uint256[25], Commonlib.Proof)
+        );
+        return (dp, proofStruct);
     }
 
-    function mint(
-        uint256[] memory utxos,
-        bytes calldata data
-    ) public onlyOwner {
-        _mint(utxos, data);
+    function _calcSize_Qurrency(
+        uint256[] memory nullifiers,
+        uint256[] memory outputs,
+        bool inputsLocked
+    ) internal view returns (uint256) {
+        ZetoAnonNullifierQurrencyStorage.DecodedProofQurrency storage dq = ZetoAnonNullifierQurrencyStorage
+            .layout()
+            .dpq;
+        if (inputsLocked) {
+            return
+                dq.encapsulatedSharedSecret.length +
+                dq.encryptedValues.length +
+                nullifiers.length +
+                outputs.length;
+        }
+        return
+            dq.encapsulatedSharedSecret.length +
+            dq.encryptedValues.length +
+            (nullifiers.length * 2) + // nullifiers + enabled flags
+            1 + // root
+            outputs.length;
     }
 
-    // function lock(
-    //     uint256[] memory nullifiers,
-    //     uint256[] memory outputs,
-    //     uint256[] memory lockedOutputs,
-    //     uint256 root,
-    //     Commonlib.Proof calldata proof,
-    //     address delegate,
-    //     bytes calldata data
-    // ) public {
-    //     // merge the outputs and lockedOutputs and do a regular transfer
-    //     uint256[] memory allOutputs = new uint256[](
-    //         outputs.length + lockedOutputs.length
-    //     );
-    //     for (uint256 i = 0; i < outputs.length; i++) {
-    //         allOutputs[i] = outputs[i];
-    //     }
-    //     for (uint256 i = 0; i < lockedOutputs.length; i++) {
-    //         allOutputs[outputs.length + i] = lockedOutputs[i];
-    //     }
-    //     nullifiers = checkAndPadCommitments(nullifiers);
-    //     allOutputs = checkAndPadCommitments(allOutputs);
-    //     validateTransactionProposal(nullifiers, allOutputs, root, false);
-    //     verifyProof(nullifiers, allOutputs, root, proof);
-
-    //     spendNullifiers(nullifiers);
-
-    //     // lock the intended outputs
-    //     _lock(nullifiers, outputs, lockedOutputs, delegate, data);
-    // }
-
-    // function unlock(
-    //     uint256[] memory nullifiers,
-    //     uint256[] memory outputs,
-    //     uint256 root,
-    //     Commonlib.Proof calldata proof,
-    //     bytes calldata data
-    // ) public {
-    //     transferLocked(nullifiers, outputs, root, proof, data);
-    // }
-
-    function verifyProof(
-        uint[2] memory computed_hashes,
+    function _fillPublicInputs_Qurrency(
+        uint256 size,
         uint256[] memory nullifiers,
         uint256[] memory outputs,
-        uint256 root,
-        Commonlib.Proof calldata proof
-    ) public view returns (bool) {
-        if (nullifiers.length > 2 || outputs.length > 2) {
-            uint256[] memory publicInputs = constructPublicInputs(
-                computed_hashes,
-                nullifiers,
-                outputs,
-                root,
-                BATCH_INPUT_SIZE,
-                false
-            );
-            // construct the public inputs for verifier
-            uint256[BATCH_INPUT_SIZE] memory fixedSizeInputs;
-            for (uint256 i = 0; i < fixedSizeInputs.length; i++) {
-                fixedSizeInputs[i] = publicInputs[i];
-            }
-            // Check the proof using batchVerifier
-            require(
-                _batchVerifier.verifyProof(
-                    proof.pA,
-                    proof.pB,
-                    proof.pC,
-                    fixedSizeInputs
-                ),
-                "Invalid proof (batch)"
-            );
-        } else {
-            uint256[] memory publicInputs = constructPublicInputs(
-                computed_hashes,
-                nullifiers,
-                outputs,
-                root,
-                INPUT_SIZE,
-                false
-            );
-            // construct the public inputs for verifier
-            uint256[INPUT_SIZE] memory fixedSizeInputs;
-            for (uint256 i = 0; i < fixedSizeInputs.length; i++) {
-                fixedSizeInputs[i] = publicInputs[i];
-            }
-            // Check the proof
-            require(
-                _verifier.verifyProof(
-                    proof.pA,
-                    proof.pB,
-                    proof.pC,
-                    fixedSizeInputs
-                ),
-                "Invalid proof"
-            );
+        bool inputsLocked
+    ) internal {
+        ZetoAnonNullifierQurrencyStorage.Layout storage $ = ZetoAnonNullifierQurrencyStorage
+            .layout();
+        $.publicInputsBuf = new uint256[](size);
+        $.piIndex = 0;
+
+        _fillEncapsulatedSharedSecret_Q();
+        _fillEncryptedValues_Q();
+        _fillInputs_Q(nullifiers);
+        if (!inputsLocked) {
+            _fillRootAndEnables_Q(nullifiers);
         }
-        return true;
+        _fillOutputs_Q(outputs);
     }
 
-    // function verifyProofLocked(
-    //     uint256[] memory nullifiers,
-    //     uint256[] memory outputs,
-    //     uint256 root,
-    //     Commonlib.Proof calldata proof
-    // ) public view returns (bool) {
-    //     if (nullifiers.length > 2 || outputs.length > 2) {
-    //         uint256[] memory publicInputs = constructPublicInputs(
-    //             nullifiers,
-    //             outputs,
-    //             root,
-    //             BATCH_INPUT_SIZE_LOCKED,
-    //             true
-    //         );
-    //         // construct the public inputs for batchVerifier
-    //         uint256[BATCH_INPUT_SIZE_LOCKED] memory fixedSizeInputs;
-    //         for (uint256 i = 0; i < fixedSizeInputs.length; i++) {
-    //             fixedSizeInputs[i] = publicInputs[i];
-    //         }
+    function _fillEncapsulatedSharedSecret_Q() internal {
+        ZetoAnonNullifierQurrencyStorage.Layout storage $ = ZetoAnonNullifierQurrencyStorage
+            .layout();
+        for (
+            uint256 i = 0;
+            i < $.dpq.encapsulatedSharedSecret.length;
+            ++i
+        ) {
+            $.publicInputsBuf[$.piIndex++] = $.dpq.encapsulatedSharedSecret[i];
+        }
+    }
 
-    //         // Check the proof using batchVerifier
-    //         require(
-    //             _batchLockVerifier.verifyProof(
-    //                 proof.pA,
-    //                 proof.pB,
-    //                 proof.pC,
-    //                 fixedSizeInputs
-    //             ),
-    //             "Invalid proof"
-    //         );
-    //     } else {
-    //         uint256[] memory publicInputs = constructPublicInputs(
-    //             nullifiers,
-    //             outputs,
-    //             root,
-    //             INPUT_SIZE_LOCKED,
-    //             true
-    //         );
-    //         // construct the public inputs for verifier
-    //         uint256[INPUT_SIZE_LOCKED] memory fixedSizeInputs;
-    //         for (uint256 i = 0; i < fixedSizeInputs.length; i++) {
-    //             fixedSizeInputs[i] = publicInputs[i];
-    //         }
-    //         // Check the proof
-    //         require(
-    //             _lockVerifier.verifyProof(
-    //                 proof.pA,
-    //                 proof.pB,
-    //                 proof.pC,
-    //                 fixedSizeInputs
-    //             ),
-    //             "Invalid proof"
-    //         );
-    //     }
-    //     return true;
-    // }
+    function _fillEncryptedValues_Q() internal {
+        ZetoAnonNullifierQurrencyStorage.Layout storage $ = ZetoAnonNullifierQurrencyStorage
+            .layout();
+        for (uint256 i = 0; i < $.dpq.encryptedValues.length; ++i) {
+            $.publicInputsBuf[$.piIndex++] = $.dpq.encryptedValues[i];
+        }
+    }
 
-    function calculateHash(
-        bytes memory ciphertext
-    ) internal view returns (uint[2] memory) {
-        bytes memory ret = new bytes(32); // return is a simple 0 or 1
-        bool ok;
-        uint256 result;
-        bytes memory ct = new bytes(768);
-        for (uint i = 0; i < ct.length; i++) {
-            ct[i] = ciphertext[i];
+    function _fillInputs_Q(uint256[] memory nullifiers) internal {
+        ZetoAnonNullifierQurrencyStorage.Layout storage $ = ZetoAnonNullifierQurrencyStorage
+            .layout();
+        for (uint256 i = 0; i < nullifiers.length; i++) {
+            $.publicInputsBuf[$.piIndex++] = nullifiers[i];
         }
-        assembly {
-            ok := staticcall(
-                gas(),
-                0x02,
-                add(ct, 0x20),
-                768,
-                add(ret, 0x20),
-                0x20
-            )
-            result := mload(add(ret, 0x20))
+    }
+
+    function _fillRootAndEnables_Q(uint256[] memory nullifiers) internal {
+        ZetoAnonNullifierQurrencyStorage.Layout storage $ = ZetoAnonNullifierQurrencyStorage
+            .layout();
+        $.publicInputsBuf[$.piIndex++] = $.dpq.root;
+        for (uint256 i = 0; i < nullifiers.length; i++) {
+            $.publicInputsBuf[$.piIndex++] = (nullifiers[i] == 0) ? 0 : 1;
         }
-        require(ok, "hash failed");
+    }
 
-        bytes32 hash = bytes32(result);
-        uint[2] memory computed_pubSignals;
-        // Calculate h0: sum of the first 16 bytes
-        for (uint i = 0; i < 16; i++) {
-            computed_pubSignals[0] += uint256(uint8(hash[i])) * (1 << (8 * i));
+    function _fillOutputs_Q(uint256[] memory outputs) internal {
+        ZetoAnonNullifierQurrencyStorage.Layout storage $ = ZetoAnonNullifierQurrencyStorage
+            .layout();
+        for (uint256 i = 0; i < outputs.length; i++) {
+            $.publicInputsBuf[$.piIndex++] = outputs[i];
         }
-        // Calculate h1: sum of the next 16 bytes
-        for (uint i = 16; i < 32; i++) {
-            computed_pubSignals[1] +=
-                uint256(uint8(hash[i])) *
-                (1 << (8 * (i - 16)));
+    }
+}
+
+/// @dev ERC-7201 (`erc7201:zeto.storage.Zeto_AnonNullifierQurrency`).
+library ZetoAnonNullifierQurrencyStorage {
+    struct DecodedProofQurrency {
+        uint256 root;
+        uint256 encryptionNonce;
+        uint256[] encryptedValues;
+        uint256[25] encapsulatedSharedSecret;
+    }
+
+    struct Layout {
+        DecodedProofQurrency dpq;
+        uint256[] publicInputsBuf;
+        uint256 piIndex;
+    }
+
+    bytes32 private constant STORAGE_LOCATION =
+        0x61ea13f87e8d672de1c36df013aa52a47bae99190f6e222ce275d312c118d800;
+
+    function layout() internal pure returns (Layout storage $) {
+        assembly {
+            $.slot := STORAGE_LOCATION
         }
-        return computed_pubSignals;
     }
 }