@lfdecentralizedtrust/zeto-contracts 0.2.2 → 0.5.0

package/contracts/zeto_anon_enc_nullifier_non_repudiation.sol

@@ -15,35 +15,32 @@
 // limitations under the License.
 pragma solidity ^0.8.27;
 
-import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
-import {Groth16Verifier_Deposit} from "./verifiers/verifier_deposit.sol";
-import {Groth16Verifier_WithdrawNullifier} from "./verifiers/verifier_withdraw_nullifier.sol";
-import {Groth16Verifier_WithdrawNullifierBatch} from "./verifiers/verifier_withdraw_nullifier_batch.sol";
-import {Groth16Verifier_AnonEncNullifierNonRepudiation} from "./verifiers/verifier_anon_enc_nullifier_non_repudiation.sol";
-import {Groth16Verifier_AnonEncNullifierNonRepudiationBatch} from "./verifiers/verifier_anon_enc_nullifier_non_repudiation_batch.sol";
-import {ZetoNullifier} from "./lib/zeto_nullifier.sol";
-import {ZetoFungibleWithdrawWithNullifiers} from "./lib/zeto_fungible_withdraw_nullifier.sol";
-import {Commonlib} from "./lib/common.sol";
-import {IZetoInitializable} from "./lib/interfaces/izeto_initializable.sol";
+import {Commonlib} from "./lib/common/common.sol";
+import {IZetoInitializable} from "./lib/interfaces/IZetoInitializable.sol";
+import {Zeto_AnonEncNullifier} from "./zeto_anon_enc_nullifier.sol";
 
-uint256 constant INPUT_SIZE = 36;
-uint256 constant BATCH_INPUT_SIZE = 140;
-
-/// @title A sample implementation of a Zeto based fungible token with anonymity, encryption and history masking
+/// @title A sample implementation of a Zeto based fungible token with
+///        anonymity, encryption, history masking via nullifiers, and
+///        non-repudiation through arbiter-decryptable transfer envelopes.
 /// @author Kaleido, Inc.
-/// @dev The proof has the following statements:
-///        - each value in the output commitments must be a positive number in the range 0 ~ (2\*\*40 - 1)
-///        - the sum of the nullified values match the sum of output values
-///        - the hashes in the input and output match the hash(value, salt, owner public key) formula
-///        - the sender possesses the private BabyJubjub key, whose public key is part of the pre-image of the input commitment hashes, which match the corresponding nullifiers
-///        - the encrypted value in the input is derived from the receiver's UTXO value and encrypted with a shared secret using the ECDH protocol between the sender and receiver (this guarantees data availability for the receiver)
-///        - the nullifiers represent input commitments that are included in a Sparse Merkle Tree represented by the root hash
-contract Zeto_AnonEncNullifierNonRepudiation is
-    IZetoInitializable,
-    ZetoNullifier,
-    ZetoFungibleWithdrawWithNullifiers,
-    UUPSUpgradeable
-{
+/// @notice Decimals: this token uses **4** decimals, inherited from
+///         {ZetoCommon.decimals}. Indexers and UIs reading this contract
+///         directly should treat balances accordingly.
+/// @dev Adds a second encryption envelope (the "authority" envelope) on
+///      top of {Zeto_AnonEncNullifier}, encrypted to the configured
+///      arbiter's BabyJubjub public key. The transfer ZK circuit asserts
+///      that the same plaintext is encrypted to both the receiver and the
+///      arbiter, so the arbiter can later decrypt every transfer envelope
+///      it observes on-chain. This is what gives the contract its
+///      non-repudiation property: the sender cannot later deny the
+///      contents of a transfer to the arbiter.
+contract Zeto_AnonEncNullifierNonRepudiation is Zeto_AnonEncNullifier {
+    /// @dev Non-repudiation-specific state ({ZetoAnonEncNullifierNonRepudiationStorage}, ERC-7201).
+
+    /// @dev Per-contract event for non-repudiable transfers. Carries both
+    ///      the receiver-bound encryption envelope and the
+    ///      authority-bound envelope, alongside the ECDH public key and
+    ///      nonce required to decrypt them.
     event UTXOTransferNonRepudiation(
         uint256[] inputs,
         uint256[] outputs,
@@ -55,257 +52,253 @@ contract Zeto_AnonEncNullifierNonRepudiation is
         bytes data
     );
 
-    Groth16Verifier_AnonEncNullifierNonRepudiation internal _verifier;
-    Groth16Verifier_AnonEncNullifierNonRepudiationBatch internal _batchVerifier;
-    // the arbiter public key that must be used to
-    // encrypt the secrets of every transaction
-    uint256[2] private arbiter;
+    /// @dev Lock the implementation contract on construction. Restated at
+    ///      every leaf in the inheritance graph for H-2 robustness.
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
 
     function initialize(
-        string memory name,
-        string memory symbol,
+        string calldata name,
+        string calldata symbol,
         address initialOwner,
         IZetoInitializable.VerifiersInfo calldata verifiers
-    ) public initializer {
-        __ZetoNullifier_init(name, symbol, initialOwner);
-        __ZetoFungibleWithdrawWithNullifiers_init(
-            (Groth16Verifier_Deposit)(verifiers.depositVerifier),
-            (Groth16Verifier_WithdrawNullifier)(verifiers.withdrawVerifier),
-            (Groth16Verifier_WithdrawNullifierBatch)(
-                verifiers.batchWithdrawVerifier
-            )
-        );
-        _verifier = (Groth16Verifier_AnonEncNullifierNonRepudiation)(
-            verifiers.verifier
-        );
-        _batchVerifier = (Groth16Verifier_AnonEncNullifierNonRepudiationBatch)(
-            verifiers.batchVerifier
+    ) public virtual override initializer {
+        __ZetoAnonEncNullifierNonRepudiation_init(
+            name,
+            symbol,
+            initialOwner,
+            verifiers
         );
     }
 
-    function _authorizeUpgrade(address) internal override onlyOwner {}
+    function __ZetoAnonEncNullifierNonRepudiation_init(
+        string calldata name_,
+        string calldata symbol_,
+        address initialOwner,
+        IZetoInitializable.VerifiersInfo calldata verifiers
+    ) internal onlyInitializing {
+        __ZetoAnonEncNullifier_init(name_, symbol_, initialOwner, verifiers);
+    }
 
     function setArbiter(uint256[2] memory _arbiter) public onlyOwner {
-        arbiter = _arbiter;
+        ZetoAnonEncNullifierNonRepudiationStorage.layout().arbiter = _arbiter;
     }
 
     function getArbiter() public view returns (uint256[2] memory) {
-        return arbiter;
+        uint256[2] storage a = ZetoAnonEncNullifierNonRepudiationStorage.layout()
+            .arbiter;
+        return [a[0], a[1]];
     }
 
-    function constructPublicInputs(
+    function emitTransferEvent(
         uint256[] memory nullifiers,
         uint256[] memory outputs,
-        uint256 root,
-        uint256 encryptionNonce,
-        uint256[2] memory ecdhPublicKey,
-        uint256[] memory encryptedValuesForReceiver,
-        uint256[] memory encryptedValuesForAuthority,
-        uint256 size
-    ) internal view returns (uint256[] memory publicInputs) {
-        publicInputs = new uint256[](size);
-        uint256 piIndex = 0;
-        // copy the ecdh public key
-        for (uint256 i = 0; i < ecdhPublicKey.length; ++i) {
-            publicInputs[piIndex++] = ecdhPublicKey[i];
-        }
-        // copy the encrypted value, salt and parity bit for receiver
-        for (uint256 i = 0; i < encryptedValuesForReceiver.length; ++i) {
-            publicInputs[piIndex++] = encryptedValuesForReceiver[i];
-        }
-        // copy the encrypted value, salt and parity bit for authority
-        for (uint256 i = 0; i < encryptedValuesForAuthority.length; ++i) {
-            publicInputs[piIndex++] = encryptedValuesForAuthority[i];
-        }
-        // copy input commitments
-        for (uint256 i = 0; i < nullifiers.length; i++) {
-            publicInputs[piIndex++] = nullifiers[i];
-        }
-
-        // copy root
-        publicInputs[piIndex++] = root;
-
-        // populate enables
-        for (uint256 i = 0; i < nullifiers.length; i++) {
-            publicInputs[piIndex++] = (nullifiers[i] == 0) ? 0 : 1;
-        }
-
-        // copy output commitments
-        for (uint256 i = 0; i < outputs.length; i++) {
-            publicInputs[piIndex++] = outputs[i];
-        }
-
-        // copy encryption nonce
-        publicInputs[piIndex++] = encryptionNonce;
-
-        // copy arbiter pub key
-        publicInputs[piIndex++] = arbiter[0];
-        publicInputs[piIndex++] = arbiter[1];
-        return publicInputs;
+        bytes memory proof,
+        bytes memory data
+    ) internal override {
+        ZetoAnonEncNullifierNonRepudiationStorage.DecodedProofNonRepudiation
+            memory dp;
+        (dp, ) = decodeProof_NonRepudiation(proof);
+        emit UTXOTransferNonRepudiation(
+            nullifiers,
+            outputs,
+            dp.encryptionNonce,
+            dp.ecdhPublicKey,
+            dp.encryptedValuesForReceiver,
+            dp.encryptedValuesForAuthority,
+            msg.sender,
+            data
+        );
     }
 
     /**
-     * @dev the main function of the contract, which transfers values from one account (represented by Babyjubjub public keys)
-     *      to one or more receiver accounts (also represented by Babyjubjub public keys). One of the two nullifiers may be zero
-     *      if the transaction only needs one UTXO to be spent. Equally one of the two outputs may be zero if the transaction
-     *      only needs to create one new UTXO.
+     * @dev Layout of `proof` (ABI-encoded tuple):
+     *        (uint256 root,
+     *         uint256 encryptionNonce,
+     *         uint256[2] ecdhPublicKey,
+     *         uint256[] encryptedValuesForReceiver,
+     *         uint256[] encryptedValuesForAuthority,
+     *         Commonlib.Proof groth16Proof)
      *
-     * @param nullifiers Array of nullifiers that are secretly bound to UTXOs to be spent by the transaction.
-     * @param outputs Array of new UTXOs to generate, for future transactions to spend.
-     * @param root The root hash of the Sparse Merkle Tree that contains the nullifiers.
-     * @param encryptionNonce The nonce used to derive the shared secret for encryption by the receiver.
-     * @param encryptedValuesForReceiver Array of encrypted values, salts and public keys for the receiver UTXO
-     * @param encryptedValuesForAuthority Array of encrypted values, salts and public keys for the input UTXOs and output UTXOs.
-     * @param proof A zero knowledge proof that the submitter is authorized to spend the inputs, and
-     *      that the outputs are valid in terms of obeying mass conservation rules.
+     *      Public-inputs layout:
+     *        ecdhPublicKey
+     *          ++ encryptedValuesForReceiver
+     *          ++ encryptedValuesForAuthority
+     *          ++ nullifiers
+     *          ++ root
+     *          ++ enabled-flags
+     *          ++ outputs
+     *          ++ encryptionNonce
+     *          ++ arbiter
      *
-     * Emits a {UTXOTransferNonRepudiation} event.
+     *      Root validation is performed here for the unlocked path so the
+     *      proof bytes are decoded exactly once per transition.
      */
-    function transfer(
+    function constructPublicInputs(
         uint256[] memory nullifiers,
         uint256[] memory outputs,
-        uint256 root,
-        uint256 encryptionNonce,
-        uint256[2] memory ecdhPublicKey,
-        uint256[] memory encryptedValuesForReceiver,
-        uint256[] memory encryptedValuesForAuthority,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public returns (bool) {
-        // Check and pad commitments
-        nullifiers = checkAndPadCommitments(nullifiers);
-        outputs = checkAndPadCommitments(outputs);
-        validateTransactionProposal(nullifiers, outputs, root, false);
-
-        // Check the proof
-        if (nullifiers.length > 2 || outputs.length > 2) {
-            require(
-                (encryptedValuesForAuthority.length == 64),
-                "Cipher Text for Authority must have a length of 64 with input or outputs number more than 2 and less than 10"
-            );
-            uint256[] memory publicInputs = constructPublicInputs(
-                nullifiers,
-                outputs,
-                root,
-                encryptionNonce,
-                ecdhPublicKey,
-                encryptedValuesForReceiver,
-                encryptedValuesForAuthority,
-                BATCH_INPUT_SIZE
-            );
-            // construct the public inputs for batchVerifier
-            uint256[BATCH_INPUT_SIZE] memory fixedSizeInputs;
-            for (uint256 i = 0; i < fixedSizeInputs.length; i++) {
-                fixedSizeInputs[i] = publicInputs[i];
-            }
+        bytes memory proof,
+        bool inputsLocked
+    ) internal override returns (uint256[] memory, Commonlib.Proof memory) {
+        (
+            ZetoAnonEncNullifierNonRepudiationStorage.DecodedProofNonRepudiation
+                memory dp,
+            Commonlib.Proof memory proofStruct
+        ) = decodeProof_NonRepudiation(proof);
 
-            // Check the proof using batchVerifier
-            require(
-                _batchVerifier.verifyProof(
-                    proof.pA,
-                    proof.pB,
-                    proof.pC,
-                    fixedSizeInputs
-                ),
-                "Invalid proof (batch)"
-            );
-        } else {
-            require(
-                (encryptedValuesForAuthority.length == 16),
-                "Cipher Text for Authority must have a length of 16 for no more than 2 inputs or outputs"
-            );
-            uint256[] memory publicInputs = constructPublicInputs(
-                nullifiers,
-                outputs,
-                root,
-                encryptionNonce,
-                ecdhPublicKey,
-                encryptedValuesForReceiver,
-                encryptedValuesForAuthority,
-                INPUT_SIZE
-            );
-            // construct the public inputs for verifier
-            uint256[INPUT_SIZE] memory fixedSizeInputs;
-            for (uint256 i = 0; i < fixedSizeInputs.length; i++) {
-                fixedSizeInputs[i] = publicInputs[i];
-            }
-            // Check the proof
-            require(
-                _verifier.verifyProof(
-                    proof.pA,
-                    proof.pB,
-                    proof.pC,
-                    fixedSizeInputs
-                ),
-                "Invalid proof"
-            );
+        if (!inputsLocked) {
+            validateRoot(dp.root);
         }
 
-        // accept the transaction to consume the input UTXOs and produce new UTXOs
-        uint256[] memory empty;
-        processInputsAndOutputs(nullifiers, outputs, empty, address(0));
+        ZetoAnonEncNullifierNonRepudiationStorage.layout().dpnr = dp;
 
-        uint256[] memory encryptedValuesReceiverArray = new uint256[](
-            encryptedValuesForReceiver.length
-        );
-        uint256[] memory encryptedValuesAuthorityArray = new uint256[](
-            encryptedValuesForAuthority.length
+        uint256 size = _calcSize_NonRepudiation(nullifiers, outputs);
+        uint256[] memory publicInputs = new uint256[](size);
+        _fillPublicInputs_NonRepudiation(publicInputs, nullifiers, outputs);
+
+        return (publicInputs, proofStruct);
+    }
+
+    function decodeProof_NonRepudiation(
+        bytes memory proof
+    )
+        private
+        pure
+        returns (
+            ZetoAnonEncNullifierNonRepudiationStorage.DecodedProofNonRepudiation
+                memory dp,
+            Commonlib.Proof memory proofStruct
+        )
+    {
+        (
+            dp.root,
+            dp.encryptionNonce,
+            dp.ecdhPublicKey,
+            dp.encryptedValuesForReceiver,
+            dp.encryptedValuesForAuthority,
+            proofStruct
+        ) = abi.decode(
+            proof,
+            (
+                uint256,
+                uint256,
+                uint256[2],
+                uint256[],
+                uint256[],
+                Commonlib.Proof
+            )
         );
-        for (uint256 i = 0; i < encryptedValuesForReceiver.length; ++i) {
-            encryptedValuesReceiverArray[i] = encryptedValuesForReceiver[i];
-        }
-        for (uint256 i = 0; i < encryptedValuesForAuthority.length; ++i) {
-            encryptedValuesAuthorityArray[i] = encryptedValuesForAuthority[i];
-        }
+    }
 
-        emit UTXOTransferNonRepudiation(
+    function _calcSize_NonRepudiation(
+        uint256[] memory nullifiers,
+        uint256[] memory outputs
+    ) internal view returns (uint256) {
+        return
+            ZetoAnonEncNullifierNonRepudiationStorage.layout().dpnr.ecdhPublicKey.length +
+            ZetoAnonEncNullifierNonRepudiationStorage.layout().dpnr.encryptedValuesForReceiver.length +
+            ZetoAnonEncNullifierNonRepudiationStorage.layout().dpnr.encryptedValuesForAuthority.length +
+            (nullifiers.length * 2) + // nullifiers + enabled flags
+            outputs.length +
+            2 + // root + encryptionNonce
+            2; // arbiter public key
+    }
+
+    function _fillPublicInputs_NonRepudiation(
+        uint256[] memory publicInputs,
+        uint256[] memory nullifiers,
+        uint256[] memory outputs
+    ) internal view {
+        uint256 piIndex = 0;
+        piIndex = _fillEcdhAndEncrypted_NR(publicInputs, piIndex);
+        piIndex = _fillNullifiersAndRoot_NR(publicInputs, nullifiers, piIndex);
+        piIndex = _fillEnablesAndOutputs_NR(
+            publicInputs,
             nullifiers,
             outputs,
-            encryptionNonce,
-            ecdhPublicKey,
-            encryptedValuesReceiverArray,
-            encryptedValuesAuthorityArray,
-            msg.sender,
-            data
+            piIndex
         );
-        return true;
+        _fillNonceAndArbiter_NR(publicInputs, piIndex);
     }
 
-    function deposit(
-        uint256 amount,
-        uint256[] memory outputs,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public {
-        _deposit(amount, outputs, proof);
-        _mint(outputs, data);
+    function _fillEcdhAndEncrypted_NR(
+        uint256[] memory publicInputs,
+        uint256 piIndex
+    ) internal view returns (uint256) {
+        for (uint256 i = 0; i < ZetoAnonEncNullifierNonRepudiationStorage.layout().dpnr.ecdhPublicKey.length; ++i) {
+            publicInputs[piIndex++] = ZetoAnonEncNullifierNonRepudiationStorage.layout().dpnr.ecdhPublicKey[i];
+        }
+        for (uint256 i = 0; i < ZetoAnonEncNullifierNonRepudiationStorage.layout().dpnr.encryptedValuesForReceiver.length; ++i) {
+            publicInputs[piIndex++] = ZetoAnonEncNullifierNonRepudiationStorage.layout().dpnr.encryptedValuesForReceiver[i];
+        }
+        for (uint256 i = 0; i < ZetoAnonEncNullifierNonRepudiationStorage.layout().dpnr.encryptedValuesForAuthority.length; ++i) {
+            publicInputs[piIndex++] = ZetoAnonEncNullifierNonRepudiationStorage.layout().dpnr.encryptedValuesForAuthority[i];
+        }
+        return piIndex;
     }
 
-    function withdraw(
-        uint256 amount,
+    function _fillNullifiersAndRoot_NR(
+        uint256[] memory publicInputs,
         uint256[] memory nullifiers,
-        uint256 output,
-        uint256 root,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public {
-        uint256[] memory outputs = new uint256[](nullifiers.length);
-        outputs[0] = output;
-        // Check and pad commitments
-        nullifiers = checkAndPadCommitments(nullifiers);
-        outputs = checkAndPadCommitments(outputs);
-        validateTransactionProposal(nullifiers, outputs, root, false);
+        uint256 piIndex
+    ) internal view returns (uint256) {
+        for (uint256 i = 0; i < nullifiers.length; i++) {
+            publicInputs[piIndex++] = nullifiers[i];
+        }
+        publicInputs[piIndex++] = ZetoAnonEncNullifierNonRepudiationStorage.layout().dpnr.root;
+        return piIndex;
+    }
 
-        _withdrawWithNullifiers(amount, nullifiers, output, root, proof);
-        uint256[] memory empty;
-        processInputsAndOutputs(nullifiers, outputs, empty, address(0));
-        emit UTXOWithdraw(amount, nullifiers, output, msg.sender, data);
+    function _fillEnablesAndOutputs_NR(
+        uint256[] memory publicInputs,
+        uint256[] memory nullifiers,
+        uint256[] memory outputs,
+        uint256 piIndex
+    ) internal pure returns (uint256) {
+        for (uint256 i = 0; i < nullifiers.length; i++) {
+            publicInputs[piIndex++] = (nullifiers[i] == 0) ? 0 : 1;
+        }
+        for (uint256 i = 0; i < outputs.length; i++) {
+            publicInputs[piIndex++] = outputs[i];
+        }
+        return piIndex;
     }
 
-    function mint(
-        uint256[] memory utxos,
-        bytes calldata data
-    ) public onlyOwner {
-        _mint(utxos, data);
+    function _fillNonceAndArbiter_NR(
+        uint256[] memory publicInputs,
+        uint256 piIndex
+    ) internal view {
+        publicInputs[piIndex++] = ZetoAnonEncNullifierNonRepudiationStorage.layout().dpnr.encryptionNonce;
+        uint256[2] storage arb = ZetoAnonEncNullifierNonRepudiationStorage.layout()
+            .arbiter;
+        publicInputs[piIndex++] = arb[0];
+        publicInputs[piIndex++] = arb[1];
+    }
+}
+
+/// @dev ERC-7201 (`erc7201:zeto.storage.Zeto_AnonEncNullifierNonRepudiation`).
+library ZetoAnonEncNullifierNonRepudiationStorage {
+    struct DecodedProofNonRepudiation {
+        uint256 root;
+        uint256 encryptionNonce;
+        uint256[2] ecdhPublicKey;
+        uint256[] encryptedValuesForReceiver;
+        uint256[] encryptedValuesForAuthority;
+    }
+
+    struct Layout {
+        DecodedProofNonRepudiation dpnr;
+        uint256[2] arbiter;
+    }
+
+    bytes32 private constant STORAGE_LOCATION =
+        0x077d29c08c3f481ec46575d42e52007dfbbb47114226730e96bb8e7b43c49600;
+
+    function layout() internal pure returns (Layout storage $) {
+        assembly {
+            $.slot := STORAGE_LOCATION
+        }
     }
 }