@lfdecentralizedtrust/zeto-contracts 0.2.2 → 0.5.0

package/contracts/test/escrow2.sol

@@ -15,16 +15,28 @@
 // limitations under the License.
 pragma solidity ^0.8.27;
 
-import {Commonlib} from "../lib/common.sol";
+import {Commonlib} from "../lib/common/common.sol";
 import {Zeto_AnonNullifier} from "../zeto_anon_nullifier.sol";
-// import {console} from "hardhat/console.sol";
+import {ILockableCapability} from "../lib/interfaces/ILockableCapability.sol";
+import {IZetoLockableCapability} from "../lib/interfaces/IZetoLockableCapability.sol";
 
-/// @title A sample on-chain implementation of an escrow contract using Zeto tokens
+/// @title zkEscrow2
 /// @author Kaleido, Inc.
-/// @dev Implements escrow based payment flows with Zeto_AnonNullifier tokens
+/// @notice Sample on-chain escrow built on top of {Zeto_AnonNullifier},
+///         the nullifier-based fungible Zeto token. The escrow flow is
+///         identical to {zkEscrow1} (see that contract for a step-by-step
+///         description); the only difference is that the underlying token
+///         consumes its locked inputs as **raw UTXO hashes** under the
+///         locked-input verifier rather than as nullifiers.
+///
+///         The {checkAndPadCommitments} +
+///         {constructPublicSignalsAndVerifyProof} pair handles both
+///         flavours uniformly via the `inputsLocked=true` flag, so this
+///         escrow does not need a different proof-shaping path from
+///         {zkEscrow1}; it just talks to a different token.
 contract zkEscrow2 {
     enum PaymentStatus {
-        UNKNOWN, // this is the default value for the empty payment slots
+        UNKNOWN, // default value for empty payment slots
         INITIATED,
         APPROVED,
         COMPLETED,
@@ -32,10 +44,9 @@ contract zkEscrow2 {
     }
 
     struct Payment {
-        uint256[] nullifiers;
+        bytes32 lockId;
         uint256[] outputs;
-        uint256 root;
-        Commonlib.Proof proof;
+        bytes proof;
         PaymentStatus status;
     }
 
@@ -46,7 +57,7 @@ contract zkEscrow2 {
 
     event PaymentInitiated(
         uint256 paymentId,
-        uint256[] nullifiers,
+        bytes32 lockId,
         uint256[] outputs,
         bytes data
     );
@@ -57,27 +68,39 @@ contract zkEscrow2 {
         zeto = Zeto_AnonNullifier(zetoAddress);
     }
 
+    /// @notice Record a new escrowed payment against an existing lock.
+    /// @dev    See {zkEscrow1.initiatePayment} for the rationale on
+    ///         requiring `info.spender == address(this)` instead of any
+    ///         caller-provided delegate parameter.
     function initiatePayment(
-        uint256[] memory nullifiers,
+        bytes32 lockId,
         uint256[] memory outputs,
         bytes calldata data
     ) public {
+        ILockableCapability.LockInfo memory info = zeto.getLock(lockId);
+        require(info.spender == address(this), "Escrow is not the spender");
         inflightCount++;
-        Commonlib.Proof memory emptyProof;
+        bytes memory emptyProof;
         payments[inflightCount] = Payment(
-            nullifiers,
+            lockId,
             outputs,
-            0,
             emptyProof,
             PaymentStatus.INITIATED
         );
-        emit PaymentInitiated(inflightCount, nullifiers, outputs, data);
+        emit PaymentInitiated(inflightCount, lockId, outputs, data);
     }
 
+    /// @notice Verify the spend ZK proof for an initiated payment.
+    /// @dev    The locked inputs are read fresh from
+    ///         {Zeto_AnonNullifier.getLockedInputs} so that the verifier
+    ///         sees the same array {Zeto_AnonNullifier} will use during
+    ///         {spendLock} downstream. For nullifier tokens these are raw
+    ///         UTXO hashes (not nullifiers): see
+    ///         {Zeto_AnonNullifier.constructPublicInputs}'s
+    ///         `inputsLocked` branch for the public-inputs layout.
     function approvePayment(
         uint256 paymentId,
-        uint256 root,
-        Commonlib.Proof memory proof,
+        bytes calldata proof,
         bytes calldata data
     ) public {
         Payment storage payment = payments[paymentId];
@@ -85,33 +108,45 @@ contract zkEscrow2 {
             payment.status == PaymentStatus.INITIATED,
             "Payment not initiated"
         );
-        uint256[] memory nullifiers = zeto.checkAndPadCommitments(
-            payment.nullifiers
-        );
-        uint256[] memory outputs = zeto.checkAndPadCommitments(payment.outputs);
+        uint256[] memory lockedInputs = zeto.getLockedInputs(payment.lockId);
+        (
+            uint256[] memory paddedInputs,
+            uint256[] memory paddedOutputs
+        ) = zeto.checkAndPadCommitments(lockedInputs, payment.outputs);
         require(
-            zeto.verifyProofLocked(nullifiers, outputs, root, proof),
+            zeto.constructPublicSignalsAndVerifyProof(
+                paddedInputs,
+                paddedOutputs,
+                proof,
+                true
+            ),
             "Invalid proof"
         );
         payment.proof = proof;
-        payment.root = root;
         payment.status = PaymentStatus.APPROVED;
         emit PaymentApproved(paymentId, data);
     }
 
+    /// @notice Forward the approved spend proof to
+    ///         {Zeto_AnonNullifier.spendLock}. After this returns the lock
+    ///         is consumed, the locked UTXOs are marked spent on the
+    ///         underlying nullifier storage, and the unlocked outputs are
+    ///         appended to the regular commitments tree.
     function completePayment(uint256 paymentId, bytes calldata data) public {
         Payment storage payment = payments[paymentId];
         require(
             payment.status == PaymentStatus.APPROVED,
             "Payment not approved"
         );
-        zeto.transferLocked(
-            payment.nullifiers,
-            payment.outputs,
-            payment.root,
-            payment.proof,
-            "0x"
-        );
+        IZetoLockableCapability.ZetoSpendLockArgs
+            memory spendArgs = IZetoLockableCapability.ZetoSpendLockArgs({
+                txId: bytes32(paymentId),
+                lockedOutputs: new uint256[](0),
+                outputs: payment.outputs,
+                proof: payment.proof,
+                data: ""
+            });
+        zeto.spendLock(payment.lockId, abi.encode(spendArgs), "");
         payment.status = PaymentStatus.COMPLETED;
         emit PaymentCompleted(paymentId, data);
     }

package/contracts/test/qurrency.sol

@@ -16,8 +16,16 @@
 pragma solidity ^0.8.27;
 
 import {Groth16Verifier_AnonNullifierQurrencyTransfer} from "../verifiers/verifier_anon_nullifier_qurrency_transfer.sol";
-import {Commonlib} from "../lib/common.sol";
+import {Commonlib} from "../lib/common/common.sol";
 
+/// @title TestVerifierQurrency
+/// @notice Thin standalone wrapper around the
+///         {Groth16Verifier_AnonNullifierQurrencyTransfer} verifier so that
+///         its 48-element public-input signature can be exercised in
+///         isolation, without dragging in the full {Zeto_AnonNullifierQurrency}
+///         token. Useful for end-to-end ML-KEM payload tests where we need
+///         to confirm the snarkjs proof matches what the on-chain verifier
+///         expects, decoupled from token bookkeeping.
 contract TestVerifierQurrency {
     Groth16Verifier_AnonNullifierQurrencyTransfer verifier;
 
@@ -29,7 +37,7 @@ contract TestVerifierQurrency {
 
     function verifyProof(
         Commonlib.Proof memory proof,
-        uint256[9] memory publicInputs
+        uint256[48] memory publicInputs
     ) public returns (bool) {
         bool result = verifier.verifyProof(
             proof.pA,

package/contracts/test/smt.sol

@@ -18,7 +18,12 @@ pragma solidity ^0.8.27;
 import {SmtLib} from "@iden3/contracts/contracts/lib/SmtLib.sol";
 import {PoseidonUnit3L} from "@iden3/contracts/contracts/lib/Poseidon.sol";
 
-// test ground for better understanding of the SmtLib library implementation
+/// @title TestSmt
+/// @notice Standalone harness for poking at the {SmtLib} sparse Merkle tree
+///         library used by the nullifier-based Zeto storage. Not part of the
+///         production tree; intended for unit tests that need to compare
+///         on-chain SMT behavior against an off-chain reference (e.g. the
+///         js-merkletree library) without spinning up a full Zeto token.
 contract TestSmt {
     using SmtLib for SmtLib.Data;
 

package/contracts/test/tendecimals.sol

@@ -16,25 +16,27 @@
 pragma solidity ^0.8.27;
 
 import {Zeto_Anon} from "../zeto_anon.sol";
-import {IZeto} from "../lib/interfaces/izeto.sol";
-import {ZetoCommon} from "../lib/zeto_common.sol";
+import {IZetoInitializable} from "../lib/interfaces/IZetoInitializable.sol";
 
+/// @title TenDecimals
+/// @notice Test sibling of {Zeto_Anon} that overrides {decimals} to 10.
+///         Confirms that downstream extensions can change the decimals
+///         exposed by the inherited {ZetoCommon.decimals} view (default 4)
+///         without otherwise altering the token. The {initialize} override
+///         is required because {Zeto_Anon.initialize} is `virtual` —
+///         re-declaring it here keeps it callable on the proxy and
+///         locks the implementation otherwise unchanged.
 contract TenDecimals is Zeto_Anon {
-    function decimals()
-        public
-        pure
-        override(IZeto, ZetoCommon)
-        returns (uint8)
-    {
+    function decimals() public pure override returns (uint8) {
         return 10;
     }
 
     function initialize(
-        string memory name,
-        string memory symbol,
+        string calldata name,
+        string calldata symbol,
         address initialOwner,
-        VerifiersInfo calldata verifiersInfo
+        IZetoInitializable.VerifiersInfo calldata verifiers
     ) public override initializer {
-        Zeto_Anon.initialize(name, symbol, initialOwner, verifiersInfo);
+        __ZetoAnon_init(name, symbol, initialOwner, verifiers);
     }
 }

package/contracts/verifiers/impl/anon.sol

@@ -0,0 +1,189 @@
+// SPDX-License-Identifier: GPL-3.0
+/*
+    Copyright 2021 0KIMS association.
+
+    This file is generated with [snarkJS](https://github.com/iden3/snarkjs).
+
+    snarkJS is a free software: you can redistribute it and/or modify it
+    under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    snarkJS is distributed in the hope that it will be useful, but WITHOUT
+    ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+    or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
+    License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with snarkJS. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+pragma solidity >=0.7.0 <0.9.0;
+
+contract Verifier_Anon {
+    // Scalar field size
+    uint256 constant r    = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
+    // Base field size
+    uint256 constant q   = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
+
+    // Verification Key data
+    uint256 constant alphax  = 20491192805390485299153009773594534940189261866228447918068658471970481763042;
+    uint256 constant alphay  = 9383485363053290200918347156157836566562967994039712273449902621266178545958;
+    uint256 constant betax1  = 4252822878758300859123897981450591353533073413197771768651442665752259397132;
+    uint256 constant betax2  = 6375614351688725206403948262868962793625744043794305715222011528459656738731;
+    uint256 constant betay1  = 21847035105528745403288232691147584728191162732299865338377159692350059136679;
+    uint256 constant betay2  = 10505242626370262277552901082094356697409835680220590971873171140371331206856;
+    uint256 constant gammax1 = 11559732032986387107991004021392285783925812861821192530917403151452391805634;
+    uint256 constant gammax2 = 10857046999023057135944570762232829481370756359578518086990519993285655852781;
+    uint256 constant gammay1 = 4082367875863433681332203403145435568316851327593401208105741076214120093531;
+    uint256 constant gammay2 = 8495653923123431417604973247489272438418190587263600148770280649306958101930;
+    uint256 constant deltax1 = 11559732032986387107991004021392285783925812861821192530917403151452391805634;
+    uint256 constant deltax2 = 10857046999023057135944570762232829481370756359578518086990519993285655852781;
+    uint256 constant deltay1 = 4082367875863433681332203403145435568316851327593401208105741076214120093531;
+    uint256 constant deltay2 = 8495653923123431417604973247489272438418190587263600148770280649306958101930;
+
+    
+    uint256 constant IC0x = 9951854304440957729970048255417847267132931648166621883720076413912489896527;
+    uint256 constant IC0y = 14409176055818543230693338142067842611649413262894612537199808888445023112373;
+    
+    uint256 constant IC1x = 5259573331603891045109512098668147509749008117612868524737824308087424702574;
+    uint256 constant IC1y = 19525471913445311889626897591512951562906439006910912392554279452294201846276;
+    
+    uint256 constant IC2x = 11117692645622336630958982687810991395188114569363058873106896045606988623896;
+    uint256 constant IC2y = 14276217142757598463675207289976891700417433194631189996761010950688853664150;
+    
+    uint256 constant IC3x = 3527562448445671453901857866044085741707077263419661700847282228715451090636;
+    uint256 constant IC3y = 7570409468150382685653626446363808187419423223162341311148036786121924318272;
+    
+    uint256 constant IC4x = 10841264388322700588655341388056493072376766887069865783096807172059689381322;
+    uint256 constant IC4y = 14972730259646309083115284299844029307953343465611976912389044052401119428032;
+    
+ 
+    // Memory data
+    uint16 constant pVk = 0;
+    uint16 constant pPairing = 128;
+
+    uint16 constant pLastMem = 896;
+
+    function verifyProof(uint[2] calldata _pA, uint[2][2] calldata _pB, uint[2] calldata _pC, uint[4] calldata _pubSignals) public view returns (bool) {
+        assembly {
+            function checkField(v) {
+                if iszero(lt(v, r)) {
+                    mstore(0, 0)
+                    return(0, 0x20)
+                }
+            }
+            
+            // G1 function to multiply a G1 value(x,y) to value in an address
+            function g1_mulAccC(pR, x, y, s) {
+                let success
+                let mIn := mload(0x40)
+                mstore(mIn, x)
+                mstore(add(mIn, 32), y)
+                mstore(add(mIn, 64), s)
+
+                success := staticcall(sub(gas(), 2000), 7, mIn, 96, mIn, 64)
+
+                if iszero(success) {
+                    mstore(0, 0)
+                    return(0, 0x20)
+                }
+
+                mstore(add(mIn, 64), mload(pR))
+                mstore(add(mIn, 96), mload(add(pR, 32)))
+
+                success := staticcall(sub(gas(), 2000), 6, mIn, 128, pR, 64)
+
+                if iszero(success) {
+                    mstore(0, 0)
+                    return(0, 0x20)
+                }
+            }
+
+            function checkPairing(pA, pB, pC, pubSignals, pMem) -> isOk {
+                let _pPairing := add(pMem, pPairing)
+                let _pVk := add(pMem, pVk)
+
+                mstore(_pVk, IC0x)
+                mstore(add(_pVk, 32), IC0y)
+
+                // Compute the linear combination vk_x
+                
+                g1_mulAccC(_pVk, IC1x, IC1y, calldataload(add(pubSignals, 0)))
+                
+                g1_mulAccC(_pVk, IC2x, IC2y, calldataload(add(pubSignals, 32)))
+                
+                g1_mulAccC(_pVk, IC3x, IC3y, calldataload(add(pubSignals, 64)))
+                
+                g1_mulAccC(_pVk, IC4x, IC4y, calldataload(add(pubSignals, 96)))
+                
+
+                // -A
+                mstore(_pPairing, calldataload(pA))
+                mstore(add(_pPairing, 32), mod(sub(q, calldataload(add(pA, 32))), q))
+
+                // B
+                mstore(add(_pPairing, 64), calldataload(pB))
+                mstore(add(_pPairing, 96), calldataload(add(pB, 32)))
+                mstore(add(_pPairing, 128), calldataload(add(pB, 64)))
+                mstore(add(_pPairing, 160), calldataload(add(pB, 96)))
+
+                // alpha1
+                mstore(add(_pPairing, 192), alphax)
+                mstore(add(_pPairing, 224), alphay)
+
+                // beta2
+                mstore(add(_pPairing, 256), betax1)
+                mstore(add(_pPairing, 288), betax2)
+                mstore(add(_pPairing, 320), betay1)
+                mstore(add(_pPairing, 352), betay2)
+
+                // vk_x
+                mstore(add(_pPairing, 384), mload(add(pMem, pVk)))
+                mstore(add(_pPairing, 416), mload(add(pMem, add(pVk, 32))))
+
+
+                // gamma2
+                mstore(add(_pPairing, 448), gammax1)
+                mstore(add(_pPairing, 480), gammax2)
+                mstore(add(_pPairing, 512), gammay1)
+                mstore(add(_pPairing, 544), gammay2)
+
+                // C
+                mstore(add(_pPairing, 576), calldataload(pC))
+                mstore(add(_pPairing, 608), calldataload(add(pC, 32)))
+
+                // delta2
+                mstore(add(_pPairing, 640), deltax1)
+                mstore(add(_pPairing, 672), deltax2)
+                mstore(add(_pPairing, 704), deltay1)
+                mstore(add(_pPairing, 736), deltay2)
+
+
+                let success := staticcall(sub(gas(), 2000), 8, _pPairing, 768, _pPairing, 0x20)
+
+                isOk := and(success, mload(_pPairing))
+            }
+
+            let pMem := mload(0x40)
+            mstore(0x40, add(pMem, pLastMem))
+
+            // Validate that all evaluations ∈ F
+            
+            checkField(calldataload(add(_pubSignals, 0)))
+            
+            checkField(calldataload(add(_pubSignals, 32)))
+            
+            checkField(calldataload(add(_pubSignals, 64)))
+            
+            checkField(calldataload(add(_pubSignals, 96)))
+            
+
+            // Validate all evaluations
+            let isValid := checkPairing(_pA, _pB, _pC, _pubSignals, pMem)
+
+            mstore(0, isValid)
+             return(0, 0x20)
+         }
+     }
+ }