@lfdecentralizedtrust/zeto-contracts 0.2.2 → 0.5.1

package/contracts/zeto_anon.sol

@@ -15,21 +15,11 @@
 // limitations under the License.
 pragma solidity ^0.8.27;
 
-import {IZeto} from "./lib/interfaces/izeto.sol";
-import {Groth16Verifier_Deposit} from "./verifiers/verifier_deposit.sol";
-import {Groth16Verifier_Withdraw} from "./verifiers/verifier_withdraw.sol";
-import {Groth16Verifier_WithdrawBatch} from "./verifiers/verifier_withdraw_batch.sol";
-import {Groth16Verifier_Anon} from "./verifiers/verifier_anon.sol";
-import {Groth16Verifier_AnonBatch} from "./verifiers/verifier_anon_batch.sol";
-import {Commonlib} from "./lib/common.sol";
-import {ZetoBase} from "./lib/zeto_base.sol";
-import {IZetoInitializable} from "./lib/interfaces/izeto_initializable.sol";
-import {ZetoFungibleWithdraw} from "./lib/zeto_fungible_withdraw.sol";
+import {ZetoFungibleBase} from "./lib/zeto_fungible_base.sol";
+import {Commonlib} from "./lib/common/common.sol";
+import {IZetoInitializable} from "./lib/interfaces/IZetoInitializable.sol";
 import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
 
-uint256 constant INPUT_SIZE = 4;
-uint256 constant BATCH_INPUT_SIZE = 20;
-
 /// @title A sample implementation of a Zeto based fungible token with anonymity and no encryption
 /// @author Kaleido, Inc.
 /// @dev The proof has the following statements:
@@ -37,252 +27,108 @@ uint256 constant BATCH_INPUT_SIZE = 20;
 ///        - the sum of the input values match the sum of output values
 ///        - the hashes in the input and output match the `hash(value, salt, owner public key)` formula
 ///        - the sender possesses the private BabyJubjub key, whose public key is part of the pre-image of the input commitment hashes
-contract Zeto_Anon is
-    IZeto,
-    IZetoInitializable,
-    ZetoBase,
-    ZetoFungibleWithdraw,
-    UUPSUpgradeable
-{
-    Groth16Verifier_Anon internal _verifier;
-    Groth16Verifier_AnonBatch internal _batchVerifier;
+///
+///      Implements the {IZetoLockableCapability} lifecycle (createLock /
+///      updateLock / delegateLock / spendLock / cancelLock) by inheriting
+///      {ZetoFungibleBase}, the non-nullifier sibling of
+///      {ZetoFungibleNullifier}. Both siblings funnel locked-input spends
+///      through the same `constructPublicInputs(_, _, _, inputsLocked=true)`
+///      hook implemented below; for the anon (non-nullifier) circuit the
+///      proof and public-input layout is identical regardless of
+///      `inputsLocked`, since neither a nullifier merkle root nor an
+///      enabled-flags vector is part of the witness.
+/// @notice Decimals: this token uses **4** decimals, inherited from
+///         {ZetoCommon.decimals}. Indexers and UIs reading this contract
+///         directly should treat balances accordingly.
+/// @custom:storage erc7201:zeto.storage.Zeto_Anon — extend {ZetoAnonStorage.Layout} on upgrade (library below).
+contract Zeto_Anon is ZetoFungibleBase, UUPSUpgradeable {
+    /// @dev Lock the implementation contract on construction so that
+    ///      {initialize} can only ever run on a proxy. Without this,
+    ///      anyone could call {initialize} directly on the deployed
+    ///      implementation, become its owner, and then `upgradeTo(any)`
+    ///      via {_authorizeUpgrade} (the OZ "implementation takeover"
+    ///      pattern, CVE-2022-35961 family). See OpenZeppelin's
+    ///      `Initializable._disableInitializers` for the rationale.
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
 
     function initialize(
-        string memory name,
-        string memory symbol,
+        string calldata name,
+        string calldata symbol,
         address initialOwner,
-        VerifiersInfo calldata verifiers
+        IZetoInitializable.VerifiersInfo calldata verifiers
     ) public virtual initializer {
         __ZetoAnon_init(name, symbol, initialOwner, verifiers);
     }
 
     function __ZetoAnon_init(
-        string memory name_,
-        string memory symbol_,
+        string calldata name_,
+        string calldata symbol_,
         address initialOwner,
-        VerifiersInfo calldata verifiers
+        IZetoInitializable.VerifiersInfo calldata verifiers
     ) internal onlyInitializing {
-        __ZetoBase_init(name_, symbol_, initialOwner);
-        __ZetoFungibleWithdraw_init(
-            (Groth16Verifier_Deposit)(verifiers.depositVerifier),
-            (Groth16Verifier_Withdraw)(verifiers.withdrawVerifier),
-            (Groth16Verifier_WithdrawBatch)(verifiers.batchWithdrawVerifier)
-        );
-        _verifier = (Groth16Verifier_Anon)(verifiers.verifier);
-        _batchVerifier = (Groth16Verifier_AnonBatch)(verifiers.batchVerifier);
+        __ZetoFungibleBase_init(name_, symbol_, initialOwner, verifiers);
     }
 
     function _authorizeUpgrade(address) internal override onlyOwner {}
 
     /**
-     * @dev transfer funds by spending the input UTXOs (owned by the sender) and creating
-     * output UTXOs (owned by the receiver). Some of the output UTXOs may be owned by the
-     * sender, to return the change.
-     *
-     * @param inputs Array of UTXOs to be spent by the transaction. They must be unlocked.
-     * @param outputs Array of new UTXOs to generate, for future transactions to spend.
-     * @param proof A zero knowledge proof that the submitter is authorized to spend the inputs, and
-     *      that the outputs are valid in terms of obeying mass conservation rules.
-     *
-     * Emits a {UTXOTransfer} event.
-     */
-    function transfer(
-        uint256[] memory inputs,
-        uint256[] memory outputs,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public returns (bool) {
-        // Check and pad inputs and outputs based on the max size
-        inputs = checkAndPadCommitments(inputs);
-        outputs = checkAndPadCommitments(outputs);
-
-        uint256[] memory lockedOutputs;
-        validateTransactionProposal(inputs, outputs, lockedOutputs, false);
-        verifyProof(inputs, outputs, proof);
-
-        processInputsAndOutputs(inputs, outputs, lockedOutputs, false);
-        emit UTXOTransfer(inputs, outputs, msg.sender, data);
-
-        return true;
-    }
-
-    /**
-     * @dev transfer funds that have been previously locked by the sender. The submitted must
-     * be the current delegate of the locked UTXOs.
-     *
-     * @param inputs Array of UTXOs to be spent by the transaction, they must be locked.
-     * @param outputs Array of new UTXOs to generate, for future transactions to spend. They are unlocked.
-     * @param proof A zero knowledge proof that the submitter is authorized to spend the inputs, and
-     *      that the outputs are valid in terms of obeying mass conservation rules.
+     * @dev Construct the public-inputs vector for the anon circuit.
      *
-     * Emits a {UTXOTransfer} event.
+     *      For Zeto_Anon the proof layout is the same in both the unlocked
+     *      `transfer` flow and the locked-input `_transferLocked` flow that
+     *      runs inside {spendLock} and {cancelLock}: the witness is just
+     *      `inputs ++ outputs`. We therefore ignore `inputsLocked` here and
+     *      let `ZetoCommon.verifyProof` pick the right verifier
+     *      (`_verifier` vs `_lockVerifier`) based on the same flag. The two
+     *      verifiers are typically wired to the same Groth16 verifier
+     *      contract for this token (see scripts/tokens/Zeto_Anon.ts) so the
+     *      flag is purely a routing concern at this layer.
      */
-    function transferLocked(
-        uint256[] memory inputs,
-        uint256[] memory outputs,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public returns (bool) {
-        // Check and pad inputs and outputs based on the max size
-        inputs = checkAndPadCommitments(inputs);
-        outputs = checkAndPadCommitments(outputs);
-
-        uint256[] memory lockedOutputs;
-        validateTransactionProposal(inputs, outputs, lockedOutputs, true);
-
-        // Check the proof
-        verifyProof(inputs, outputs, proof);
-
-        processInputsAndOutputs(inputs, outputs, lockedOutputs, false);
-        emit UTXOTransfer(inputs, outputs, msg.sender, data);
-
-        return true;
-    }
-
-    function deposit(
-        uint256 amount,
-        uint256[] memory outputs,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public {
-        _deposit(amount, outputs, proof);
-        _mint(outputs, data);
-    }
-
-    function withdraw(
-        uint256 amount,
-        uint256[] memory inputs,
-        uint256 output,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public {
-        // Check and pad inputs and outputs based on the max size
-        uint256[] memory outputs = new uint256[](inputs.length);
-        outputs[0] = output;
-        inputs = checkAndPadCommitments(inputs);
-        outputs = checkAndPadCommitments(outputs);
-        uint256[] memory lockedOutputs;
-        validateTransactionProposal(inputs, outputs, lockedOutputs, false);
-
-        _withdraw(amount, inputs, output, proof);
-        processInputsAndOutputs(inputs, outputs, lockedOutputs, false);
-        emit UTXOWithdraw(amount, inputs, output, msg.sender, data);
-    }
-
-    function mint(
-        uint256[] memory utxos,
-        bytes calldata data
-    ) public onlyOwner {
-        _mint(utxos, data);
-    }
-
-    function lock(
+    function constructPublicInputs(
         uint256[] memory inputs,
         uint256[] memory outputs,
-        uint256[] memory lockedOutputs,
-        Commonlib.Proof calldata proof,
-        address delegate,
-        bytes calldata data
-    ) public {
-        validateTransactionProposal(inputs, outputs, lockedOutputs, false);
-
-        // Check the proof
-        // merge the outputs and lockedOutputs and do a regular transfer
-        uint256[] memory allOutputs = new uint256[](
-            outputs.length + lockedOutputs.length
+        bytes memory proof,
+        bool /* inputsLocked */
+    )
+        internal
+        view
+        virtual
+        override
+        returns (uint256[] memory, Commonlib.Proof memory)
+    {
+        Commonlib.Proof memory proofStruct = abi.decode(
+            proof,
+            (Commonlib.Proof)
         );
-        for (uint256 i = 0; i < outputs.length; i++) {
-            allOutputs[i] = outputs[i];
+        uint256 size = inputs.length + outputs.length;
+        uint256[] memory publicInputs = new uint256[](size);
+        uint256 piIndex = 0;
+        for (uint256 i = 0; i < inputs.length; i++) {
+            publicInputs[piIndex++] = inputs[i];
         }
-        for (uint256 i = 0; i < lockedOutputs.length; i++) {
-            allOutputs[outputs.length + i] = lockedOutputs[i];
+        for (uint256 i = 0; i < outputs.length; i++) {
+            publicInputs[piIndex++] = outputs[i];
         }
-        verifyProof(inputs, allOutputs, proof);
 
-        processInputsAndOutputs(inputs, outputs, lockedOutputs, false);
-
-        // lock the intended outputs
-        _lock(inputs, outputs, lockedOutputs, delegate, data);
-    }
-
-    function unlock(
-        uint256[] memory inputs,
-        uint256[] memory outputs,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public {
-        transferLocked(inputs, outputs, proof, data);
+        return (publicInputs, proofStruct);
     }
+}
 
-    function verifyProof(
-        uint256[] memory inputs,
-        uint256[] memory outputs,
-        Commonlib.Proof calldata proof
-    ) public view returns (bool) {
-        if (inputs.length > 2 || outputs.length > 2) {
-            uint256[] memory publicInputs = constructPublicInputs(
-                inputs,
-                outputs,
-                BATCH_INPUT_SIZE
-            );
-            // construct the public inputs for batchVerifier
-            uint256[BATCH_INPUT_SIZE] memory fixedSizeInputs;
-            for (uint256 i = 0; i < fixedSizeInputs.length; i++) {
-                fixedSizeInputs[i] = publicInputs[i];
-            }
-
-            // Check the proof using batchVerifier
-            require(
-                _batchVerifier.verifyProof(
-                    proof.pA,
-                    proof.pB,
-                    proof.pC,
-                    fixedSizeInputs
-                ),
-                "Invalid proof (batch)"
-            );
-        } else {
-            uint256[] memory publicInputs = constructPublicInputs(
-                inputs,
-                outputs,
-                INPUT_SIZE
-            );
-            // construct the public inputs for verifier
-            uint256[INPUT_SIZE] memory fixedSizeInputs;
-            for (uint256 i = 0; i < fixedSizeInputs.length; i++) {
-                fixedSizeInputs[i] = publicInputs[i];
-            }
-            // Check the proof
-            require(
-                _verifier.verifyProof(
-                    proof.pA,
-                    proof.pB,
-                    proof.pC,
-                    fixedSizeInputs
-                ),
-                "Invalid proof"
-            );
-        }
-        return true;
+/// @dev ERC-7201 (`erc7201:zeto.storage.Zeto_Anon`): reserved for leaf-only state.
+library ZetoAnonStorage {
+    struct Layout {
+        uint256 __reserved;
     }
 
-    function constructPublicInputs(
-        uint256[] memory inputs,
-        uint256[] memory outputs,
-        uint256 size
-    ) internal pure returns (uint256[] memory publicInputs) {
-        publicInputs = new uint256[](size);
-        uint256 piIndex = 0;
-        // copy input commitments
-        for (uint256 i = 0; i < inputs.length; i++) {
-            publicInputs[piIndex++] = inputs[i];
-        }
+    bytes32 private constant STORAGE_LOCATION =
+        0x55dc1d3a15de9f45cbdb6ca703ca412b79d40234f2782d90869f053dd2e9ef00;
 
-        // copy output commitments
-        for (uint256 i = 0; i < outputs.length; i++) {
-            publicInputs[piIndex++] = outputs[i];
+    function layout() internal pure returns (Layout storage $) {
+        assembly {
+            $.slot := STORAGE_LOCATION
         }
-
-        return publicInputs;
     }
 }

package/contracts/zeto_anon_burnable.sol

@@ -15,32 +15,76 @@
 // limitations under the License.
 pragma solidity ^0.8.27;
 
-import {Groth16Verifier_Burn} from "./verifiers/verifier_burn.sol";
-import {Groth16Verifier_BurnBatch} from "./verifiers/verifier_burn_batch.sol";
+import {IZetoInitializable} from "./lib/interfaces/IZetoInitializable.sol";
 import {Zeto_Anon} from "./zeto_anon.sol";
 import {ZetoFungibleBurnable} from "./lib/zeto_fungible_burn.sol";
+import {Commonlib} from "./lib/common/common.sol";
+import {ZetoCommon} from "./lib/zeto_common.sol";
 
-uint256 constant INPUT_SIZE = 4;
-uint256 constant BATCH_INPUT_SIZE = 20;
-
-/// @title A sample implementation of a Zeto based fungible token with anonymity and no encryption
+/// @title A sample implementation of a Zeto based fungible token with
+///        anonymity, no encryption, and {burn} support.
 /// @author Kaleido, Inc.
-/// @dev The proof has the following statements:
+/// @notice Decimals: this token uses **4** decimals, inherited from
+///         {ZetoCommon.decimals}. Indexers and UIs reading this contract
+///         directly should treat balances accordingly.
+/// @dev The transfer proof has the following statements:
 ///        - each value in the output commitments must be a positive number in the range 0 ~ (2\*\*40 - 1)
 ///        - the sum of the input values match the sum of output values
 ///        - the hashes in the input and output match the `hash(value, salt, owner public key)` formula
 ///        - the sender possesses the private BabyJubjub key, whose public key is part of the pre-image of the input commitment hashes
+///
+///      The burn proof has the analogous statements with the output side
+///      collapsed to a single remainder commitment.
+///
+///      Composes {Zeto_Anon} (transfer + lock lifecycle) with
+///      {ZetoFungibleBurnable} (burn entry point). Both base paths converge
+///      on the abstract {ZetoCommon.constructPublicInputs} hook, so this
+///      leaf contract must explicitly disambiguate the override; it simply
+///      forwards to {Zeto_Anon}'s implementation, which is the same proof
+///      layout used for both unlocked transfers and the locked-input spend
+///      flow inherited from {ZetoFungible}.
+///
+///      Unlike the pre-{ILockableCapability} version, there is no longer a
+///      separate `constructPublicInputsForLock` hook to override; the lock
+///      lifecycle now reuses {constructPublicInputs} with `inputsLocked = true`.
 contract Zeto_AnonBurnable is Zeto_Anon, ZetoFungibleBurnable {
+    /// @dev Lock the implementation contract on construction. The parent
+    ///      {Zeto_Anon} already does this via its own constructor (which
+    ///      Solidity invokes as part of every leaf's deployment), but we
+    ///      restate it here so the H-2 protection survives any future
+    ///      refactor that changes the inheritance graph.
+    ///      `_disableInitializers()` is idempotent, so the duplicate call
+    ///      is a harmless no-op.
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
+
     function initialize(
-        string memory name,
-        string memory symbol,
+        string calldata name,
+        string calldata symbol,
         address initialOwner,
-        VerifiersInfo calldata verifiers
+        IZetoInitializable.VerifiersInfo calldata verifiers
     ) public override initializer {
         __ZetoAnon_init(name, symbol, initialOwner, verifiers);
         __ZetoFungibleBurnable_init(
-            (Groth16Verifier_Burn)(verifiers.burnVerifier),
-            (Groth16Verifier_BurnBatch)(verifiers.batchBurnVerifier)
+            verifiers.burnVerifier,
+            verifiers.batchBurnVerifier
         );
     }
+
+    function constructPublicInputs(
+        uint256[] memory inputs,
+        uint256[] memory outputs,
+        bytes memory proof,
+        bool isLocked
+    )
+        internal
+        view
+        override(Zeto_Anon, ZetoCommon)
+        returns (uint256[] memory, Commonlib.Proof memory)
+    {
+        return
+            Zeto_Anon.constructPublicInputs(inputs, outputs, proof, isLocked);
+    }
 }