@lfdecentralizedtrust/zeto-contracts 0.2.2 → 0.5.1

package/contracts/zeto_anon_enc.sol

@@ -15,228 +15,131 @@
 // limitations under the License.
 pragma solidity ^0.8.27;
 
-import {IZeto} from "./lib/interfaces/izeto.sol";
-import {Groth16Verifier_Deposit} from "./verifiers/verifier_deposit.sol";
-import {Groth16Verifier_Withdraw} from "./verifiers/verifier_withdraw.sol";
-import {Groth16Verifier_WithdrawBatch} from "./verifiers/verifier_withdraw_batch.sol";
-import {Groth16Verifier_AnonEnc} from "./verifiers/verifier_anon_enc.sol";
-import {Groth16Verifier_AnonEncBatch} from "./verifiers/verifier_anon_enc_batch.sol";
-import {ZetoFungibleWithdraw} from "./lib/zeto_fungible_withdraw.sol";
-import {ZetoBase} from "./lib/zeto_base.sol";
-import {Commonlib} from "./lib/common.sol";
-import {IZetoInitializable} from "./lib/interfaces/izeto_initializable.sol";
-import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
+import {Commonlib} from "./lib/common/common.sol";
+import {IZetoInitializable} from "./lib/interfaces/IZetoInitializable.sol";
+import {Zeto_Anon} from "./zeto_anon.sol";
 
-uint256 constant INPUT_SIZE = 15;
-uint256 constant BATCH_INPUT_SIZE = 63;
-
-/// @title A sample implementation of a Zeto based fungible token with anonymity, and encryption
+/// @title A sample implementation of a Zeto based fungible token with
+///        anonymity and encryption (no nullifier history masking).
 /// @author Kaleido, Inc.
+/// @notice Decimals: this token uses **4** decimals, inherited from
+///         {ZetoCommon.decimals}. Indexers and UIs reading this contract
+///         directly should treat balances accordingly.
 /// @dev The proof has the following statements:
 ///        - each value in the output commitments must be a positive number in the range 0 ~ (2\*\*40 - 1)
 ///        - the sum of the input values match the sum of output values
 ///        - the hashes in the input and output match the hash(value, salt, owner public key) formula
 ///        - the sender possesses the private BabyJubjub key, whose public key is part of the pre-image of the input commitment hashes
-///        - the encrypted value in the input is derived from the receiver's UTXO value and encrypted with a shared secret using
+///        - the encrypted value in the output is derived from the receiver's UTXO value and encrypted with a shared secret using
 ///          the ECDH protocol between the sender and receiver (this guarantees data availability for the receiver)
-contract Zeto_AnonEnc is
-    IZeto,
-    IZetoInitializable,
-    ZetoBase,
-    ZetoFungibleWithdraw,
-    UUPSUpgradeable
-{
-    Groth16Verifier_AnonEnc internal _verifier;
-    Groth16Verifier_AnonEncBatch internal _batchVerifier;
+///
+///      Composes {Zeto_Anon} (transfer + ILockableCapability lifecycle) with
+///      an encryption-aware {emitTransferEvent}/{constructPublicInputs}
+///      override. The proof bytes carry the additional encryption metadata
+///      (ECDH public key, encryption nonce, encrypted values) and a
+///      Groth16 proof; we decode them in the public-inputs builder so the
+///      circuit verifies the encryption commitments alongside value
+///      conservation.
+contract Zeto_AnonEnc is Zeto_Anon {
+    /// @dev Lock the implementation contract on construction. The parent
+    ///      {Zeto_Anon} already does this via its own constructor (which
+    ///      Solidity invokes as part of every leaf's deployment), but we
+    ///      restate it here so the H-2 protection survives any future
+    ///      refactor that changes the inheritance graph.
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
 
     function initialize(
-        string memory name,
-        string memory symbol,
+        string calldata name,
+        string calldata symbol,
         address initialOwner,
         IZetoInitializable.VerifiersInfo calldata verifiers
-    ) public initializer {
-        __ZetoBase_init(name, symbol, initialOwner);
-        __ZetoFungibleWithdraw_init(
-            (Groth16Verifier_Deposit)(verifiers.depositVerifier),
-            (Groth16Verifier_Withdraw)(verifiers.withdrawVerifier),
-            (Groth16Verifier_WithdrawBatch)(verifiers.batchWithdrawVerifier)
-        );
-        _verifier = (Groth16Verifier_AnonEnc)(verifiers.verifier);
-        _batchVerifier = (Groth16Verifier_AnonEncBatch)(
-            verifiers.batchVerifier
-        );
+    ) public virtual override initializer {
+        __ZetoAnon_init(name, symbol, initialOwner, verifiers);
     }
 
-    function _authorizeUpgrade(address) internal override onlyOwner {}
+    function emitTransferEvent(
+        uint256[] memory inputs,
+        uint256[] memory outputs,
+        bytes memory proof,
+        bytes memory data
+    ) internal virtual override {
+        (
+            uint256 encryptionNonce,
+            uint256[2] memory ecdhPublicKey,
+            uint256[] memory encryptedValues,
+
+        ) = abi.decode(
+                proof,
+                (uint256, uint256[2], uint256[], Commonlib.Proof)
+            );
+        emit UTXOTransferWithEncryptedValues(
+            inputs,
+            outputs,
+            encryptionNonce,
+            ecdhPublicKey,
+            encryptedValues,
+            msg.sender,
+            data
+        );
+    }
 
+    /// @dev Layout of `proof` (ABI-encoded tuple):
+    ///        (uint256 encryptionNonce,
+    ///         uint256[2] ecdhPublicKey,
+    ///         uint256[] encryptedValues,
+    ///         Commonlib.Proof groth16Proof)
+    ///
+    ///      `inputsLocked` is ignored: the encryption circuit's public-input
+    ///      layout is identical regardless of whether the inputs were
+    ///      previously locked, since the lock state is enforced at the
+    ///      Zeto layer (via {ZetoFungible}) rather than inside the circuit.
     function constructPublicInputs(
         uint256[] memory inputs,
         uint256[] memory outputs,
-        uint256 encryptionNonce,
-        uint256[2] memory ecdhPublicKey,
-        uint256[] memory encryptedValues,
-        uint256 size
-    ) internal pure returns (uint256[] memory publicInputs) {
-        publicInputs = new uint256[](size);
+        bytes memory proof,
+        bool /* inputsLocked */
+    )
+        internal
+        view
+        virtual
+        override
+        returns (uint256[] memory, Commonlib.Proof memory)
+    {
+        (
+            uint256 encryptionNonce,
+            uint256[2] memory ecdhPublicKey,
+            uint256[] memory encryptedValues,
+            Commonlib.Proof memory proofStruct
+        ) = abi.decode(
+                proof,
+                (uint256, uint256[2], uint256[], Commonlib.Proof)
+            );
+
+        // Layout: ecdhPublicKey ++ encryptedValues ++ inputs ++ outputs ++ encryptionNonce
+        uint256 size = ecdhPublicKey.length +
+            encryptedValues.length +
+            inputs.length +
+            outputs.length +
+            1;
+        uint256[] memory publicInputs = new uint256[](size);
         uint256 piIndex = 0;
-        // copy the ecdh public key
         for (uint256 i = 0; i < ecdhPublicKey.length; ++i) {
             publicInputs[piIndex++] = ecdhPublicKey[i];
         }
-
-        // copy the encrypted value, salt and parity bit
         for (uint256 i = 0; i < encryptedValues.length; ++i) {
             publicInputs[piIndex++] = encryptedValues[i];
         }
-        // copy input commitments
         for (uint256 i = 0; i < inputs.length; i++) {
             publicInputs[piIndex++] = inputs[i];
         }
-
-        // copy output commitments
         for (uint256 i = 0; i < outputs.length; i++) {
             publicInputs[piIndex++] = outputs[i];
         }
-
-        // copy encryption nonce
         publicInputs[piIndex++] = encryptionNonce;
 
-        return publicInputs;
-    }
-
-    /**
-     * @dev the main function of the contract.
-     *
-     * @param inputs Array of UTXOs to be spent by the transaction.
-     * @param outputs Array of new UTXOs to generate, for future transactions to spend.
-     * @param proof A zero knowledge proof that the submitter is authorized to spend the inputs, and
-     *      that the outputs are valid in terms of obeying mass conservation rules.
-     *
-     * Emits a {UTXOTransferWithEncryptedValues} event.
-     */
-    function transfer(
-        uint256[] memory inputs,
-        uint256[] memory outputs,
-        uint256 encryptionNonce,
-        uint256[2] memory ecdhPublicKey,
-        uint256[] memory encryptedValues,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public returns (bool) {
-        // Check and pad commitments
-        inputs = checkAndPadCommitments(inputs);
-        outputs = checkAndPadCommitments(outputs);
-        uint256[] memory lockedOutputs;
-        validateTransactionProposal(inputs, outputs, lockedOutputs, false);
-
-        // Check the proof
-        if (inputs.length > 2 || outputs.length > 2) {
-            uint256[] memory publicInputs = constructPublicInputs(
-                inputs,
-                outputs,
-                encryptionNonce,
-                ecdhPublicKey,
-                encryptedValues,
-                BATCH_INPUT_SIZE
-            );
-            // construct the public inputs for batchVerifier
-            uint256[BATCH_INPUT_SIZE] memory fixedSizeInputs;
-            for (uint256 i = 0; i < fixedSizeInputs.length; i++) {
-                fixedSizeInputs[i] = publicInputs[i];
-            }
-
-            // Check the proof using batchVerifier
-            require(
-                _batchVerifier.verifyProof(
-                    proof.pA,
-                    proof.pB,
-                    proof.pC,
-                    fixedSizeInputs
-                ),
-                "Invalid proof (batch)"
-            );
-        } else {
-            uint256[] memory publicInputs = constructPublicInputs(
-                inputs,
-                outputs,
-                encryptionNonce,
-                ecdhPublicKey,
-                encryptedValues,
-                INPUT_SIZE
-            );
-            // construct the public inputs for verifier
-            uint256[INPUT_SIZE] memory fixedSizeInputs;
-            for (uint256 i = 0; i < fixedSizeInputs.length; i++) {
-                fixedSizeInputs[i] = publicInputs[i];
-            }
-            // Check the proof
-            require(
-                _verifier.verifyProof(
-                    proof.pA,
-                    proof.pB,
-                    proof.pC,
-                    fixedSizeInputs
-                ),
-                "Invalid proof"
-            );
-        }
-
-        processInputsAndOutputs(inputs, outputs, lockedOutputs, false);
-
-        uint256[] memory encryptedValuesArray = new uint256[](
-            encryptedValues.length
-        );
-        for (uint256 i = 0; i < encryptedValues.length; ++i) {
-            encryptedValuesArray[i] = encryptedValues[i];
-        }
-
-        emit UTXOTransferWithEncryptedValues(
-            inputs,
-            outputs,
-            encryptionNonce,
-            ecdhPublicKey,
-            encryptedValuesArray,
-            msg.sender,
-            data
-        );
-        return true;
-    }
-
-    function deposit(
-        uint256 amount,
-        uint256[] memory outputs,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public {
-        _deposit(amount, outputs, proof);
-        _mint(outputs, data);
-    }
-
-    function withdraw(
-        uint256 amount,
-        uint256[] memory inputs,
-        uint256 output,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public {
-        uint256[] memory outputs = new uint256[](inputs.length);
-        outputs[0] = output;
-        // Check and pad commitments
-        inputs = checkAndPadCommitments(inputs);
-        outputs = checkAndPadCommitments(outputs);
-        uint256[] memory lockedOutputs;
-        validateTransactionProposal(inputs, outputs, lockedOutputs, false);
-
-        _withdraw(amount, inputs, output, proof);
-
-        processInputsAndOutputs(inputs, outputs, lockedOutputs, false);
-        emit UTXOWithdraw(amount, inputs, output, msg.sender, data);
-    }
-
-    function mint(
-        uint256[] memory utxos,
-        bytes calldata data
-    ) public onlyOwner {
-        _mint(utxos, data);
+        return (publicInputs, proofStruct);
     }
 }