@lfdecentralizedtrust/zeto-contracts 0.2.2 → 0.5.1

package/contracts/zeto_anon_nullifier_kyc.sol

@@ -15,368 +15,63 @@
 // limitations under the License.
 pragma solidity ^0.8.27;
 
-import {IZeto} from "./lib/interfaces/izeto.sol";
-import {Groth16Verifier_Deposit} from "./verifiers/verifier_deposit.sol";
-import {Groth16Verifier_WithdrawNullifier} from "./verifiers/verifier_withdraw_nullifier.sol";
-import {Groth16Verifier_WithdrawNullifierBatch} from "./verifiers/verifier_withdraw_nullifier_batch.sol";
-import {Groth16Verifier_AnonNullifierKycTransfer} from "./verifiers/verifier_anon_nullifier_kyc_transfer.sol";
-import {Groth16Verifier_AnonNullifierKycTransferBatch} from "./verifiers/verifier_anon_nullifier_kyc_transfer_batch.sol";
-import {Groth16Verifier_AnonNullifierKycTransferLocked} from "./verifiers/verifier_anon_nullifier_kyc_transferLocked.sol";
-import {Groth16Verifier_AnonNullifierKycTransferLockedBatch} from "./verifiers/verifier_anon_nullifier_kyc_transferLocked_batch.sol";
-import {ZetoNullifier} from "./lib/zeto_nullifier.sol";
-import {ZetoFungibleWithdrawWithNullifiers} from "./lib/zeto_fungible_withdraw_nullifier.sol";
+import {Zeto_AnonNullifier} from "./zeto_anon_nullifier.sol";
 import {Registry} from "./lib/registry.sol";
-import {Commonlib} from "./lib/common.sol";
-import {IZetoInitializable} from "./lib/interfaces/izeto_initializable.sol";
-import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
-import {console} from "hardhat/console.sol";
+import {IZetoInitializable} from "./lib/interfaces/IZetoInitializable.sol";
 
-uint256 constant INPUT_SIZE = 8;
-uint256 constant BATCH_INPUT_SIZE = 32;
-uint256 constant INPUT_SIZE_LOCKED = 9;
-uint256 constant BATCH_INPUT_SIZE_LOCKED = 33;
-
-/// @title A sample implementation of a Zeto based fungible token with anonymity and history masking
+/// @title A sample implementation of a Zeto based fungible token with
+///        anonymity, history masking via nullifiers, and KYC enforcement.
 /// @author Kaleido, Inc.
+/// @notice Decimals: this token uses **4** decimals, inherited from
+///         {ZetoCommon.decimals}. Indexers and UIs reading this contract
+///         directly should treat balances accordingly.
 /// @dev The proof has the following statements:
 ///        - each value in the output commitments must be a positive number in the range 0 ~ (2\*\*40 - 1)
 ///        - the sum of the nullified values match the sum of output values
 ///        - the hashes in the input and output match the hash(value, salt, owner public key) formula
 ///        - the sender possesses the private BabyJubjub key, whose public key is part of the pre-image of the input commitment hashes, which match the corresponding nullifiers
 ///        - the nullifiers represent input commitments that are included in a Sparse Merkle Tree represented by the root hash
-contract Zeto_AnonNullifierKyc is
-    IZeto,
-    IZetoInitializable,
-    ZetoNullifier,
-    ZetoFungibleWithdrawWithNullifiers,
-    Registry,
-    UUPSUpgradeable
-{
-    Groth16Verifier_AnonNullifierKycTransfer internal _verifier;
-    Groth16Verifier_AnonNullifierKycTransferBatch internal _batchVerifier;
-    Groth16Verifier_AnonNullifierKycTransferLocked internal _lockVerifier;
-    Groth16Verifier_AnonNullifierKycTransferLockedBatch
-        internal _batchLockVerifier;
+///        - the input/output owners are members of the {Registry}'s identities tree
+///
+///      The {extraInputs} / {extraInputsForDeposit} overrides surface the
+///      identities tree's root as an additional public input to the
+///      transfer / deposit circuits, which is what wires KYC enforcement
+///      into the same proof system used for value conservation.
+contract Zeto_AnonNullifierKyc is Zeto_AnonNullifier, Registry {
+    /// @dev Lock the implementation contract on construction. The parent
+    ///      {Zeto_AnonNullifier} already does this via its own constructor
+    ///      (which Solidity invokes as part of every leaf's deployment),
+    ///      but we restate it here so the H-2 protection survives any
+    ///      future refactor that changes the inheritance graph.
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
+    }
 
     function initialize(
-        string memory name,
-        string memory symbol,
+        string calldata name,
+        string calldata symbol,
         address initialOwner,
         IZetoInitializable.VerifiersInfo calldata verifiers
-    ) public initializer {
+    ) public override initializer {
+        __ZetoAnonNullifier_init(name, symbol, initialOwner, verifiers);
         __Registry_init();
-        __ZetoNullifier_init(name, symbol, initialOwner);
-        __ZetoFungibleWithdrawWithNullifiers_init(
-            (Groth16Verifier_Deposit)(verifiers.depositVerifier),
-            (Groth16Verifier_WithdrawNullifier)(verifiers.withdrawVerifier),
-            (Groth16Verifier_WithdrawNullifierBatch)(
-                verifiers.batchWithdrawVerifier
-            )
-        );
-        _verifier = (Groth16Verifier_AnonNullifierKycTransfer)(
-            verifiers.verifier
-        );
-        _batchVerifier = (Groth16Verifier_AnonNullifierKycTransferBatch)(
-            verifiers.batchVerifier
-        );
-        _lockVerifier = (Groth16Verifier_AnonNullifierKycTransferLocked)(
-            verifiers.lockVerifier
-        );
-        _batchLockVerifier = (
-            Groth16Verifier_AnonNullifierKycTransferLockedBatch
-        )(verifiers.batchLockVerifier);
-    }
-
-    function _authorizeUpgrade(address) internal override onlyOwner {}
-
-    function constructPublicInputs(
-        uint256[] memory nullifiers,
-        uint256[] memory outputs,
-        uint256 root,
-        uint256 size,
-        bool locked
-    ) internal view returns (uint256[] memory publicInputs) {
-        publicInputs = new uint256[](size);
-        uint256 piIndex = 0;
-        // copy input nullifiers
-        for (uint256 i = 0; i < nullifiers.length; i++) {
-            publicInputs[piIndex++] = nullifiers[i];
-        }
-        // when verifying locked transfers, additional public input
-        // for the lock delegate
-        if (locked) {
-            publicInputs[piIndex++] = uint256(uint160(msg.sender));
-        }
-
-        // copy root
-        publicInputs[piIndex++] = root;
-
-        // populate enables
-        for (uint256 i = 0; i < nullifiers.length; i++) {
-            publicInputs[piIndex++] = (nullifiers[i] == 0) ? 0 : 1;
-        }
-
-        // copy identities root
-        publicInputs[piIndex++] = getIdentitiesRoot();
-
-        // copy output commitments
-        for (uint256 i = 0; i < outputs.length; i++) {
-            publicInputs[piIndex++] = outputs[i];
-        }
-
-        return publicInputs;
-    }
-
-    /**
-     * @dev the main function of the contract.
-     *
-     * @param nullifiers Array of nullifiers that are secretly bound to UTXOs to be spent by the transaction.
-     * @param outputs Array of new UTXOs to generate, for future transactions to spend.
-     * @param root The root hash of the Sparse Merkle Tree that contains the nullifiers.
-     * @param proof A zero knowledge proof that the submitter is authorized to spend the inputs, and
-     *      that the outputs are valid in terms of obeying mass conservation rules.
-     *
-     * Emits a {UTXOTransfer} event.
-     */
-    function transfer(
-        uint256[] memory nullifiers,
-        uint256[] memory outputs,
-        uint256 root,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public returns (bool) {
-        // Check and pad inputs and outputs based on the max size
-        nullifiers = checkAndPadCommitments(nullifiers);
-        outputs = checkAndPadCommitments(outputs);
-        validateTransactionProposal(nullifiers, outputs, root, false);
-        verifyProof(nullifiers, outputs, root, proof);
-        uint256[] memory empty;
-        processInputsAndOutputs(nullifiers, outputs, empty, address(0));
-
-        uint256[] memory nullifierArray = new uint256[](nullifiers.length);
-        uint256[] memory outputArray = new uint256[](outputs.length);
-        for (uint256 i = 0; i < nullifiers.length; ++i) {
-            nullifierArray[i] = nullifiers[i];
-            outputArray[i] = outputs[i];
-        }
-        emit UTXOTransfer(nullifierArray, outputArray, msg.sender, data);
-        return true;
-    }
-
-    function transferLocked(
-        uint256[] memory nullifiers,
-        uint256[] memory outputs,
-        uint256 root,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public returns (bool) {
-        nullifiers = checkAndPadCommitments(nullifiers);
-        outputs = checkAndPadCommitments(outputs);
-        validateTransactionProposal(nullifiers, outputs, root, true);
-        verifyProofLocked(nullifiers, outputs, root, proof);
-        uint256[] memory empty;
-        processInputsAndOutputs(nullifiers, outputs, empty, address(0));
-
-        uint256[] memory nullifierArray = new uint256[](nullifiers.length);
-        uint256[] memory outputArray = new uint256[](outputs.length);
-        for (uint256 i = 0; i < nullifiers.length; ++i) {
-            nullifierArray[i] = nullifiers[i];
-            outputArray[i] = outputs[i];
-        }
-        emit UTXOTransfer(nullifierArray, outputArray, msg.sender, data);
-        return true;
     }
 
-    function deposit(
-        uint256 amount,
-        uint256[] memory outputs,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public {
-        _deposit(amount, outputs, proof);
-        _mint(outputs, data);
+    function extraInputs() internal view override returns (uint256[] memory) {
+        uint256[] memory extras = new uint256[](1);
+        extras[0] = getIdentitiesRoot();
+        return extras;
     }
 
-    function withdraw(
-        uint256 amount,
-        uint256[] memory nullifiers,
-        uint256 output,
-        uint256 root,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public {
-        uint256[] memory outputs = new uint256[](nullifiers.length);
-        outputs[0] = output;
-        // Check and pad inputs and outputs based on the max size
-        nullifiers = checkAndPadCommitments(nullifiers);
-        outputs = checkAndPadCommitments(outputs);
-        validateTransactionProposal(nullifiers, outputs, root, false);
-
-        _withdrawWithNullifiers(amount, nullifiers, output, root, proof);
-        uint256[] memory empty;
-        processInputsAndOutputs(nullifiers, outputs, empty, address(0));
-        emit UTXOWithdraw(amount, nullifiers, output, msg.sender, data);
-    }
-
-    function mint(
-        uint256[] memory utxos,
-        bytes calldata data
-    ) public onlyOwner {
-        _mint(utxos, data);
-    }
-
-    function lock(
-        uint256[] memory nullifiers,
-        uint256[] memory outputs,
-        uint256[] memory lockedOutputs,
-        uint256 root,
-        Commonlib.Proof calldata proof,
-        address delegate,
-        bytes calldata data
-    ) public {
-        // merge the outputs and lockedOutputs and do a regular transfer
-        uint256[] memory allOutputs = new uint256[](
-            outputs.length + lockedOutputs.length
-        );
-        for (uint256 i = 0; i < outputs.length; i++) {
-            allOutputs[i] = outputs[i];
-        }
-        for (uint256 i = 0; i < lockedOutputs.length; i++) {
-            allOutputs[outputs.length + i] = lockedOutputs[i];
-        }
-        nullifiers = checkAndPadCommitments(nullifiers);
-        allOutputs = checkAndPadCommitments(allOutputs);
-        validateTransactionProposal(nullifiers, allOutputs, root, false);
-        verifyProof(nullifiers, allOutputs, root, proof);
-
-        processNullifiers(nullifiers);
-
-        // lock the intended outputs
-        _lock(nullifiers, outputs, lockedOutputs, delegate, data);
-    }
-
-    function unlock(
-        uint256[] memory nullifiers,
-        uint256[] memory outputs,
-        uint256 root,
-        Commonlib.Proof calldata proof,
-        bytes calldata data
-    ) public {
-        transferLocked(nullifiers, outputs, root, proof, data);
-    }
-
-    function verifyProof(
-        uint256[] memory nullifiers,
-        uint256[] memory outputs,
-        uint256 root,
-        Commonlib.Proof calldata proof
-    ) public view returns (bool) {
-        // Check the proof
-        if (nullifiers.length > 2 || outputs.length > 2) {
-            uint256[] memory publicInputs = constructPublicInputs(
-                nullifiers,
-                outputs,
-                root,
-                BATCH_INPUT_SIZE,
-                false
-            );
-            // construct the public inputs for batchVerifier
-            uint256[BATCH_INPUT_SIZE] memory fixedSizeInputs;
-            for (uint256 i = 0; i < fixedSizeInputs.length; i++) {
-                fixedSizeInputs[i] = publicInputs[i];
-            }
-
-            // Check the proof using batchVerifier
-            require(
-                _batchVerifier.verifyProof(
-                    proof.pA,
-                    proof.pB,
-                    proof.pC,
-                    fixedSizeInputs
-                ),
-                "Invalid proof (batch)"
-            );
-        } else {
-            uint256[] memory publicInputs = constructPublicInputs(
-                nullifiers,
-                outputs,
-                root,
-                INPUT_SIZE,
-                false
-            );
-            // construct the public inputs for verifier
-            uint256[INPUT_SIZE] memory fixedSizeInputs;
-            for (uint256 i = 0; i < fixedSizeInputs.length; i++) {
-                fixedSizeInputs[i] = publicInputs[i];
-            }
-            // Check the proof
-            require(
-                _verifier.verifyProof(
-                    proof.pA,
-                    proof.pB,
-                    proof.pC,
-                    fixedSizeInputs
-                ),
-                "Invalid proof"
-            );
-        }
-        return true;
-    }
-
-    function verifyProofLocked(
-        uint256[] memory nullifiers,
-        uint256[] memory outputs,
-        uint256 root,
-        Commonlib.Proof calldata proof
-    ) public view returns (bool) {
-        if (nullifiers.length > 2 || outputs.length > 2) {
-            uint256[] memory publicInputs = constructPublicInputs(
-                nullifiers,
-                outputs,
-                root,
-                BATCH_INPUT_SIZE_LOCKED,
-                true
-            );
-            // construct the public inputs for batchVerifier
-            uint256[BATCH_INPUT_SIZE_LOCKED] memory fixedSizeInputs;
-            for (uint256 i = 0; i < fixedSizeInputs.length; i++) {
-                fixedSizeInputs[i] = publicInputs[i];
-            }
-
-            // Check the proof using batchVerifier
-            require(
-                _batchLockVerifier.verifyProof(
-                    proof.pA,
-                    proof.pB,
-                    proof.pC,
-                    fixedSizeInputs
-                ),
-                "Invalid proof (batch)"
-            );
-        } else {
-            uint256[] memory publicInputs = constructPublicInputs(
-                nullifiers,
-                outputs,
-                root,
-                INPUT_SIZE_LOCKED,
-                true
-            );
-            // construct the public inputs for verifier
-            uint256[INPUT_SIZE_LOCKED] memory fixedSizeInputs;
-            for (uint256 i = 0; i < fixedSizeInputs.length; i++) {
-                fixedSizeInputs[i] = publicInputs[i];
-            }
-            // Check the proof
-            require(
-                _lockVerifier.verifyProof(
-                    proof.pA,
-                    proof.pB,
-                    proof.pC,
-                    fixedSizeInputs
-                ),
-                "Invalid proof"
-            );
-        }
-        return true;
+    function extraInputsForDeposit()
+        internal
+        view
+        override
+        returns (uint256[] memory)
+    {
+        uint256[] memory extras = new uint256[](1);
+        extras[0] = getIdentitiesRoot();
+        return extras;
     }
 }