@lfdecentralizedtrust/zeto-contracts 0.2.2 → 0.5.1

package/test/zeto_anon_nullifier.ts

@@ -14,11 +14,18 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-import { ethers, network } from "hardhat";
-import { ContractTransactionReceipt, Signer, BigNumberish, lock } from "ethers";
+import { ethers, network, upgrades } from "hardhat";
+import {
+  ContractTransactionReceipt,
+  Signer,
+  BigNumberish,
+  AbiCoder,
+  ZeroAddress,
+} from "ethers";
 import { expect } from "chai";
-import { loadCircuit, Poseidon, encodeProof } from "zeto-js";
-import { groth16 } from "snarkjs";
+import * as chai from "chai";
+chai.config.truncateThreshold = 0; // disable truncating
+import { loadCircuit, Poseidon } from "zeto-js";
 import { Merkletree, InMemoryDB, str2Bytes } from "@iden3/js-merkletree";
 import {
   UTXO,
@@ -29,15 +36,30 @@ import {
   doMint,
   ZERO_UTXO,
   parseUTXOEvents,
+  logger,
 } from "./lib/utils";
 import {
   loadProvingKeys,
   prepareDepositProof,
   prepareNullifierWithdrawProof,
-  prepareNullifierBurnProof,
+  encodeToBytesForDeposit,
+  encodeToBytesForWithdraw,
+  inflateUtxos,
+  inflateOwners,
+  calculateSpendHash,
+  calculateCancelHash,
 } from "./utils";
+import {
+  prepareProof as prepareProofForLocked,
+  encodeToBytes as encodeToBytesForLocked,
+} from "./lib/anon_zeto_helpers";
+import {
+  prepareProof,
+  encodeToBytes,
+} from "./lib/anon_nullifier_helpers";
 import { deployZeto } from "./lib/deploy";
-import { Zeto_AnonNullifier, Zeto_AnonNullifierBurnable } from "../typechain-types";
+import { Zeto_AnonNullifier } from "../typechain-types";
+import smt from "../ignition/modules/test/smt";
 
 describe("Zeto based fungible token with anonymity using nullifiers without encryption", function () {
   let deployer: Signer;
@@ -46,14 +68,6 @@ describe("Zeto based fungible token with anonymity using nullifiers without encr
   let Charlie: User;
   let erc20: any;
   let zeto: Zeto_AnonNullifier;
-  let zetoBurnable: Zeto_AnonNullifierBurnable;
-  let utxo100: UTXO;
-  let utxo1: UTXO;
-  let utxo2: UTXO;
-  let utxo3: UTXO;
-  let utxo4: UTXO;
-  let utxo7: UTXO;
-  let utxo9: UTXO;
   let circuit: any, provingKey: any;
   let circuitForLocked: any, provingKeyForLocked: any;
   let batchCircuit: any, batchProvingKey: any;
@@ -61,19 +75,21 @@ describe("Zeto based fungible token with anonymity using nullifiers without encr
   let smtBob: Merkletree;
 
   before(async function () {
+    // skip the tests if this is called by other test modules to use the exported test functions
+    if (process.env.SKIP_ANON_NULLIFIER_TESTS === "true") {
+      this.skip();
+    }
     if (network.name !== "hardhat") {
       // accommodate for longer block times on public networks
       this.timeout(120000);
     }
-
-    let [d, a, b, c] = await ethers.getSigners();
+    let [d, a, b, c, e] = await ethers.getSigners();
     deployer = d;
     Alice = await newUser(a);
     Bob = await newUser(b);
     Charlie = await newUser(c);
 
     ({ deployer, zeto, erc20 } = await deployZeto("Zeto_AnonNullifier"));
-    ({ zeto: zetoBurnable } = await deployZeto("Zeto_AnonNullifierBurnable"));
 
     const storage1 = new InMemoryDB(str2Bytes(""));
     smtAlice = new Merkletree(storage1, true, 64);
@@ -85,14 +101,24 @@ describe("Zeto based fungible token with anonymity using nullifiers without encr
     ({ provingKeyFile: provingKey } = loadProvingKeys(
       "anon_nullifier_transfer",
     ));
-    circuitForLocked = await loadCircuit("anon_nullifier_transferLocked");
-    ({ provingKeyFile: provingKeyForLocked } = loadProvingKeys(
-      "anon_nullifier_transferLocked",
-    ));
     batchCircuit = await loadCircuit("anon_nullifier_transfer_batch");
     ({ provingKeyFile: batchProvingKey } = loadProvingKeys(
       "anon_nullifier_transfer_batch",
     ));
+    // for consuming locked UTXOs, we always use the "regular" circuit,
+    // because the locked UTXOs are always tracked in their own base storage,
+    // regardless of which token type is being used. This means for the nullifier-based token,
+    // where the unlocked UTXOs are tracked in SMTs, processing unlocked UTXOs require the
+    // circuits based on SMT proofs, while the locked UTXOs are processed using the "base" circuit.
+    circuitForLocked = await loadCircuit("anon");
+    ({ provingKeyFile: provingKeyForLocked } = loadProvingKeys("anon"));
+  });
+
+  beforeEach(async function () {
+    // skip the tests if this is called by other test modules to use the exported test functions
+    if (process.env.SKIP_ANON_NULLIFIER_TESTS === "true") {
+      this.skip();
+    }
   });
 
   it("onchain SMT root should be equal to the offchain SMT root", async function () {
@@ -102,917 +128,1199 @@ describe("Zeto based fungible token with anonymity using nullifiers without encr
     expect(root.string()).to.equal(onchainRoot.toString());
   });
 
-  it("(batch) mint to Alice and batch transfer 10 UTXOs honestly to Bob & Charlie then withdraw should succeed", async function () {
-    // first mint the tokens for batch testing
-    const inputUtxos = [];
-    const nullifiers = [];
-    for (let i = 0; i < 10; i++) {
-      // mint 10 utxos
-      const _utxo = newUTXO(1, Alice);
-      nullifiers.push(newNullifier(_utxo, Alice));
-      inputUtxos.push(_utxo);
-    }
-    const mintResult = await doMint(zeto, deployer, inputUtxos);
-
-    const mintEvents = parseUTXOEvents(zeto, mintResult);
-    const mintedHashes = mintEvents[0].outputs;
-    for (let i = 0; i < mintedHashes.length; i++) {
-      if (mintedHashes[i] !== 0) {
-        await smtAlice.add(mintedHashes[i], mintedHashes[i]);
-        await smtBob.add(mintedHashes[i], mintedHashes[i]);
-      }
-    }
-    // Alice generates inclusion proofs for the UTXOs to be spent
-    let root = await smtAlice.root();
-    const mtps = [];
-    for (let i = 0; i < inputUtxos.length; i++) {
-      const p = await smtAlice.generateCircomVerifierProof(
-        inputUtxos[i].hash,
-        root,
-      );
-      mtps.push(p.siblings.map((s) => s.bigInt()));
-    }
-    const aliceUTXOsToBeWithdrawn = [
-      newUTXO(1, Alice),
-      newUTXO(1, Alice),
-      newUTXO(1, Alice),
-    ];
-    // Alice proposes the output UTXOs, 1 utxo to bob, 1 utxo to charlie and 3 utxos to alice
-    const _bOut1 = newUTXO(6, Bob);
-    const _bOut2 = newUTXO(1, Charlie);
-
-    const outputUtxos = [_bOut1, _bOut2, ...aliceUTXOsToBeWithdrawn];
-    const outputOwners = [Bob, Charlie, Alice, Alice, Alice];
-    const inflatedOutputUtxos = [...outputUtxos];
-    const inflatedOutputOwners = [...outputOwners];
-    for (let i = 0; i < 10 - outputUtxos.length; i++) {
-      inflatedOutputUtxos.push(ZERO_UTXO);
-      inflatedOutputOwners.push(Bob);
-    }
-    // Alice transfers her UTXOs to Bob
-    const result = await doTransfer(
-      Alice,
-      inputUtxos,
-      nullifiers,
-      inflatedOutputUtxos,
-      root.bigInt(),
-      mtps,
-      inflatedOutputOwners,
+  // H-2: implementation contracts must be initialization-locked so an
+  // attacker cannot call initialize() directly on the impl, become its
+  // owner, and then upgradeTo(any) via _authorizeUpgrade (the OZ
+  // "implementation takeover" pattern, CVE-2022-35961 family). We test
+  // against the *actual deployed* implementation (read from the EIP-1967
+  // impl slot on the proxy) so this asserts the production deployment
+  // path produces a locked impl, not just that a redeployed contract
+  // would be locked.
+  it("initialize() reverts on the bare Zeto_AnonNullifier implementation contract", async function () {
+    const implAddress = await upgrades.erc1967.getImplementationAddress(
+      await zeto.getAddress(),
     );
-
-    const signerAddress = await Alice.signer.getAddress();
-    const events = parseUTXOEvents(zeto, result.txResult!);
-    expect(events[0].submitter).to.equal(signerAddress);
-    expect(events[0].inputs).to.deep.equal(nullifiers.map((n) => n.hash));
-
-    const incomingUTXOs: any = events[0].outputs;
-    // check the non-empty output hashes are correct
-    for (let i = 0; i < outputUtxos.length; i++) {
-      // Bob uses the information received from Alice to reconstruct the UTXO sent to him
-      const receivedValue = outputUtxos[i].value;
-      const receivedSalt = outputUtxos[i].salt;
-      const hash = Poseidon.poseidon4([
-        BigInt(receivedValue),
-        receivedSalt,
-        outputOwners[i].babyJubPublicKey[0],
-        outputOwners[i].babyJubPublicKey[1],
-      ]);
-      expect(incomingUTXOs[i]).to.equal(hash);
-      await smtAlice.add(incomingUTXOs[i], incomingUTXOs[i]);
-      await smtBob.add(incomingUTXOs[i], incomingUTXOs[i]);
-    }
-
-    // check empty hashes are empty
-    for (let i = outputUtxos.length; i < 10; i++) {
-      expect(incomingUTXOs[i]).to.equal(0);
-    }
-
-    // mint sufficient balance in Zeto contract address for Alice to withdraw
-    const mintTx = await erc20.connect(deployer).mint(zeto, 3);
-    await mintTx.wait();
-    const startingBalance = await erc20.balanceOf(Alice.ethAddress);
-
-    // Alice generates the nullifiers for the UTXOs to be spent
-    root = await smtAlice.root();
-    const inflatedWithdrawNullifiers = [];
-    const inflatedWithdrawInputs = [];
-    const inflatedWithdrawMTPs = [];
-    for (let i = 0; i < aliceUTXOsToBeWithdrawn.length; i++) {
-      inflatedWithdrawInputs.push(aliceUTXOsToBeWithdrawn[i]);
-      inflatedWithdrawNullifiers.push(
-        newNullifier(aliceUTXOsToBeWithdrawn[i], Alice),
-      );
-      const _withdrawUTXOProof = await smtAlice.generateCircomVerifierProof(
-        aliceUTXOsToBeWithdrawn[i].hash,
-        root,
-      );
-      inflatedWithdrawMTPs.push(
-        _withdrawUTXOProof.siblings.map((s) => s.bigInt()),
-      );
-    }
-    // Alice generates inclusion proofs for the UTXOs to be spent
-
-    for (let i = aliceUTXOsToBeWithdrawn.length; i < 10; i++) {
-      inflatedWithdrawInputs.push(ZERO_UTXO);
-      inflatedWithdrawNullifiers.push(ZERO_UTXO);
-      const _zeroProof = await smtAlice.generateCircomVerifierProof(0n, root);
-      inflatedWithdrawMTPs.push(_zeroProof.siblings.map((s) => s.bigInt()));
-    }
-
-    const {
-      nullifiers: _withdrawNullifiers,
-      outputCommitments: withdrawCommitments,
-      encodedProof: withdrawEncodedProof,
-    } = await prepareNullifierWithdrawProof(
-      Alice,
-      inflatedWithdrawInputs,
-      inflatedWithdrawNullifiers,
-      ZERO_UTXO,
-      root.bigInt(),
-      inflatedWithdrawMTPs,
-    );
-
-    // Alice withdraws her UTXOs to ERC20 tokens
-    const tx = await zeto
-      .connect(Alice.signer)
-      .withdraw(
-        3,
-        _withdrawNullifiers,
-        withdrawCommitments[0],
-        root.bigInt(),
-        withdrawEncodedProof,
-        "0x",
-      );
-    await tx.wait();
-
-    // Alice checks her ERC20 balance
-    const endingBalance = await erc20.balanceOf(Alice.ethAddress);
-    expect(endingBalance - startingBalance).to.be.equal(3);
-  }).timeout(60000);
-
-  it("mint ERC20 tokens to Alice to deposit to Zeto should succeed", async function () {
-    const startingBalance = await erc20.balanceOf(Alice.ethAddress);
-    const tx = await erc20.connect(deployer).mint(Alice.ethAddress, 100);
-    await tx.wait();
-    const endingBalance = await erc20.balanceOf(Alice.ethAddress);
-    expect(endingBalance - startingBalance).to.be.equal(100);
-
-    const tx1 = await erc20.connect(Alice.signer).approve(zeto.target, 100);
-    await tx1.wait();
-
-    utxo100 = newUTXO(100, Alice);
-    const utxo0 = newUTXO(0, Alice);
-    const { outputCommitments, encodedProof } = await prepareDepositProof(
-      Alice,
-      [utxo0, utxo100],
-    );
-    const tx2 = await zeto
-      .connect(Alice.signer)
-      .deposit(100, outputCommitments, encodedProof, "0x");
-    await tx2.wait();
-
-    await smtAlice.add(utxo100.hash, utxo100.hash);
-    await smtAlice.add(utxo0.hash, utxo0.hash);
-    await smtBob.add(utxo100.hash, utxo100.hash);
-    await smtBob.add(utxo0.hash, utxo0.hash);
+    const impl = await ethers.getContractAt("Zeto_AnonNullifier", implAddress);
+    await expect(
+      impl.initialize("Z", "Z", await Alice.signer.getAddress(), {
+        verifier: ZeroAddress,
+        depositVerifier: ZeroAddress,
+        withdrawVerifier: ZeroAddress,
+        lockVerifier: ZeroAddress,
+        burnVerifier: ZeroAddress,
+        batchVerifier: ZeroAddress,
+        batchWithdrawVerifier: ZeroAddress,
+        batchLockVerifier: ZeroAddress,
+        batchBurnVerifier: ZeroAddress,
+      }),
+    ).to.be.revertedWithCustomError(impl, "InvalidInitialization");
   });
 
-  it("mint to Alice and transfer UTXOs honestly to Bob should succeed", async function () {
-    const startingBalance = await erc20.balanceOf(Alice.ethAddress);
-    // The authority mints a new UTXO and assigns it to Alice
-    utxo1 = newUTXO(10, Alice);
-    utxo2 = newUTXO(20, Alice);
-    const result1 = await doMint(zeto, deployer, [utxo1, utxo2]);
-
-    // check the private mint activity is not exposed in the ERC20 contract
-    const afterMintBalance = await erc20.balanceOf(Alice.ethAddress);
-    expect(afterMintBalance).to.equal(startingBalance);
-
-    // Alice locally tracks the UTXOs inside the Sparse Merkle Tree
-    // hardhat doesn't have a good way to subscribe to events so we have to parse the Tx result object
-    const mintEvents = parseUTXOEvents(zeto, result1);
-    const [_utxo1, _utxo2] = mintEvents[0].outputs;
-    await smtAlice.add(_utxo1, _utxo1);
-    await smtAlice.add(_utxo2, _utxo2);
-    let root = await smtAlice.root();
-    let onchainRoot = await zeto.getRoot();
-    expect(root.string()).to.equal(onchainRoot.toString());
-    // Bob also locally tracks the UTXOs inside the Sparse Merkle Tree
-    await smtBob.add(_utxo1, _utxo1);
-    await smtBob.add(_utxo2, _utxo2);
-
-    // Alice proposes the output UTXOs for the transfer to Bob
-    const _utxo3 = newUTXO(25, Bob);
-    utxo4 = newUTXO(5, Alice);
-
-    // Alice generates the nullifiers for the UTXOs to be spent
-    const nullifier1 = newNullifier(utxo1, Alice);
-    const nullifier2 = newNullifier(utxo2, Alice);
-
-    // Alice generates inclusion proofs for the UTXOs to be spent
-    const proof1 = await smtAlice.generateCircomVerifierProof(utxo1.hash, root);
-    const proof2 = await smtAlice.generateCircomVerifierProof(utxo2.hash, root);
-    const merkleProofs = [
-      proof1.siblings.map((s) => s.bigInt()),
-      proof2.siblings.map((s) => s.bigInt()),
-    ];
-
-    // Alice transfers her UTXOs to Bob
-    const result2 = await doTransfer(
-      Alice,
-      [utxo1, utxo2],
-      [nullifier1, nullifier2],
-      [_utxo3, utxo4],
-      root.bigInt(),
-      merkleProofs,
-      [Bob, Alice],
-    );
-
-    // check the private transfer activity is not exposed in the ERC20 contract
-    const afterTransferBalance = await erc20.balanceOf(Alice.ethAddress);
-    expect(afterTransferBalance).to.equal(startingBalance);
-
-    // Alice locally tracks the UTXOs inside the Sparse Merkle Tree
-    await smtAlice.add(_utxo3.hash, _utxo3.hash);
-    await smtAlice.add(utxo4.hash, utxo4.hash);
-    root = await smtAlice.root();
-    onchainRoot = await zeto.getRoot();
-    expect(root.string()).to.equal(onchainRoot.toString());
-
-    // Bob locally tracks the UTXOs inside the Sparse Merkle Tree
-    // Bob parses the UTXOs from the onchain event
-    const signerAddress = await Alice.signer.getAddress();
-    const events = parseUTXOEvents(zeto, result2.txResult!);
-    expect(events[0].submitter).to.equal(signerAddress);
-    expect(events[0].inputs).to.deep.equal([nullifier1.hash, nullifier2.hash]);
-    expect(events[0].outputs).to.deep.equal([_utxo3.hash, utxo4.hash]);
-    await smtBob.add(events[0].outputs[0], events[0].outputs[0]);
-    await smtBob.add(events[0].outputs[1], events[0].outputs[1]);
-
-    // Bob uses the information received from Alice to reconstruct the UTXO sent to him
-    const receivedValue = _utxo3.value!;
-    const receivedSalt = _utxo3.salt;
-    const incomingUTXOs: any = events[0].outputs;
-    const hash = Poseidon.poseidon4([
-      BigInt(receivedValue),
-      receivedSalt,
-      Bob.babyJubPublicKey[0],
-      Bob.babyJubPublicKey[1],
-    ]);
-    expect(incomingUTXOs[0]).to.equal(hash);
-
-    // Bob uses the received values to construct the UTXO received from the transaction
-    utxo3 = newUTXO(receivedValue, Bob, receivedSalt);
-  }).timeout(600000);
-
-  it("Bob transfers UTXOs, previously received from Alice, honestly to Charlie should succeed", async function () {
-    // Bob generates the nullifiers for the UTXO to be spent
-    const nullifier1 = newNullifier(utxo3, Bob);
-
-    // Bob generates inclusion proofs for the UTXOs to be spent, as private input to the proof generation
-    const root = await smtBob.root();
-    const proof1 = await smtBob.generateCircomVerifierProof(utxo3.hash, root);
-    const proof2 = await smtBob.generateCircomVerifierProof(0n, root);
-    const merkleProofs = [
-      proof1.siblings.map((s) => s.bigInt()),
-      proof2.siblings.map((s) => s.bigInt()),
-    ];
-
-    // Bob proposes the output UTXOs
-    const utxo6 = newUTXO(10, Charlie);
-    utxo7 = newUTXO(15, Bob);
-
-    // Bob should be able to spend the UTXO that was reconstructed from the previous transaction
-    const result = await doTransfer(
-      Bob,
-      [utxo3, ZERO_UTXO],
-      [nullifier1, ZERO_UTXO],
-      [utxo6, utxo7],
-      root.bigInt(),
-      merkleProofs,
-      [Charlie, Bob],
-    );
-
-    // Bob keeps the local SMT in sync
-    await smtBob.add(utxo6.hash, utxo6.hash);
-    await smtBob.add(utxo7.hash, utxo7.hash);
-
-    // Alice gets the new UTXOs from the onchain event and keeps the local SMT in sync
-    const events = parseUTXOEvents(zeto, result.txResult!);
-    await smtAlice.add(events[0].outputs[0], events[0].outputs[0]);
-    await smtAlice.add(events[0].outputs[1], events[0].outputs[1]);
-  }).timeout(600000);
+  describe("batch transfers", () => {
+    let inputUtxos: UTXO[];
+    let nullifiers: UTXO[];
+    let outputUtxos: UTXO[];
+    let outputOwners: User[];
+    let aliceUTXOsToBeWithdrawn: UTXO[];
+    let txResult: any;
 
-  it("Alice withdraws her UTXOs to ERC20 tokens should succeed", async function () {
-    const startingBalance = await erc20.balanceOf(Alice.ethAddress);
-
-    // Alice generates the nullifiers for the UTXOs to be spent
-    const nullifier1 = newNullifier(utxo100, Alice);
-
-    // Alice generates inclusion proofs for the UTXOs to be spent
-    let root = await smtAlice.root();
-    const proof1 = await smtAlice.generateCircomVerifierProof(
-      utxo100.hash,
-      root,
-    );
-    const proof2 = await smtAlice.generateCircomVerifierProof(0n, root);
-    const merkleProofs = [
-      proof1.siblings.map((s) => s.bigInt()),
-      proof2.siblings.map((s) => s.bigInt()),
-    ];
+    beforeEach(async function () {
+      // this.skip();
+    });
 
-    // Alice proposes the output ERC20 tokens
-    const withdrawChangesUTXO = newUTXO(20, Alice);
+    it("mint 10 UTXOs to Alice", async function () {
+      // first mint the tokens for batch testing
+      inputUtxos = [];
+      nullifiers = [];
+      for (let i = 0; i < 10; i++) {
+        // mint 10 utxos
+        const _utxo = newUTXO(1, Alice);
+        nullifiers.push(newNullifier(_utxo, Alice));
+        inputUtxos.push(_utxo);
+      }
+      const mintResult = await doMint(zeto, deployer, inputUtxos);
+
+      const mintEvents = parseUTXOEvents(zeto, mintResult);
+      const mintedHashes = mintEvents[0].outputs;
+      for (let i = 0; i < mintedHashes.length; i++) {
+        if (mintedHashes[i] !== 0) {
+          await smtAlice.add(mintedHashes[i], mintedHashes[i]);
+          await smtBob.add(mintedHashes[i], mintedHashes[i]);
+        }
+      }
+    });
 
-    const { nullifiers, outputCommitments, encodedProof } =
-      await prepareNullifierWithdrawProof(
+    it("Alice transfers some UTXOs to Bob and Charlie", async function () {
+      // Batched proof generation routinely runs ~38–40s on a warm machine;
+      // the mocha default of 40s flakes on cold starts. Mirror the explicit
+      // timeout already used for the batch-withdraw it() below.
+      this.timeout(60000);
+      // Alice generates inclusion proofs for the UTXOs to be spent
+      let root = await smtAlice.root();
+      const mtps = [];
+      for (let i = 0; i < inputUtxos.length; i++) {
+        const p = await smtAlice.generateCircomVerifierProof(
+          inputUtxos[i].hash,
+          root,
+        );
+        mtps.push(p.siblings.map((s) => s.bigInt()));
+      }
+      aliceUTXOsToBeWithdrawn = [
+        newUTXO(1, Alice),
+        newUTXO(1, Alice),
+        newUTXO(1, Alice),
+      ];
+      // Alice proposes the output UTXOs, 1 utxo to bob, 1 utxo to charlie and 3 utxos to alice
+      const _bOut1 = newUTXO(6, Bob);
+      const _bOut2 = newUTXO(1, Charlie);
+
+      outputUtxos = [_bOut1, _bOut2, ...aliceUTXOsToBeWithdrawn];
+      outputOwners = [Bob, Charlie, Alice, Alice, Alice];
+      // Alice transfers her UTXOs to Bob
+      txResult = await doTransfer(
         Alice,
-        [utxo100, ZERO_UTXO],
-        [nullifier1, ZERO_UTXO],
-        withdrawChangesUTXO,
-        root.bigInt(),
-        merkleProofs,
-      );
-
-    // Alice withdraws her UTXOs to ERC20 tokens
-    const tx = await zeto
-      .connect(Alice.signer)
-      .withdraw(
-        80,
+        inputUtxos,
         nullifiers,
-        outputCommitments[0],
+        outputUtxos,
         root.bigInt(),
-        encodedProof,
-        "0x",
+        mtps,
+        outputOwners,
       );
-    await tx.wait();
-
-    // Alice tracks the UTXO inside the SMT
-    await smtAlice.add(withdrawChangesUTXO.hash, withdrawChangesUTXO.hash);
-    // Bob also locally tracks the UTXOs inside the SMT
-    await smtBob.add(withdrawChangesUTXO.hash, withdrawChangesUTXO.hash);
-
-    // Alice checks her ERC20 balance
-    const endingBalance = await erc20.balanceOf(Alice.ethAddress);
-    expect(endingBalance - startingBalance).to.be.equal(80);
-  });
+    });
 
-  it("(burnable) mint to Alice and burn should succeed", async function () {
-    // first mint the tokens
-    const inputUtxos = [];
-    const nullifiers = [];
-    for (let i = 0; i < 2; i++) {
-      const _utxo = newUTXO(1, Alice);
-      nullifiers.push(newNullifier(_utxo, Alice));
-      inputUtxos.push(_utxo);
-    }
-    const mintResult = await doMint(zetoBurnable, deployer, inputUtxos);
-    const outputUtxo = newUTXO(0, Alice);
+    it("check the transfer is successful", async function () {
+      const signerAddress = await Alice.signer.getAddress();
+      const events = parseUTXOEvents(zeto, txResult);
+      expect(events[0].submitter).to.equal(signerAddress);
+      expect(events[0].inputs).to.deep.equal(nullifiers.map((n) => n.hash));
+
+      const incomingUTXOs: any = events[0].outputs;
+      // check the non-empty output hashes are correct
+      for (let i = 0; i < outputUtxos.length; i++) {
+        // Bob uses the information received from Alice to reconstruct the UTXO sent to him
+        const receivedValue = outputUtxos[i].value;
+        const receivedSalt = outputUtxos[i].salt;
+        const hash = Poseidon.poseidon4([
+          BigInt(receivedValue),
+          receivedSalt,
+          outputOwners[i].babyJubPublicKey[0],
+          outputOwners[i].babyJubPublicKey[1],
+        ]);
+        expect(incomingUTXOs[i]).to.equal(hash);
+        await smtAlice.add(incomingUTXOs[i], incomingUTXOs[i]);
+        await smtBob.add(incomingUTXOs[i], incomingUTXOs[i]);
+      }
+    });
 
-    const storage1 = new InMemoryDB(str2Bytes(""));
-    const smtAliceBurnable = new Merkletree(storage1, true, 64);
+    it("Alice withdraws her UTXOs to ERC20 tokens", async function () {
+      // mint sufficient balance in Zeto contract address for Alice to withdraw
+      const mintTx = await erc20.connect(deployer).mint(zeto, 3);
+      await mintTx.wait();
+      const startingBalance = await erc20.balanceOf(Alice.ethAddress);
 
-    const mintEvents = parseUTXOEvents(zetoBurnable, mintResult);
-    const mintedHashes = mintEvents[0].outputs;
-    for (let i = 0; i < mintedHashes.length; i++) {
-      if (mintedHashes[i] !== 0) {
-        await smtAliceBurnable.add(mintedHashes[i], mintedHashes[i]);
+      // Alice generates the nullifiers for the UTXOs to be spent
+      const root = await smtAlice.root();
+      const inflatedWithdrawNullifiers = [];
+      const inflatedWithdrawInputs = [];
+      const inflatedWithdrawMTPs = [];
+      for (let i = 0; i < aliceUTXOsToBeWithdrawn.length; i++) {
+        inflatedWithdrawInputs.push(aliceUTXOsToBeWithdrawn[i]);
+        inflatedWithdrawNullifiers.push(
+          newNullifier(aliceUTXOsToBeWithdrawn[i], Alice),
+        );
+        const _withdrawUTXOProof = await smtAlice.generateCircomVerifierProof(
+          aliceUTXOsToBeWithdrawn[i].hash,
+          root,
+        );
+        inflatedWithdrawMTPs.push(
+          _withdrawUTXOProof.siblings.map((s) => s.bigInt()),
+        );
       }
-    }
-
-    // Alice generates inclusion proofs for the UTXOs to be spent
-    let root = await smtAliceBurnable.root();
-    const mtps = [];
-    for (let i = 0; i < inputUtxos.length; i++) {
-      const p = await smtAliceBurnable.generateCircomVerifierProof(
-        inputUtxos[i].hash,
-        root,
-      );
-      mtps.push(p.siblings.map((s) => s.bigInt()));
-    }
+      // Alice generates inclusion proofs for the UTXOs to be spent
 
-    // Alice generates the nullifiers for the UTXOs to be burnt
-    const {
-      nullifiers: _burnNullifiers,
-      outputCommitment,
-      encodedProof,
-    } = await prepareNullifierBurnProof(
-      Alice,
-      inputUtxos,
-      outputUtxo,
-      nullifiers,
-      root.bigInt(),
-      mtps,
-    );
+      for (let i = aliceUTXOsToBeWithdrawn.length; i < 10; i++) {
+        inflatedWithdrawInputs.push(ZERO_UTXO);
+        inflatedWithdrawNullifiers.push(ZERO_UTXO);
+        const _zeroProof = await smtAlice.generateCircomVerifierProof(0n, root);
+        inflatedWithdrawMTPs.push(_zeroProof.siblings.map((s) => s.bigInt()));
+      }
 
-    // Alice withdraws her UTXOs to ERC20 tokens
-    const tx = await zetoBurnable
-      .connect(Alice.signer)
-      .burn(
-        _burnNullifiers,
-        outputCommitment,
+      const {
+        nullifiers: _withdrawNullifiers,
+        outputCommitments: withdrawCommitments,
+        encodedProof: withdrawEncodedProof,
+      } = await prepareNullifierWithdrawProof(
+        Alice,
+        inflatedWithdrawInputs,
+        inflatedWithdrawNullifiers,
+        ZERO_UTXO,
         root.bigInt(),
-        encodedProof,
-        "0x",
+        inflatedWithdrawMTPs,
       );
-    await tx.wait();
-  }).timeout(60000);
-
-  describe("lock() tests", function () {
-    let lockedUtxo1: UTXO;
-    let smtBobForLocked: Merkletree;
-    let utxo10: UTXO;
-    let utxo11: UTXO;
-    let utxo12: UTXO;
 
-    before(async function () {
-      const storage1 = new InMemoryDB(str2Bytes(""));
-      smtBobForLocked = new Merkletree(storage1, true, 64);
+      // Alice withdraws her UTXOs to ERC20 tokens
+      const tx = await zeto
+        .connect(Alice.signer)
+        .withdraw(
+          3,
+          _withdrawNullifiers,
+          withdrawCommitments[0],
+          encodeToBytesForWithdraw(root.bigInt(), withdrawEncodedProof),
+          "0x",
+        );
+      const result1 = await tx.wait();
+      logger.debug(`Method withdraw() complete. Gas used: ${result1?.gasUsed}`);
 
-      // mint a UTXO for Bob and spend it (to use it in a failure case test)
-      utxo12 = newUTXO(1, Alice);
-      await doMint(zeto, deployer, [utxo12]);
-      await smtAlice.add(utxo12.hash, utxo12.hash);
-      await smtBob.add(utxo12.hash, utxo12.hash);
+      // Alice checks her ERC20 balance
+      const endingBalance = await erc20.balanceOf(Alice.ethAddress);
+      expect(endingBalance - startingBalance).to.be.equal(3);
+    }).timeout(60000);
+  });
 
-      const _utxo1 = newUTXO(1, Bob);
-      const nullifier1 = newNullifier(utxo12, Alice);
-      let root = await smtAlice.root();
-      const proof1 = await smtAlice.generateCircomVerifierProof(
-        utxo12.hash,
-        root,
-      );
-      const proof2 = await smtAlice.generateCircomVerifierProof(
-        utxo12.hash,
-        root,
-      );
-      const merkleProofs = [
-        proof1.siblings.map((s) => s.bigInt()),
-        proof2.siblings.map((s) => s.bigInt()),
-      ];
+  describe("mint, deposit, transfer, withdraw flows", () => {
+    let aliceUtxo30: UTXO;
+    let aliceUtxo70: UTXO;
 
-      await doTransfer(
-        Alice,
-        [utxo12, ZERO_UTXO],
-        [nullifier1, ZERO_UTXO],
-        [_utxo1, ZERO_UTXO],
-        root.bigInt(),
-        merkleProofs,
-        [Bob, Alice],
-      );
-      await smtAlice.add(_utxo1.hash, _utxo1.hash);
-      await smtBob.add(_utxo1.hash, _utxo1.hash);
+    beforeEach(async function () {
+      // this.skip();
     });
 
-    describe("lock -> transfer flow", function () {
-      it("lock() should succeed when using unlocked states", async function () {
-        const nullifier1 = newNullifier(utxo7, Bob);
-        lockedUtxo1 = newUTXO(utxo7.value!, Bob);
-        const root = await smtBob.root();
-        const proof1 = await smtBob.generateCircomVerifierProof(
-          utxo7.hash,
-          root,
-        );
-        const proof2 = await smtBob.generateCircomVerifierProof(0n, root);
-        const merkleProofs = [
-          proof1.siblings.map((s) => s.bigInt()),
-          proof2.siblings.map((s) => s.bigInt()),
-        ];
-        const { outputCommitments, encodedProof } = await prepareProof(
-          circuit,
-          provingKey,
-          Bob,
-          [utxo7, ZERO_UTXO],
-          [nullifier1, ZERO_UTXO],
-          [lockedUtxo1, ZERO_UTXO],
-          root.bigInt(),
-          merkleProofs,
-          [Bob, Bob],
-        );
+    describe("Shielding ERC20 tokens to Zeto privacy tokens", async function () {
+      it("mint ERC20 tokens to Alice", async function () {
+        const startingBalance = await erc20.balanceOf(Alice.ethAddress);
+        const tx = await erc20.connect(deployer).mint(Alice.ethAddress, 100);
+        await tx.wait();
+        const endingBalance = await erc20.balanceOf(Alice.ethAddress);
+        expect(endingBalance - startingBalance).to.be.equal(100);
+      });
 
-        const tx = await zeto.connect(Bob.signer).lock(
-          [nullifier1.hash],
-          [],
-          outputCommitments,
-          root.bigInt(),
-          encodedProof,
-          Alice.ethAddress, // make Alice the delegate who can spend the state (if she has the right proof)
-          "0x",
-        );
-        const result: ContractTransactionReceipt | null = await tx.wait();
+      it("Alice approves the Zeto contract to spend her ERC20 tokens, to prepare for the deposit", async function () {
+        const tx1 = await erc20.connect(Alice.signer).approve(zeto.target, 100);
+        await tx1.wait();
+      });
 
-        // Note that the locked UTXO should NOT be added to the local SMT for UTXOs because it's tracked in a separate SMT onchain
-        // we add it to the local SMT for locked UTXOs
-        const events = parseUTXOEvents(zeto, result!);
-        await smtBobForLocked.add(
-          events[0].lockedOutputs[0],
-          ethers.toBigInt(events[0].delegate),
+      it("Alice deposits her ERC20 tokens to Zeto, and get shielded UTXOs in return", async function () {
+        aliceUtxo30 = newUTXO(30, Alice);
+        aliceUtxo70 = newUTXO(70, Alice);
+        const { outputCommitments, encodedProof } = await prepareDepositProof(
+          Alice,
+          [aliceUtxo30, aliceUtxo70],
         );
+        const tx2 = await zeto
+          .connect(Alice.signer)
+          .deposit(
+            100,
+            outputCommitments,
+            encodeToBytesForDeposit(encodedProof),
+            "0x",
+          );
+        const result = await tx2.wait();
+        logger.debug(`Method deposit() complete. Gas used: ${result?.gasUsed}`);
+
+        await smtAlice.add(aliceUtxo30.hash, aliceUtxo30.hash);
+        await smtAlice.add(aliceUtxo70.hash, aliceUtxo70.hash);
+        await smtBob.add(aliceUtxo30.hash, aliceUtxo30.hash);
+        await smtBob.add(aliceUtxo70.hash, aliceUtxo70.hash);
       });
+    });
+
+    describe("Transferring privacy tokens", async function () {
+      let value1: any;
+      let salt1: bigint;
+      let transferEvent: any;
 
-      it("onchain SMT root for the locked UTXOs should be equal to the offchain SMT root", async function () {
-        const root = await smtBobForLocked.root();
-        const onchainRoot = await zeto.getRootForLocked();
-        expect(root.string()).to.equal(onchainRoot.toString());
+      it("Check the onchain SMT root for the unlocked UTXOs should be equal to the offchain SMT root", async function () {
+        const onchainRoot = await zeto.getRoot();
+        const aliceRoot = await smtAlice.root();
+        expect(aliceRoot.string()).to.equal(onchainRoot.toString());
+        const bobRoot = await smtBob.root();
+        expect(bobRoot.string()).to.equal(onchainRoot.toString());
       });
 
-      it("lock() should fail when trying to lock again by not as the current delegate", async function () {
-        if (network.name !== "hardhat") {
-          return;
-        }
+      it("Alice transfers her privacy tokens to Bob", async function () {
+        // Alice proposes the output UTXOs for the transfer to Bob
+        // 25 to Bob
+        const _utxo1 = newUTXO(25, Bob);
+        // 5 back to Alice as change
+        const _utxo2 = newUTXO(5, Alice);
 
-        // the owner of the locked UTXO can generate the proper proof to spend the locked state,
-        // but not able to lock again because it's not the current delegate
-        const nullifier1 = newNullifier(lockedUtxo1, Bob);
-        const utxo1 = newUTXO(lockedUtxo1.value!, Bob);
-        const root = await smtBobForLocked.root();
-        const proof1 = await smtBobForLocked.generateCircomVerifierProof(
-          lockedUtxo1.hash,
-          root,
-        );
-        const proof2 = await smtBobForLocked.generateCircomVerifierProof(
-          0n,
+        // Alice will share these secrets with Bob when she performs the transfer
+        value1 = _utxo1.value!;
+        salt1 = _utxo1.salt!;
+
+        // Alice generates the nullifiers for the UTXOs to be spent
+        const nullifier1 = newNullifier(aliceUtxo30, Alice);
+
+        // Alice generates inclusion proofs for the UTXOs to be spent
+        const root = await smtAlice.root();
+        const proof1 = await smtAlice.generateCircomVerifierProof(
+          aliceUtxo30.hash,
           root,
         );
+        const proof2 = await smtAlice.generateCircomVerifierProof(0n, root);
         const merkleProofs = [
           proof1.siblings.map((s) => s.bigInt()),
           proof2.siblings.map((s) => s.bigInt()),
         ];
-        const { outputCommitments, encodedProof } = await prepareProof(
-          circuitForLocked,
-          provingKeyForLocked,
-          Bob,
-          [lockedUtxo1, ZERO_UTXO],
+
+        // Alice transfers her UTXOs to Bob
+        const result2 = await doTransfer(
+          Alice,
+          [aliceUtxo30, ZERO_UTXO],
           [nullifier1, ZERO_UTXO],
-          [utxo1, ZERO_UTXO],
+          [_utxo1, _utxo2],
           root.bigInt(),
           merkleProofs,
-          [Bob, Bob],
-          Alice.ethAddress,
+          [Bob, Alice],
         );
 
-        await expect(
-          zeto
-            .connect(Bob.signer)
-            .lock(
-              [nullifier1.hash],
-              [],
-              outputCommitments,
-              root.bigInt(),
-              encodedProof,
-              Charlie.ethAddress,
-              "0x",
-            ),
-        ).to.be.rejectedWith("UTXORootNotFound");
-      });
+        // Alice locally tracks the UTXOs inside the Sparse Merkle Tree
+        await smtAlice.add(_utxo1.hash, _utxo1.hash);
+        await smtAlice.add(_utxo2.hash, _utxo2.hash);
 
-      it("the original owner can NOT spend the locked state", async function () {
-        // Bob generates inclusion proofs for the UTXOs to be spent, as private input to the proof generation
-        const nullifier1 = newNullifier(lockedUtxo1, Bob);
-        const root = await smtBobForLocked.root();
-        const proof1 = await smtBobForLocked.generateCircomVerifierProof(
-          lockedUtxo1.hash,
-          root,
-        );
-        const proof2 = await smtBobForLocked.generateCircomVerifierProof(
-          0n,
-          root,
-        );
-        const merkleProofs = [
-          proof1.siblings.map((s) => s.bigInt()),
-          proof2.siblings.map((s) => s.bigInt()),
-        ];
-        // Bob proposes the output UTXOs, attempting to transfer the locked UTXO to Charlie
-        utxo9 = newUTXO(15, Charlie);
+        const events = parseUTXOEvents(zeto, result2);
+        transferEvent = events[0];
+        const signerAddress = await Alice.signer.getAddress();
+        expect(transferEvent.submitter).to.equal(signerAddress);
+      });
 
-        // Bob should NOT be able to spend the UTXO which has been locked and delegated to Alice
-        await expect(
-          doTransfer(
+      describe("Bob can spend the tokens received from Alice", async function () {
+        let bobUtxo25: UTXO;
+        let transferEventToCharlie: any;
+
+        it("Bob locally tracks the new UTXOs inside the Sparse Merkle Tree", async function () {
+          // Bob parses the UTXOs from the onchain event
+          // and add them to the local SMT
+          await smtBob.add(transferEvent.outputs[0], transferEvent.outputs[0]);
+          await smtBob.add(transferEvent.outputs[1], transferEvent.outputs[1]);
+
+          // Bob uses the received values to construct the UTXO received from the transaction
+          bobUtxo25 = newUTXO(value1, Bob, salt1);
+          // Bob verifies the UTXO is valid onchain
+          expect(bobUtxo25.hash).to.equal(transferEvent.outputs[0]);
+        });
+
+        it("Bob transfers UTXOs, previously received from Alice, honestly to Charlie should succeed", async function () {
+          // Bob generates the nullifiers for the UTXO to be spent
+          const nullifier1 = newNullifier(bobUtxo25, Bob);
+
+          // Bob generates inclusion proofs for the UTXOs to be spent, as private input to the proof generation
+          const root = await smtBob.root();
+          const proof1 = await smtBob.generateCircomVerifierProof(
+            bobUtxo25.hash,
+            root,
+          );
+          const proof2 = await smtBob.generateCircomVerifierProof(0n, root);
+          const merkleProofs = [
+            proof1.siblings.map((s) => s.bigInt()),
+            proof2.siblings.map((s) => s.bigInt()),
+          ];
+
+          // Bob proposes the output UTXOs
+          const _utxo1 = newUTXO(10, Charlie);
+          const _utxo2 = newUTXO(15, Bob);
+
+          // Bob should be able to spend the UTXO that was reconstructed from the previous transaction
+          const result = await doTransfer(
             Bob,
-            [lockedUtxo1, ZERO_UTXO],
+            [bobUtxo25, ZERO_UTXO],
             [nullifier1, ZERO_UTXO],
-            [utxo9, ZERO_UTXO],
+            [_utxo1, _utxo2],
             root.bigInt(),
             merkleProofs,
             [Charlie, Bob],
-            Alice,
-          ),
-        ).to.be.rejectedWith("Invalid proof"); // due to the lockDelegate part of the public input not matching the current delegate
+          );
+
+          // Bob keeps the local SMT in sync
+          await smtBob.add(_utxo1.hash, _utxo1.hash);
+          await smtBob.add(_utxo2.hash, _utxo2.hash);
+
+          const events = parseUTXOEvents(zeto, result);
+          transferEventToCharlie = events[0];
+        });
+
+        it("Alice gets the new UTXOs from the onchain event and keeps the local SMT in sync", async function () {
+          await smtAlice.add(
+            transferEventToCharlie.outputs[0],
+            transferEventToCharlie.outputs[0],
+          );
+          await smtAlice.add(
+            transferEventToCharlie.outputs[1],
+            transferEventToCharlie.outputs[1],
+          );
+        });
       });
+    });
 
-      it("the original owner can NOT withdraw the locked state", async function () {
-        // Bob generates inclusion proofs for the UTXOs to be spent, as private input to the proof generation
-        const nullifier1 = newNullifier(lockedUtxo1, Bob);
-        const root = await smtBobForLocked.root();
-        const proof1 = await smtBobForLocked.generateCircomVerifierProof(
-          lockedUtxo1.hash,
-          root,
-        );
-        const proof2 = await smtBobForLocked.generateCircomVerifierProof(
-          0n,
+    describe("Alice withdraws her UTXOs back to ERC20 tokens", async function () {
+      let startingBalance: any;
+      let withdrawEvent: any;
+
+      it("Alice withdraws her UTXOs to ERC20 tokens should succeed", async function () {
+        startingBalance = await erc20.balanceOf(Alice.ethAddress);
+
+        // Alice generates the nullifiers for the UTXOs to be spent
+        const nullifier1 = newNullifier(aliceUtxo70, Alice);
+
+        // Alice generates inclusion proofs for the UTXOs to be spent
+        let root = await smtAlice.root();
+        const proof1 = await smtAlice.generateCircomVerifierProof(
+          aliceUtxo70.hash,
           root,
         );
+        const proof2 = await smtAlice.generateCircomVerifierProof(0n, root);
         const merkleProofs = [
           proof1.siblings.map((s) => s.bigInt()),
           proof2.siblings.map((s) => s.bigInt()),
         ];
 
-        const utxo1 = newUTXO(5, Bob);
+        // Alice proposes the output ERC20 tokens
+        const withdrawChangesUTXO = newUTXO(20, Alice);
 
-        await expect(
-          prepareNullifierWithdrawProof(
-            Bob,
-            [lockedUtxo1, ZERO_UTXO],
+        const { nullifiers, outputCommitments, encodedProof } =
+          await prepareNullifierWithdrawProof(
+            Alice,
+            [aliceUtxo70, ZERO_UTXO],
             [nullifier1, ZERO_UTXO],
-            utxo1,
+            withdrawChangesUTXO,
             root.bigInt(),
             merkleProofs,
-          ),
-        ).to.be.rejectedWith("SMTVerifier_249 line: 134");
-      });
+          );
 
-      it("attempting to use an existing UTXO as output should fail", async function () {
-        // Bob generates inclusion proofs for the UTXOs to be spent, as private input to the proof generation
-        const nullifier1 = newNullifier(lockedUtxo1, Bob);
-        const root = await smtBobForLocked.root();
-        const proof1 = await smtBobForLocked.generateCircomVerifierProof(
-          lockedUtxo1.hash,
-          root,
+        // Alice withdraws her UTXOs to ERC20 tokens
+        const tx = await zeto
+          .connect(Alice.signer)
+          .withdraw(
+            50,
+            nullifiers,
+            outputCommitments[0],
+            encodeToBytesForWithdraw(root.bigInt(), encodedProof),
+            "0x",
+          );
+        const result = await tx.wait();
+        logger.debug(
+          `Method withdraw() complete. Gas used: ${result?.gasUsed}`,
         );
-        const proof2 = await smtBobForLocked.generateCircomVerifierProof(
-          0n,
+
+        // Alice tracks the UTXO inside the SMT
+        await smtAlice.add(withdrawChangesUTXO.hash, withdrawChangesUTXO.hash);
+        const events = parseUTXOEvents(zeto, result);
+        withdrawEvent = events[1];
+      });
+
+      it("Bob also locally tracks the new UTXOs from the withdraw event inside the SMT", async function () {
+        await smtBob.add(withdrawEvent.output, withdrawEvent.output);
+      });
+
+      it("Alice checks her ERC20 balance", async function () {
+        const endingBalance = await erc20.balanceOf(Alice.ethAddress);
+        expect(endingBalance - startingBalance).to.be.equal(50);
+      });
+    });
+  });
+
+  describe("ILockableCapability tests", function () {
+    // ABI fragments for the ZetoLockableCapability *Args payloads.
+    const CREATE_ARGS_ABI =
+      "tuple(bytes32 txId, uint256[] inputs, uint256[] outputs, uint256[] lockedOutputs, bytes proof)";
+    const UPDATE_ARGS_ABI = "tuple(bytes32 txId)";
+    const DELEGATE_ARGS_ABI = "tuple(bytes32 txId)";
+    const SPEND_ARGS_ABI =
+      "tuple(bytes32 txId, uint256[] lockedOutputs, uint256[] outputs, bytes proof, bytes data)";
+
+    function encodeCreateArgs(args: {
+      txId: string;
+      inputs: BigNumberish[];
+      outputs: BigNumberish[];
+      lockedOutputs: BigNumberish[];
+      proof: string;
+    }) {
+      return new AbiCoder().encode([CREATE_ARGS_ABI], [args]);
+    }
+
+    function encodeUpdateArgs(txId: string) {
+      return new AbiCoder().encode([UPDATE_ARGS_ABI], [{ txId }]);
+    }
+
+    function encodeDelegateArgs(txId: string) {
+      return new AbiCoder().encode([DELEGATE_ARGS_ABI], [{ txId }]);
+    }
+
+    function encodeSpendArgs(args: {
+      txId: string;
+      lockedOutputs: BigNumberish[];
+      outputs: BigNumberish[];
+      proof: string;
+      data: string;
+    }) {
+      return new AbiCoder().encode([SPEND_ARGS_ABI], [args]);
+    }
+
+    function randomBytes32(): string {
+      return ethers.hexlify(ethers.randomBytes(32));
+    }
+
+    beforeEach(async function () {
+      // this.skip();
+    });
+
+    describe("createLock -> updateLock -> delegateLock -> spendLock flow", function () {
+      let bobUtxo1: UTXO;
+      let aliceUtxo1: UTXO;
+      let lockedUtxo1: UTXO;
+      let lockId: string;
+      let outputUtxo1: UTXO;
+      let outputUtxo2: UTXO;
+      let unlockHash: string;
+
+      before(async function () {
+        bobUtxo1 = newUTXO(100, Bob);
+        await doMint(zeto, deployer, [bobUtxo1]);
+        await smtAlice.add(bobUtxo1.hash, bobUtxo1.hash);
+        await smtBob.add(bobUtxo1.hash, bobUtxo1.hash);
+
+        aliceUtxo1 = newUTXO(100, Alice);
+        await doMint(zeto, deployer, [aliceUtxo1]);
+        await smtAlice.add(aliceUtxo1.hash, aliceUtxo1.hash);
+        await smtBob.add(aliceUtxo1.hash, aliceUtxo1.hash);
+      });
+
+      it("createLock() with deterministic lockId computed from txId", async function () {
+        const nullifier1 = newNullifier(bobUtxo1, Bob);
+        lockedUtxo1 = newUTXO(bobUtxo1.value!, Bob);
+        const root = await smtBob.root();
+        const p1 = await smtBob.generateCircomVerifierProof(
+          bobUtxo1.hash,
           root,
         );
+        const p2 = await smtBob.generateCircomVerifierProof(0n, root);
         const merkleProofs = [
-          proof1.siblings.map((s) => s.bigInt()),
-          proof2.siblings.map((s) => s.bigInt()),
+          p1.siblings.map((s) => s.bigInt()),
+          p2.siblings.map((s) => s.bigInt()),
         ];
-        // Bob proposes the output UTXOs, attempting to transfer the locked UTXO to Alice
-        // and reusing an existing UTXO (utxo4)
-        const utxo1 = newUTXO(10, Alice);
-
-        const result = await prepareProof(
-          circuitForLocked,
-          provingKeyForLocked,
+        const encodedZkProof = await prepareProof(
+          circuit,
+          provingKey,
           Bob,
-          [lockedUtxo1, ZERO_UTXO],
+          [bobUtxo1, ZERO_UTXO],
           [nullifier1, ZERO_UTXO],
-          [utxo4, utxo1],
+          [lockedUtxo1, ZERO_UTXO],
           root.bigInt(),
           merkleProofs,
-          [Alice, Alice],
-          Alice.ethAddress, // current lock delegate
+          [Bob, Bob],
         );
-        const nullifiers = [nullifier1.hash];
 
-        // Alice (in reality this is usually a contract that orchestrates a trade flow) can spend the locked state
-        // using the proof generated by the trade counterparty (Bob in this case)
-        await expect(
-          sendTx(
-            Alice,
-            nullifiers,
-            result.outputCommitments,
-            root.bigInt(),
-            result.encodedProof,
-            true,
-          ),
-        ).to.be.rejectedWith(`UTXOAlreadyOwned(${utxo4.hash.toString()})`);
+        const txId = randomBytes32();
+        const createArgs = encodeCreateArgs({
+          txId,
+          inputs: [nullifier1.hash],
+          outputs: [],
+          lockedOutputs: [lockedUtxo1.hash],
+          proof: encodeToBytes(root.bigInt(), encodedZkProof),
+        });
+
+        // Pre-compute lockId off-chain and compare against contract.
+        const predicted = await zeto
+          .connect(Bob.signer)
+          .computeLockId(createArgs);
+        lockId = predicted;
+
+        const tx = await zeto
+          .connect(Bob.signer)
+          .createLock(createArgs, ethers.ZeroHash, ethers.ZeroHash, "0x");
+        const result: ContractTransactionReceipt | null = await tx.wait();
+        logger.debug(`createLock() complete. Gas used: ${result?.gasUsed}`);
+
+        // Expect a LockCreated event with the predicted lockId.
+        const created = result!.logs
+          .map((l) => {
+            try {
+              return zeto.interface.parseLog(l as any);
+            } catch (_e) {
+              return null;
+            }
+          })
+          .find((p) => p && p.name === "LockCreated");
+        expect(created, "LockCreated event not found").to.not.be.null;
+        expect(created!.args.lockId).to.equal(predicted);
+        expect(created!.args.owner).to.equal(Bob.ethAddress);
+        expect(created!.args.spender).to.equal(Bob.ethAddress);
       });
 
-      it("attempting to use a spent UTXO as output should fail", async function () {
-        // Bob generates inclusion proofs for the UTXOs to be spent, as private input to the proof generation
-        const nullifier1 = newNullifier(lockedUtxo1, Bob);
-        const root = await smtBobForLocked.root();
-        const proof1 = await smtBobForLocked.generateCircomVerifierProof(
-          lockedUtxo1.hash,
-          root,
-        );
-        const proof2 = await smtBobForLocked.generateCircomVerifierProof(
-          0n,
-          root,
+      it("isLockActive() and getLock() reflect the newly created lock", async function () {
+        expect(await zeto.isLockActive(lockId)).to.equal(true);
+        const info = await zeto.getLock(lockId);
+        expect(info.owner).to.equal(Bob.ethAddress);
+        expect(info.spender).to.equal(Bob.ethAddress);
+        expect(info.spendCommitment).to.equal(ethers.ZeroHash);
+        expect(info.cancelCommitment).to.equal(ethers.ZeroHash);
+      });
+
+      it("locked() returns true for locked UTXOs and false for unlocked or spent UTXOs", async function () {
+        expect(await zeto.locked(lockedUtxo1.hash)).to.deep.equal([
+          true,
+          Bob.ethAddress,
+        ]);
+        expect((await zeto.locked(aliceUtxo1.hash))[0]).to.be.false;
+        expect((await zeto.locked(bobUtxo1.hash))[0]).to.be.false;
+      });
+
+      it("updateLock() commits the spend hash while owner == spender", async function () {
+        outputUtxo1 = newUTXO(10, Alice);
+        outputUtxo2 = newUTXO(90, Bob);
+
+        unlockHash = calculateSpendHash(
+          [lockedUtxo1],
+          [],
+          [outputUtxo1, outputUtxo2],
+          "0x",
         );
-        const merkleProofs = [
-          proof1.siblings.map((s) => s.bigInt()),
-          proof2.siblings.map((s) => s.bigInt()),
-        ];
-        // Bob proposes the output UTXOs, attempting to transfer the locked UTXO to Alice
-        // and reusing an unlocked spent UTXO (utxo12)
-        const utxo1 = newUTXO(14, Alice);
 
-        const result = await prepareProof(
+        const tx = await zeto
+          .connect(Bob.signer)
+          .updateLock(
+            lockId,
+            encodeUpdateArgs(randomBytes32()),
+            unlockHash,
+            ethers.ZeroHash,
+            "0x",
+          );
+        const result: ContractTransactionReceipt | null = await tx.wait();
+        logger.debug(`updateLock() complete. Gas used: ${result?.gasUsed}`);
+
+        const info = await zeto.getLock(lockId);
+        expect(info.spendCommitment).to.equal(unlockHash);
+      });
+
+      it("delegateLock() transfers spending authority to Alice", async function () {
+        const tx = await zeto
+          .connect(Bob.signer)
+          .delegateLock(
+            lockId,
+            encodeDelegateArgs(randomBytes32()),
+            Alice.ethAddress,
+            "0x",
+          );
+        const result: ContractTransactionReceipt | null = await tx.wait();
+        logger.debug(`delegateLock() complete. Gas used: ${result?.gasUsed}`);
+
+        const info = await zeto.getLock(lockId);
+        expect(info.spender).to.equal(Alice.ethAddress);
+        // Storage-layer delegate must also be moved.
+        expect(await zeto.locked(lockedUtxo1.hash)).to.deep.equal([
+          true,
+          Alice.ethAddress,
+        ]);
+      });
+
+      it("the new spender can spendLock() with the matching payload", async function () {
+        const encodedZkProofForSettle = await prepareProofForLocked(
           circuitForLocked,
           provingKeyForLocked,
           Bob,
           [lockedUtxo1, ZERO_UTXO],
-          [nullifier1, ZERO_UTXO],
-          [utxo12, utxo1],
-          root.bigInt(),
-          merkleProofs,
-          [Alice, Alice],
-          Alice.ethAddress, // current lock delegate
+          [outputUtxo1, outputUtxo2],
+          [Alice, Bob],
         );
-        const nullifiers = [nullifier1.hash];
 
-        // Alice (in reality this is usually a contract that orchestrates a trade flow) can spend the locked state
-        // using the proof generated by the trade counterparty (Bob in this case)
-        await expect(
-          sendTx(
-            Alice,
-            nullifiers,
-            result.outputCommitments,
-            root.bigInt(),
-            result.encodedProof,
-            true,
-          ),
-        ).to.be.rejectedWith(`UTXOAlreadyOwned(${utxo12.hash.toString()})`);
+        const spendArgs = encodeSpendArgs({
+          txId: randomBytes32(),
+          lockedOutputs: [],
+          outputs: [outputUtxo1.hash, outputUtxo2.hash],
+          proof: encodeToBytesForLocked(encodedZkProofForSettle),
+          data: "0x",
+        });
+
+        const tx = await zeto
+          .connect(Alice.signer)
+          .spendLock(lockId, spendArgs, "0x");
+        const result = await tx.wait();
+
+        const parsed = result!.logs
+          .map((l) => {
+            try {
+              return zeto.interface.parseLog(l as any);
+            } catch (_e) {
+              return null;
+            }
+          })
+          .filter((p) => p !== null) as ReadonlyArray<{
+            name: string;
+            args: any;
+          }>;
+        const lockSpent = parsed.find((p) => p.name === "LockSpent");
+        const zetoLockSpent = parsed.find((p) => p.name === "ZetoLockSpent");
+        expect(lockSpent, "LockSpent event not emitted").to.not.be.undefined;
+        expect(zetoLockSpent, "ZetoLockSpent event not emitted").to.not.be
+          .undefined;
+        expect(lockSpent!.args.lockId).to.equal(lockId);
+        expect(lockSpent!.args.spender).to.equal(Alice.ethAddress);
+
+        const outputs = zetoLockSpent!.args.outputs;
+        await smtAlice.add(outputs[0], outputs[0]);
+        await smtAlice.add(outputs[1], outputs[1]);
+        await smtBob.add(outputs[0], outputs[0]);
+        await smtBob.add(outputs[1], outputs[1]);
+
+        // Lock is no longer active.
+        expect(await zeto.isLockActive(lockId)).to.equal(false);
       });
 
-      it("the designated delegate can use the proper proof to spend the locked state", async function () {
-        // Bob generates inclusion proofs for the UTXOs to be spent, as private input to the proof generation
-        const nullifier1 = newNullifier(lockedUtxo1, Bob);
-        const root = await smtBobForLocked.root();
-        const proof1 = await smtBobForLocked.generateCircomVerifierProof(
-          lockedUtxo1.hash,
-          root,
-        );
-        const proof2 = await smtBobForLocked.generateCircomVerifierProof(
-          0n,
+      it("onchain SMT root for the unlocked UTXOs equals the offchain SMT root", async function () {
+        const bobRoot = await smtBob.root();
+        const aliceRoot = await smtAlice.root();
+        const onchainRoot = await zeto.getRoot();
+        expect(bobRoot.string()).to.equal(onchainRoot.toString());
+        expect(aliceRoot.string()).to.equal(onchainRoot.toString());
+      });
+    });
+
+    describe("createLock -> cancelLock flow", function () {
+      let bobUtxo1: UTXO;
+      let lockedUtxo1: UTXO;
+      let lockId: string;
+      let cancelHash: string;
+      let outUtxo1: UTXO;
+      let outUtxo2: UTXO;
+
+      before(async function () {
+        bobUtxo1 = newUTXO(100, Bob);
+        await doMint(zeto, deployer, [bobUtxo1]);
+        await smtAlice.add(bobUtxo1.hash, bobUtxo1.hash);
+        await smtBob.add(bobUtxo1.hash, bobUtxo1.hash);
+      });
+
+      it("Bob createLock()", async function () {
+        const nullifier1 = newNullifier(bobUtxo1, Bob);
+        lockedUtxo1 = newUTXO(bobUtxo1.value!, Bob);
+        const root = await smtBob.root();
+        const p1 = await smtBob.generateCircomVerifierProof(
+          bobUtxo1.hash,
           root,
         );
+        const p2 = await smtBob.generateCircomVerifierProof(0n, root);
         const merkleProofs = [
-          proof1.siblings.map((s) => s.bigInt()),
-          proof2.siblings.map((s) => s.bigInt()),
+          p1.siblings.map((s) => s.bigInt()),
+          p2.siblings.map((s) => s.bigInt()),
         ];
-        // Bob proposes the output UTXOs, attempting to transfer the locked UTXO to Alice
-        utxo9 = newUTXO(10, Alice);
-        utxo10 = newUTXO(5, Bob);
+        const encodedZkProof = await prepareProof(
+          circuit,
+          provingKey,
+          Bob,
+          [bobUtxo1, ZERO_UTXO],
+          [nullifier1, ZERO_UTXO],
+          [lockedUtxo1, ZERO_UTXO],
+          root.bigInt(),
+          merkleProofs,
+          [Bob, Bob],
+        );
+
+        // Commit the cancel hash up-front to exercise the cancelCommitment branch.
+        outUtxo1 = newUTXO(10, Alice);
+        outUtxo2 = newUTXO(90, Bob);
+        cancelHash = calculateCancelHash(
+          [lockedUtxo1],
+          [],
+          [outUtxo1, outUtxo2],
+          "0x",
+        );
+
+        const createArgs = encodeCreateArgs({
+          txId: randomBytes32(),
+          inputs: [nullifier1.hash],
+          outputs: [],
+          lockedOutputs: [lockedUtxo1.hash],
+          proof: encodeToBytes(root.bigInt(), encodedZkProof),
+        });
+        lockId = await zeto.connect(Bob.signer).computeLockId(createArgs);
+        const tx = await zeto
+          .connect(Bob.signer)
+          .createLock(createArgs, ethers.ZeroHash, cancelHash, "0x");
+        const result: ContractTransactionReceipt | null = await tx.wait();
+        logger.debug(`createLock() complete. Gas used: ${result?.gasUsed}`);
+      });
 
-        const result = await prepareProof(
+      it("the owner can cancelLock() to reverse the lock without delegation", async function () {
+        const encodedZkProofForCancel = await prepareProofForLocked(
           circuitForLocked,
           provingKeyForLocked,
           Bob,
           [lockedUtxo1, ZERO_UTXO],
-          [nullifier1, ZERO_UTXO],
-          [utxo9, utxo10],
-          root.bigInt(),
-          merkleProofs,
+          [outUtxo1, outUtxo2],
           [Alice, Bob],
-          Alice.ethAddress, // current lock delegate
         );
-        const nullifiers = [nullifier1.hash];
 
-        // Alice (in reality this is usually a contract that orchestrates a trade flow) can spend the locked state
-        // using the proof generated by the trade counterparty (Bob in this case)
-        await expect(
-          sendTx(
-            Alice,
-            nullifiers,
-            result.outputCommitments,
-            root.bigInt(),
-            result.encodedProof,
-            true,
-          ),
-        ).to.be.fulfilled;
+        const cancelArgs = encodeSpendArgs({
+          txId: randomBytes32(),
+          lockedOutputs: [],
+          outputs: [outUtxo1.hash, outUtxo2.hash],
+          proof: encodeToBytesForLocked(encodedZkProofForCancel),
+          data: "0x",
+        });
 
-        // Alice and Bob keep the local SMT in sync
-        await smtAlice.add(utxo9.hash, utxo9.hash);
-        await smtAlice.add(utxo10.hash, utxo10.hash);
-        await smtBob.add(utxo9.hash, utxo9.hash);
-        await smtBob.add(utxo10.hash, utxo10.hash);
-      });
+        const tx = await zeto
+          .connect(Bob.signer)
+          .cancelLock(lockId, cancelArgs, "0x");
+        const result = await tx.wait();
 
-      it("onchain SMT root for the locked UTXOs should be equal to the offchain SMT root", async function () {
-        const root = await smtBobForLocked.root();
-        const onchainRoot = await zeto.getRootForLocked();
-        expect(root.string()).to.equal(onchainRoot.toString());
+        const parsed = result!.logs
+          .map((l) => {
+            try {
+              return zeto.interface.parseLog(l as any);
+            } catch (_e) {
+              return null;
+            }
+          })
+          .filter((p) => p !== null) as ReadonlyArray<{
+            name: string;
+            args: any;
+          }>;
+        const cancelled = parsed.find((p) => p.name === "LockCancelled");
+        const zetoCancelled = parsed.find(
+          (p) => p.name === "ZetoLockCancelled",
+        );
+        expect(cancelled, "LockCancelled event not emitted").to.not.be
+          .undefined;
+        expect(zetoCancelled, "ZetoLockCancelled event not emitted").to.not.be
+          .undefined;
+
+        const outputs = zetoCancelled!.args.outputs;
+        await smtAlice.add(outputs[0], outputs[0]);
+        await smtAlice.add(outputs[1], outputs[1]);
+        await smtBob.add(outputs[0], outputs[0]);
+        await smtBob.add(outputs[1], outputs[1]);
+
+        expect(await zeto.isLockActive(lockId)).to.equal(false);
       });
 
-      it("onchain SMT root for the unlocked UTXOs should be equal to the offchain SMT root", async function () {
-        const root = await smtBob.root();
+      it("onchain SMT root for the unlocked UTXOs equals the offchain SMT root", async function () {
+        const bobRoot = await smtBob.root();
+        const aliceRoot = await smtAlice.root();
         const onchainRoot = await zeto.getRoot();
-        expect(root.string()).to.equal(onchainRoot.toString());
+        expect(bobRoot.string()).to.equal(onchainRoot.toString());
+        expect(aliceRoot.string()).to.equal(onchainRoot.toString());
       });
     });
 
-    describe("lock -> delegate -> transfer flow", function () {
-      let lockedUtxo2: UTXO;
+    describe("spendLock with a payload that does not match the spend commitment fails", function () {
+      let bobUtxo1: UTXO;
+      let lockedUtxo1: UTXO;
+      let lockId: string;
+      let expectedHash: string;
+
+      before(async function () {
+        bobUtxo1 = newUTXO(100, Bob);
+        await doMint(zeto, deployer, [bobUtxo1]);
+        await smtAlice.add(bobUtxo1.hash, bobUtxo1.hash);
+        await smtBob.add(bobUtxo1.hash, bobUtxo1.hash);
+      });
 
-      it("Bob locks a UTXO and makes Alice as the delegate ", async function () {
-        const nullifier1 = newNullifier(utxo10, Bob);
-        lockedUtxo2 = newUTXO(utxo10.value!, Bob);
+      it("Bob createLock()", async function () {
+        const nullifier1 = newNullifier(bobUtxo1, Bob);
+        lockedUtxo1 = newUTXO(bobUtxo1.value!, Bob);
         const root = await smtBob.root();
-        const proof1 = await smtBob.generateCircomVerifierProof(
-          utxo10.hash,
+        const p1 = await smtBob.generateCircomVerifierProof(
+          bobUtxo1.hash,
           root,
         );
-        const proof2 = await smtBob.generateCircomVerifierProof(0n, root);
+        const p2 = await smtBob.generateCircomVerifierProof(0n, root);
         const merkleProofs = [
-          proof1.siblings.map((s) => s.bigInt()),
-          proof2.siblings.map((s) => s.bigInt()),
+          p1.siblings.map((s) => s.bigInt()),
+          p2.siblings.map((s) => s.bigInt()),
         ];
-        const { outputCommitments, encodedProof } = await prepareProof(
+        const encodedZkProof = await prepareProof(
           circuit,
           provingKey,
           Bob,
-          [utxo10, ZERO_UTXO],
+          [bobUtxo1, ZERO_UTXO],
           [nullifier1, ZERO_UTXO],
-          [lockedUtxo2, ZERO_UTXO],
+          [lockedUtxo1, ZERO_UTXO],
           root.bigInt(),
           merkleProofs,
           [Bob, Bob],
         );
 
-        const tx = await zeto.connect(Bob.signer).lock(
-          [nullifier1.hash],
+        const createArgs = encodeCreateArgs({
+          txId: randomBytes32(),
+          inputs: [nullifier1.hash],
+          outputs: [],
+          lockedOutputs: [lockedUtxo1.hash],
+          proof: encodeToBytes(root.bigInt(), encodedZkProof),
+        });
+        lockId = await zeto.connect(Bob.signer).computeLockId(createArgs);
+        await (
+          await zeto
+            .connect(Bob.signer)
+            .createLock(createArgs, ethers.ZeroHash, ethers.ZeroHash, "0x")
+        ).wait();
+      });
+
+      it("Bob updateLock() committing a specific spend hash", async function () {
+        const expectedOut1 = newUTXO(10, Alice);
+        const expectedOut2 = newUTXO(90, Bob);
+        expectedHash = calculateSpendHash(
+          [lockedUtxo1],
           [],
-          outputCommitments,
-          root.bigInt(),
-          encodedProof,
-          Alice.ethAddress, // make Alice the delegate who can spend the state (if she has the right proof)
+          [expectedOut1, expectedOut2],
           "0x",
         );
-        const result: ContractTransactionReceipt | null = await tx.wait();
 
-        // Note that the locked UTXO should NOT be added to the local SMT for UTXOs because it's tracked in a separate SMT onchain
-        // we add it to the local SMT for locked UTXOs
-        const events = parseUTXOEvents(zeto, result!);
-        await smtBobForLocked.add(
-          events[0].lockedOutputs[0],
-          ethers.toBigInt(events[0].delegate),
-        );
+        await (
+          await zeto
+            .connect(Bob.signer)
+            .updateLock(
+              lockId,
+              encodeUpdateArgs(randomBytes32()),
+              expectedHash,
+              ethers.ZeroHash,
+              "0x",
+            )
+        ).wait();
       });
 
-      it("Alice delegates the lock to Charlie", async function () {
-        const tx = await zeto
-          .connect(Alice.signer)
-          .delegateLock([lockedUtxo2.hash], Charlie.ethAddress, "0x");
-        const result = await tx.wait();
-        const events = parseUTXOEvents(zeto, result);
-        // this should update the existing leaf node value from address of Alice to Charlie
-        await smtBobForLocked.update(
-          events[0].lockedOutputs[0],
-          ethers.toBigInt(events[0].newDelegate),
+      it("spendLock() with a different payload reverts with InvalidUnlockHash", async function () {
+        const wrongOut1 = newUTXO(20, Alice);
+        const wrongOut2 = newUTXO(80, Bob);
+
+        const encodedZkProofForSettle = await prepareProofForLocked(
+          circuitForLocked,
+          provingKeyForLocked,
+          Bob,
+          [lockedUtxo1, ZERO_UTXO],
+          [wrongOut1, wrongOut2],
+          [Alice, Bob],
         );
-      });
 
-      it("onchain SMT root for the locked UTXOs should be equal to the offchain SMT root", async function () {
-        const root = await smtBobForLocked.root();
-        const onchainRoot = await zeto.getRootForLocked();
-        expect(root.string()).to.equal(onchainRoot.toString());
-      });
+        const spendArgs = encodeSpendArgs({
+          txId: randomBytes32(),
+          lockedOutputs: [],
+          outputs: [wrongOut1.hash, wrongOut2.hash],
+          proof: encodeToBytesForLocked(encodedZkProofForSettle),
+          data: "0x",
+        });
 
-      it("Charlie can use the proper proof to spend the locked state", async function () {
-        // Bob generates inclusion proofs for the UTXOs to be spent, as private input to the proof generation
-        const nullifier1 = newNullifier(lockedUtxo2, Bob);
-        const root = await smtBobForLocked.root();
-        const proof1 = await smtBobForLocked.generateCircomVerifierProof(
-          lockedUtxo2.hash,
-          root,
+        const calculatedHash = calculateSpendHash(
+          [lockedUtxo1],
+          [],
+          [wrongOut1, wrongOut2],
+          "0x",
+        );
+
+        await expect(
+          zeto.connect(Bob.signer).spendLock(lockId, spendArgs, "0x"),
+        ).rejectedWith(
+          `InvalidUnlockHash("${expectedHash}", "${calculatedHash}")`,
         );
-        const proof2 = await smtBobForLocked.generateCircomVerifierProof(
-          0n,
+      });
+    });
+
+    describe("negative cases for the lock lifecycle", function () {
+      // These tests rely on hardhat-style revert decoding. Skip on real chains.
+      if (network.name !== "hardhat") {
+        return;
+      }
+
+      // freshLock mints a UTXO for `owner`, locks it, and returns the
+      // resulting lock metadata so each negative case can branch off without
+      // polluting other test scopes. Each call advances the SMT.
+      async function freshLock(
+        owner: User,
+        spendCommitment: string = ethers.ZeroHash,
+        cancelCommitment: string = ethers.ZeroHash,
+      ): Promise<{
+        lockId: string;
+        sourceUtxo: UTXO;
+        lockedUtxo: UTXO;
+        createArgs: string;
+      }> {
+        const sourceUtxo = newUTXO(100, owner);
+        await doMint(zeto, deployer, [sourceUtxo]);
+        await smtAlice.add(sourceUtxo.hash, sourceUtxo.hash);
+        await smtBob.add(sourceUtxo.hash, sourceUtxo.hash);
+
+        const nullifier = newNullifier(sourceUtxo, owner);
+        const lockedUtxo = newUTXO(sourceUtxo.value!, owner);
+        const root = await smtBob.root();
+        const p1 = await smtBob.generateCircomVerifierProof(
+          sourceUtxo.hash,
           root,
         );
+        const p2 = await smtBob.generateCircomVerifierProof(0n, root);
         const merkleProofs = [
-          proof1.siblings.map((s) => s.bigInt()),
-          proof2.siblings.map((s) => s.bigInt()),
+          p1.siblings.map((s) => s.bigInt()),
+          p2.siblings.map((s) => s.bigInt()),
         ];
-        // Bob proposes the output UTXOs, attempting to transfer the locked UTXO to Alice
-        const utxo1 = newUTXO(1, Alice);
-        utxo11 = newUTXO(4, Bob);
+        const encodedZkProof = await prepareProof(
+          circuit,
+          provingKey,
+          owner,
+          [sourceUtxo, ZERO_UTXO],
+          [nullifier, ZERO_UTXO],
+          [lockedUtxo, ZERO_UTXO],
+          root.bigInt(),
+          merkleProofs,
+          [owner, owner],
+        );
+
+        const createArgs = encodeCreateArgs({
+          txId: randomBytes32(),
+          inputs: [nullifier.hash],
+          outputs: [],
+          lockedOutputs: [lockedUtxo.hash],
+          proof: encodeToBytes(root.bigInt(), encodedZkProof),
+        });
+        const lockId = await zeto
+          .connect(owner.signer)
+          .computeLockId(createArgs);
+        await (
+          await zeto
+            .connect(owner.signer)
+            .createLock(createArgs, spendCommitment, cancelCommitment, "0x")
+        ).wait();
+        return { lockId, sourceUtxo, lockedUtxo, createArgs };
+      }
+
+      // Re-encoding helper: produce a syntactically valid spend payload that
+      // does NOT need to verify a real ZK proof. Tests for authorization /
+      // immutability assertions short-circuit before the proof is touched.
+      function dummySpendArgs(): string {
+        return encodeSpendArgs({
+          txId: randomBytes32(),
+          lockedOutputs: [],
+          outputs: [],
+          proof: "0x",
+          data: "0x",
+        });
+      }
+
+      it("createLock() with a duplicate txId from the same caller reverts with DuplicateLock", async function () {
+        const { lockId, createArgs } = await freshLock(Bob);
+
+        // Same createArgs (same txId, same caller) → same lockId → DuplicateLock
+        // fires before any input or proof validation.
+        await expect(
+          zeto
+            .connect(Bob.signer)
+            .createLock(createArgs, ethers.ZeroHash, ethers.ZeroHash, "0x"),
+        ).rejectedWith(`DuplicateLock("${lockId}")`);
+      });
+
+      it("updateLock() by a non-owner reverts with LockUnauthorized", async function () {
+        const { lockId } = await freshLock(Bob);
+
+        await expect(
+          zeto
+            .connect(Alice.signer)
+            .updateLock(
+              lockId,
+              encodeUpdateArgs(randomBytes32()),
+              ethers.ZeroHash,
+              ethers.ZeroHash,
+              "0x",
+            ),
+        ).to.be.revertedWithCustomError(zeto, "LockUnauthorized")
+          .withArgs(lockId, Bob.ethAddress, Alice.ethAddress);
+      });
+
+      it("updateLock() after delegateLock() reverts with LockImmutable", async function () {
+        const { lockId } = await freshLock(Bob);
+
+        // Bob delegates spending authority to Alice; spender (Alice) now
+        // differs from owner (Bob).
+        await (
+          await zeto
+            .connect(Bob.signer)
+            .delegateLock(
+              lockId,
+              encodeDelegateArgs(randomBytes32()),
+              Alice.ethAddress,
+              "0x",
+            )
+        ).wait();
+
+        // Even Bob (the owner) can no longer mutate the commitments — the
+        // lock is now externally controlled and must be considered immutable.
+        await expect(
+          zeto
+            .connect(Bob.signer)
+            .updateLock(
+              lockId,
+              encodeUpdateArgs(randomBytes32()),
+              ethers.ZeroHash,
+              ethers.ZeroHash,
+              "0x",
+            ),
+        ).rejectedWith(`LockImmutable("${lockId}")`);
+      });
+
+      it("delegateLock() by a non-spender reverts with LockUnauthorized", async function () {
+        const { lockId } = await freshLock(Bob);
+
+        await expect(
+          zeto
+            .connect(Alice.signer)
+            .delegateLock(
+              lockId,
+              encodeDelegateArgs(randomBytes32()),
+              Charlie.ethAddress,
+              "0x",
+            ),
+        )
+          .to.be.revertedWithCustomError(zeto, "LockUnauthorized")
+          .withArgs(lockId, Bob.ethAddress, Alice.ethAddress);
+      });
+
+      it("spendLock() by a non-spender reverts with LockUnauthorized before touching the proof", async function () {
+        const { lockId } = await freshLock(Bob);
 
-        const result = await prepareProof(
+        // Garbage proof — the onlySpender modifier MUST short-circuit before
+        // any proof verification is attempted. This is also what protects the
+        // contract from accepting a spend whose payload does not match the
+        // committed unlockHash for an unauthorized caller.
+        await expect(
+          zeto.connect(Alice.signer).spendLock(lockId, dummySpendArgs(), "0x"),
+        )
+          .to.be.revertedWithCustomError(zeto, "LockUnauthorized")
+          .withArgs(lockId, Bob.ethAddress, Alice.ethAddress);
+      });
+
+      it("cancelLock() by a non-spender reverts with LockUnauthorized", async function () {
+        const { lockId } = await freshLock(Bob);
+
+        await expect(
+          zeto.connect(Alice.signer).cancelLock(lockId, dummySpendArgs(), "0x"),
+        )
+          .to.be.revertedWithCustomError(zeto, "LockUnauthorized")
+          .withArgs(lockId, Bob.ethAddress, Alice.ethAddress);
+      });
+
+      it("cancelLock() with a payload that does not match cancelCommitment reverts with InvalidUnlockHash", async function () {
+        // Pre-commit a non-zero cancelCommitment so the hash check is armed.
+        const expectedOut1 = newUTXO(10, Alice);
+        const expectedOut2 = newUTXO(90, Bob);
+        // We don't yet know the lockedUtxo hash (it's randomized inside
+        // freshLock), so commit to a fixed value that we know cannot match
+        // any honest cancellation. The hash-mismatch check fires regardless
+        // of the locked-input contents.
+        const sentinelHash = ethers.keccak256(
+          ethers.toUtf8Bytes("zeto:test:cancelCommitment"),
+        );
+        const { lockId, lockedUtxo } = await freshLock(
+          Bob,
+          ethers.ZeroHash,
+          sentinelHash,
+        );
+
+        const wrongProof = await prepareProofForLocked(
           circuitForLocked,
           provingKeyForLocked,
           Bob,
-          [lockedUtxo2, ZERO_UTXO],
-          [nullifier1, ZERO_UTXO],
-          [utxo1, utxo11],
-          root.bigInt(),
-          merkleProofs,
+          [lockedUtxo, ZERO_UTXO],
+          [expectedOut1, expectedOut2],
           [Alice, Bob],
-          Charlie.ethAddress, // current lock delegate
         );
-        const nullifiers = [nullifier1.hash];
+        const cancelArgs = encodeSpendArgs({
+          txId: randomBytes32(),
+          lockedOutputs: [],
+          outputs: [expectedOut1.hash, expectedOut2.hash],
+          proof: encodeToBytesForLocked(wrongProof),
+          data: "0x",
+        });
+        const calculatedHash = calculateCancelHash(
+          [lockedUtxo],
+          [],
+          [expectedOut1, expectedOut2],
+          "0x",
+        );
 
-        // Charlie (in reality this is usually a contract that orchestrates a trade flow) can spend the locked state
-        // using the proof generated by the trade counterparty (Bob in this case)
         await expect(
-          sendTx(
-            Charlie,
-            nullifiers,
-            result.outputCommitments,
-            root.bigInt(),
-            result.encodedProof,
-            true,
-          ),
-        ).to.be.fulfilled;
+          zeto.connect(Bob.signer).cancelLock(lockId, cancelArgs, "0x"),
+        ).rejectedWith(
+          `InvalidUnlockHash("${sentinelHash}", "${calculatedHash}")`,
+        );
+      });
 
-        // Alice and Bob keep the local SMT in sync
-        await smtAlice.add(utxo1.hash, utxo1.hash);
-        await smtAlice.add(utxo11.hash, utxo11.hash);
-        await smtBob.add(utxo1.hash, utxo1.hash);
-        await smtBob.add(utxo11.hash, utxo11.hash);
+      it("after a successful spendLock(), the lock is no longer active and getLock() reverts", async function () {
+        const { lockId, lockedUtxo } = await freshLock(Bob);
+
+        const out1 = newUTXO(10, Alice);
+        const out2 = newUTXO(90, Bob);
+        const zkProof = await prepareProofForLocked(
+          circuitForLocked,
+          provingKeyForLocked,
+          Bob,
+          [lockedUtxo, ZERO_UTXO],
+          [out1, out2],
+          [Alice, Bob],
+        );
+        const spendArgs = encodeSpendArgs({
+          txId: randomBytes32(),
+          lockedOutputs: [],
+          outputs: [out1.hash, out2.hash],
+          proof: encodeToBytesForLocked(zkProof),
+          data: "0x",
+        });
+        await (
+          await zeto.connect(Bob.signer).spendLock(lockId, spendArgs, "0x")
+        ).wait();
+        // Keep both SMTs in sync with the new unlocked outputs so unrelated
+        // tests in later blocks can still reason about roots.
+        await smtAlice.add(out1.hash, out1.hash);
+        await smtAlice.add(out2.hash, out2.hash);
+        await smtBob.add(out1.hash, out1.hash);
+        await smtBob.add(out2.hash, out2.hash);
+
+        expect(await zeto.isLockActive(lockId)).to.equal(false);
+        await expect(zeto.getLock(lockId))
+          .to.be.revertedWithCustomError(zeto, "LockNotActive")
+          .withArgs(lockId);
+        // Re-spending a consumed lock MUST also fail — lockActive is the
+        // first modifier and emits LockNotActive before onlySpender.
+        await expect(
+          zeto.connect(Bob.signer).spendLock(lockId, dummySpendArgs(), "0x"),
+        )
+          .to.be.revertedWithCustomError(zeto, "LockNotActive")
+          .withArgs(lockId);
       });
     });
   });
@@ -1025,14 +1333,60 @@ describe("Zeto based fungible token with anonymity using nullifiers without encr
       return;
     }
 
+    let aliceUtxo1: UTXO;
+    let aliceUtxoSpent: UTXO;
+
+    before(async function () {
+      // mint a UTXO for Alice
+      aliceUtxo1 = newUTXO(100, Alice);
+      aliceUtxoSpent = newUTXO(10, Alice);
+      await doMint(zeto, deployer, [aliceUtxo1, aliceUtxoSpent]);
+      await smtAlice.add(aliceUtxo1.hash, aliceUtxo1.hash);
+      await smtAlice.add(aliceUtxoSpent.hash, aliceUtxoSpent.hash);
+
+      // spent one of the UTXOs
+      const _utxo1 = newUTXO(5, Bob);
+      const _utxo2 = newUTXO(5, Alice);
+      const nullifier1 = newNullifier(aliceUtxoSpent, Alice);
+      const root = await smtAlice.root();
+      const proof1 = await smtAlice.generateCircomVerifierProof(
+        aliceUtxoSpent.hash,
+        root,
+      );
+      const proof2 = await smtAlice.generateCircomVerifierProof(0n, root);
+      const merkleProofs = [
+        proof1.siblings.map((s) => s.bigInt()),
+        proof2.siblings.map((s) => s.bigInt()),
+      ];
+      await expect(
+        doTransfer(
+          Alice,
+          [aliceUtxoSpent, ZERO_UTXO],
+          [nullifier1, ZERO_UTXO],
+          [_utxo1, _utxo2],
+          root.bigInt(),
+          merkleProofs,
+          [Bob, Alice],
+        ),
+      ).to.be.fulfilled;
+
+      // Alice locally tracks the UTXOs inside the Sparse Merkle Tree
+      await smtAlice.add(_utxo1.hash, _utxo1.hash);
+      await smtAlice.add(_utxo2.hash, _utxo2.hash);
+    });
+
+    beforeEach(async function () {
+      // this.skip();
+    });
+
     it("Alice attempting to withdraw spent UTXOs should fail", async function () {
       // Alice generates the nullifiers for the UTXOs to be spent
-      const nullifier1 = newNullifier(utxo100, Alice);
+      const nullifier1 = newNullifier(aliceUtxoSpent, Alice);
 
       // Alice generates inclusion proofs for the UTXOs to be spent
       let root = await smtAlice.root();
       const proof1 = await smtAlice.generateCircomVerifierProof(
-        utxo100.hash,
+        aliceUtxoSpent.hash,
         root,
       );
       const proof2 = await smtAlice.generateCircomVerifierProof(0n, root);
@@ -1041,64 +1395,58 @@ describe("Zeto based fungible token with anonymity using nullifiers without encr
         proof2.siblings.map((s) => s.bigInt()),
       ];
 
-      // Alice proposes the output ERC20 tokens
-      const outputCommitment = newUTXO(90, Alice);
+      // Alice proposes the output UTXO
+      const outputCommitment = newUTXO(9, Alice);
 
-      const { nullifiers, outputCommitments, encodedProof } =
-        await prepareNullifierWithdrawProof(
-          Alice,
-          [utxo100, ZERO_UTXO],
-          [nullifier1, ZERO_UTXO],
-          outputCommitment,
-          root.bigInt(),
-          merkleProofs,
-        );
+      const { encodedProof } = await prepareNullifierWithdrawProof(
+        Alice,
+        [aliceUtxoSpent, ZERO_UTXO],
+        [nullifier1, ZERO_UTXO],
+        outputCommitment,
+        root.bigInt(),
+        merkleProofs,
+      );
 
       await expect(
         zeto
           .connect(Alice.signer)
           .withdraw(
-            10,
-            nullifiers,
-            outputCommitments[0],
-            root.bigInt(),
-            encodedProof,
+            1,
+            [nullifier1.hash],
+            outputCommitment.hash,
+            encodeToBytesForWithdraw(root.bigInt(), encodedProof),
             "0x",
           ),
       ).rejectedWith("UTXOAlreadySpent");
     });
 
     it("mint existing unspent UTXOs should fail", async function () {
-      await expect(doMint(zeto, deployer, [utxo4])).rejectedWith(
+      await expect(doMint(zeto, deployer, [aliceUtxo1])).rejectedWith(
         "UTXOAlreadyOwned",
       );
     });
 
     it("mint existing spent UTXOs should fail", async function () {
-      await expect(doMint(zeto, deployer, [utxo1])).rejectedWith(
+      await expect(doMint(zeto, deployer, [aliceUtxoSpent])).rejectedWith(
         "UTXOAlreadyOwned",
       );
     });
 
     it("transfer spent UTXOs should fail (double spend protection)", async function () {
       // create outputs
-      const _utxo1 = newUTXO(25, Bob);
+      const _utxo1 = newUTXO(5, Bob);
       const _utxo2 = newUTXO(5, Alice);
 
       // generate the nullifiers for the UTXOs to be spent
-      const nullifier1 = newNullifier(utxo1, Alice);
-      const nullifier2 = newNullifier(utxo2, Alice);
+      const nullifier1 = newNullifier(aliceUtxoSpent, Alice);
 
       // generate inclusion proofs for the UTXOs to be spent
       let root = await smtAlice.root();
       const proof1 = await smtAlice.generateCircomVerifierProof(
-        utxo1.hash,
-        root,
-      );
-      const proof2 = await smtAlice.generateCircomVerifierProof(
-        utxo2.hash,
+        aliceUtxoSpent.hash,
         root,
       );
+      const proof2 = await smtAlice.generateCircomVerifierProof(0n, root);
       const merkleProofs = [
         proof1.siblings.map((s) => s.bigInt()),
         proof2.siblings.map((s) => s.bigInt()),
@@ -1107,21 +1455,22 @@ describe("Zeto based fungible token with anonymity using nullifiers without encr
       await expect(
         doTransfer(
           Alice,
-          [utxo1, utxo2],
-          [nullifier1, nullifier2],
+          [aliceUtxoSpent, ZERO_UTXO],
+          [nullifier1, ZERO_UTXO],
           [_utxo1, _utxo2],
           root.bigInt(),
           merkleProofs,
           [Bob, Alice],
         ),
       ).rejectedWith("UTXOAlreadySpent");
-    }).timeout(600000);
+    });
 
     it("transfer with existing UTXOs in the output should fail (mass conservation protection)", async function () {
-      const nullifier1 = newNullifier(utxo9, Alice);
+      const nullifier1 = newNullifier(aliceUtxo1, Alice);
+      const _utxo1 = newUTXO(90, Alice);
       let root = await smtAlice.root();
       const proof1 = await smtAlice.generateCircomVerifierProof(
-        utxo9.hash,
+        aliceUtxo1.hash,
         root,
       );
       const proof2 = await smtAlice.generateCircomVerifierProof(0n, root);
@@ -1133,29 +1482,29 @@ describe("Zeto based fungible token with anonymity using nullifiers without encr
       await expect(
         doTransfer(
           Alice,
-          [utxo9, ZERO_UTXO],
+          [aliceUtxo1, ZERO_UTXO],
           [nullifier1, ZERO_UTXO],
-          [utxo1, ZERO_UTXO],
+          [aliceUtxoSpent, _utxo1],
           root.bigInt(),
           merkleProofs,
           [Alice, Alice],
         ),
       ).rejectedWith("UTXOAlreadyOwned");
-    }).timeout(600000);
+    });
 
     it("spend by using the same UTXO as both inputs should fail", async function () {
-      const _utxo1 = newUTXO(15, Alice);
-      const _utxo2 = newUTXO(5, Bob);
-      const nullifier1 = newNullifier(utxo9, Alice);
-      const nullifier2 = newNullifier(utxo9, Alice);
+      const _utxo1 = newUTXO(150, Alice);
+      const _utxo2 = newUTXO(50, Bob);
+      const nullifier1 = newNullifier(aliceUtxo1, Alice);
+      const nullifier2 = newNullifier(aliceUtxo1, Alice);
       // generate inclusion proofs for the UTXOs to be spent
       let root = await smtAlice.root();
       const proof1 = await smtAlice.generateCircomVerifierProof(
-        utxo9.hash,
+        aliceUtxo1.hash,
         root,
       );
       const proof2 = await smtAlice.generateCircomVerifierProof(
-        utxo9.hash,
+        aliceUtxo1.hash,
         root,
       );
       const merkleProofs = [
@@ -1166,7 +1515,7 @@ describe("Zeto based fungible token with anonymity using nullifiers without encr
       await expect(
         doTransfer(
           Alice,
-          [utxo9, utxo9],
+          [aliceUtxo1, aliceUtxo1],
           [nullifier1, nullifier2],
           [_utxo1, _utxo2],
           root.bigInt(),
@@ -1174,7 +1523,7 @@ describe("Zeto based fungible token with anonymity using nullifiers without encr
           [Alice, Bob],
         ),
       ).rejectedWith(`UTXODuplicate`);
-    }).timeout(600000);
+    });
 
     it("transfer non-existing UTXOs should fail", async function () {
       const nonExisting1 = newUTXO(25, Alice);
@@ -1205,20 +1554,20 @@ describe("Zeto based fungible token with anonymity using nullifiers without encr
 
       // propose the output UTXOs
       const _utxo1 = newUTXO(30, Charlie);
-      utxo7 = newUTXO(15, Bob);
+      const _utxo2 = newUTXO(15, Bob);
 
       await expect(
         doTransfer(
           Alice,
           [nonExisting1, nonExisting2],
           [nullifier1, nullifier2],
-          [utxo7, _utxo1],
+          [_utxo1, _utxo2],
           root.bigInt(),
           merkleProofs,
-          [Bob, Charlie],
+          [Charlie, Bob],
         ),
       ).rejectedWith("UTXORootNotFound");
-    }).timeout(600000);
+    });
 
     it("repeated mint calls with single UTXO should not fail", async function () {
       const utxo5 = newUTXO(10, Alice);
@@ -1236,157 +1585,66 @@ describe("Zeto based fungible token with anonymity using nullifiers without encr
     root: BigInt,
     merkleProofs: BigInt[][],
     owners: User[],
-    lockDelegate?: User,
   ) {
-    let nullifiers: BigNumberish[];
-    let outputCommitments: BigNumberish[];
-    let encodedProof: any;
-    const circuitToUse = lockDelegate
-      ? circuitForLocked
-      : inputs.length > 2
-        ? batchCircuit
-        : circuit;
-    const provingKeyToUse = lockDelegate
-      ? provingKeyForLocked
-      : inputs.length > 2
-        ? batchProvingKey
-        : provingKey;
-    const result = await prepareProof(
+    // NOTE: this helper is only for unlocked-input transfers. Locked-input
+    // transitions go through {createLock,updateLock,delegateLock,spendLock,
+    // cancelLock} — exercised by the "ILockableCapability tests" block.
+    const circuitToUse = inputs.length > 2 ? batchCircuit : circuit;
+    const provingKeyToUse = inputs.length > 2 ? batchProvingKey : provingKey;
+
+    const inflatedInputUtxos = inflateUtxos(inputs);
+    const inflatedNullifiers = inflateUtxos(_nullifiers);
+    const inflatedOutputUtxos = inflateUtxos(outputs);
+    const inflatedOwners = inflateOwners(owners);
+
+    const encodedProof = await prepareProof(
       circuitToUse,
       provingKeyToUse,
       signer,
-      inputs,
-      _nullifiers,
-      outputs,
+      inflatedInputUtxos,
+      inflatedNullifiers,
+      inflatedOutputUtxos,
       root,
       merkleProofs,
-      owners,
-      lockDelegate?.ethAddress,
+      inflatedOwners,
     );
-    nullifiers = _nullifiers.map(
+    const nullifiers = _nullifiers.map(
       (nullifier) => nullifier.hash,
     ) as BigNumberish[];
-    outputCommitments = result.outputCommitments;
-    encodedProof = result.encodedProof;
+    const outputCommitments = outputs.map((output) => output.hash);
 
-    const txResult = await sendTx(
+    return await sendTransfer(
       signer,
       nullifiers,
       outputCommitments,
       root,
       encodedProof,
-      lockDelegate !== undefined,
     );
-    return {
-      txResult,
-    };
   }
 
-  async function sendTx(
+  async function sendTransfer(
     signer: User,
     nullifiers: BigNumberish[],
     outputCommitments: BigNumberish[],
     root: BigNumberish,
     encodedProof: any,
-    isLocked: boolean = false,
   ) {
     const startTx = Date.now();
-    let tx: any;
-    if (!isLocked) {
-      tx = await zeto.connect(signer.signer).transfer(
-        nullifiers.filter((ic) => ic !== 0n), // trim off empty utxo hashes to check padding logic for batching works
-        outputCommitments.filter((oc) => oc !== 0n), // trim off empty utxo hashes to check padding logic for batching works
-        root,
-        encodedProof,
-        "0x",
-      );
-    } else {
-      tx = await zeto.connect(signer.signer).transferLocked(
-        nullifiers.filter((ic) => ic !== 0n), // trim off empty utxo hashes to check padding logic for batching works
-        outputCommitments.filter((oc) => oc !== 0n), // trim off empty utxo hashes to check padding logic for batching works
-        root,
-        encodedProof,
-        "0x",
-      );
-    }
+    const tx = await zeto.connect(signer.signer).transfer(
+      nullifiers.filter((ic) => ic !== 0n), // trim padding zeros so we exercise the contract padding logic
+      outputCommitments.filter((oc) => oc !== 0n),
+      encodeToBytes(root, encodedProof),
+      "0x",
+    );
     const results: ContractTransactionReceipt | null = await tx.wait();
-    console.log(
+    logger.debug(
       `Time to execute transaction: ${Date.now() - startTx}ms. Gas used: ${results?.gasUsed}`,
     );
     return results;
   }
 });
 
-async function prepareProof(
-  circuit: any,
-  provingKey: any,
-  signer: User,
-  inputs: UTXO[],
-  _nullifiers: UTXO[],
-  outputs: UTXO[],
-  root: BigInt,
-  merkleProof: BigInt[][],
-  owners: User[],
-  lockDelegate?: string,
-) {
-  const nullifiers = _nullifiers.map((nullifier) => nullifier.hash) as [
-    BigNumberish,
-    BigNumberish,
-  ];
-  const inputCommitments: BigNumberish[] = inputs.map(
-    (input) => input.hash,
-  ) as BigNumberish[];
-  const inputValues = inputs.map((input) => BigInt(input.value || 0n));
-  const inputSalts = inputs.map((input) => input.salt || 0n);
-  const outputCommitments: BigNumberish[] = outputs.map(
-    (output) => output.hash,
-  ) as BigNumberish[];
-  const outputValues = outputs.map((output) => BigInt(output.value || 0n));
-  const outputOwnerPublicKeys: BigNumberish[][] = owners.map(
-    (owner) => owner.babyJubPublicKey,
-  ) as BigNumberish[][];
-
-  const startWitnessCalculation = Date.now();
-  const inputObj: any = {
-    nullifiers,
-    inputCommitments,
-    inputValues,
-    inputSalts,
-    inputOwnerPrivateKey: signer.formattedPrivateKey,
-    root,
-    enabled: nullifiers.map((n) => (n !== 0n ? 1 : 0)),
-    merkleProof,
-    outputCommitments,
-    outputValues,
-    outputSalts: outputs.map((output) => output.salt || 0n),
-    outputOwnerPublicKeys,
-  };
-  if (lockDelegate) {
-    inputObj["lockDelegate"] = ethers.toBigInt(lockDelegate);
-  }
-
-  const witness = await circuit.calculateWTNSBin(inputObj, true);
-  const timeWithnessCalculation = Date.now() - startWitnessCalculation;
-
-  const startProofGeneration = Date.now();
-  const { proof, publicSignals } = (await groth16.prove(
-    provingKey,
-    witness,
-  )) as { proof: BigNumberish[]; publicSignals: BigNumberish[] };
-  const timeProofGeneration = Date.now() - startProofGeneration;
-
-  console.log(
-    `Witness calculation time: ${timeWithnessCalculation}ms. Proof generation time: ${timeProofGeneration}ms.`,
-  );
-
-  const encodedProof = encodeProof(proof);
-  return {
-    inputCommitments,
-    outputCommitments,
-    encodedProof,
-  };
-}
-
 module.exports = {
   prepareProof,
+  encodeToBytes,
 };