@maci-protocol/circuits 0.0.0-ci.044d30d → 0.0.0-ci.0bef05d
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/build/ts/{genZkeys.d.ts → generateZkeys.d.ts} +1 -1
- package/build/ts/generateZkeys.d.ts.map +1 -0
- package/build/ts/{genZkeys.js → generateZkeys.js} +1 -1
- package/build/ts/generateZkeys.js.map +1 -0
- package/build/ts/types.d.ts +8 -8
- package/build/ts/types.d.ts.map +1 -1
- package/build/tsconfig.build.tsbuildinfo +1 -1
- package/circom/circuits.json +7 -7
- package/circom/coordinator/non-qv/processMessages.circom +92 -95
- package/circom/coordinator/non-qv/tallyVotes.circom +35 -32
- package/circom/coordinator/qv/processMessages.circom +94 -94
- package/circom/coordinator/qv/tallyVotes.circom +37 -37
- package/circom/utils/{calculateTotal.circom → CalculateTotal.circom} +2 -0
- package/circom/utils/{verifySignature.circom → EdDSAPoseidonVerifier.circom} +40 -66
- package/circom/utils/MessageHasher.circom +57 -0
- package/circom/utils/MessageToCommand.circom +107 -0
- package/circom/utils/PoseidonHasher.circom +29 -0
- package/circom/utils/{privToPubKey.circom → PrivateToPublicKey.circom} +11 -9
- package/circom/utils/VerifySignature.circom +39 -0
- package/circom/utils/non-qv/{messageValidator.circom → MessageValidator.circom} +13 -11
- package/circom/utils/non-qv/{stateLeafAndBallotTransformer.circom → StateLeafAndBallotTransformer.circom} +32 -32
- package/circom/utils/qv/{messageValidator.circom → MessageValidator.circom} +13 -11
- package/circom/utils/qv/{stateLeafAndBallotTransformer.circom → StateLeafAndBallotTransformer.circom} +32 -32
- package/circom/utils/trees/BinaryMerkleRoot.circom +11 -3
- package/circom/utils/trees/CheckRoot.circom +18 -14
- package/circom/utils/trees/LeafExists.circom +1 -1
- package/circom/utils/trees/{MerkleGeneratePathIndices.circom → MerklePathIndicesGenerator.circom} +11 -7
- package/circom/utils/trees/MerkleTreeInclusionProof.circom +6 -5
- package/circom/utils/trees/incrementalQuinaryTree.circom +2 -2
- package/circom/voter/PollJoined.circom +43 -0
- package/circom/voter/PollJoining.circom +54 -0
- package/package.json +12 -11
- package/build/ts/genZkeys.d.ts.map +0 -1
- package/build/ts/genZkeys.js.map +0 -1
- package/circom/utils/hashers.circom +0 -78
- package/circom/utils/messageToCommand.circom +0 -78
- package/circom/voter/poll.circom +0 -92
|
@@ -3,7 +3,7 @@ pragma circom 2.0.0;
|
|
|
3
3
|
// zk-kit imports
|
|
4
4
|
include "./safe-comparators.circom";
|
|
5
5
|
// local imports
|
|
6
|
-
include "../
|
|
6
|
+
include "../VerifySignature.circom";
|
|
7
7
|
|
|
8
8
|
/**
|
|
9
9
|
* Checks if a MACI message is valid or not.
|
|
@@ -11,12 +11,14 @@ include "../verifySignature.circom";
|
|
|
11
11
|
*/
|
|
12
12
|
template MessageValidator() {
|
|
13
13
|
// Length of the packed command.
|
|
14
|
-
var
|
|
14
|
+
var PACKED_COMMAND_LENGTH = 4;
|
|
15
|
+
// Number of checks to be performed.
|
|
16
|
+
var TOTAL_CHECKS = 6;
|
|
15
17
|
|
|
16
18
|
// State index of the user.
|
|
17
19
|
signal input stateTreeIndex;
|
|
18
20
|
// Number of user sign-ups in the state tree.
|
|
19
|
-
signal input
|
|
21
|
+
signal input totalSignups;
|
|
20
22
|
// Vote option index.
|
|
21
23
|
signal input voteOptionIndex;
|
|
22
24
|
// Number of valid vote options for the poll.
|
|
@@ -26,13 +28,13 @@ template MessageValidator() {
|
|
|
26
28
|
// Command nonce.
|
|
27
29
|
signal input nonce;
|
|
28
30
|
// Packed command.
|
|
29
|
-
signal input
|
|
31
|
+
signal input command[PACKED_COMMAND_LENGTH];
|
|
30
32
|
// Public key of the state leaf (user).
|
|
31
|
-
signal input
|
|
33
|
+
signal input publicKey[2];
|
|
32
34
|
// ECDSA signature of the command (R part).
|
|
33
|
-
signal input
|
|
35
|
+
signal input signaturePoint[2];
|
|
34
36
|
// ECDSA signature of the command (S part).
|
|
35
|
-
signal input
|
|
37
|
+
signal input signatureScalar;
|
|
36
38
|
// State leaf current voice credit balance.
|
|
37
39
|
signal input currentVoiceCreditBalance;
|
|
38
40
|
// Current number of votes for specific option.
|
|
@@ -48,10 +50,10 @@ template MessageValidator() {
|
|
|
48
50
|
signal output isVoteOptionIndexValid;
|
|
49
51
|
|
|
50
52
|
// Check (1) - The state leaf index must be valid.
|
|
51
|
-
// The check ensure that the stateTreeIndex <
|
|
53
|
+
// The check ensure that the stateTreeIndex < totalSignups as first validation.
|
|
52
54
|
// Must be < because the stateTreeIndex is 0-based. Zero is for blank state leaf
|
|
53
55
|
// while 1 is for the first actual user.
|
|
54
|
-
var computedIsStateLeafIndexValid = SafeLessThan(252)([stateTreeIndex,
|
|
56
|
+
var computedIsStateLeafIndexValid = SafeLessThan(252)([stateTreeIndex, totalSignups]);
|
|
55
57
|
|
|
56
58
|
// Check (2) - The vote option index must be less than the number of valid vote options (0 indexed).
|
|
57
59
|
var computedIsVoteOptionIndexValid = SafeLessThan(252)([voteOptionIndex, voteOptions]);
|
|
@@ -60,7 +62,7 @@ template MessageValidator() {
|
|
|
60
62
|
var computedIsNonceValid = IsEqual()([originalNonce + 1, nonce]);
|
|
61
63
|
|
|
62
64
|
// Check (4) - The signature must be correct.
|
|
63
|
-
var computedIsSignatureValid = VerifySignature()(
|
|
65
|
+
var computedIsSignatureValid = VerifySignature()(publicKey, signaturePoint, signatureScalar, command);
|
|
64
66
|
|
|
65
67
|
// Check (5) - There must be sufficient voice credits.
|
|
66
68
|
// The check ensure that the voteWeight is < sqrt(field size)
|
|
@@ -79,7 +81,7 @@ template MessageValidator() {
|
|
|
79
81
|
// When all six checks are correct, then isValid = 1.
|
|
80
82
|
var computedIsUpdateValid = IsEqual()(
|
|
81
83
|
[
|
|
82
|
-
|
|
84
|
+
TOTAL_CHECKS,
|
|
83
85
|
computedIsSignatureValid +
|
|
84
86
|
computedAreVoiceCreditsSufficient +
|
|
85
87
|
computedIsVoteWeightValid +
|
|
@@ -3,7 +3,7 @@ pragma circom 2.0.0;
|
|
|
3
3
|
// circomlib import
|
|
4
4
|
include "./mux1.circom";
|
|
5
5
|
// local import
|
|
6
|
-
include "./
|
|
6
|
+
include "./MessageValidator.circom";
|
|
7
7
|
|
|
8
8
|
/**
|
|
9
9
|
* Processes a command by verifying its validity and updates the state leaf and ballot accordingly.
|
|
@@ -13,18 +13,18 @@ include "./messageValidator.circom";
|
|
|
13
13
|
*/
|
|
14
14
|
template StateLeafAndBallotTransformer() {
|
|
15
15
|
// Length of the packed command.
|
|
16
|
-
var
|
|
16
|
+
var PACKED_COMMAND_LENGTH = 4;
|
|
17
17
|
|
|
18
18
|
// Number of user sign-ups in the state tree.
|
|
19
|
-
signal input
|
|
19
|
+
signal input totalSignups;
|
|
20
20
|
// Number of valid vote options for the poll.
|
|
21
21
|
signal input voteOptions;
|
|
22
22
|
|
|
23
23
|
// The following signals represents a state leaf (signed up user).
|
|
24
24
|
// Public key.
|
|
25
|
-
signal input
|
|
25
|
+
signal input stateLeafPublicKey[2];
|
|
26
26
|
// Current voice credit balance.
|
|
27
|
-
signal input
|
|
27
|
+
signal input stateLeafVoiceCreditBalance;
|
|
28
28
|
|
|
29
29
|
// The following signals represents a ballot.
|
|
30
30
|
// Nonce.
|
|
@@ -34,29 +34,29 @@ template StateLeafAndBallotTransformer() {
|
|
|
34
34
|
|
|
35
35
|
// The following signals represents a command.
|
|
36
36
|
// State index of the user.
|
|
37
|
-
signal input
|
|
37
|
+
signal input commandStateIndex;
|
|
38
38
|
// Public key of the user.
|
|
39
|
-
signal input
|
|
39
|
+
signal input commandPublicKey[2];
|
|
40
40
|
// Vote option index.
|
|
41
|
-
signal input
|
|
41
|
+
signal input commandVoteOptionIndex;
|
|
42
42
|
// Vote weight.
|
|
43
|
-
signal input
|
|
43
|
+
signal input commandNewVoteWeight;
|
|
44
44
|
// Nonce.
|
|
45
|
-
signal input
|
|
45
|
+
signal input commandNonce;
|
|
46
46
|
// Poll identifier.
|
|
47
|
-
signal input
|
|
47
|
+
signal input commandPollId;
|
|
48
48
|
// Salt.
|
|
49
|
-
signal input
|
|
49
|
+
signal input commandSalt;
|
|
50
50
|
// ECDSA signature of the command (R part).
|
|
51
|
-
signal input
|
|
51
|
+
signal input commandSignaturePoint[2];
|
|
52
52
|
// ECDSA signature of the command (S part).
|
|
53
|
-
signal input
|
|
53
|
+
signal input commandSignatureScalar;
|
|
54
54
|
// Packed command.
|
|
55
55
|
// nb. we are assuming that the packedCommand is always valid.
|
|
56
|
-
signal input packedCommand[
|
|
56
|
+
signal input packedCommand[PACKED_COMMAND_LENGTH];
|
|
57
57
|
|
|
58
58
|
// New state leaf (if the command is valid).
|
|
59
|
-
signal output
|
|
59
|
+
signal output newStateLeafPublicKey[2];
|
|
60
60
|
// New ballot (if the command is valid).
|
|
61
61
|
signal output newBallotNonce;
|
|
62
62
|
|
|
@@ -69,33 +69,33 @@ template StateLeafAndBallotTransformer() {
|
|
|
69
69
|
|
|
70
70
|
// Check if the command / message is valid.
|
|
71
71
|
var (computedMessageValidator, computedIsStateLeafIndexValid, computedIsVoteOptionIndexValid) = MessageValidator()(
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
72
|
+
commandStateIndex,
|
|
73
|
+
totalSignups,
|
|
74
|
+
commandVoteOptionIndex,
|
|
75
75
|
voteOptions,
|
|
76
76
|
ballotNonce,
|
|
77
|
-
|
|
77
|
+
commandNonce,
|
|
78
78
|
packedCommand,
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
79
|
+
stateLeafPublicKey,
|
|
80
|
+
commandSignaturePoint,
|
|
81
|
+
commandSignatureScalar,
|
|
82
|
+
stateLeafVoiceCreditBalance,
|
|
83
83
|
ballotCurrentVotesForOption,
|
|
84
|
-
|
|
84
|
+
commandNewVoteWeight
|
|
85
85
|
);
|
|
86
86
|
|
|
87
87
|
// If the message is valid then we swap out the public key.
|
|
88
|
-
// This means using a Mux1() for
|
|
89
|
-
// for
|
|
90
|
-
var
|
|
91
|
-
var
|
|
88
|
+
// This means using a Mux1() for publicKey[0] and another one
|
|
89
|
+
// for publicKey[1].
|
|
90
|
+
var computedNewstateLeafPublicKey0Mux = Mux1()([stateLeafPublicKey[0], commandPublicKey[0]], computedMessageValidator);
|
|
91
|
+
var computedNewstateLeafPublicKey1Mux = Mux1()([stateLeafPublicKey[1], commandPublicKey[1]], computedMessageValidator);
|
|
92
92
|
|
|
93
|
-
|
|
94
|
-
|
|
93
|
+
newStateLeafPublicKey[0] <== computedNewstateLeafPublicKey0Mux;
|
|
94
|
+
newStateLeafPublicKey[1] <== computedNewstateLeafPublicKey1Mux;
|
|
95
95
|
|
|
96
96
|
// If the message is valid, then we swap out the ballot nonce
|
|
97
97
|
// using a Mux1().
|
|
98
|
-
var computedNewBallotNonceMux = Mux1()([ballotNonce,
|
|
98
|
+
var computedNewBallotNonceMux = Mux1()([ballotNonce, commandNonce], computedMessageValidator);
|
|
99
99
|
|
|
100
100
|
newBallotNonce <== computedNewBallotNonceMux;
|
|
101
101
|
|
|
@@ -4,7 +4,7 @@ pragma circom 2.0.0;
|
|
|
4
4
|
include "./mux1.circom";
|
|
5
5
|
include "./comparators.circom";
|
|
6
6
|
// local import
|
|
7
|
-
include "../
|
|
7
|
+
include "../PoseidonHasher.circom";
|
|
8
8
|
|
|
9
9
|
// @note taken from @zk-kit/circuits
|
|
10
10
|
// if used directly in processMessages circom complains about duplicated
|
|
@@ -21,8 +21,16 @@ include "../hashers.circom";
|
|
|
21
21
|
// NOTE: This circuit will successfully verify `out = 0` for `depth > MAX_DEPTH`.
|
|
22
22
|
// Make sure to enforce `depth <= MAX_DEPTH` outside the circuit.
|
|
23
23
|
template BinaryMerkleRoot(MAX_DEPTH) {
|
|
24
|
-
|
|
25
|
-
|
|
24
|
+
// The leaf node of the Merkle tree.
|
|
25
|
+
signal input leaf;
|
|
26
|
+
// The depth of the Merkle tree.
|
|
27
|
+
signal input depth;
|
|
28
|
+
// The indices of the leaf node in the Merkle tree.
|
|
29
|
+
signal input indices[MAX_DEPTH];
|
|
30
|
+
// The sibling nodes of the leaf node in the Merkle tree.
|
|
31
|
+
signal input siblings[MAX_DEPTH][1];
|
|
32
|
+
|
|
33
|
+
// The output of the Merkle tree root.
|
|
26
34
|
signal output out;
|
|
27
35
|
|
|
28
36
|
signal nodes[MAX_DEPTH + 1];
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
pragma circom 2.0.0;
|
|
2
2
|
|
|
3
3
|
// local import
|
|
4
|
-
include "../
|
|
4
|
+
include "../PoseidonHasher.circom";
|
|
5
5
|
|
|
6
6
|
/**
|
|
7
7
|
* Verifies the correct construction of a Merkle tree from a set of leaves.
|
|
@@ -10,36 +10,40 @@ include "../hashers.circom";
|
|
|
10
10
|
*/
|
|
11
11
|
template CheckRoot(levels) {
|
|
12
12
|
// The total number of leaves in the Merkle tree, calculated as 2 to the power of `levels`.
|
|
13
|
-
var
|
|
13
|
+
var TOTAL_LEVELS = 2 ** levels;
|
|
14
14
|
// The number of first-level hashers needed, equal to half the total leaves, as each hasher combines two leaves.
|
|
15
|
-
var
|
|
15
|
+
var LEAF_HASHERS = TOTAL_LEVELS / 2;
|
|
16
16
|
// The number of intermediate hashers, one less than the number of leaf hashers,
|
|
17
17
|
// as each level of hashing reduces the number of hash elements by about half.
|
|
18
|
-
var
|
|
18
|
+
var INTERMEDIATE_HASHERS = LEAF_HASHERS - 1;
|
|
19
19
|
|
|
20
20
|
// Array of leaf values input to the circuit.
|
|
21
|
-
signal input leaves[
|
|
21
|
+
signal input leaves[TOTAL_LEVELS];
|
|
22
22
|
|
|
23
23
|
// Output signal for the Merkle root that results from hashing all the input leaves.
|
|
24
24
|
signal output root;
|
|
25
25
|
|
|
26
26
|
// Total number of hashers used in constructing the tree, one less than the total number of leaves,
|
|
27
27
|
// since each level of the tree combines two elements into one.
|
|
28
|
-
var
|
|
29
|
-
var computedLevelHashers[
|
|
28
|
+
var hashersLength = TOTAL_LEVELS - 1;
|
|
29
|
+
var computedLevelHashers[hashersLength];
|
|
30
30
|
|
|
31
31
|
// Initialize hashers for the leaves, each taking two adjacent leaves as inputs.
|
|
32
|
-
for (var i = 0; i <
|
|
33
|
-
computedLevelHashers[i] = PoseidonHasher(2)([leaves[i*2], leaves[i*2+1]]);
|
|
32
|
+
for (var i = 0; i < LEAF_HASHERS; i++){
|
|
33
|
+
computedLevelHashers[i] = PoseidonHasher(2)([leaves[i * 2], leaves[i * 2 + 1]]);
|
|
34
34
|
}
|
|
35
35
|
|
|
36
36
|
// Initialize hashers for intermediate levels, each taking the outputs of two hashers from the previous level.
|
|
37
|
-
var
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
37
|
+
var index = 0;
|
|
38
|
+
|
|
39
|
+
for (var i = LEAF_HASHERS; i < LEAF_HASHERS + INTERMEDIATE_HASHERS; i++) {
|
|
40
|
+
computedLevelHashers[i] = PoseidonHasher(2)([
|
|
41
|
+
computedLevelHashers[index * 2],
|
|
42
|
+
computedLevelHashers[index * 2 + 1]
|
|
43
|
+
]);
|
|
44
|
+
index++;
|
|
41
45
|
}
|
|
42
46
|
|
|
43
47
|
// Connect the output of the final hasher in the array to the root output signal.
|
|
44
|
-
root <== computedLevelHashers[
|
|
48
|
+
root <== computedLevelHashers[hashersLength - 1];
|
|
45
49
|
}
|
|
@@ -6,7 +6,7 @@ include "./MerkleTreeInclusionProof.circom";
|
|
|
6
6
|
/**
|
|
7
7
|
* Ensures that a leaf exists within a Merkle tree with a given root.
|
|
8
8
|
*/
|
|
9
|
-
template LeafExists(levels){
|
|
9
|
+
template LeafExists(levels) {
|
|
10
10
|
// The leaf whose existence within the tree is being verified.
|
|
11
11
|
signal input leaf;
|
|
12
12
|
|
package/circom/utils/trees/{MerkleGeneratePathIndices.circom → MerklePathIndicesGenerator.circom}
RENAMED
|
@@ -3,27 +3,31 @@ pragma circom 2.0.0;
|
|
|
3
3
|
// zk-kit imports
|
|
4
4
|
include "./safe-comparators.circom";
|
|
5
5
|
// local import
|
|
6
|
-
include "../
|
|
6
|
+
include "../CalculateTotal.circom";
|
|
7
7
|
|
|
8
8
|
/**
|
|
9
9
|
* Calculates the path indices required for Merkle proof verifications.
|
|
10
10
|
* Given a node index within an IMT and the total tree levels, it outputs the path indices leading to that node.
|
|
11
11
|
* The template handles the modulo and division operations to break down the tree index into its constituent path indices.
|
|
12
12
|
*/
|
|
13
|
-
template
|
|
13
|
+
template MerklePathIndicesGenerator(levels) {
|
|
14
|
+
// The base used for the modulo and division operations, set to 2 for binary trees.
|
|
14
15
|
var BASE = 2;
|
|
15
16
|
|
|
16
|
-
|
|
17
|
+
// The total sum of the path indices.
|
|
18
|
+
signal input indices;
|
|
19
|
+
|
|
20
|
+
// The generated path indices.
|
|
17
21
|
signal output out[levels];
|
|
18
22
|
|
|
19
|
-
var
|
|
23
|
+
var computedIndices = indices;
|
|
20
24
|
var computedResults[levels];
|
|
21
25
|
|
|
22
26
|
for (var i = 0; i < levels; i++) {
|
|
23
27
|
// circom's best practices suggests to avoid using <-- unless you
|
|
24
28
|
// are aware of what's going on. This is the only way to do modulo operation.
|
|
25
|
-
out[i] <--
|
|
26
|
-
|
|
29
|
+
out[i] <-- computedIndices % BASE;
|
|
30
|
+
computedIndices = computedIndices \ BASE;
|
|
27
31
|
|
|
28
32
|
// Check that each output element is less than the base.
|
|
29
33
|
var computedIsOutputElementLessThanBase = SafeLessThan(3)([out[i], BASE]);
|
|
@@ -36,5 +40,5 @@ template MerkleGeneratePathIndices(levels) {
|
|
|
36
40
|
// Check that the total sum matches the index.
|
|
37
41
|
var computedCalculateTotal = CalculateTotal(levels)(computedResults);
|
|
38
42
|
|
|
39
|
-
computedCalculateTotal ===
|
|
43
|
+
computedCalculateTotal === indices;
|
|
40
44
|
}
|
|
@@ -3,7 +3,7 @@ pragma circom 2.0.0;
|
|
|
3
3
|
// circomlib import
|
|
4
4
|
include "./mux1.circom";
|
|
5
5
|
// local import
|
|
6
|
-
include "../
|
|
6
|
+
include "../PoseidonHasher.circom";
|
|
7
7
|
|
|
8
8
|
/**
|
|
9
9
|
* Recomputes a Merkle root from a given leaf and its path in a Merkle tree.
|
|
@@ -16,6 +16,7 @@ template MerkleTreeInclusionProof(n_levels) {
|
|
|
16
16
|
// Sibling node values required to compute the hash at each level.
|
|
17
17
|
signal input path_elements[n_levels][1];
|
|
18
18
|
|
|
19
|
+
// The merkle root.
|
|
19
20
|
signal output root;
|
|
20
21
|
|
|
21
22
|
// Stores the hash at each level starting from the leaf to the root.
|
|
@@ -28,17 +29,17 @@ template MerkleTreeInclusionProof(n_levels) {
|
|
|
28
29
|
path_index[i] * (1 - path_index[i]) === 0;
|
|
29
30
|
|
|
30
31
|
// Configure the multiplexer based on the path index for the current level.
|
|
31
|
-
var
|
|
32
|
+
var multiplexer[2][2] = [
|
|
32
33
|
[levelHashes[i], path_elements[i][0]],
|
|
33
34
|
[path_elements[i][0], levelHashes[i]]
|
|
34
35
|
];
|
|
35
36
|
|
|
36
|
-
var
|
|
37
|
-
|
|
37
|
+
var multiplexerResult[2] = MultiMux1(2)(
|
|
38
|
+
multiplexer,
|
|
38
39
|
path_index[i]
|
|
39
40
|
);
|
|
40
41
|
|
|
41
|
-
var computedLevelHash = PoseidonHasher(2)([
|
|
42
|
+
var computedLevelHash = PoseidonHasher(2)([multiplexerResult[0], multiplexerResult[1]]);
|
|
42
43
|
|
|
43
44
|
// Store the resulting hash as the next level's hash.
|
|
44
45
|
levelHashes[i + 1] <== computedLevelHash;
|
|
@@ -6,8 +6,8 @@ include "./mux1.circom";
|
|
|
6
6
|
// zk-kit import
|
|
7
7
|
include "./safe-comparators.circom";
|
|
8
8
|
// local imports
|
|
9
|
-
include "../
|
|
10
|
-
include "../
|
|
9
|
+
include "../CalculateTotal.circom";
|
|
10
|
+
include "../PoseidonHasher.circom";
|
|
11
11
|
|
|
12
12
|
// Incremental Quintary Merkle Tree (IQT) verification circuits.
|
|
13
13
|
// Since each node contains 5 leaves, we are using PoseidonT6 for hashing them.
|
|
@@ -0,0 +1,43 @@
|
|
|
1
|
+
pragma circom 2.0.0;
|
|
2
|
+
|
|
3
|
+
// local imports
|
|
4
|
+
include "../utils/PoseidonHasher.circom";
|
|
5
|
+
include "../utils/PrivateToPublicKey.circom";
|
|
6
|
+
include "../utils/trees/BinaryMerkleRoot.circom";
|
|
7
|
+
|
|
8
|
+
// Poll Joined Circuit
|
|
9
|
+
// Allows a user to prove that they have joined a MACI poll.
|
|
10
|
+
// This is to be used with the MACI offchain implementation to allow
|
|
11
|
+
// users to authenticate to the relayer service (to reduce spamming).
|
|
12
|
+
template PollJoined(stateTreeDepth) {
|
|
13
|
+
// Constants defining the tree structure
|
|
14
|
+
var STATE_TREE_ARITY = 2;
|
|
15
|
+
|
|
16
|
+
// User's private key
|
|
17
|
+
signal input privateKey;
|
|
18
|
+
// User's voice credits balance
|
|
19
|
+
signal input voiceCreditsBalance;
|
|
20
|
+
// Path elements
|
|
21
|
+
signal input pathElements[stateTreeDepth][STATE_TREE_ARITY - 1];
|
|
22
|
+
// Path indices
|
|
23
|
+
signal input pathIndices[stateTreeDepth];
|
|
24
|
+
// Poll State tree root which proves the user is joined
|
|
25
|
+
signal input stateRoot;
|
|
26
|
+
// The actual tree depth (might be <= stateTreeDepth) Used in BinaryMerkleRoot
|
|
27
|
+
signal input actualStateTreeDepth;
|
|
28
|
+
|
|
29
|
+
// User private to public key
|
|
30
|
+
var derivedPublicKey[2] = PrivateToPublicKey()(privateKey);
|
|
31
|
+
|
|
32
|
+
var stateLeaf = PoseidonHasher(3)([derivedPublicKey[0], derivedPublicKey[1], voiceCreditsBalance]);
|
|
33
|
+
|
|
34
|
+
// Inclusion proof
|
|
35
|
+
var stateLeafQip = BinaryMerkleRoot(stateTreeDepth)(
|
|
36
|
+
stateLeaf,
|
|
37
|
+
actualStateTreeDepth,
|
|
38
|
+
pathIndices,
|
|
39
|
+
pathElements
|
|
40
|
+
);
|
|
41
|
+
|
|
42
|
+
stateLeafQip === stateRoot;
|
|
43
|
+
}
|
|
@@ -0,0 +1,54 @@
|
|
|
1
|
+
pragma circom 2.0.0;
|
|
2
|
+
|
|
3
|
+
// local imports
|
|
4
|
+
include "../utils/PoseidonHasher.circom";
|
|
5
|
+
include "../utils/PrivateToPublicKey.circom";
|
|
6
|
+
include "../utils/trees/BinaryMerkleRoot.circom";
|
|
7
|
+
|
|
8
|
+
// Poll Joining Circuit
|
|
9
|
+
// Allows a user to prove knowledge of a private key that is signed up to
|
|
10
|
+
// a MACI contract.
|
|
11
|
+
template PollJoining(stateTreeDepth) {
|
|
12
|
+
// Constants defining the tree structure
|
|
13
|
+
var STATE_TREE_ARITY = 2;
|
|
14
|
+
|
|
15
|
+
// User's private key
|
|
16
|
+
signal input privateKey;
|
|
17
|
+
// Poll's public key
|
|
18
|
+
signal input pollPublicKey[2];
|
|
19
|
+
// Siblings
|
|
20
|
+
signal input siblings[stateTreeDepth][STATE_TREE_ARITY - 1];
|
|
21
|
+
// Indices
|
|
22
|
+
signal input indices[stateTreeDepth];
|
|
23
|
+
// User's hashed private key
|
|
24
|
+
signal input nullifier;
|
|
25
|
+
// MACI State tree root which proves the user is signed up
|
|
26
|
+
signal input stateRoot;
|
|
27
|
+
// The actual tree depth (might be <= stateTreeDepth) used in BinaryMerkleRoot
|
|
28
|
+
signal input actualStateTreeDepth;
|
|
29
|
+
// The poll id
|
|
30
|
+
signal input pollId;
|
|
31
|
+
|
|
32
|
+
// Compute the nullifier (hash of private key and poll id)
|
|
33
|
+
var computedNullifier = PoseidonHasher(2)([privateKey, pollId]);
|
|
34
|
+
nullifier === computedNullifier;
|
|
35
|
+
|
|
36
|
+
// User private to public key
|
|
37
|
+
var derivedPublicKey[2] = PrivateToPublicKey()(privateKey);
|
|
38
|
+
// Hash the public key
|
|
39
|
+
var publicKeyHash = PoseidonHasher(2)([derivedPublicKey[0], derivedPublicKey[1]]);
|
|
40
|
+
|
|
41
|
+
// Ensure the poll public key is the same as the maci one (public input)
|
|
42
|
+
derivedPublicKey[0] === pollPublicKey[0];
|
|
43
|
+
derivedPublicKey[1] === pollPublicKey[1];
|
|
44
|
+
|
|
45
|
+
// Inclusion proof
|
|
46
|
+
var calculatedRoot = BinaryMerkleRoot(stateTreeDepth)(
|
|
47
|
+
publicKeyHash,
|
|
48
|
+
actualStateTreeDepth,
|
|
49
|
+
indices,
|
|
50
|
+
siblings
|
|
51
|
+
);
|
|
52
|
+
|
|
53
|
+
calculatedRoot === stateRoot;
|
|
54
|
+
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@maci-protocol/circuits",
|
|
3
|
-
"version": "0.0.0-ci.
|
|
3
|
+
"version": "0.0.0-ci.0bef05d",
|
|
4
4
|
"private": false,
|
|
5
5
|
"description": "zk-SNARK circuits for MACI",
|
|
6
6
|
"main": "build/ts/index.js",
|
|
@@ -18,7 +18,7 @@
|
|
|
18
18
|
"scripts": {
|
|
19
19
|
"build-test-circuits-c": "ts-node ./ts/compile.ts --cWitness",
|
|
20
20
|
"build-test-circuits-wasm": "ts-node ./ts/compile.ts",
|
|
21
|
-
"
|
|
21
|
+
"generate-zkeys": "ts-node ./ts/generateZkeys.ts",
|
|
22
22
|
"info": "NODE_OPTIONS=--max-old-space-size=4096 ts-node ./ts/info.ts",
|
|
23
23
|
"watch": "tsc --watch",
|
|
24
24
|
"build": "tsc -p tsconfig.build.json",
|
|
@@ -28,12 +28,13 @@
|
|
|
28
28
|
"mocha-test": "NODE_OPTIONS=--max-old-space-size=4096 ts-mocha --exit -g '^(?!.*\\[fuzz\\]).*$'",
|
|
29
29
|
"test": "pnpm run mocha-test ts/__tests__/*.test.ts",
|
|
30
30
|
"test:fuzz": "NODE_OPTIONS=--max-old-space-size=4096 ts-mocha --exit -g '\\[fuzz\\]' ./ts/__tests__/*.test.ts",
|
|
31
|
-
"test:
|
|
31
|
+
"test:poseidonHasher": "pnpm run mocha-test ts/__tests__/PoseidonHasher.test.ts",
|
|
32
|
+
"test:messageHasher": "pnpm run mocha-test ts/__tests__/MessageHasher.test.ts",
|
|
32
33
|
"test:slAndBallotTransformer": "pnpm run mocha-test ts/__tests__/StateLeafAndBallotTransformer.test.ts",
|
|
33
34
|
"test:messageToCommand": "pnpm run mocha-test ts/__tests__/MessageToCommand.test.ts",
|
|
34
35
|
"test:messageValidator": "pnpm run mocha-test ts/__tests__/MessageValidator.test.ts",
|
|
35
36
|
"test:verifySignature": "pnpm run mocha-test ts/__tests__/VerifySignature.test.ts",
|
|
36
|
-
"test:
|
|
37
|
+
"test:privateToPublicKey": "pnpm run mocha-test ts/__tests__/PrivateToPublicKey.test.ts",
|
|
37
38
|
"test:calculateTotal": "pnpm run mocha-test ts/__tests__/CalculateTotal.test.ts",
|
|
38
39
|
"test:processMessages": "pnpm run mocha-test ts/__tests__/ProcessMessages.test.ts",
|
|
39
40
|
"test:tallyVotes": "pnpm run mocha-test ts/__tests__/TallyVotes.test.ts",
|
|
@@ -43,10 +44,10 @@
|
|
|
43
44
|
"test:pollJoined": "pnpm run mocha-test ts/__tests__/PollJoined.test.ts"
|
|
44
45
|
},
|
|
45
46
|
"dependencies": {
|
|
46
|
-
"@maci-protocol/core": "0.0.0-ci.
|
|
47
|
-
"@maci-protocol/crypto": "0.0.0-ci.
|
|
48
|
-
"@maci-protocol/domainobjs": "0.0.0-ci.
|
|
49
|
-
"@maci-protocol/sdk": "0.0.0-ci.
|
|
47
|
+
"@maci-protocol/core": "0.0.0-ci.0bef05d",
|
|
48
|
+
"@maci-protocol/crypto": "0.0.0-ci.0bef05d",
|
|
49
|
+
"@maci-protocol/domainobjs": "0.0.0-ci.0bef05d",
|
|
50
|
+
"@maci-protocol/sdk": "0.0.0-ci.0bef05d",
|
|
50
51
|
"@zk-kit/circuits": "^0.4.0",
|
|
51
52
|
"circomkit": "^0.3.2",
|
|
52
53
|
"circomlib": "^2.0.5"
|
|
@@ -55,17 +56,17 @@
|
|
|
55
56
|
"@types/chai": "^4.3.11",
|
|
56
57
|
"@types/chai-as-promised": "^7.1.8",
|
|
57
58
|
"@types/mocha": "^10.0.10",
|
|
58
|
-
"@types/node": "^22.14.
|
|
59
|
+
"@types/node": "^22.14.1",
|
|
59
60
|
"@types/snarkjs": "^0.7.9",
|
|
60
61
|
"@zk-kit/baby-jubjub": "^1.0.3",
|
|
61
62
|
"chai": "^4.3.10",
|
|
62
63
|
"chai-as-promised": "^7.1.2",
|
|
63
|
-
"fast-check": "^4.1.
|
|
64
|
+
"fast-check": "^4.1.1",
|
|
64
65
|
"glob": "^11.0.1",
|
|
65
66
|
"mocha": "^11.1.0",
|
|
66
67
|
"ts-mocha": "^11.1.0",
|
|
67
68
|
"ts-node": "^10.9.1",
|
|
68
69
|
"typescript": "^5.8.3"
|
|
69
70
|
},
|
|
70
|
-
"gitHead": "
|
|
71
|
+
"gitHead": "2b18e370edea4dfb301502ce357e2e9adeb8e4ca"
|
|
71
72
|
}
|
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"genZkeys.d.ts","sourceRoot":"","sources":["../../ts/genZkeys.ts"],"names":[],"mappings":"AAQA;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAU,aAAa,MAAM,KAAG,OAAO,CAAC,IAAI,CA2CrE,CAAC"}
|
package/build/ts/genZkeys.js.map
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"genZkeys.js","sourceRoot":"","sources":["../../ts/genZkeys.ts"],"names":[],"mappings":";;;;;;AAAA,4CAAkD;AAClD,yCAAgF;AAEhF,4CAAoB;AACpB,gDAAwB;AAIxB;;;;;;GAMG;AACI,MAAM,aAAa,GAAG,KAAK,EAAE,UAAmB,EAAiB,EAAE;IACxE,8BAA8B;IAC9B,MAAM,cAAc,GAAG,cAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,YAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC,CAAoB,CAAC;IAC3G,MAAM,kBAAkB,GAAG,cAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IACpF,MAAM,qBAAqB,GAAG,IAAI,CAAC,KAAK,CACtC,MAAM,YAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,CACZ,CAAC;IAC9C,MAAM,eAAe,GAA4B,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9G,IAAI;QACJ,GAAG,MAAM;KACV,CAAC,CAAC,CAAC;IAEJ,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,cAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,8BAA8B;IAC9B,IAAI,OAAO,EAAE,CAAC;QACZ,eAAe,CAAC,QAAQ,GAAG,OAAO,CAAC;QACnC,eAAe,CAAC,OAAO,GAAG,OAAO,CAAC;IACpC,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,qBAAS,CAAC;QACtC,GAAG,eAAe;QAClB,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;IAEH,oDAAoD;IACpD,4DAA4D;IAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QAEnC,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,uBAAuB,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;QAEtD,4CAA4C;QAC5C,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtE,kBAAkB;QAClB,MAAM,QAAQ,GAAG,cAAI,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,SAAS,CAAC,CAAC;QAChG,4CAA4C;QAC5C,MAAM,YAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IAED,sCAAsC;IACtC,MAAM,IAAA,kBAAY,GAAE,CAAC;AACvB,CAAC,CAAC;AA3CW,QAAA,aAAa,iBA2CxB;AAEF,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,CAAC,KAAK,IAAI,EAAE;QACV,MAAM,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,eAAe,KAAK,CAAC,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAA,qBAAa,GAAE,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YACzE,MAAM,IAAA,qBAAa,EAAC,YAAY,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;AACP,CAAC"}
|
|
@@ -1,78 +0,0 @@
|
|
|
1
|
-
pragma circom 2.0.0;
|
|
2
|
-
|
|
3
|
-
// zk-kit imports
|
|
4
|
-
include "./poseidon-cipher.circom";
|
|
5
|
-
|
|
6
|
-
/**
|
|
7
|
-
* Computes the Poseidon hash for an array of n inputs, including a default initial state
|
|
8
|
-
* of zero not counted in n. First, extends the inputs by prepending a zero, creating an array [0, inputs].
|
|
9
|
-
* Then, the Poseidon hash of the extended inputs is calculated, with the first element of the
|
|
10
|
-
* result assigned as the output.
|
|
11
|
-
*/
|
|
12
|
-
template PoseidonHasher(n) {
|
|
13
|
-
signal input inputs[n];
|
|
14
|
-
signal output out;
|
|
15
|
-
|
|
16
|
-
// [0, inputs].
|
|
17
|
-
var computedExtendedInputs[n + 1];
|
|
18
|
-
computedExtendedInputs[0] = 0;
|
|
19
|
-
|
|
20
|
-
for (var i = 0; i < n; i++) {
|
|
21
|
-
computedExtendedInputs[i + 1] = inputs[i];
|
|
22
|
-
}
|
|
23
|
-
|
|
24
|
-
// Compute the Poseidon hash of the extended inputs.
|
|
25
|
-
var computedPoseidonPerm[n + 1];
|
|
26
|
-
computedPoseidonPerm = PoseidonPerm(n + 1)(computedExtendedInputs);
|
|
27
|
-
|
|
28
|
-
out <== computedPoseidonPerm[0];
|
|
29
|
-
}
|
|
30
|
-
|
|
31
|
-
/**
|
|
32
|
-
* Hashes a MACI message and the public key used for message encryption.
|
|
33
|
-
* This template processes 10 message inputs and a 2-element public key
|
|
34
|
-
* combining them using the Poseidon hash function. The hashing process involves two stages:
|
|
35
|
-
* 1. hashing message parts in groups of five and,
|
|
36
|
-
* 2. hashing the grouped results alongside the first message input and
|
|
37
|
-
* the encryption public key to produce a final hash output.
|
|
38
|
-
*/
|
|
39
|
-
template MessageHasher() {
|
|
40
|
-
// The MACI message is composed of 10 parts.
|
|
41
|
-
signal input in[10];
|
|
42
|
-
// the public key used to encrypt the message.
|
|
43
|
-
signal input encPubKey[2];
|
|
44
|
-
// we output an hash.
|
|
45
|
-
signal output hash;
|
|
46
|
-
|
|
47
|
-
// Hasher4(
|
|
48
|
-
// Hasher5_1(in[1], in[2], in[3], in[4], in[5]),
|
|
49
|
-
// Hasher5_2(in[6], in[7], in[8], in[9], in[10])
|
|
50
|
-
// in[11],
|
|
51
|
-
// in[12]
|
|
52
|
-
// )
|
|
53
|
-
|
|
54
|
-
var computedHasher5_1;
|
|
55
|
-
computedHasher5_1 = PoseidonHasher(5)([
|
|
56
|
-
in[0],
|
|
57
|
-
in[1],
|
|
58
|
-
in[2],
|
|
59
|
-
in[3],
|
|
60
|
-
in[4]
|
|
61
|
-
]);
|
|
62
|
-
|
|
63
|
-
var computedHasher5_2;
|
|
64
|
-
computedHasher5_2 = PoseidonHasher(5)([
|
|
65
|
-
in[5],
|
|
66
|
-
in[6],
|
|
67
|
-
in[7],
|
|
68
|
-
in[8],
|
|
69
|
-
in[9]
|
|
70
|
-
]);
|
|
71
|
-
|
|
72
|
-
hash <== PoseidonHasher(4)([
|
|
73
|
-
computedHasher5_1,
|
|
74
|
-
computedHasher5_2,
|
|
75
|
-
encPubKey[0],
|
|
76
|
-
encPubKey[1]
|
|
77
|
-
]);
|
|
78
|
-
}
|