@maci-protocol/circuits 0.0.0-ci.2653bc0

package/circom/utils/verifySignature.circom

@@ -0,0 +1,117 @@
+pragma circom 2.0.0;
+
+// circomlib imports
+include "./compconstant.circom";
+include "./comparators.circom";
+include "./pointbits.circom";
+include "./bitify.circom";
+include "./escalarmulany.circom";
+include "./escalarmulfix.circom";
+// local imports
+include "./hashers.circom";
+
+/**
+ * Variant of the EdDSAPoseidonVerifier template from circomlib
+ * https://github.com/iden3/circomlib/blob/master/circuits/eddsa.circom
+ */
+template EdDSAPoseidonVerifier_patched() {
+    // The x and y coordinates of the public key.
+    signal input Ax;
+    signal input Ay;
+    // Signature scalar.
+    signal input S;
+    // The x and y coordinates of the signature point.
+    signal input R8x;
+    signal input R8y;
+    // Message hash.
+    signal input M;
+
+    signal output valid;
+
+    // Ensure S<Subgroup Order.
+    // convert the signature scalar S into its binary representation.
+    var computedNum2Bits[254] = Num2Bits(254)(S);
+
+    var computedCompConstantIn[254] = computedNum2Bits;
+    computedCompConstantIn[253] = 0;
+
+    // A component that ensures S is within a valid range, 
+    // comparing it against a constant representing the subgroup order.
+    var computedCompConstant = CompConstant(2736030358979909402780800718157159386076813972158567259200215660948447373040)(computedCompConstantIn);
+
+    // Calculate the h = H(R,A, msg).
+    var computedH2Bits[254] = Num2Bits_strict()(PoseidonHasher(5)([R8x, R8y, Ax, Ay, M]));
+
+    // These components perform point doubling operations on the public key
+    // to align it within the correct subgroup as part of the verification process.
+    var (computedDbl1XOut, computedDbl1YOut) = BabyDbl()(Ax, Ay);
+    var (computedDbl2XOut, computedDbl2YOut) = BabyDbl()(computedDbl1XOut, computedDbl1YOut);
+    var (computedDbl3XOut, computedDbl3YOut) = BabyDbl()(computedDbl2XOut, computedDbl2YOut);
+
+    // A component that performs scalar multiplication of the 
+    // adjusted public key by the hash output, essential for the verification calculation.
+    var computedEscalarMulAny[2] = EscalarMulAny(254)(computedH2Bits, [computedDbl3XOut, computedDbl3YOut]);
+
+    // Compute the right side: right =  R8 + right2.
+    var (computedAddRightXOut, computedAddRightYOut) = BabyAdd()(R8x, R8y, computedEscalarMulAny[0], computedEscalarMulAny[1]);
+
+    // Calculate the left side: left = S * B8.
+    var BASE8[2] = [
+        5299619240641551281634865583518297030282874472190772894086521144482721001553,
+        16950150798460657717958625567821834550301663161624707787222815936182638968203
+    ];
+    
+    // Fixed-base scalar multiplication of a base point by S.
+    var computedEscalarMulFix[2] = EscalarMulFix(254, BASE8)(computedNum2Bits);
+
+    // Components to check the equality of x and y coordinates 
+    // between the computed and expected points of the signature.
+    var computedIsRightValid = IsEqual()([computedEscalarMulFix[0], computedAddRightXOut]);
+    var computedIsLeftValid = IsEqual()([computedEscalarMulFix[1], computedAddRightYOut]);
+    var computedIsLeftRightValid = IsEqual()([computedIsRightValid + computedIsLeftValid, 2]);
+
+    // Components to handle edge cases and ensure that all conditions 
+    // for a valid signature are met, including the 
+    // public key not being zero and other integrity checks.
+    var computedIsAxZero = IsZero()(Ax);
+    var computedIsAxEqual = IsEqual()([computedIsAxZero, 0]);
+    var computedIsCcZero = IsZero()(computedCompConstant);
+    var computedIsValid = IsEqual()([computedIsLeftRightValid + computedIsAxEqual + computedIsCcZero, 3]);
+
+    valid <== computedIsValid;
+}
+
+/**
+ * Verifies the EdDSA signature for a given command, which has exactly four elements in the hash preimage.
+ */
+template VerifySignature() {
+    // Public key of the signer, consisting of two coordinates [x, y].
+    signal input pubKey[2];
+    // R8 point from the signature, consisting of two coordinates [x, y]. 
+    signal input R8[2];
+    // Scalar component of the signature.
+    signal input S;
+
+    // Number of elements in the hash preimage.
+    var k = 4;
+    
+    // The preimage data that was hashed, an array of four elements.
+    signal input preimage[k];
+
+    signal output valid;
+
+    // Hash the preimage using the Poseidon hashing function configured for four inputs.
+    var computedM = PoseidonHasher(4)(preimage);
+
+    // Instantiate the patched EdDSA Poseidon verifier with the necessary inputs.
+    var computedVerifier = EdDSAPoseidonVerifier_patched()(
+        pubKey[0],
+        pubKey[1],
+        S,
+        R8[0],
+        R8[1],
+        computedM
+    );
+
+    valid <== computedVerifier;
+}

package/circom/voter/poll.circom

@@ -0,0 +1,93 @@
+pragma circom 2.0.0;
+
+// local imports
+include "../utils/hashers.circom";
+include "../utils/privToPubKey.circom";
+include "../utils/trees/incrementalMerkleTree.circom";
+
+// Poll Joining Circuit
+// Allows a user to prove knowledge of a private key that is signed up to 
+// a MACI contract.
+template PollJoining(stateTreeDepth) {
+    // Constants defining the tree structure
+    var STATE_TREE_ARITY = 2;
+
+    // User's private key
+    signal input privKey;
+    // Poll's public key
+    signal input pollPubKey[2];
+    // Siblings
+    signal input siblings[stateTreeDepth][STATE_TREE_ARITY - 1];
+    // Indices
+    signal input indices[stateTreeDepth];
+    // User's hashed private key
+    signal input nullifier;
+    // MACI State tree root which proves the user is signed up
+    signal input stateRoot;
+    // The actual tree depth (might be <= stateTreeDepth) used in BinaryMerkleRoot
+    signal input actualStateTreeDepth;
+    // The poll id
+    signal input pollId;
+
+    // Compute the nullifier (hash of private key and poll id)
+    var computedNullifier = PoseidonHasher(2)([privKey, pollId]);
+    nullifier === computedNullifier;
+
+    // User private to public key
+    var derivedPubKey[2] = PrivToPubKey()(privKey);
+    // Hash the public key
+    var pubKeyHash = PoseidonHasher(2)([derivedPubKey[0], derivedPubKey[1]]);
+
+    // Ensure the poll public key is the same as the maci one (public input)
+    derivedPubKey[0] === pollPubKey[0];
+    derivedPubKey[1] === pollPubKey[1];
+
+    // Inclusion proof  
+    var calculatedRoot = BinaryMerkleRoot(stateTreeDepth)(
+        pubKeyHash,
+        actualStateTreeDepth,
+        indices,
+        siblings
+    );
+
+    calculatedRoot === stateRoot;
+}
+
+// Poll Joined Circuit
+// Allows a user to prove that they have joined a MACI poll.
+// This is to be used with the MACI offchain implementation to allow 
+// users to authenticate to the relayer service (to reduce spamming).
+template PollJoined(stateTreeDepth) {
+    // Constants defining the tree structure
+    var STATE_TREE_ARITY = 2;
+
+    // User's private key
+    signal input privKey;
+    // User's voice credits balance
+    signal input voiceCreditsBalance;
+    // Poll's joined timestamp
+    signal input joinTimestamp;
+    // Path elements
+    signal input pathElements[stateTreeDepth][STATE_TREE_ARITY - 1];
+    // Path indices
+    signal input pathIndices[stateTreeDepth];
+    // Poll State tree root which proves the user is joined
+    signal input stateRoot;
+    // The actual tree depth (might be <= stateTreeDepth) Used in BinaryMerkleRoot
+    signal input actualStateTreeDepth;
+
+     // User private to public key
+    var derivedPubKey[2] = PrivToPubKey()(privKey);
+
+    var stateLeaf = PoseidonHasher(4)([derivedPubKey[0], derivedPubKey[1], voiceCreditsBalance, joinTimestamp]);
+
+    // Inclusion proof  
+    var stateLeafQip = BinaryMerkleRoot(stateTreeDepth)(
+        stateLeaf,
+        actualStateTreeDepth,
+        pathIndices,
+        pathElements
+    );
+
+    stateLeafQip === stateRoot;
+}

package/circomkit.json

@@ -0,0 +1,18 @@
+{
+  "protocol": "groth16",
+  "prime": "bn128",
+  "version": "2.1.6",
+  "circuits": "./circom/circuits.json",
+  "dirPtau": "./ptau",
+  "dirCircuits": "./circom",
+  "dirInputs": "./inputs",
+  "dirBuild": "./build",
+  "optimization": 2,
+  "inspect": false,
+  "include": ["./node_modules/circomlib/circuits", "./node_modules/@zk-kit/circuits/circom"],
+  "groth16numContributions": 0,
+  "groth16askForEntropy": false,
+  "logLevel": "INFO",
+  "verbose": true,
+  "cWitness": true
+}

package/package.json

@@ -0,0 +1,71 @@
+{
+  "name": "@maci-protocol/circuits",
+  "version": "0.0.0-ci.2653bc0",
+  "private": false,
+  "description": "zk-SNARK circuits for MACI",
+  "main": "build/ts/index.js",
+  "files": [
+    "build",
+    "circom",
+    "circomkit.json",
+    "LICENSE",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build-test-circuits-c": "ts-node ./ts/compile.ts --cWitness",
+    "build-test-circuits-wasm": "ts-node ./ts/compile.ts",
+    "gen-zkeys": "ts-node ./ts/genZkeys.ts",
+    "info": "NODE_OPTIONS=--max-old-space-size=4096 ts-node ./ts/info.ts",
+    "watch": "tsc --watch",
+    "build": "tsc -p tsconfig.build.json",
+    "circom:build": "NODE_OPTIONS=--max-old-space-size=4096 circomkit compile",
+    "circom:setup": "NODE_OPTIONS=--max-old-space-size=4096 circomkit setup",
+    "types": "tsc -p tsconfig.json --noEmit",
+    "mocha-test": "NODE_OPTIONS=--max-old-space-size=4096 ts-mocha --exit -g '^(?!.*\\[fuzz\\]).*$'",
+    "test": "pnpm run mocha-test ts/__tests__/*.test.ts",
+    "test:fuzz": "NODE_OPTIONS=--max-old-space-size=4096 ts-mocha --exit -g '\\[fuzz\\]' ./ts/__tests__/*.test.ts",
+    "test:hasher": "pnpm run mocha-test ts/__tests__/Hasher.test.ts",
+    "test:slAndBallotTransformer": "pnpm run mocha-test ts/__tests__/StateLeafAndBallotTransformer.test.ts",
+    "test:messageToCommand": "pnpm run mocha-test ts/__tests__/MessageToCommand.test.ts",
+    "test:messageValidator": "pnpm run mocha-test ts/__tests__/MessageValidator.test.ts",
+    "test:verifySignature": "pnpm run mocha-test ts/__tests__/VerifySignature.test.ts",
+    "test:privToPubKey": "pnpm run mocha-test ts/__tests__/PrivToPubKey.test.ts",
+    "test:calculateTotal": "pnpm run mocha-test ts/__tests__/CalculateTotal.test.ts",
+    "test:processMessages": "pnpm run mocha-test ts/__tests__/ProcessMessages.test.ts",
+    "test:tallyVotes": "pnpm run mocha-test ts/__tests__/TallyVotes.test.ts",
+    "test:ceremonyParams": "pnpm run mocha-test ts/__tests__/CeremonyParams.test.ts",
+    "test:incrementalQuinaryTree": "pnpm run mocha-test ts/__tests__/IncrementalQuinaryTree.test.ts",
+    "test:pollJoining": "pnpm run mocha-test ts/__tests__/PollJoining.test.ts",
+    "test:pollJoined": "pnpm run mocha-test ts/__tests__/PollJoined.test.ts"
+  },
+  "dependencies": {
+    "@maci-protocol/core": "0.0.0-ci.2653bc0",
+    "@maci-protocol/crypto": "0.0.0-ci.2653bc0",
+    "@maci-protocol/domainobjs": "0.0.0-ci.2653bc0",
+    "@maci-protocol/sdk": "0.0.0-ci.2653bc0",
+    "@zk-kit/circuits": "^0.4.0",
+    "circomkit": "^0.3.2",
+    "circomlib": "^2.0.5"
+  },
+  "devDependencies": {
+    "@types/chai": "^4.3.11",
+    "@types/chai-as-promised": "^7.1.8",
+    "@types/mocha": "^10.0.10",
+    "@types/node": "^22.13.10",
+    "@types/snarkjs": "^0.7.9",
+    "@zk-kit/baby-jubjub": "^1.0.3",
+    "chai": "^4.3.10",
+    "chai-as-promised": "^7.1.2",
+    "fast-check": "^4.0.0",
+    "glob": "^11.0.1",
+    "mocha": "^11.1.0",
+    "ts-mocha": "^11.1.0",
+    "ts-node": "^10.9.1",
+    "typescript": "^5.8.2"
+  },
+  "gitHead": "244acf2206f9cf6660e2c091f04de18d3c87fd02"
+}