@maci-protocol/circuits 0.0.0-ci.26f28d6

package/circom/coordinator/non-qv/tallyVotes.circom

@@ -0,0 +1,232 @@
+pragma circom 2.0.0;
+
+// circomlib import
+include "./comparators.circom";
+// zk-kit import
+include "./unpack-element.circom";
+// local imports
+include "../../utils/trees/incrementalMerkleTree.circom";
+include "../../utils/trees/incrementalQuinaryTree.circom";
+include "../../utils/calculateTotal.circom";
+include "../../utils/hashers.circom";
+
+/**
+ * Processes batches of votes and verifies their validity in a Merkle tree structure.
+ * This template does not support Quadratic Voting (QV).
+ */
+template TallyVotesNonQv(
+    stateTreeDepth,
+    intStateTreeDepth,
+    voteOptionTreeDepth
+) {
+    // Ensure there's at least one level in the vote option tree.
+    assert(voteOptionTreeDepth > 0);
+    // Ensure the intermediate state tree has at least one level.
+    assert(intStateTreeDepth > 0);
+    // The intermediate state tree must be smaller than the full state tree.
+    assert(intStateTreeDepth < stateTreeDepth); 
+
+    // Number of children per node in the tree, defining the tree's branching factor.
+    var TREE_ARITY = 5;
+    var BALLOT_TREE_ARITY = 2;
+
+    // The number of ballots processed at once, determined by the depth of the intermediate state tree.
+    var batchSize = BALLOT_TREE_ARITY ** intStateTreeDepth;
+    // Number of voting options available, determined by the depth of the vote option tree.
+    var numVoteOptions = TREE_ARITY ** voteOptionTreeDepth;
+
+    // Number of elements in each ballot.
+    var BALLOT_LENGTH = 2;
+    // Index for the nonce in the ballot array.
+    var BALLOT_NONCE_IDX = 0;
+    // Index for the voting option root in the ballot array.
+    var BALLOT_VO_ROOT_IDX = 1;
+    // Difference in tree depths, used in path calculations.
+    var k = stateTreeDepth - intStateTreeDepth;
+
+    // Root of the state Merkle tree, representing the overall state before voting.
+    signal input stateRoot;
+    // Root of the ballot Merkle tree, representing the submitted ballots.
+    signal input ballotRoot;
+    // Salt used in commitment to secure the ballot data.
+    signal input sbSalt;
+    // Commitment to the state and ballots.
+    signal input sbCommitment;
+    // Commitment to the current tally before this batch.
+    signal input currentTallyCommitment;
+    // Commitment to the new tally after processing this batch.
+    signal input newTallyCommitment;
+    // Start index of given batch
+    signal input index;
+    // Number of users that signup
+    signal input numSignUps;
+    // Ballots and their corresponding path elements for verification in the tree.
+    signal input ballots[batchSize][BALLOT_LENGTH];
+    signal input ballotPathElements[k][BALLOT_TREE_ARITY - 1];
+    signal input votes[batchSize][numVoteOptions];
+    // Current results for each vote option.
+    signal input currentResults[numVoteOptions];
+    // Salt for the root of the current results.
+    signal input currentResultsRootSalt;
+    // Total voice credits spent so far.
+    signal input currentSpentVoiceCreditSubtotal;
+    // Salt for the total spent voice credits.
+    signal input currentSpentVoiceCreditSubtotalSalt;
+    // Salt for the root of the new results.
+    signal input newResultsRootSalt;
+    // Salt for the new total spent voice credits root. 
+    signal input newSpentVoiceCreditSubtotalSalt;
+
+    // Verify sbCommitment.
+    var computedSbCommitment = PoseidonHasher(3)([stateRoot, ballotRoot, sbSalt]);
+    computedSbCommitment === sbCommitment;
+
+
+    // Validates that the index is within the valid range of sign-ups.
+    var numSignUpsValid = LessEqThan(50)([index, numSignUps]);
+    numSignUpsValid === 1;
+
+    // Hashes each ballot for subroot generation, and checks the existence of the leaf in the Merkle tree.    
+    var computedBallotHashers[batchSize];
+    
+    for (var i = 0; i < batchSize; i++) {
+        computedBallotHashers[i] = PoseidonHasher(2)([ballots[i][BALLOT_NONCE_IDX], ballots[i][BALLOT_VO_ROOT_IDX]]);
+    }
+
+    var computedBallotSubroot = CheckRoot(intStateTreeDepth)(computedBallotHashers);
+    var computedBallotPathIndices[k] = MerkleGeneratePathIndices(k)(index / batchSize);
+
+    // Verifies each ballot's existence within the ballot tree.
+    LeafExists(k)(
+        computedBallotSubroot,
+        ballotPathElements,
+        computedBallotPathIndices,
+        ballotRoot
+    );
+
+    // Processes vote options, verifying each against its declared root.
+    var computedVoteTree[batchSize];
+    for (var i = 0; i < batchSize; i++) {
+        computedVoteTree[i] = QuinCheckRoot(voteOptionTreeDepth)(votes[i]);
+        computedVoteTree[i] === ballots[i][BALLOT_VO_ROOT_IDX];
+    }
+
+    // Calculates new results and spent voice credits based on the current and incoming votes.
+    var computedIsFirstBatch = IsZero()(index);
+    var computedIsZero = IsZero()(computedIsFirstBatch);
+
+    // Tally the new results.
+    var computedCalculateTotalResult[numVoteOptions];
+    for (var i = 0; i < numVoteOptions; i++) {
+        var computedNumsRC[batchSize + 1];
+        computedNumsRC[batchSize] = currentResults[i] * computedIsZero;
+        for (var j = 0; j < batchSize; j++) {
+            computedNumsRC[j] = votes[j][i];
+        }
+
+        computedCalculateTotalResult[i] = CalculateTotal(batchSize + 1)(computedNumsRC);
+    }
+
+    // Tally the new spent voice credit total.
+    var computedNumsSVC[batchSize * numVoteOptions + 1];
+    computedNumsSVC[batchSize * numVoteOptions] = currentSpentVoiceCreditSubtotal * computedIsZero;
+    for (var i = 0; i < batchSize; i++) {
+        for (var j = 0; j < numVoteOptions; j++) {
+            computedNumsSVC[i * numVoteOptions + j] = votes[i][j];
+        }
+    }
+
+    var computedNewSpentVoiceCreditSubtotal = CalculateTotal(batchSize * numVoteOptions + 1)(computedNumsSVC);
+
+    // Verifies the updated results and spent credits, ensuring consistency and correctness of tally updates.
+    ResultCommitmentVerifierNonQv(voteOptionTreeDepth)(
+        computedIsFirstBatch,
+        currentTallyCommitment,
+        newTallyCommitment,
+        currentResults,
+        currentResultsRootSalt,
+        computedCalculateTotalResult,
+        newResultsRootSalt,
+        currentSpentVoiceCreditSubtotal,
+        currentSpentVoiceCreditSubtotalSalt,
+        computedNewSpentVoiceCreditSubtotal,
+        newSpentVoiceCreditSubtotalSalt        
+    );
+}
+
+/** 
+ * Performs verifications and computations related to current voting results. 
+ * Also, computes and outputs a commitment to the new results.
+ * This template does not support Quadratic Voting (QV).
+ */
+ template ResultCommitmentVerifierNonQv(voteOptionTreeDepth) {
+    // Number of children per node in the tree, defining the tree's branching factor.
+    var TREE_ARITY = 5;
+    // Number of voting options available, determined by the depth of the vote option tree.
+    var numVoteOptions = TREE_ARITY ** voteOptionTreeDepth;
+
+    // Equal to 1 if this is the first batch, otherwise 0.
+    signal input isFirstBatch;
+    // Commitment to the current tally before this batch.
+    signal input currentTallyCommitment;
+    // Commitment to the new tally after processing this batch.
+    signal input newTallyCommitment;
+
+    // Current results for each vote option.
+    signal input currentResults[numVoteOptions];
+    // Salt for the root of the current results.
+    signal input currentResultsRootSalt;
+
+    // New results for each vote option.
+    signal input newResults[numVoteOptions];
+    // Salt for the root of the new results.
+    signal input newResultsRootSalt;
+
+    // Total voice credits spent so far.
+    signal input currentSpentVoiceCreditSubtotal;
+    // Salt for the total spent voice credits.
+    signal input currentSpentVoiceCreditSubtotalSalt;
+
+    // Total new voice credits spent.
+    signal input newSpentVoiceCreditSubtotal;
+    // Salt for the new total spent voice credits.
+    signal input newSpentVoiceCreditSubtotalSalt;
+
+    // Compute the commitment to the current results.
+    var computedCurrentResultsRoot = QuinCheckRoot(voteOptionTreeDepth)(currentResults);
+
+    // Verify currentResultsCommitmentHash.
+    var computedCurrentResultsCommitment = PoseidonHasher(2)([computedCurrentResultsRoot, currentResultsRootSalt]);
+
+    // Compute the commitment to the current spent voice credits.
+    var computedCurrentSpentVoiceCreditsCommitment = PoseidonHasher(2)([currentSpentVoiceCreditSubtotal, currentSpentVoiceCreditSubtotalSalt]);
+
+    // Commit to the current tally
+    var computedCurrentTallyCommitment = PoseidonHasher(2)([computedCurrentResultsCommitment, computedCurrentSpentVoiceCreditsCommitment]);
+
+    // Check if the current tally commitment is correct only if this is not the first batch.
+    // computedIsZero.out is 1 if this is not the first batch.
+    // computedIsZero.out is 0 if this is the first batch.
+    var computedIsZero = IsZero()(isFirstBatch);
+
+    // hz is 0 if this is the first batch, currentTallyCommitment should be 0 if this is the first batch.
+    // hz is 1 if this is not the first batch, currentTallyCommitment should not be 0 if this is the first batch.
+    signal hz;
+    hz <== computedIsZero * computedCurrentTallyCommitment;
+    hz === currentTallyCommitment;
+
+    // Compute the root of the new results.
+    var computedNewResultsRoot = QuinCheckRoot(voteOptionTreeDepth)(newResults);
+    var computedNewResultsCommitment = PoseidonHasher(2)([computedNewResultsRoot, newResultsRootSalt]);
+
+    // Compute the commitment to the new spent voice credits value.
+    var computedNewSpentVoiceCreditsCommitment = PoseidonHasher(2)([newSpentVoiceCreditSubtotal, newSpentVoiceCreditSubtotalSalt]);
+
+    // Commit to the new tally.
+    var computedNewTallyCommitment = PoseidonHasher(2)([
+        computedNewResultsCommitment,
+        computedNewSpentVoiceCreditsCommitment
+    ]);
+    
+    computedNewTallyCommitment === newTallyCommitment;
+}

package/circom/coordinator/qv/processMessages.circom

@@ -0,0 +1,449 @@
+pragma circom 2.0.0;
+
+// circomlib import
+include "./mux1.circom";
+// zk-kit imports
+include "./safe-comparators.circom";
+// local imports
+include "../../utils/hashers.circom";
+include "../../utils/messageToCommand.circom";
+include "../../utils/privToPubKey.circom";
+include "../../utils/qv/stateLeafAndBallotTransformer.circom";
+include "../../utils/trees/incrementalQuinaryTree.circom";
+include "../../utils/trees/incrementalMerkleTree.circom";
+
+/**
+ * Proves the correctness of processing a batch of MACI messages.
+ * This template supports the Quadratic Voting (QV).
+ */
+template ProcessMessages(
+    stateTreeDepth,
+    batchSize,
+    voteOptionTreeDepth
+) {
+    // Must ensure that the trees have a valid structure.
+    assert(stateTreeDepth > 0);
+    assert(batchSize > 0);
+    assert(voteOptionTreeDepth > 0);
+
+    // Default for IQT (quinary trees).
+    var VOTE_OPTION_TREE_ARITY = 5;
+    // Default for binary trees.
+    var STATE_TREE_ARITY = 2;
+    var MSG_LENGTH = 10;
+    var PACKED_CMD_LENGTH = 4;
+    var STATE_LEAF_LENGTH = 4;
+    var BALLOT_LENGTH = 2;
+    var BALLOT_NONCE_IDX = 0;
+    var BALLOT_VO_ROOT_IDX = 1;
+    var STATE_LEAF_PUB_X_IDX = 0;
+    var STATE_LEAF_PUB_Y_IDX = 1;
+    var STATE_LEAF_VOICE_CREDIT_BALANCE_IDX = 2;
+    var STATE_LEAF_TIMESTAMP_IDX = 3;
+    var msgTreeZeroValue = 8370432830353022751713833565135785980866757267633941821328460903436894336785;
+    // Number of options for this poll.
+    var maxVoteOptions = VOTE_OPTION_TREE_ARITY ** voteOptionTreeDepth;
+
+    // Number of users that have completed the sign up.
+    signal input numSignUps;
+    // Value of chainHash at beginning of batch
+    signal input inputBatchHash;
+    // Value of chainHash at end of batch
+    signal input outputBatchHash;
+    // The messages.
+    signal input msgs[batchSize][MSG_LENGTH];
+    // The coordinator's private key.
+    signal input coordPrivKey;
+    // The ECDH public key per message.
+    signal input encPubKeys[batchSize][2];
+    // The current state root (before the processing).
+    signal input currentStateRoot;
+    // The actual tree depth (might be <= stateTreeDepth).
+    // @note it is a public input to ensure fair processing from 
+    // the coordinator (no censoring)
+    signal input actualStateTreeDepth;
+    // The coordinator public key hash
+    signal input coordinatorPublicKeyHash;
+    // The number of valid vote options for the poll.
+    signal input voteOptions;
+
+    // The state leaves upon which messages are applied.
+    //    transform(currentStateLeaf[4], message5) => newStateLeaf4
+    //    transform(currentStateLeaf[3], message4) => newStateLeaf3
+    //    transform(currentStateLeaf[2], message3) => newStateLeaf2
+    //    transform(currentStateLeaf[1], message1) => newStateLeaf1
+    //    transform(currentStateLeaf[0], message0) => newStateLeaf0
+    //    ...
+
+    signal input currentStateLeaves[batchSize][STATE_LEAF_LENGTH];
+    // The Merkle path to each incremental new state root.
+    signal input currentStateLeavesPathElements[batchSize][stateTreeDepth][STATE_TREE_ARITY - 1];
+    // The salted commitment to the state and ballot roots.
+    signal input currentSbCommitment;
+    signal input currentSbSalt;
+    // The salted commitment to the new state and ballot roots.
+    signal input newSbCommitment;
+    signal input newSbSalt;
+    // The current ballot root before batch processing.
+    signal input currentBallotRoot;
+    // Intermediate ballots.
+    signal input currentBallots[batchSize][BALLOT_LENGTH];
+    signal input currentBallotsPathElements[batchSize][stateTreeDepth][STATE_TREE_ARITY - 1];
+    // Intermediate vote weights.
+    signal input currentVoteWeights[batchSize];
+    signal input currentVoteWeightsPathElements[batchSize][voteOptionTreeDepth][VOTE_OPTION_TREE_ARITY - 1];
+
+    // nb. The messages are processed in REVERSE order.
+    // Therefore, the index of the first message to process does not match the index of the
+    // first message (e.g., [msg1, msg2, msg3] => first message to process has index 3).
+
+    // The index of the first message in the batch, inclusive.
+    signal input index;
+    
+    // The index of the last message in the batch to process, exclusive.
+    // This value may be less than batchSize if this batch is
+    // the last batch and the total number of messages is not a multiple of the batch size.
+    signal input batchEndIndex;
+
+    // The history of state and ballot roots and temporary intermediate
+    // signals (for processing purposes).
+    signal stateRoots[batchSize + 1];
+    signal ballotRoots[batchSize + 1];
+
+    // Must verify the current sb commitment.
+    var computedCurrentSbCommitment = PoseidonHasher(3)([currentStateRoot, currentBallotRoot, currentSbSalt]);
+    computedCurrentSbCommitment === currentSbCommitment;
+
+    // Ensure that the vote options signal is valid
+    var voteOptionsValid = LessEqThan(32)([voteOptions, VOTE_OPTION_TREE_ARITY ** voteOptionTreeDepth]);
+    voteOptionsValid === 1;
+
+    // Check numSignUps <= the max number of users (i.e., number of state leaves
+    // that can fit the state tree).
+    var numSignUpsValid = LessEqThan(32)([numSignUps, STATE_TREE_ARITY ** stateTreeDepth]);
+    numSignUpsValid === 1;
+
+    // Hash each Message to check their existence in the Message tree.
+    var computedMessageHashers[batchSize];
+    var computedChainHashes[batchSize];
+    var chainHash[batchSize + 1];
+    chainHash[0] = inputBatchHash;
+
+    for (var i = 0; i < batchSize; i++) {
+        // calculate message hash
+        computedMessageHashers[i] = MessageHasher()(msgs[i], encPubKeys[i]);
+        // check if message is valid or not (if index of message is less than index of last valid message in batch)
+        var batchStartIndexValid = SafeLessThan(32)([index + i, batchEndIndex]);
+        // calculate chain hash if message is valid
+        computedChainHashes[i] = PoseidonHasher(2)([chainHash[i], computedMessageHashers[i]]);
+        // choose between old chain hash value and new chain hash value depending if message is valid or not
+        chainHash[i + 1] = Mux1()([chainHash[i], computedChainHashes[i]], batchStartIndexValid);
+    }
+
+    // If batchEndIndex < index + i, the remaining
+    // message hashes should be the zero value.
+    // e.g. [m, z, z, z, z] if there is only 1 real message in the batch
+    // This makes possible to have a batch of messages which is only partially full.
+
+    chainHash[batchSize] === outputBatchHash;
+
+    // Decrypt each Message to a Command.
+    // MessageToCommand derives the ECDH shared key from the coordinator's
+    // private key and the message's ephemeral public key. Next, it uses this
+    // shared key to decrypt a Message to a Command.
+
+    // Ensure that the coordinator's public key from the contract is correct
+    // based on the given private key - that is, the prover knows the
+    // coordinator's private key.
+    var derivedPubKey[2] = PrivToPubKey()(coordPrivKey);
+    var derivedPubKeyHash = PoseidonHasher(2)(derivedPubKey);
+    derivedPubKeyHash === coordinatorPublicKeyHash;
+
+    // Decrypt each Message into a Command.
+    // The command i-th is composed by the following fields.
+    // e.g., command 0 is made of commandsStateIndex[0], 
+    // commandsNewPubKey[0], ..., commandsPackedCommandOut[0]
+    var computedCommandsStateIndex[batchSize];
+    var computedCommandsNewPubKey[batchSize][2];
+    var computedCommandsVoteOptionIndex[batchSize];
+    var computedCommandsNewVoteWeight[batchSize];
+    var computedCommandsNonce[batchSize];
+    var computedCommandsPollId[batchSize];
+    var computedCommandsSalt[batchSize];
+    var computedCommandsSigR8[batchSize][2];
+    var computedCommandsSigS[batchSize];
+    var computedCommandsPackedCommandOut[batchSize][PACKED_CMD_LENGTH];
+
+    for (var i = 0; i < batchSize; i++) {
+        (
+            computedCommandsStateIndex[i],
+            computedCommandsNewPubKey[i],
+            computedCommandsVoteOptionIndex[i],
+            computedCommandsNewVoteWeight[i],
+            computedCommandsNonce[i],
+            computedCommandsPollId[i],
+            computedCommandsSalt[i],
+            computedCommandsSigR8[i],
+            computedCommandsSigS[i],
+            computedCommandsPackedCommandOut[i]
+        ) = MessageToCommand()(msgs[i], coordPrivKey, encPubKeys[i]);
+    }
+
+    // Process messages in reverse order.
+    // Assign current state and ballot roots.
+    stateRoots[batchSize] <== currentStateRoot;
+    ballotRoots[batchSize] <== currentBallotRoot;
+
+    // Define vote type message processors.
+    var computedNewVoteStateRoot[batchSize];
+    var computedNewVoteBallotRoot[batchSize];
+
+    // Start from batchSize and decrement for process in reverse order.
+    for (var i = batchSize - 1; i >= 0; i--) {
+        // Process as vote type message.
+        var currentStateLeavesPathElement[stateTreeDepth][STATE_TREE_ARITY - 1];
+        var currentBallotPathElement[stateTreeDepth][STATE_TREE_ARITY - 1];
+        var currentVoteWeightsPathElement[voteOptionTreeDepth][VOTE_OPTION_TREE_ARITY - 1];
+        
+        for (var j = 0; j < stateTreeDepth; j++) {
+            for (var k = 0; k < STATE_TREE_ARITY - 1; k++) {
+                currentStateLeavesPathElement[j][k] = currentStateLeavesPathElements[i][j][k];
+                currentBallotPathElement[j][k] = currentBallotsPathElements[i][j][k];
+            }
+        }
+
+        for (var j = 0; j < voteOptionTreeDepth; j++) {
+            for (var k = 0; k < VOTE_OPTION_TREE_ARITY - 1; k++) {
+                currentVoteWeightsPathElement[j][k] = currentVoteWeightsPathElements[i][j][k];
+            }
+        }
+        
+        (computedNewVoteStateRoot[i], computedNewVoteBallotRoot[i]) = ProcessOne(stateTreeDepth, voteOptionTreeDepth)(
+            numSignUps,
+            stateRoots[i + 1],
+            ballotRoots[i + 1],
+            actualStateTreeDepth,
+            currentStateLeaves[i],
+            currentStateLeavesPathElement,
+            currentBallots[i],
+            currentBallotPathElement,
+            currentVoteWeights[i],
+            currentVoteWeightsPathElement,
+            computedCommandsStateIndex[i],
+            computedCommandsNewPubKey[i],
+            computedCommandsVoteOptionIndex[i],
+            computedCommandsNewVoteWeight[i],
+            computedCommandsNonce[i],
+            computedCommandsPollId[i],
+            computedCommandsSalt[i],
+            computedCommandsSigR8[i],
+            computedCommandsSigS[i],
+            computedCommandsPackedCommandOut[i],
+            voteOptions
+        );
+
+        stateRoots[i] <== computedNewVoteStateRoot[i];
+        ballotRoots[i] <== computedNewVoteBallotRoot[i];
+    }
+
+    var computedNewSbCommitment = PoseidonHasher(3)([stateRoots[0], ballotRoots[0], newSbSalt]);
+    computedNewSbCommitment === newSbCommitment;
+}
+
+/**
+ * Processes one message and updates the state accordingly. 
+ * This template involves complex interactions, including transformations based on message type, 
+ * validations against current states like voice credit balances or vote weights, 
+ * and updates to Merkle trees representing state and ballot information. 
+ * This is a critical building block for ensuring the integrity and correctness of MACI state.
+ * This template supports the Quadratic Voting (QV).
+ */
+template ProcessOne(stateTreeDepth, voteOptionTreeDepth) {
+    // Constants defining the structure and size of state and ballots.
+    var STATE_LEAF_LENGTH = 4;
+    var BALLOT_LENGTH = 2;
+    var MSG_LENGTH = 10;
+    var PACKED_CMD_LENGTH = 4;
+    var VOTE_OPTION_TREE_ARITY = 5;
+    var STATE_TREE_ARITY = 2;
+    var BALLOT_NONCE_IDX = 0;
+    // Ballot vote option (VO) root index.
+    var BALLOT_VO_ROOT_IDX = 1;
+
+    // Indices for elements within a state leaf.
+    // Public key.
+    var STATE_LEAF_PUB_X_IDX = 0;
+    var STATE_LEAF_PUB_Y_IDX = 1;
+    // Voice Credit balance.
+    var STATE_LEAF_VOICE_CREDIT_BALANCE_IDX = 2;
+    // Timestamp.
+    var STATE_LEAF_TIMESTAMP_IDX = 3;
+    var N_BITS = 252;
+
+    // Number of users that have completed the sign up.
+    signal input numSignUps;
+    // The current value of the state tree root.
+    signal input currentStateRoot;
+    // The current value of the ballot tree root.
+    signal input currentBallotRoot;
+    // The actual tree depth (might be <= stateTreeDepth).
+    signal input actualStateTreeDepth;
+
+    // The state leaf and related path elements.
+    signal input stateLeaf[STATE_LEAF_LENGTH];
+    // Sibling nodes at each level of the state tree to verify the specific state leaf.
+    signal input stateLeafPathElements[stateTreeDepth][STATE_TREE_ARITY - 1];
+
+    // The ballot and related path elements.
+    signal input ballot[BALLOT_LENGTH];
+    signal input ballotPathElements[stateTreeDepth][STATE_TREE_ARITY - 1];
+
+    // The current vote weight and related path elements.
+    signal input currentVoteWeight;
+    signal input currentVoteWeightsPathElements[voteOptionTreeDepth][VOTE_OPTION_TREE_ARITY - 1];
+
+    // Inputs related to the command being processed.
+    signal input cmdStateIndex;
+    signal input cmdNewPubKey[2];
+    signal input cmdVoteOptionIndex;
+    signal input cmdNewVoteWeight;
+    signal input cmdNonce;
+    signal input cmdPollId;
+    signal input cmdSalt;
+    signal input cmdSigR8[2];
+    signal input cmdSigS;
+    signal input packedCmd[PACKED_CMD_LENGTH];
+
+    // The number of valid vote options for the poll.
+    signal input voteOptions;
+
+    signal output newStateRoot;
+    signal output newBallotRoot;
+
+    // Intermediate signals.
+    // currentVoteWeight * currentVoteWeight.
+    signal currentVoteWeightSquare;
+    // cmdNewVoteWeight * cmdNewVoteWeight.
+    signal cmdNewVoteWeightSquare;
+    // equal to newBallotVoRootMux (Mux1).
+    signal newBallotVoRoot;
+
+    // 1. Transform a state leaf and a ballot with a command.
+    // The result is a new state leaf, a new ballot, and an isValid signal (0 or 1).
+    var computedNewSlPubKey[2], computedNewBallotNonce, computedIsValid, computedIsStateLeafIndexValid, computedIsVoteOptionIndexValid;
+    (computedNewSlPubKey, computedNewBallotNonce, computedIsValid, computedIsStateLeafIndexValid, computedIsVoteOptionIndexValid) = StateLeafAndBallotTransformer()(
+        numSignUps,
+        voteOptions,
+        [stateLeaf[STATE_LEAF_PUB_X_IDX], stateLeaf[STATE_LEAF_PUB_Y_IDX]],
+        stateLeaf[STATE_LEAF_VOICE_CREDIT_BALANCE_IDX],
+        ballot[BALLOT_NONCE_IDX],
+        currentVoteWeight,
+        cmdStateIndex,
+        cmdNewPubKey,
+        cmdVoteOptionIndex,
+        cmdNewVoteWeight,
+        cmdNonce,
+        cmdPollId,
+        cmdSalt,
+        cmdSigR8,
+        cmdSigS,
+        packedCmd
+    );
+
+    // 2. If computedIsStateLeafIndexValid is equal to zero, generate indices for leaf zero.
+    // Otherwise, generate indices for command.stateIndex.
+    var stateIndexMux = Mux1()([0, cmdStateIndex], computedIsStateLeafIndexValid);
+    var computedStateLeafPathIndices[stateTreeDepth] = MerkleGeneratePathIndices(stateTreeDepth)(stateIndexMux);
+
+    // 3. Verify that the original state leaf exists in the given state root.
+    var stateLeafHash = PoseidonHasher(4)(stateLeaf);
+    var stateLeafQip = BinaryMerkleRoot(stateTreeDepth)(
+        stateLeafHash,
+        actualStateTreeDepth,
+        computedStateLeafPathIndices,
+        stateLeafPathElements
+    );
+
+    stateLeafQip === currentStateRoot;
+
+    // 4. Verify that the original ballot exists in the given ballot root.
+    var computedBallot = PoseidonHasher(2)([
+        ballot[BALLOT_NONCE_IDX], 
+        ballot[BALLOT_VO_ROOT_IDX]
+    ]);
+
+    var computedBallotQip = MerkleTreeInclusionProof(stateTreeDepth)(
+        computedBallot,
+        computedStateLeafPathIndices,
+        ballotPathElements
+    );
+
+    computedBallotQip === currentBallotRoot;
+
+    // 5. Verify that currentVoteWeight exists in the ballot's vote option root
+    // at cmdVoteOptionIndex.
+    currentVoteWeightSquare <== currentVoteWeight * currentVoteWeight;
+    cmdNewVoteWeightSquare <== cmdNewVoteWeight * cmdNewVoteWeight;
+
+    var cmdVoteOptionIndexMux = Mux1()([0, cmdVoteOptionIndex], computedIsVoteOptionIndexValid);
+    var computedCurrentVoteWeightPathIndices[voteOptionTreeDepth] = QuinGeneratePathIndices(voteOptionTreeDepth)(cmdVoteOptionIndexMux);
+
+    var computedCurrentVoteWeightQip = QuinTreeInclusionProof(voteOptionTreeDepth)(
+        currentVoteWeight,
+        computedCurrentVoteWeightPathIndices,
+        currentVoteWeightsPathElements
+    );
+
+    computedCurrentVoteWeightQip === ballot[BALLOT_VO_ROOT_IDX];
+
+    var voteWeightMux = Mux1()([currentVoteWeight, cmdNewVoteWeight], computedIsValid);
+    var voiceCreditBalanceMux = Mux1()(
+        [
+            stateLeaf[STATE_LEAF_VOICE_CREDIT_BALANCE_IDX],
+            stateLeaf[STATE_LEAF_VOICE_CREDIT_BALANCE_IDX] + currentVoteWeightSquare - cmdNewVoteWeightSquare
+        ],
+        computedIsValid
+    );
+
+    // 5.1. Update the ballot's vote option root with the new vote weight.
+    var computedNewVoteOptionTreeQip = QuinTreeInclusionProof(voteOptionTreeDepth)(
+        voteWeightMux,
+        computedCurrentVoteWeightPathIndices,
+        currentVoteWeightsPathElements
+    );
+
+    // The new vote option root in the ballot
+    var newBallotVoRootMux = Mux1()(
+        [ballot[BALLOT_VO_ROOT_IDX], computedNewVoteOptionTreeQip],
+        computedIsValid
+    );
+
+    newBallotVoRoot <== newBallotVoRootMux;
+
+    // 6. Generate a new state root.
+    var computedNewStateLeafhash = PoseidonHasher(4)([
+        computedNewSlPubKey[STATE_LEAF_PUB_X_IDX],
+        computedNewSlPubKey[STATE_LEAF_PUB_Y_IDX],
+        voiceCreditBalanceMux,
+        stateLeaf[STATE_LEAF_TIMESTAMP_IDX]
+    ]);
+
+    var computedNewStateLeafQip = BinaryMerkleRoot(stateTreeDepth)(
+        computedNewStateLeafhash,
+        actualStateTreeDepth,
+        computedStateLeafPathIndices,
+        stateLeafPathElements
+    );
+
+    newStateRoot <== computedNewStateLeafQip;
+ 
+    // 7. Generate a new ballot root.    
+    var computedNewBallot = PoseidonHasher(2)([computedNewBallotNonce, newBallotVoRoot]);
+    var computedNewBallotQip = MerkleTreeInclusionProof(stateTreeDepth)(
+        computedNewBallot,
+        computedStateLeafPathIndices,
+        ballotPathElements
+    );
+
+    newBallotRoot <== computedNewBallotQip;
+}