@maci-protocol/circuits 0.0.0-ci.26f28d6

package/circom/utils/qv/messageValidator.circom

@@ -0,0 +1,95 @@
+pragma circom 2.0.0;
+
+// zk-kit imports
+include "./safe-comparators.circom";
+// local imports
+include "../verifySignature.circom";
+
+/**
+ * Checks if a MACI message is valid or not.
+ * This template supports the Quadratic Voting (QV).
+ */
+template MessageValidator() {
+    // Length of the packed command.
+    var PACKED_CMD_LENGTH = 4;
+
+    // State index of the user.
+    signal input stateTreeIndex;
+    // Number of user sign-ups in the state tree.
+    signal input numSignUps;
+    // Vote option index.
+    signal input voteOptionIndex;
+    // Number of valid vote options for the poll.
+    signal input voteOptions;
+    // Ballot nonce.
+    signal input originalNonce;
+    // Command nonce.
+    signal input nonce;
+    // Packed command.
+    signal input cmd[PACKED_CMD_LENGTH];
+    // Public key of the state leaf (user).
+    signal input pubKey[2];
+    // ECDSA signature of the command (R part).
+    signal input sigR8[2];
+    // ECDSA signature of the command (S part).
+    signal input sigS;
+    // State leaf current voice credit balance.
+    signal input currentVoiceCreditBalance;
+    // Current number of votes for specific option. 
+    signal input currentVotesForOption;
+    // Vote weight.
+    signal input voteWeight;
+
+    // True when the command is valid; otherwise false.
+    signal output isValid;
+    // True if the state leaf index is valid
+    signal output isStateLeafIndexValid;
+    // True if the vote option index is valid
+    signal output isVoteOptionIndexValid;
+
+    // Check (1) - The state leaf index must be valid.
+    // The check ensure that the stateTreeIndex < numSignUps as first validation.
+    // Must be < because the stateTreeIndex is 0-based. Zero is for blank state leaf
+    // while 1 is for the first actual user.
+    var computedIsStateLeafIndexValid = SafeLessThan(252)([stateTreeIndex, numSignUps]);
+
+    // Check (2) - The vote option index must be less than the number of valid vote options (0 indexed).
+    var computedIsVoteOptionIndexValid = SafeLessThan(252)([voteOptionIndex, voteOptions]);
+
+    // Check (3) - The nonce must be correct.    
+    var computedIsNonceValid = IsEqual()([originalNonce + 1, nonce]);
+
+    // Check (4) - The signature must be correct.    
+    var computedIsSignatureValid = VerifySignature()(pubKey, sigR8, sigS, cmd);
+
+    // Check (5) - There must be sufficient voice credits.
+    // The check ensure that the voteWeight is < sqrt(field size)
+    // so that voteWeight ^ 2 will not overflow.
+    var computedIsVoteWeightValid = SafeLessEqThan(252)([voteWeight, 147946756881789319005730692170996259609]);
+
+    // Check (6) - Check the current voice credit balance.
+    // The check ensure that currentVoiceCreditBalance + (currentVotesForOption ** 2) >= (voteWeight ** 2)
+    var computedAreVoiceCreditsSufficient = SafeGreaterEqThan(252)(
+        [
+            (currentVotesForOption * currentVotesForOption) + currentVoiceCreditBalance,
+            voteWeight * voteWeight
+        ]
+    );
+
+    // When all six checks are correct, then isValid = 1.
+    var computedIsUpdateValid = IsEqual()(
+        [
+            6,
+            computedIsSignatureValid + 
+            computedAreVoiceCreditsSufficient +
+            computedIsVoteWeightValid +
+            computedIsNonceValid +
+            computedIsStateLeafIndexValid +
+            computedIsVoteOptionIndexValid
+        ]
+    );
+
+    isValid <== computedIsUpdateValid;
+    isStateLeafIndexValid <== computedIsStateLeafIndexValid;
+    isVoteOptionIndexValid <== computedIsVoteOptionIndexValid;
+}

package/circom/utils/qv/stateLeafAndBallotTransformer.circom

@@ -0,0 +1,105 @@
+pragma circom 2.0.0;
+
+// circomlib import
+include "./mux1.circom";
+// local import
+include "./messageValidator.circom";
+
+/**
+ * Processes a command by verifying its validity and updates the state leaf and ballot accordingly. 
+ * If the message is correct, updates the public key in the state leaf and the nonce 
+ * in the ballot using multiplexer components.
+ * This template supports the Quadratic Voting (QV).
+ */
+template StateLeafAndBallotTransformer() {
+    // Length of the packed command.
+    var PACKED_CMD_LENGTH = 4;
+
+    // Number of user sign-ups in the state tree.
+    signal input numSignUps;
+    // Number of valid vote options for the poll.
+    signal input voteOptions;
+
+    // The following signals represents a state leaf (signed up user).
+    // Public key.
+    signal input slPubKey[2];
+    // Current voice credit balance.
+    signal input slVoiceCreditBalance;
+
+    // The following signals represents a ballot.
+    // Nonce.
+    signal input ballotNonce;
+    // Current number of votes for specific option. 
+    signal input ballotCurrentVotesForOption;
+
+    // The following signals represents a command.
+    // State index of the user.
+    signal input cmdStateIndex;
+    // Public key of the user.
+    signal input cmdNewPubKey[2];
+    // Vote option index.
+    signal input cmdVoteOptionIndex;
+    // Vote weight.
+    signal input cmdNewVoteWeight;
+    // Nonce.
+    signal input cmdNonce;
+    // Poll identifier.
+    signal input cmdPollId;
+    // Salt.
+    signal input cmdSalt;
+    // ECDSA signature of the command (R part).
+    signal input cmdSigR8[2];
+    // ECDSA signature of the command (S part).
+    signal input cmdSigS;
+    // Packed command. 
+    // nb. we are assuming that the packedCommand is always valid.
+    signal input packedCommand[PACKED_CMD_LENGTH];
+
+    // New state leaf (if the command is valid).
+    signal output newSlPubKey[2];
+    // New ballot (if the command is valid).
+    signal output newBallotNonce;
+    
+    // True when the command is valid; otherwise false.
+    signal output isValid;
+    // True if the state leaf index is valid
+    signal output isStateLeafIndexValid;
+    // True if the vote option index is valid
+    signal output isVoteOptionIndexValid;
+
+    // Check if the command / message is valid.
+    var (computedMessageValidator, computedIsStateLeafIndexValid, computedIsVoteOptionIndexValid) = MessageValidator()(
+        cmdStateIndex,
+        numSignUps,
+        cmdVoteOptionIndex,
+        voteOptions,
+        ballotNonce,
+        cmdNonce,
+        packedCommand,
+        slPubKey,
+        cmdSigR8,
+        cmdSigS,
+        slVoiceCreditBalance,
+        ballotCurrentVotesForOption,
+        cmdNewVoteWeight
+    );
+
+    // If the message is valid then we swap out the public key.
+    // This means using a Mux1() for pubKey[0] and another one
+    // for pubKey[1].
+    var computedNewSlPubKey0Mux = Mux1()([slPubKey[0], cmdNewPubKey[0]], computedMessageValidator);
+    var computedNewSlPubKey1Mux = Mux1()([slPubKey[1], cmdNewPubKey[1]], computedMessageValidator);
+
+    newSlPubKey[0] <== computedNewSlPubKey0Mux;
+    newSlPubKey[1] <== computedNewSlPubKey1Mux;
+
+    // If the message is valid, then we swap out the ballot nonce
+    // using a Mux1().
+    var computedNewBallotNonceMux = Mux1()([ballotNonce, cmdNonce], computedMessageValidator);
+
+    newBallotNonce <== computedNewBallotNonceMux;
+
+    isValid <== computedMessageValidator;
+    isStateLeafIndexValid <== computedIsStateLeafIndexValid;
+    isVoteOptionIndexValid <== computedIsVoteOptionIndexValid;
+}

package/circom/utils/trees/incrementalMerkleTree.circom

@@ -0,0 +1,198 @@
+pragma circom 2.0.0;
+
+// zk-kit imports
+include "./safe-comparators.circom";
+// circomlib import
+include "./mux1.circom";
+include "./comparators.circom";
+// local import
+include "../hashers.circom";
+include "../calculateTotal.circom";
+
+/**
+ * Recomputes a Merkle root from a given leaf and its path in a Merkle tree.
+ */
+template MerkleTreeInclusionProof(n_levels) {
+    // The leaf node from which the Merkle root is calculated.
+    signal input leaf;
+    // Indices indicating left or right child for each level of the tree.
+    signal input path_index[n_levels];
+    // Sibling node values required to compute the hash at each level.
+    signal input path_elements[n_levels][1];
+
+    signal output root;
+
+     // Stores the hash at each level starting from the leaf to the root.
+    signal levelHashes[n_levels + 1];
+    // Initialize the first level with the given leaf.
+    levelHashes[0] <== leaf;
+
+    for (var i = 0; i < n_levels; i++) {
+        // Validate path_index to be either 0 or 1, ensuring no other values.
+        path_index[i] * (1 - path_index[i]) === 0;
+
+        // Configure the multiplexer based on the path index for the current level.
+        var c[2][2] = [
+            [levelHashes[i], path_elements[i][0]],
+            [path_elements[i][0], levelHashes[i]]
+        ];
+
+        var mux[2] = MultiMux1(2)(
+            c,
+            path_index[i]
+        );
+
+        var computedLevelHash = PoseidonHasher(2)([mux[0], mux[1]]);
+
+        // Store the resulting hash as the next level's hash.
+        levelHashes[i + 1] <== computedLevelHash;
+    }
+
+    // Set the final level hash as the root.
+    root <== levelHashes[n_levels];
+}
+
+/**
+ * Ensures that a leaf exists within a Merkle tree with a given root.
+ */
+template LeafExists(levels){
+  // The leaf whose existence within the tree is being verified.
+  signal input leaf;
+
+  // The elements along the path needed for the inclusion proof.
+  signal input path_elements[levels][1];
+  // The indices indicating the path taken through the tree for the leaf.
+  signal input path_index[levels];
+  // The root of the Merkle tree, against which the inclusion is verified.
+  signal input root;
+
+  var computedMerkleRoot = MerkleTreeInclusionProof(levels)(
+    leaf,
+    path_index,
+    path_elements
+  );
+
+  root === computedMerkleRoot;
+}
+
+/**
+ * Verifies the correct construction of a Merkle tree from a set of leaves.
+ * Given a Merkle root and a list of leaves, check if the root is the
+ * correct result of inserting all the leaves into the tree (in the given order).
+ */
+template CheckRoot(levels) {
+    // The total number of leaves in the Merkle tree, calculated as 2 to the power of `levels`.
+    var totalLeaves = 2 ** levels;
+    // The number of first-level hashers needed, equal to half the total leaves, as each hasher combines two leaves.
+    var numLeafHashers = totalLeaves / 2;
+    // The number of intermediate hashers, one less than the number of leaf hashers, 
+    // as each level of hashing reduces the number of hash elements by about half.
+    var numIntermediateHashers = numLeafHashers - 1;
+    
+    // Array of leaf values input to the circuit.
+    signal input leaves[totalLeaves];
+
+    // Output signal for the Merkle root that results from hashing all the input leaves.
+    signal output root;
+
+    // Total number of hashers used in constructing the tree, one less than the total number of leaves,
+    // since each level of the tree combines two elements into one.
+    var numHashers = totalLeaves - 1;
+    var computedLevelHashers[numHashers];
+
+    // Initialize hashers for the leaves, each taking two adjacent leaves as inputs.
+    for (var i = 0; i < numLeafHashers; i++){
+        computedLevelHashers[i] = PoseidonHasher(2)([leaves[i*2], leaves[i*2+1]]);
+    }
+
+    // Initialize hashers for intermediate levels, each taking the outputs of two hashers from the previous level.
+    var k = 0;
+    for (var i = numLeafHashers; i < numLeafHashers + numIntermediateHashers; i++) {
+        computedLevelHashers[i] = PoseidonHasher(2)([computedLevelHashers[k*2], computedLevelHashers[k*2+1]]);
+        k++;
+    }
+
+    // Connect the output of the final hasher in the array to the root output signal.
+    root <== computedLevelHashers[numHashers-1];
+}
+
+/**
+ * Calculates the path indices required for Merkle proof verifications. 
+ * Given a node index within an IMT and the total tree levels, it outputs the path indices leading to that node.
+ * The template handles the modulo and division operations to break down the tree index into its constituent path indices.
+ */
+template MerkleGeneratePathIndices(levels) {
+    var BASE = 2;
+
+    signal input in; 
+    signal output out[levels];
+
+    var m = in;
+    var computedResults[levels];
+
+    for (var i = 0; i < levels; i++) {
+        // circom's best practices suggests to avoid using <-- unless you
+        // are aware of what's going on. This is the only way to do modulo operation.
+        out[i] <-- m % BASE;
+        m = m \ BASE;
+
+        // Check that each output element is less than the base.
+        var computedIsOutputElementLessThanBase = SafeLessThan(3)([out[i], BASE]);
+        computedIsOutputElementLessThanBase === 1;
+
+        // Re-compute the total sum.
+        computedResults[i] = out[i] * (BASE ** i);
+    }
+    
+    // Check that the total sum matches the index.
+    var computedCalculateTotal = CalculateTotal(levels)(computedResults);
+
+    computedCalculateTotal === in;
+}
+
+// @note taken from @zk-kit/circuits
+// if used directly in processMessages circom complains about duplicated
+// templates (Ark, Poseidon, etc.)
+// This circuit is designed to calculate the root of a binary Merkle
+// tree given a leaf, its depth, and the necessary sibling
+// information (aka proof of membership).
+// A circuit is designed without the capability to iterate through
+// a dynamic array. To address this, a parameter with the static maximum
+// tree depth is defined (i.e. 'MAX_DEPTH'). And additionally, the circuit
+// receives a dynamic depth as an input, which is utilized in calculating the
+// true root of the Merkle tree. The actual depth of the Merkle tree
+// may be equal to or less than the static maximum depth.
+// NOTE: This circuit will successfully verify `out = 0` for `depth > MAX_DEPTH`.
+// Make sure to enforce `depth <= MAX_DEPTH` outside the circuit.
+template BinaryMerkleRoot(MAX_DEPTH) {
+    signal input leaf, depth, indices[MAX_DEPTH], siblings[MAX_DEPTH][1];
+
+    signal output out;
+
+    signal nodes[MAX_DEPTH + 1];
+    nodes[0] <== leaf;
+
+    signal roots[MAX_DEPTH];
+    var root = 0;
+
+    for (var i = 0; i < MAX_DEPTH; i++) {
+        var isDepth = IsEqual()([depth, i]);
+
+        roots[i] <== isDepth * nodes[i];
+
+        root += roots[i];
+
+        var c[2][2] = [
+            [nodes[i], siblings[i][0]],
+            [siblings[i][0], nodes[i]]
+        ];
+        
+        var childNodes[2] = MultiMux1(2)(c, indices[i]);
+
+        nodes[i + 1] <== PoseidonHasher(2)(childNodes);
+    }
+
+    var isDepth = IsEqual()([depth, MAX_DEPTH]);
+
+    out <== root + isDepth * nodes[MAX_DEPTH];
+}

package/circom/utils/trees/incrementalQuinaryTree.circom

@@ -0,0 +1,287 @@
+pragma circom 2.0.0;
+
+// circomlib imports
+include "./bitify.circom";
+include "./mux1.circom";
+// zk-kit import
+include "./safe-comparators.circom";
+// local imports
+include "../calculateTotal.circom";
+include "../hashers.circom";
+
+// Incremental Quintary Merkle Tree (IQT) verification circuits.
+// Since each node contains 5 leaves, we are using PoseidonT6 for hashing them.
+// 
+// nb. circom has some particularities which limit the code patterns we can use:
+//  - You can only assign a value to a signal once.
+//  - A component's input signal must only be wired to another component's output signal.
+//  - Variables can store linear combinations, and can also be used for loops,
+//    declaring sizes of things, and anything that is not related to inputs of a circuit.
+//  - The compiler fails whenever you try to mix invalid elements.
+//  - You can't use a signal as a list index.
+
+/**
+ * Selects an item from a list based on the given index.
+ * It verifies the index is within the valid range and then iterates over the inputs to find the match.
+ * For each item, it checks if its position equals the given index and if so, multiplies the item 
+ * by the result of the equality check, effectively selecting it.
+ * The sum of these results yields the selected item, ensuring only the item at the specified index be the output.
+ *
+ * nb. The number of items must be less than 8, and the index must be less than the number of items.
+ */
+template QuinSelector(choices) {
+    signal input in[choices];
+    signal input index;
+    signal output out;
+    
+    // Ensure that index < choices.
+    var computedLtIndex = SafeLessThan(3)([index, choices]);
+    computedLtIndex === 1;
+
+    // Initialize an array to hold the results of equality checks.
+    var computedResults[choices];
+
+    // For each item, check whether its index equals the input index.
+    // The result is multiplied by the corresponding input value.
+    for (var i = 0; i < choices; i++) {
+        var computedIsIndexEqual = IsEqual()([i, index]);
+
+        computedResults[i] = computedIsIndexEqual * in[i];
+    }
+
+    // Calculate the total sum of the results array.
+    out <== CalculateTotal(choices)(computedResults);
+}
+
+/**
+ * The output array contains the input items, with the leaf inserted at the
+ * specified index. For example, if input = [0, 20, 30, 40], index = 3, and
+ * leaf = 10, the output will be [0, 20, 30, 10, 40].
+ */
+template Splicer(numItems) {
+    // The number of output items (because only one item is inserted).
+    var NUM_OUTPUT_ITEMS = numItems + 1;
+
+    signal input in[numItems];
+    signal input leaf;
+    signal input index;
+    signal output out[NUM_OUTPUT_ITEMS];
+    
+    // There is a loop where the goal is to assign values to the output signal.
+    // 
+    //  | output[0] | output[1] | output[2] | ...
+    // 
+    // We can either assign the leaf, or an item from the `items` signal, to the output, using Mux1().
+    // The Mux1's selector is 0 or 1 depending on whether the index is equal to the loop counter.
+    // 
+    //  i --> [IsEqual] <-- index
+    //             |
+    //             v
+    //  leaf --> [Mux1] <-- <item from in>
+    //             |
+    //             v
+    //          output[m]
+    // 
+    // To obtain the value from <item from in>, we need to compute an item
+    // index (let it be `s`).
+    // 1. if index = 2 and i = 0, then s = 0
+    // 2. if index = 2 and i = 1, then s = 1
+    // 3. if index = 2 and i = 2, then s = 2
+    // 4. if index = 2 and i = 3, then s = 2
+    // 5. if index = 2 and i = 4, then s = 3
+    // We then wire `s`, as well as each item in `in` to a QuinSelector.
+    // The output signal from the QuinSelector is <item from in> and gets
+    // wired to Mux1 (as above).
+
+    var inputs[NUM_OUTPUT_ITEMS];
+
+    for (var i = 0; i < numItems; i++) {
+        inputs[i] = in[i];
+    }
+    inputs[NUM_OUTPUT_ITEMS - 1] = 0;
+
+    for (var i = 0; i < NUM_OUTPUT_ITEMS; i++) {
+        // Determines if current index is greater than the insertion index.
+        var computedIsIndexAfterInsertPoint = SafeGreaterThan(3)([i, index]);
+
+        // Calculates correct index for original items, adjusting for leaf insertion.
+        var computedAdjustedIndex = i - computedIsIndexAfterInsertPoint;
+
+        // Selects item from the original array or the leaf for insertion.
+        var computedQuinSelected = QuinSelector(NUM_OUTPUT_ITEMS)(inputs, computedAdjustedIndex);
+        var computedIsIndexEqual = IsEqual()([index, i]);
+        var mux = Mux1()([computedQuinSelected, leaf], computedIsIndexEqual);
+
+        out[i] <== mux;
+    }
+}
+
+/**
+ * Computes the root of an IQT given a leaf, its path, and sibling nodes at each level of the tree. 
+ * It iteratively incorporates the leaf or the hash from the previous level with sibling nodes using 
+ * the Splicer to place the leaf or hash at the correct position based on path_index. 
+ * Then, it hashes these values together with PoseidonHasher to move up the tree. 
+ * This process repeats for each level (levels) of the tree, culminating in the computation of the tree's root.
+ */
+template QuinTreeInclusionProof(levels) {
+    var LEAVES_PER_NODE = 5;
+    var LEAVES_PER_PATH_LEVEL = LEAVES_PER_NODE - 1;
+
+    signal input leaf;
+    signal input path_index[levels];
+    signal input path_elements[levels][LEAVES_PER_PATH_LEVEL];
+    signal output root;
+
+    var currentLeaf = leaf;
+
+    // Iteratively hash each level of path_elements with the leaf or previous hash
+    for (var i = 0; i < levels; i++) {
+        var elements[LEAVES_PER_PATH_LEVEL];
+
+        for (var j = 0; j < LEAVES_PER_PATH_LEVEL; j++) {
+            elements[j] = path_elements[i][j];
+        }
+
+        var computedSplicedLeaf[LEAVES_PER_NODE] = Splicer(LEAVES_PER_PATH_LEVEL)(
+            elements, 
+            currentLeaf, 
+            path_index[i]
+        );
+
+        currentLeaf = PoseidonHasher(5)([
+            computedSplicedLeaf[0],
+            computedSplicedLeaf[1],
+            computedSplicedLeaf[2],
+            computedSplicedLeaf[3],
+            computedSplicedLeaf[4]
+        ]);
+    }
+
+    root <== currentLeaf;
+}
+
+/**
+ * Verifies if a given leaf exists within an IQT.
+ * Takes a leaf, its path to the root (specified by indices and path elements),
+ * and the root itself, to verify the leaf's inclusion within the tree.
+ */
+template QuinLeafExists(levels){
+    var LEAVES_PER_NODE = 5;
+    var LEAVES_PER_PATH_LEVEL = LEAVES_PER_NODE - 1;
+
+    signal input leaf;
+    signal input path_index[levels];
+    signal input path_elements[levels][LEAVES_PER_PATH_LEVEL];
+    signal input root;
+
+    // Verify the Merkle path.
+    var computedRoot = QuinTreeInclusionProof(levels)(leaf, path_index, path_elements);
+
+    root === computedRoot;
+}
+
+/**
+ * Checks if a list of leaves exists within an IQT, leveraging the PoseidonT6
+ * circuit for hashing. This can be used to verify the presence of multiple leaves.
+ */
+template QuinBatchLeavesExists(levels, batchLevels) {
+    var LEAVES_PER_NODE = 5;
+    var LEAVES_PER_PATH_LEVEL = LEAVES_PER_NODE - 1;
+    var LEAVES_PER_BATCH = LEAVES_PER_NODE ** batchLevels;
+
+    signal input root;
+    signal input leaves[LEAVES_PER_BATCH];
+    signal input path_index[levels - batchLevels];
+    signal input path_elements[levels - batchLevels][LEAVES_PER_PATH_LEVEL];
+
+    // Compute the subroot (= leaf).
+    var computedQuinSubroot = QuinCheckRoot(batchLevels)(leaves);
+
+    // Check if the Merkle path is valid
+    QuinLeafExists(levels - batchLevels)(computedQuinSubroot, path_index, path_elements, root);
+}
+
+/**
+ * Calculates the path indices required for Merkle proof verifications (e.g., QuinTreeInclusionProof, QuinLeafExists). 
+ * Given a node index within an IQT and the total tree levels, it outputs the path indices leading to that node.
+ * The template handles the modulo and division operations to break down the tree index into its constituent path indices.
+ * e.g., if the index is 30 and the number of levels is 4, the output should be [0, 1, 1, 0].
+ */
+template QuinGeneratePathIndices(levels) {
+    var BASE = 5;
+
+    signal input in; 
+    signal output out[levels];
+
+    var m = in;
+    var computedResults[levels];
+
+    for (var i = 0; i < levels; i++) {
+        // circom's best practices suggests to avoid using <-- unless you
+        // are aware of what's going on. This is the only way to do modulo operation.
+        out[i] <-- m % BASE;
+        m = m \ BASE;
+
+        // Check that each output element is less than the base.
+        var computedIsOutputElementLessThanBase = SafeLessThan(3)([out[i], BASE]);
+        computedIsOutputElementLessThanBase === 1;
+
+        // Re-compute the total sum.
+        computedResults[i] = out[i] * (BASE ** i);
+    }
+    
+    // Check that the total sum matches the index.
+    var computedCalculateTotal = CalculateTotal(levels)(computedResults);
+
+    computedCalculateTotal === in;
+}
+
+/**
+ * Computes the root of a quintary Merkle tree given a list of leaves.
+ * This template constructs a Merkle tree with each node having 5 children (quintary)
+ * and computes the root by hashing with Poseidon the leaves and intermediate nodes in the given order.
+ * The computation is performed by first hashing groups of 5 leaves to form the bottom layer of nodes,
+ * then recursively hashing groups of these nodes to form the next layer, and so on, until the root is computed.
+ */
+template QuinCheckRoot(levels) {
+    var LEAVES_PER_NODE = 5;
+    var totalLeaves = LEAVES_PER_NODE ** levels;
+    var numLeafHashers = LEAVES_PER_NODE ** (levels - 1); 
+
+    signal input leaves[totalLeaves];
+    signal output root;
+
+    // Determine the total number of hashers.
+    var numHashers = 0;
+    for (var i = 0; i < levels; i++) {
+        numHashers += LEAVES_PER_NODE ** i;
+    }
+
+    var computedHashers[numHashers]; 
+
+    // Initialize hashers for the leaves.
+    for (var i = 0; i < numLeafHashers; i++) {
+        computedHashers[i] = PoseidonHasher(5)([
+            leaves[i * LEAVES_PER_NODE + 0],
+            leaves[i * LEAVES_PER_NODE + 1],
+            leaves[i * LEAVES_PER_NODE + 2],
+            leaves[i * LEAVES_PER_NODE + 3],
+            leaves[i * LEAVES_PER_NODE + 4]
+        ]);
+    }
+
+    // Initialize hashers for intermediate nodes and compute the root.
+    var k = 0;
+    for (var i = numLeafHashers; i < numHashers; i++) {
+        computedHashers[i] = PoseidonHasher(5)([
+            computedHashers[k * LEAVES_PER_NODE + 0],
+            computedHashers[k * LEAVES_PER_NODE + 1],
+            computedHashers[k * LEAVES_PER_NODE + 2],
+            computedHashers[k * LEAVES_PER_NODE + 3],
+            computedHashers[k * LEAVES_PER_NODE + 4]
+        ]);
+        k++;
+    }
+
+    root <== computedHashers[numHashers - 1]; 
+}