@maci-protocol/circuits 0.0.0-ci.4c6d4e8 → 0.0.0-ci.52ce07e

package/circom/coordinator/qv/tallyVotes.circom

@@ -6,11 +6,11 @@ include "./comparators.circom";
 include "./unpack-element.circom";
 // local imports
 include "../../utils/trees/CheckRoot.circom";
-include "../../utils/trees/MerkleGeneratePathIndices.circom";
+include "../../utils/trees/MerklePathIndicesGenerator.circom";
 include "../../utils/trees/LeafExists.circom";
-include "../../utils/trees/incrementalQuinaryTree.circom";
-include "../../utils/calculateTotal.circom";
-include "../../utils/hashers.circom";
+include "../../utils/trees/QuinaryCheckRoot.circom";
+include "../../utils/CalculateTotal.circom";
+include "../../utils/PoseidonHasher.circom";
 
 /**
  * Processes batches of votes and verifies their validity in a Merkle tree structure.
@@ -18,33 +18,33 @@ include "../../utils/hashers.circom";
  */
 template TallyVotes(
     stateTreeDepth,
-    intStateTreeDepth,
+    tallyProcessingStateTreeDepth,
     voteOptionTreeDepth
 ) {
     // Ensure there's at least one level in the vote option tree.
     assert(voteOptionTreeDepth > 0);
     // Ensure the intermediate state tree has at least one level.
-    assert(intStateTreeDepth > 0);
+    assert(tallyProcessingStateTreeDepth > 0);
     // The intermediate state tree must be smaller than the full state tree.
-    assert(intStateTreeDepth < stateTreeDepth); 
+    assert(tallyProcessingStateTreeDepth < stateTreeDepth); 
 
     // Number of children per node in the tree, defining the tree's branching factor.
     var TREE_ARITY = 5;
     var BALLOT_TREE_ARITY = 2;
 
     // The number of ballots processed at once, determined by the depth of the intermediate state tree.
-    var batchSize = BALLOT_TREE_ARITY ** intStateTreeDepth;
+    var batchSize = BALLOT_TREE_ARITY ** tallyProcessingStateTreeDepth;
     // Number of voting options available, determined by the depth of the vote option tree.
-    var numVoteOptions = TREE_ARITY ** voteOptionTreeDepth;
+    var totalVoteOptions = TREE_ARITY ** voteOptionTreeDepth;
 
     // Number of elements in each ballot.
     var BALLOT_LENGTH = 2;
     // Index for the nonce in the ballot array.
-    var BALLOT_NONCE_IDX = 0;
+    var BALLOT_NONCE_INDEX = 0;
     // Index for the voting option root in the ballot array.
-    var BALLOT_VO_ROOT_IDX = 1;
+    var BALLOT_VOTE_OPTION_ROOT_INDEX = 1;
     // Difference in tree depths, used in path calculations.
-    var k = stateTreeDepth - intStateTreeDepth;
+    var STATE_TREE_DEPTH_DIFFERENCE = stateTreeDepth - tallyProcessingStateTreeDepth;
 
     // Root of the state Merkle tree, representing the overall state before voting.
     signal input stateRoot;
@@ -61,13 +61,13 @@ template TallyVotes(
     // Start index of given batch
     signal input index;
     // Number of users that signup
-    signal input numSignUps;
+    signal input totalSignups;
     // Ballots and their corresponding path elements for verification in the tree.
     signal input ballots[batchSize][BALLOT_LENGTH];
-    signal input ballotPathElements[k][BALLOT_TREE_ARITY - 1];
-    signal input votes[batchSize][numVoteOptions];
+    signal input ballotPathElements[STATE_TREE_DEPTH_DIFFERENCE][BALLOT_TREE_ARITY - 1];
+    signal input votes[batchSize][totalVoteOptions];
     // Current results for each vote option.
-    signal input currentResults[numVoteOptions];
+    signal input currentResults[totalVoteOptions];
     // Salt for the root of the current results.
     signal input currentResultsRootSalt;
     // Total voice credits spent so far.
@@ -75,13 +75,13 @@ template TallyVotes(
     // Salt for the total spent voice credits.
     signal input currentSpentVoiceCreditSubtotalSalt;
     // Spent voice credits per vote option.
-    signal input currentPerVOSpentVoiceCredits[numVoteOptions];
+    signal input currentPerVoteOptionSpentVoiceCredits[totalVoteOptions];
     // Salt for the root of spent credits per option.
-    signal input currentPerVOSpentVoiceCreditsRootSalt;
+    signal input currentPerVoteOptionSpentVoiceCreditsRootSalt;
     // Salt for the root of the new results.
     signal input newResultsRootSalt;
     // Salt for the new spent credits per vote option root.
-    signal input newPerVOSpentVoiceCreditsRootSalt;
+    signal input newPerVoteOptionSpentVoiceCreditsRootSalt;
     // Salt for the new total spent voice credits root. 
     signal input newSpentVoiceCreditSubtotalSalt;
 
@@ -90,21 +90,21 @@ template TallyVotes(
     computedSbCommitment === sbCommitment;
 
     // Validates that the index is within the valid range of sign-ups.
-    var numSignUpsValid = LessEqThan(50)([index, numSignUps]);
-    numSignUpsValid === 1;
+    var totalSignupsValid = LessEqThan(50)([index, totalSignups]);
+    totalSignupsValid === 1;
 
     // Hashes each ballot for subroot generation, and checks the existence of the leaf in the Merkle tree.    
     var computedBallotHashers[batchSize];
     
     for (var i = 0; i < batchSize; i++) {
-        computedBallotHashers[i] = PoseidonHasher(2)([ballots[i][BALLOT_NONCE_IDX], ballots[i][BALLOT_VO_ROOT_IDX]]);
+        computedBallotHashers[i] = PoseidonHasher(2)([ballots[i][BALLOT_NONCE_INDEX], ballots[i][BALLOT_VOTE_OPTION_ROOT_INDEX]]);
     }
 
-    var computedBallotSubroot = CheckRoot(intStateTreeDepth)(computedBallotHashers);
-    var computedBallotPathIndices[k] = MerkleGeneratePathIndices(k)(index / batchSize);
+    var computedBallotSubroot = CheckRoot(tallyProcessingStateTreeDepth)(computedBallotHashers);
+    var computedBallotPathIndices[STATE_TREE_DEPTH_DIFFERENCE] = MerklePathIndicesGenerator(STATE_TREE_DEPTH_DIFFERENCE)(index / batchSize);
 
     // Verifies each ballot's existence within the ballot tree.
-    LeafExists(k)(
+    LeafExists(STATE_TREE_DEPTH_DIFFERENCE)(
         computedBallotSubroot,
         ballotPathElements,
         computedBallotPathIndices,
@@ -114,8 +114,8 @@ template TallyVotes(
     // Processes vote options, verifying each against its declared root.
     var computedVoteTree[batchSize];
     for (var i = 0; i < batchSize; i++) {
-        computedVoteTree[i] = QuinCheckRoot(voteOptionTreeDepth)(votes[i]);
-        computedVoteTree[i] === ballots[i][BALLOT_VO_ROOT_IDX];
+        computedVoteTree[i] = QuinaryCheckRoot(voteOptionTreeDepth)(votes[i]);
+        computedVoteTree[i] === ballots[i][BALLOT_VOTE_OPTION_ROOT_INDEX];
     }
 
     // Calculates new results and spent voice credits based on the current and incoming votes.
@@ -123,8 +123,8 @@ template TallyVotes(
     var computedIsZero = IsZero()(computedIsFirstBatch);
 
     // Tally the new results.
-    var computedCalculateTotalResult[numVoteOptions];
-    for (var i = 0; i < numVoteOptions; i++) {
+    var computedCalculateTotalResult[totalVoteOptions];
+    for (var i = 0; i < totalVoteOptions; i++) {
         var numsRC[batchSize + 1];
         numsRC[batchSize] = currentResults[i] * computedIsZero;
         for (var j = 0; j < batchSize; j++) {
@@ -135,27 +135,27 @@ template TallyVotes(
     }
 
     // Tally the new spent voice credit total.
-    var numsSVC[batchSize * numVoteOptions + 1];
-    numsSVC[batchSize * numVoteOptions] = currentSpentVoiceCreditSubtotal * computedIsZero;
+    var numsSVC[batchSize * totalVoteOptions + 1];
+    numsSVC[batchSize * totalVoteOptions] = currentSpentVoiceCreditSubtotal * computedIsZero;
     for (var i = 0; i < batchSize; i++) {
-        for (var j = 0; j < numVoteOptions; j++) {
-            numsSVC[i * numVoteOptions + j] = votes[i][j] * votes[i][j];
+        for (var j = 0; j < totalVoteOptions; j++) {
+            numsSVC[i * totalVoteOptions + j] = votes[i][j] * votes[i][j];
         }
     }
 
-    var computedNewSpentVoiceCreditSubtotal = CalculateTotal(batchSize * numVoteOptions + 1)(numsSVC);
+    var computedNewSpentVoiceCreditSubtotal = CalculateTotal(batchSize * totalVoteOptions + 1)(numsSVC);
 
     // Tally the spent voice credits per vote option.
-    var computedNewPerVOSpentVoiceCredits[numVoteOptions];
+    var computedNewPerVOSpentVoiceCredits[totalVoteOptions];
 
-    for (var i = 0; i < numVoteOptions; i++) {
-        var computedNumsSVC[batchSize + 1];
-        computedNumsSVC[batchSize] = currentPerVOSpentVoiceCredits[i] * computedIsZero;
+    for (var i = 0; i < totalVoteOptions; i++) {
+        var computedTotalVoiceCreditSpent[batchSize + 1];
+        computedTotalVoiceCreditSpent[batchSize] = currentPerVoteOptionSpentVoiceCredits[i] * computedIsZero;
         for (var j = 0; j < batchSize; j++) {
-            computedNumsSVC[j] = votes[j][i] * votes[j][i];
+            computedTotalVoiceCreditSpent[j] = votes[j][i] * votes[j][i];
         }
 
-        computedNewPerVOSpentVoiceCredits[i] = CalculateTotal(batchSize + 1)(computedNumsSVC);
+        computedNewPerVOSpentVoiceCredits[i] = CalculateTotal(batchSize + 1)(computedTotalVoiceCreditSpent);
     }
     
     // Verifies the updated results and spent credits, ensuring consistency and correctness of tally updates.
@@ -171,10 +171,10 @@ template TallyVotes(
         currentSpentVoiceCreditSubtotalSalt,
         computedNewSpentVoiceCreditSubtotal,
         newSpentVoiceCreditSubtotalSalt,
-        currentPerVOSpentVoiceCredits,
-        currentPerVOSpentVoiceCreditsRootSalt,
+        currentPerVoteOptionSpentVoiceCredits,
+        currentPerVoteOptionSpentVoiceCreditsRootSalt,
         computedNewPerVOSpentVoiceCredits,
-        newPerVOSpentVoiceCreditsRootSalt        
+        newPerVoteOptionSpentVoiceCreditsRootSalt        
     );
 }
 
@@ -187,7 +187,7 @@ template ResultCommitmentVerifier(voteOptionTreeDepth) {
     // Number of children per node in the tree, defining the tree's branching factor.
     var TREE_ARITY = 5;
     // Number of voting options available, determined by the depth of the vote option tree.
-    var numVoteOptions = TREE_ARITY ** voteOptionTreeDepth;
+    var totalVoteOptions = TREE_ARITY ** voteOptionTreeDepth;
 
     // Equal to 1 if this is the first batch, otherwise 0.
     signal input isFirstBatch;
@@ -197,12 +197,12 @@ template ResultCommitmentVerifier(voteOptionTreeDepth) {
     signal input newTallyCommitment;
 
     // Current results for each vote option.
-    signal input currentResults[numVoteOptions];
+    signal input currentResults[totalVoteOptions];
     // Salt for the root of the current results.
     signal input currentResultsRootSalt;
 
     // New results for each vote option.
-    signal input newResults[numVoteOptions];
+    signal input newResults[totalVoteOptions];
     // Salt for the root of the new results.
     signal input newResultsRootSalt;
 
@@ -217,17 +217,17 @@ template ResultCommitmentVerifier(voteOptionTreeDepth) {
     signal input newSpentVoiceCreditSubtotalSalt;
 
     // Spent voice credits per vote option.
-    signal input currentPerVOSpentVoiceCredits[numVoteOptions];
+    signal input currentPerVoteOptionSpentVoiceCredits[totalVoteOptions];
     // Salt for the root of spent credits per option.
-    signal input currentPerVOSpentVoiceCreditsRootSalt;
+    signal input currentPerVoteOptionSpentVoiceCreditsRootSalt;
 
     // New spent voice credits per vote option.
-    signal input newPerVOSpentVoiceCredits[numVoteOptions];
+    signal input newPerVoteOptionSpentVoiceCredits[totalVoteOptions];
     // Salt for the root of new spent credits per option.
-    signal input newPerVOSpentVoiceCreditsRootSalt;
+    signal input newPerVoteOptionSpentVoiceCreditsRootSalt;
 
     // Compute the commitment to the current results.
-    var computedCurrentResultsRoot = QuinCheckRoot(voteOptionTreeDepth)(currentResults);
+    var computedCurrentResultsRoot = QuinaryCheckRoot(voteOptionTreeDepth)(currentResults);
 
     // Verify currentResultsCommitmentHash.
     var computedCurrentResultsCommitment = PoseidonHasher(2)([computedCurrentResultsRoot, currentResultsRootSalt]);
@@ -236,14 +236,14 @@ template ResultCommitmentVerifier(voteOptionTreeDepth) {
     var computedCurrentSpentVoiceCreditsCommitment = PoseidonHasher(2)([currentSpentVoiceCreditSubtotal, currentSpentVoiceCreditSubtotalSalt]);
 
     // Compute the root of the spent voice credits per vote option.
-    var computedCurrentPerVOSpentVoiceCreditsRoot = QuinCheckRoot(voteOptionTreeDepth)(currentPerVOSpentVoiceCredits);
-    var computedCurrentPerVOSpentVoiceCreditsCommitment = PoseidonHasher(2)([computedCurrentPerVOSpentVoiceCreditsRoot, currentPerVOSpentVoiceCreditsRootSalt]);
+    var computedCurrentPerVoteOptionSpentVoiceCreditsRoot = QuinaryCheckRoot(voteOptionTreeDepth)(currentPerVoteOptionSpentVoiceCredits);
+    var computedCurrentPerVoteOptionSpentVoiceCreditsCommitment = PoseidonHasher(2)([computedCurrentPerVoteOptionSpentVoiceCreditsRoot, currentPerVoteOptionSpentVoiceCreditsRootSalt]);
 
     // Commit to the current tally.
     var computedCurrentTallyCommitment = PoseidonHasher(3)([
         computedCurrentResultsCommitment, 
         computedCurrentSpentVoiceCreditsCommitment, 
-        computedCurrentPerVOSpentVoiceCreditsCommitment
+        computedCurrentPerVoteOptionSpentVoiceCreditsCommitment
     ]);
 
     // Check if the current tally commitment is correct only if this is not the first batch.
@@ -251,28 +251,28 @@ template ResultCommitmentVerifier(voteOptionTreeDepth) {
     // computedIsZero.out is 0 if this is the first batch.
     var computedIsZero = IsZero()(isFirstBatch);
 
-    // hz is 0 if this is the first batch, currentTallyCommitment should be 0 if this is the first batch.
-    // hz is 1 if this is not the first batch, currentTallyCommitment should not be 0 if this is the first batch.
-    signal hz;
-    hz <== computedIsZero * computedCurrentTallyCommitment;
-    hz === currentTallyCommitment;
+    // isFirstCommitment is 0 if this is the first batch, currentTallyCommitment should be 0 if this is the first batch.
+    // isFirstCommitment is 1 if this is not the first batch, currentTallyCommitment should not be 0 if this is the first batch.
+    signal isFirstCommitment;
+    isFirstCommitment <== computedIsZero * computedCurrentTallyCommitment;
+    isFirstCommitment === currentTallyCommitment;
 
     // Compute the root of the new results.
-    var computedNewResultsRoot = QuinCheckRoot(voteOptionTreeDepth)(newResults);
+    var computedNewResultsRoot = QuinaryCheckRoot(voteOptionTreeDepth)(newResults);
     var computedNewResultsCommitment = PoseidonHasher(2)([computedNewResultsRoot, newResultsRootSalt]);
 
     // Compute the commitment to the new spent voice credits value.
     var computedNewSpentVoiceCreditsCommitment = PoseidonHasher(2)([newSpentVoiceCreditSubtotal, newSpentVoiceCreditSubtotalSalt]);
 
     // Compute the root of the spent voice credits per vote option.
-    var computedNewPerVOSpentVoiceCreditsRoot = QuinCheckRoot(voteOptionTreeDepth)(newPerVOSpentVoiceCredits);
-    var computedNewPerVOSpentVoiceCreditsCommitment = PoseidonHasher(2)([computedNewPerVOSpentVoiceCreditsRoot, newPerVOSpentVoiceCreditsRootSalt]);
+    var computedNewPerVoteOptionSpentVoiceCreditsRoot = QuinaryCheckRoot(voteOptionTreeDepth)(newPerVoteOptionSpentVoiceCredits);
+    var computedNewPerVoteOptionSpentVoiceCreditsCommitment = PoseidonHasher(2)([computedNewPerVoteOptionSpentVoiceCreditsRoot, newPerVoteOptionSpentVoiceCreditsRootSalt]);
 
     // Commit to the new tally.
     var computedNewTallyCommitment = PoseidonHasher(3)([
         computedNewResultsCommitment,
         computedNewSpentVoiceCreditsCommitment,
-        computedNewPerVOSpentVoiceCreditsCommitment
+        computedNewPerVoteOptionSpentVoiceCreditsCommitment
     ]);
     
     computedNewTallyCommitment === newTallyCommitment;

package/circom/utils/{calculateTotal.circom → CalculateTotal.circom}

@@ -1,22 +1,24 @@
 pragma circom 2.0.0;
 
 /**
- * Computes the cumulative sum of an array of n input signals.
+ * Computes the cumulative sum of an array of length input signals.
  * It iterates through each input, aggregating the sum up to that point,
  * and outputs the total sum of all inputs. This template is useful for
  * operations requiring the total sum of multiple signals, ensuring the
  * final output reflects the cumulative total of the inputs provided.
  */
-template CalculateTotal(n) {
-    signal input nums[n];
+template CalculateTotal(length) {
+    // Array of values.
+    signal input nums[length];
+    // Total sum.
     signal output sum;
 
-    signal sums[n];
+    signal sums[length];
     sums[0] <== nums[0];
 
-    for (var i = 1; i < n; i++) {
+    for (var i = 1; i < length; i++) {
         sums[i] <== sums[i - 1] + nums[i];
     }
 
-    sum <== sums[n - 1];
+    sum <== sums[length - 1];
 }

package/circom/utils/{verifySignature.circom → EdDSAPoseidonVerifier.circom}

@@ -8,60 +8,69 @@ include "./bitify.circom";
 include "./escalarmulany.circom";
 include "./escalarmulfix.circom";
 // local imports
-include "./hashers.circom";
+include "./PoseidonHasher.circom";
 
 /**
  * Variant of the EdDSAPoseidonVerifier template from circomlib
  * https://github.com/iden3/circomlib/blob/master/circuits/eddsa.circom
  */
-template EdDSAPoseidonVerifier_patched() {
+template EdDSAPoseidonVerifier() {
+    // The prime subgroup order.
+    var SUBGROUP_ORDER = 2736030358979909402780800718157159386076813972158567259200215660948447373041;
+
+    // The base point of the BabyJubJub curve.
+    var BASE8[2] = [
+        5299619240641551281634865583518297030282874472190772894086521144482721001553,
+        16950150798460657717958625567821834550301663161624707787222815936182638968203
+    ];
+
     // The x and y coordinates of the public key.
-    signal input Ax;
-    signal input Ay;
+    signal input publicKeyX;
+    signal input publicKeyY;
     // Signature scalar.
-    signal input S;
+    signal input signatureScalar;
     // The x and y coordinates of the signature point.
-    signal input R8x;
-    signal input R8y;
+    signal input signaturePointX;
+    signal input signaturePointY;
     // Message hash.
-    signal input M;
+    signal input messageHash;
+    // Output signal for the validity of the signature.
+    signal output isValid;
 
-    signal output valid;
-
-    // Ensure S<Subgroup Order.
-    // convert the signature scalar S into its binary representation.
-    var computedNum2Bits[254] = Num2Bits(254)(S);
+    // Ensure signatureScalar<Subgroup Order.
+    // convert the signature scalar signatureScalar into its binary representation.
+    var computedNum2Bits[254] = Num2Bits(254)(signatureScalar);
 
     var computedCompConstantIn[254] = computedNum2Bits;
     computedCompConstantIn[253] = 0;
 
-    // A component that ensures S is within a valid range, 
+    // A component that ensures signatureScalar is within a valid range, 
     // comparing it against a constant representing the subgroup order.
-    var computedCompConstant = CompConstant(2736030358979909402780800718157159386076813972158567259200215660948447373040)(computedCompConstantIn);
+    var computedCompConstant = CompConstant(SUBGROUP_ORDER - 1)(computedCompConstantIn);
 
-    // Calculate the h = H(R,A, msg).
-    var computedH2Bits[254] = Num2Bits_strict()(PoseidonHasher(5)([R8x, R8y, Ax, Ay, M]));
+    // Calculate the h = H(R, A, msg).
+    var computedH2Bits[254] = Num2Bits_strict()(PoseidonHasher(5)([
+      signaturePointX,
+      signaturePointY,
+      publicKeyX,
+      publicKeyY,
+      messageHash
+    ]));
 
     // These components perform point doubling operations on the public key
     // to align it within the correct subgroup as part of the verification process.
-    var (computedDbl1XOut, computedDbl1YOut) = BabyDbl()(Ax, Ay);
-    var (computedDbl2XOut, computedDbl2YOut) = BabyDbl()(computedDbl1XOut, computedDbl1YOut);
-    var (computedDbl3XOut, computedDbl3YOut) = BabyDbl()(computedDbl2XOut, computedDbl2YOut);
+    var (computedDouble1XOut, computedDouble1YOut) = BabyDbl()(publicKeyX, publicKeyY);
+    var (computedDouble2XOut, computedDouble2YOut) = BabyDbl()(computedDouble1XOut, computedDouble1YOut);
+    var (computedDouble3XOut, computedDouble3YOut) = BabyDbl()(computedDouble2XOut, computedDouble2YOut);
 
     // A component that performs scalar multiplication of the 
     // adjusted public key by the hash output, essential for the verification calculation.
-    var computedEscalarMulAny[2] = EscalarMulAny(254)(computedH2Bits, [computedDbl3XOut, computedDbl3YOut]);
+    var computedEscalarMulAny[2] = EscalarMulAny(254)(computedH2Bits, [computedDouble3XOut, computedDouble3YOut]);
 
     // Compute the right side: right =  R8 + right2.
-    var (computedAddRightXOut, computedAddRightYOut) = BabyAdd()(R8x, R8y, computedEscalarMulAny[0], computedEscalarMulAny[1]);
-
-    // Calculate the left side: left = S * B8.
-    var BASE8[2] = [
-        5299619240641551281634865583518297030282874472190772894086521144482721001553,
-        16950150798460657717958625567821834550301663161624707787222815936182638968203
-    ];
+    var (computedAddRightXOut, computedAddRightYOut) = BabyAdd()(signaturePointX, signaturePointY, computedEscalarMulAny[0], computedEscalarMulAny[1]);
     
-    // Fixed-base scalar multiplication of a base point by S.
+    // Fixed-base scalar multiplication of a base point by signatureScalar.
     var computedEscalarMulFix[2] = EscalarMulFix(254, BASE8)(computedNum2Bits);
 
     // Components to check the equality of x and y coordinates 
@@ -73,45 +82,10 @@ template EdDSAPoseidonVerifier_patched() {
     // Components to handle edge cases and ensure that all conditions 
     // for a valid signature are met, including the 
     // public key not being zero and other integrity checks.
-    var computedIsAxZero = IsZero()(Ax);
+    var computedIsAxZero = IsZero()(publicKeyX);
     var computedIsAxEqual = IsEqual()([computedIsAxZero, 0]);
     var computedIsCcZero = IsZero()(computedCompConstant);
     var computedIsValid = IsEqual()([computedIsLeftRightValid + computedIsAxEqual + computedIsCcZero, 3]);
 
-    valid <== computedIsValid;
-}
-
-/**
- * Verifies the EdDSA signature for a given command, which has exactly four elements in the hash preimage.
- */
-template VerifySignature() {
-    // Public key of the signer, consisting of two coordinates [x, y].
-    signal input pubKey[2];
-    // R8 point from the signature, consisting of two coordinates [x, y]. 
-    signal input R8[2];
-    // Scalar component of the signature.
-    signal input S;
-
-    // Number of elements in the hash preimage.
-    var k = 4;
-    
-    // The preimage data that was hashed, an array of four elements.
-    signal input preimage[k];
-
-    signal output valid;
-
-    // Hash the preimage using the Poseidon hashing function configured for four inputs.
-    var computedM = PoseidonHasher(4)(preimage);
-
-    // Instantiate the patched EdDSA Poseidon verifier with the necessary inputs.
-    var computedVerifier = EdDSAPoseidonVerifier_patched()(
-        pubKey[0],
-        pubKey[1],
-        S,
-        R8[0],
-        R8[1],
-        computedM
-    );
-
-    valid <== computedVerifier;
+    isValid <== computedIsValid;
 }

package/circom/utils/MessageHasher.circom

@@ -0,0 +1,57 @@
+pragma circom 2.0.0;
+
+include "./PoseidonHasher.circom";
+
+/**
+ * Hashes a MACI message and the public key used for message encryption. 
+ * This template processes 10 message inputs and a 2-element public key
+ * combining them using the Poseidon hash function. The hashing process involves two stages: 
+ * 1. hashing message parts data groups of five and,
+ * 2. hashing the grouped results alongside the first message input and 
+ * the encryption public key to produce a final hash output. 
+ */
+template MessageHasher() {
+    // Message parts
+    var MESSAGE_PARTS = 10;
+    var STATE_INDEX = 0;
+    var VOTE_OPTION_INDEX = 1;
+    var NEW_VOTE_WEIGHT = 2;
+    var NONCE = 3;
+    var POLL_ID = 4;
+    var SIGNATURE_POINT_X = 5;
+    var SIGNATURE_POINT_Y = 6;
+    var SIGNATURE_SCALAR = 7;
+    var ENCRYPTED_PUBLIC_KEY_X = 8;
+    var ENCRYPTED_PUBLIC_KEY_Y = 9;
+
+    // The MACI message is composed of 10 parts.
+    signal input data[MESSAGE_PARTS];
+    // the public key used to encrypt the message.
+    signal input encryptionPublicKey[2];
+
+    // we output an hash.
+    signal output hash;
+
+    var computedHasherPart1 = PoseidonHasher(5)([
+        data[STATE_INDEX],
+        data[VOTE_OPTION_INDEX],
+        data[NEW_VOTE_WEIGHT],
+        data[NONCE],
+        data[POLL_ID]
+    ]);
+
+    var computedHasherPart2 = PoseidonHasher(5)([
+        data[SIGNATURE_POINT_X],        
+        data[SIGNATURE_POINT_Y],
+        data[SIGNATURE_SCALAR],
+        data[ENCRYPTED_PUBLIC_KEY_X],
+        data[ENCRYPTED_PUBLIC_KEY_Y]
+    ]);
+
+    hash <== PoseidonHasher(4)([
+        computedHasherPart1,
+        computedHasherPart2,
+        encryptionPublicKey[0],
+        encryptionPublicKey[1]        
+    ]);
+}

package/circom/utils/MessageToCommand.circom

@@ -0,0 +1,107 @@
+pragma circom 2.0.0;
+
+// circomlib import
+include "./bitify.circom";
+// zk-kit imports
+include "./ecdh.circom";
+include "./unpack-element.circom";
+include "./poseidon-cipher.circom";
+
+/**
+ * Converts a MACI message to a command by decrypting it.
+ * Processes encrypted MACI messages into structured MACI commands 
+ * by decrypting using a shared key derived from ECDH. After decryption, 
+ * unpacks and assigns decrypted values to specific command components. 
+ */
+template MessageToCommand() {
+    var MESSAGE_LENGTH = 7;
+    var PACKED_COMMAND_LENGTH = 4;
+    var UNPACK_ELEMENT_LENGTH = 5;
+    var DECRYPTED_LENGTH = 9;
+    var MESSAGE_PARTS = 10;
+    
+    // Element indices.
+    var ELEMENT_POLL_ID = 0;
+    var ELEMENT_NONCE = 1;
+    var ELEMENT_NEW_VOTE_WEIGHT = 2;
+    var ELEMENT_VOTE_OPTION_INDEX = 3;
+    var ELEMENT_STATE_INDEX = 4;
+
+    // Command indices.
+    var COMMAND_STATE_INDEX = 0;
+    var COMMAND_PUBLIC_KEY_X = 1;
+    var COMMAND_PUBLIC_KEY_Y = 2;
+    var COMMAND_SALT = 3;
+
+    // Decryptor indices.
+    var SIGNATURE_POINT_X = 4;
+    var SIGNATURE_POINT_Y = 5;
+    var SIGNATURE_SCALAR = 6;
+
+    // The message is an array of 10 parts.
+    signal input message[MESSAGE_PARTS];
+    // The encryption private key
+    signal input encryptionPrivateKey;
+    // The encryption public key
+    signal input encryptionPublicKey[2];
+
+    // Command parts.
+    signal output stateIndex;
+    // The new public key.
+    signal output newPublicKey[2];
+    // The vote option index.
+    signal output voteOptionIndex;
+    // The new vote weight.
+    signal output newVoteWeight;
+    // The nonce.
+    signal output nonce;
+    // The poll id.
+    signal output pollId;
+    // The salt.
+    signal output salt;
+    // The signature point.
+    signal output signaturePoint[2];
+    // The signature scalar.
+    signal output signatureScalar;
+
+    // Packed command. 
+    signal output packedCommandOut[PACKED_COMMAND_LENGTH];
+
+    // Generate the shared key for decrypting the message.
+    var computedEcdh[2] = Ecdh()(encryptionPrivateKey, encryptionPublicKey);
+
+    // Decrypt the message using Poseidon decryption.
+    var computedDecryptor[DECRYPTED_LENGTH] = PoseidonDecryptWithoutCheck(MESSAGE_LENGTH)(
+        message,
+        0, 
+        computedEcdh
+    );
+
+    // Save the decrypted message into a packed command signal.
+    signal packedCommand[PACKED_COMMAND_LENGTH];
+
+    for (var i = 0; i < PACKED_COMMAND_LENGTH; i++) {
+        packedCommand[i] <== computedDecryptor[i];
+    }
+
+    var computedUnpackElement[UNPACK_ELEMENT_LENGTH] = UnpackElement(UNPACK_ELEMENT_LENGTH)(
+        packedCommand[COMMAND_STATE_INDEX]
+    );
+
+    // Everything below were packed into the first element.
+    pollId <== computedUnpackElement[ELEMENT_POLL_ID];
+    nonce <== computedUnpackElement[ELEMENT_NONCE];
+    newVoteWeight <== computedUnpackElement[ELEMENT_NEW_VOTE_WEIGHT];
+    voteOptionIndex <== computedUnpackElement[ELEMENT_VOTE_OPTION_INDEX];
+    stateIndex <== computedUnpackElement[ELEMENT_STATE_INDEX];
+
+    newPublicKey[0] <== packedCommand[COMMAND_PUBLIC_KEY_X];
+    newPublicKey[1] <== packedCommand[COMMAND_PUBLIC_KEY_Y];
+    salt <== packedCommand[COMMAND_SALT];
+
+    signaturePoint[0] <== computedDecryptor[SIGNATURE_POINT_X];
+    signaturePoint[1] <== computedDecryptor[SIGNATURE_POINT_Y];
+    signatureScalar <== computedDecryptor[SIGNATURE_SCALAR];
+
+    packedCommandOut <== packedCommand;
+}

package/circom/utils/PoseidonHasher.circom

@@ -0,0 +1,29 @@
+pragma circom 2.0.0;
+
+// zk-kit imports
+include "./poseidon-cipher.circom";
+
+/**
+ * Computes the Poseidon hash for an array of n inputs, including a default initial state 
+ * of zero not counted in n. First, extends the inputs by prepending a zero, creating an array [0, inputs]. 
+ * Then, the Poseidon hash of the extended inputs is calculated, with the first element of the 
+ * result assigned as the output. 
+ */
+template PoseidonHasher(n) {
+    signal input inputs[n];
+    signal output out;
+
+    // [0, inputs].
+    var computedExtendedInputs[n + 1];
+    computedExtendedInputs[0] = 0;
+
+    for (var i = 0; i < n; i++) {
+        computedExtendedInputs[i + 1] = inputs[i];
+    }
+
+    // Compute the Poseidon hash of the extended inputs.
+    var computedPoseidonPerm[n + 1]; 
+    computedPoseidonPerm = PoseidonPerm(n + 1)(computedExtendedInputs);
+
+    out <== computedPoseidonPerm[0];
+}