@maci-protocol/circuits 0.0.0-ci.f433bba → 0.0.0-ci.f4e2c46

package/circom/coordinator/qv/tallyVotes.circom

@@ -1,277 +0,0 @@
-pragma circom 2.0.0;
-
-// circomlib import
-include "./comparators.circom";
-// zk-kit import
-include "./unpack-element.circom";
-// local imports
-include "../../utils/trees/incrementalMerkleTree.circom";
-include "../../utils/trees/incrementalQuinaryTree.circom";
-include "../../utils/calculateTotal.circom";
-include "../../utils/hashers.circom";
-
-/**
- * Processes batches of votes and verifies their validity in a Merkle tree structure.
- * This template supports Quadratic Voting (QV).
- */
-template TallyVotes(
-    stateTreeDepth,
-    intStateTreeDepth,
-    voteOptionTreeDepth
-) {
-    // Ensure there's at least one level in the vote option tree.
-    assert(voteOptionTreeDepth > 0);
-    // Ensure the intermediate state tree has at least one level.
-    assert(intStateTreeDepth > 0);
-    // The intermediate state tree must be smaller than the full state tree.
-    assert(intStateTreeDepth < stateTreeDepth); 
-
-    // Number of children per node in the tree, defining the tree's branching factor.
-    var TREE_ARITY = 5;
-    var BALLOT_TREE_ARITY = 2;
-
-    // The number of ballots processed at once, determined by the depth of the intermediate state tree.
-    var batchSize = BALLOT_TREE_ARITY ** intStateTreeDepth;
-    // Number of voting options available, determined by the depth of the vote option tree.
-    var numVoteOptions = TREE_ARITY ** voteOptionTreeDepth;
-
-    // Number of elements in each ballot.
-    var BALLOT_LENGTH = 2;
-    // Index for the nonce in the ballot array.
-    var BALLOT_NONCE_IDX = 0;
-    // Index for the voting option root in the ballot array.
-    var BALLOT_VO_ROOT_IDX = 1;
-    // Difference in tree depths, used in path calculations.
-    var k = stateTreeDepth - intStateTreeDepth;
-
-    // Root of the state Merkle tree, representing the overall state before voting.
-    signal input stateRoot;
-    // Root of the ballot Merkle tree, representing the submitted ballots.
-    signal input ballotRoot;
-    // Salt used in commitment to secure the ballot data.
-    signal input sbSalt;
-    // Commitment to the state and ballots.
-    signal input sbCommitment;
-    // Commitment to the current tally before this batch.
-    signal input currentTallyCommitment;
-    // Commitment to the new tally after processing this batch.
-    signal input newTallyCommitment;
-    // Start index of given batch
-    signal input index;
-    // Number of users that signup
-    signal input numSignUps;
-    // Ballots and their corresponding path elements for verification in the tree.
-    signal input ballots[batchSize][BALLOT_LENGTH];
-    signal input ballotPathElements[k][BALLOT_TREE_ARITY - 1];
-    signal input votes[batchSize][numVoteOptions];
-    // Current results for each vote option.
-    signal input currentResults[numVoteOptions];
-    // Salt for the root of the current results.
-    signal input currentResultsRootSalt;
-    // Total voice credits spent so far.
-    signal input currentSpentVoiceCreditSubtotal;
-    // Salt for the total spent voice credits.
-    signal input currentSpentVoiceCreditSubtotalSalt;
-    // Spent voice credits per vote option.
-    signal input currentPerVOSpentVoiceCredits[numVoteOptions];
-    // Salt for the root of spent credits per option.
-    signal input currentPerVOSpentVoiceCreditsRootSalt;
-    // Salt for the root of the new results.
-    signal input newResultsRootSalt;
-    // Salt for the new spent credits per vote option root.
-    signal input newPerVOSpentVoiceCreditsRootSalt;
-    // Salt for the new total spent voice credits root. 
-    signal input newSpentVoiceCreditSubtotalSalt;
-
-    // Verify sbCommitment.
-    var computedSbCommitment = PoseidonHasher(3)([stateRoot, ballotRoot, sbSalt]);
-    computedSbCommitment === sbCommitment;
-
-    // Validates that the index is within the valid range of sign-ups.
-    var numSignUpsValid = LessEqThan(50)([index, numSignUps]);
-    numSignUpsValid === 1;
-
-    // Hashes each ballot for subroot generation, and checks the existence of the leaf in the Merkle tree.    
-    var computedBallotHashers[batchSize];
-    
-    for (var i = 0; i < batchSize; i++) {
-        computedBallotHashers[i] = PoseidonHasher(2)([ballots[i][BALLOT_NONCE_IDX], ballots[i][BALLOT_VO_ROOT_IDX]]);
-    }
-
-    var computedBallotSubroot = CheckRoot(intStateTreeDepth)(computedBallotHashers);
-    var computedBallotPathIndices[k] = MerkleGeneratePathIndices(k)(index / batchSize);
-
-    // Verifies each ballot's existence within the ballot tree.
-    LeafExists(k)(
-        computedBallotSubroot,
-        ballotPathElements,
-        computedBallotPathIndices,
-        ballotRoot
-    );
-
-    // Processes vote options, verifying each against its declared root.
-    var computedVoteTree[batchSize];
-    for (var i = 0; i < batchSize; i++) {
-        computedVoteTree[i] = QuinCheckRoot(voteOptionTreeDepth)(votes[i]);
-        computedVoteTree[i] === ballots[i][BALLOT_VO_ROOT_IDX];
-    }
-
-    // Calculates new results and spent voice credits based on the current and incoming votes.
-    var computedIsFirstBatch = IsZero()(index);
-    var computedIsZero = IsZero()(computedIsFirstBatch);
-
-    // Tally the new results.
-    var computedCalculateTotalResult[numVoteOptions];
-    for (var i = 0; i < numVoteOptions; i++) {
-        var numsRC[batchSize + 1];
-        numsRC[batchSize] = currentResults[i] * computedIsZero;
-        for (var j = 0; j < batchSize; j++) {
-            numsRC[j] = votes[j][i];
-        }
-
-        computedCalculateTotalResult[i] = CalculateTotal(batchSize + 1)(numsRC);
-    }
-
-    // Tally the new spent voice credit total.
-    var numsSVC[batchSize * numVoteOptions + 1];
-    numsSVC[batchSize * numVoteOptions] = currentSpentVoiceCreditSubtotal * computedIsZero;
-    for (var i = 0; i < batchSize; i++) {
-        for (var j = 0; j < numVoteOptions; j++) {
-            numsSVC[i * numVoteOptions + j] = votes[i][j] * votes[i][j];
-        }
-    }
-
-    var computedNewSpentVoiceCreditSubtotal = CalculateTotal(batchSize * numVoteOptions + 1)(numsSVC);
-
-    // Tally the spent voice credits per vote option.
-    var computedNewPerVOSpentVoiceCredits[numVoteOptions];
-
-    for (var i = 0; i < numVoteOptions; i++) {
-        var computedNumsSVC[batchSize + 1];
-        computedNumsSVC[batchSize] = currentPerVOSpentVoiceCredits[i] * computedIsZero;
-        for (var j = 0; j < batchSize; j++) {
-            computedNumsSVC[j] = votes[j][i] * votes[j][i];
-        }
-
-        computedNewPerVOSpentVoiceCredits[i] = CalculateTotal(batchSize + 1)(computedNumsSVC);
-    }
-    
-    // Verifies the updated results and spent credits, ensuring consistency and correctness of tally updates.
-    ResultCommitmentVerifier(voteOptionTreeDepth)(
-        computedIsFirstBatch,
-        currentTallyCommitment,
-        newTallyCommitment,
-        currentResults,
-        currentResultsRootSalt,
-        computedCalculateTotalResult,
-        newResultsRootSalt,
-        currentSpentVoiceCreditSubtotal,
-        currentSpentVoiceCreditSubtotalSalt,
-        computedNewSpentVoiceCreditSubtotal,
-        newSpentVoiceCreditSubtotalSalt,
-        currentPerVOSpentVoiceCredits,
-        currentPerVOSpentVoiceCreditsRootSalt,
-        computedNewPerVOSpentVoiceCredits,
-        newPerVOSpentVoiceCreditsRootSalt        
-    );
-}
-
-/** 
- * Performs verifications and computations related to current voting results. 
- * Also, computes and outputs a commitment to the new results.
- * This template supports the Quadratic Voting (QV).
- */
-template ResultCommitmentVerifier(voteOptionTreeDepth) {
-    // Number of children per node in the tree, defining the tree's branching factor.
-    var TREE_ARITY = 5;
-    // Number of voting options available, determined by the depth of the vote option tree.
-    var numVoteOptions = TREE_ARITY ** voteOptionTreeDepth;
-
-    // Equal to 1 if this is the first batch, otherwise 0.
-    signal input isFirstBatch;
-    // Commitment to the current tally before this batch.
-    signal input currentTallyCommitment;
-    // Commitment to the new tally after processing this batch.
-    signal input newTallyCommitment;
-
-    // Current results for each vote option.
-    signal input currentResults[numVoteOptions];
-    // Salt for the root of the current results.
-    signal input currentResultsRootSalt;
-
-    // New results for each vote option.
-    signal input newResults[numVoteOptions];
-    // Salt for the root of the new results.
-    signal input newResultsRootSalt;
-
-    // Total voice credits spent so far.
-    signal input currentSpentVoiceCreditSubtotal;
-    // Salt for the total spent voice credits.
-    signal input currentSpentVoiceCreditSubtotalSalt;
-
-    // Total new voice credits spent.
-    signal input newSpentVoiceCreditSubtotal;
-    // Salt for the new total spent voice credits.
-    signal input newSpentVoiceCreditSubtotalSalt;
-
-    // Spent voice credits per vote option.
-    signal input currentPerVOSpentVoiceCredits[numVoteOptions];
-    // Salt for the root of spent credits per option.
-    signal input currentPerVOSpentVoiceCreditsRootSalt;
-
-    // New spent voice credits per vote option.
-    signal input newPerVOSpentVoiceCredits[numVoteOptions];
-    // Salt for the root of new spent credits per option.
-    signal input newPerVOSpentVoiceCreditsRootSalt;
-
-    // Compute the commitment to the current results.
-    var computedCurrentResultsRoot = QuinCheckRoot(voteOptionTreeDepth)(currentResults);
-
-    // Verify currentResultsCommitmentHash.
-    var computedCurrentResultsCommitment = PoseidonHasher(2)([computedCurrentResultsRoot, currentResultsRootSalt]);
-
-    // Compute the commitment to the current spent voice credits.
-    var computedCurrentSpentVoiceCreditsCommitment = PoseidonHasher(2)([currentSpentVoiceCreditSubtotal, currentSpentVoiceCreditSubtotalSalt]);
-
-    // Compute the root of the spent voice credits per vote option.
-    var computedCurrentPerVOSpentVoiceCreditsRoot = QuinCheckRoot(voteOptionTreeDepth)(currentPerVOSpentVoiceCredits);
-    var computedCurrentPerVOSpentVoiceCreditsCommitment = PoseidonHasher(2)([computedCurrentPerVOSpentVoiceCreditsRoot, currentPerVOSpentVoiceCreditsRootSalt]);
-
-    // Commit to the current tally.
-    var computedCurrentTallyCommitment = PoseidonHasher(3)([
-        computedCurrentResultsCommitment, 
-        computedCurrentSpentVoiceCreditsCommitment, 
-        computedCurrentPerVOSpentVoiceCreditsCommitment
-    ]);
-
-    // Check if the current tally commitment is correct only if this is not the first batch.
-    // computedIsZero.out is 1 if this is not the first batch.
-    // computedIsZero.out is 0 if this is the first batch.
-    var computedIsZero = IsZero()(isFirstBatch);
-
-    // hz is 0 if this is the first batch, currentTallyCommitment should be 0 if this is the first batch.
-    // hz is 1 if this is not the first batch, currentTallyCommitment should not be 0 if this is the first batch.
-    signal hz;
-    hz <== computedIsZero * computedCurrentTallyCommitment;
-    hz === currentTallyCommitment;
-
-    // Compute the root of the new results.
-    var computedNewResultsRoot = QuinCheckRoot(voteOptionTreeDepth)(newResults);
-    var computedNewResultsCommitment = PoseidonHasher(2)([computedNewResultsRoot, newResultsRootSalt]);
-
-    // Compute the commitment to the new spent voice credits value.
-    var computedNewSpentVoiceCreditsCommitment = PoseidonHasher(2)([newSpentVoiceCreditSubtotal, newSpentVoiceCreditSubtotalSalt]);
-
-    // Compute the root of the spent voice credits per vote option.
-    var computedNewPerVOSpentVoiceCreditsRoot = QuinCheckRoot(voteOptionTreeDepth)(newPerVOSpentVoiceCredits);
-    var computedNewPerVOSpentVoiceCreditsCommitment = PoseidonHasher(2)([computedNewPerVOSpentVoiceCreditsRoot, newPerVOSpentVoiceCreditsRootSalt]);
-
-    // Commit to the new tally.
-    var computedNewTallyCommitment = PoseidonHasher(3)([
-        computedNewResultsCommitment,
-        computedNewSpentVoiceCreditsCommitment,
-        computedNewPerVOSpentVoiceCreditsCommitment
-    ]);
-    
-    computedNewTallyCommitment === newTallyCommitment;
-}

package/circom/utils/hashers.circom

@@ -1,78 +0,0 @@
-pragma circom 2.0.0;
-
-// zk-kit imports
-include "./poseidon-cipher.circom";
-
-/**
- * Computes the Poseidon hash for an array of n inputs, including a default initial state 
- * of zero not counted in n. First, extends the inputs by prepending a zero, creating an array [0, inputs]. 
- * Then, the Poseidon hash of the extended inputs is calculated, with the first element of the 
- * result assigned as the output. 
- */
-template PoseidonHasher(n) {
-    signal input inputs[n];
-    signal output out;
-
-    // [0, inputs].
-    var computedExtendedInputs[n + 1];
-    computedExtendedInputs[0] = 0;
-
-    for (var i = 0; i < n; i++) {
-        computedExtendedInputs[i + 1] = inputs[i];
-    }
-
-    // Compute the Poseidon hash of the extended inputs.
-    var computedPoseidonPerm[n + 1]; 
-    computedPoseidonPerm = PoseidonPerm(n + 1)(computedExtendedInputs);
-
-    out <== computedPoseidonPerm[0];
-}
-
-/**
- * Hashes a MACI message and the public key used for message encryption. 
- * This template processes 10 message inputs and a 2-element public key
- * combining them using the Poseidon hash function. The hashing process involves two stages: 
- * 1. hashing message parts in groups of five and,
- * 2. hashing the grouped results alongside the first message input and 
- * the encryption public key to produce a final hash output. 
- */
-template MessageHasher() {
-    // The MACI message is composed of 10 parts.
-    signal input in[10];
-    // the public key used to encrypt the message.
-    signal input encPubKey[2];
-    // we output an hash.
-    signal output hash;
-
-    // Hasher4(
-    //     Hasher5_1(in[1], in[2], in[3], in[4], in[5]),
-    //     Hasher5_2(in[6], in[7], in[8], in[9], in[10])
-    //     in[11],
-    //     in[12]
-    // )
-
-    var computedHasher5_1;
-    computedHasher5_1 = PoseidonHasher(5)([
-        in[0],
-        in[1],
-        in[2],
-        in[3],
-        in[4]
-    ]);
-
-    var computedHasher5_2;
-    computedHasher5_2 = PoseidonHasher(5)([
-        in[5],        
-        in[6],
-        in[7],
-        in[8],
-        in[9]
-    ]);
-
-    hash <== PoseidonHasher(4)([
-        computedHasher5_1,
-        computedHasher5_2,
-        encPubKey[0],
-        encPubKey[1]        
-    ]);
-}

package/circom/utils/messageToCommand.circom

@@ -1,78 +0,0 @@
-pragma circom 2.0.0;
-
-// circomlib import
-include "./bitify.circom";
-// zk-kit imports
-include "./ecdh.circom";
-include "./unpack-element.circom";
-include "./poseidon-cipher.circom";
-// local imports
-include "./hashers.circom";
-
-/**
- * Converts a MACI message to a command by decrypting it.
- * Processes encrypted MACI messages into structured MACI commands 
- * by decrypting using a shared key derived from ECDH. After decryption, 
- * unpacks and assigns decrypted values to specific command components. 
- */
-template MessageToCommand() {
-    var MSG_LENGTH = 7;
-    var PACKED_CMD_LENGTH = 4;
-    var UNPACKED_CMD_LENGTH = 8;
-    var UNPACK_ELEM_LENGTH = 5;
-    var DECRYPTED_LENGTH = 9;
-    var MESSAGE_PARTS = 10;
-
-    // The message is an array of 10 parts.
-    signal input message[MESSAGE_PARTS];
-    signal input encPrivKey;
-    signal input encPubKey[2];
-
-    // Command parts.
-    signal output stateIndex;
-    signal output newPubKey[2];
-    signal output voteOptionIndex;
-    signal output newVoteWeight;
-    signal output nonce;
-    signal output pollId;
-    signal output salt;
-    signal output sigR8[2];
-    signal output sigS;
-    // Packed command. 
-    signal output packedCommandOut[PACKED_CMD_LENGTH];
-
-    // Generate the shared key for decrypting the message.
-    var computedEcdh[2] = Ecdh()(encPrivKey, encPubKey);
-
-    // Decrypt the message using Poseidon decryption.
-    var computedDecryptor[DECRYPTED_LENGTH] = PoseidonDecryptWithoutCheck(MSG_LENGTH)(
-        message,
-        0, 
-        computedEcdh
-    );
-
-    // Save the decrypted message into a packed command signal.
-    signal packedCommand[PACKED_CMD_LENGTH];
-    for (var i = 0; i < PACKED_CMD_LENGTH; i++) {
-        packedCommand[i] <== computedDecryptor[i];
-    }
-
-    var computedUnpackElement[UNPACK_ELEM_LENGTH] = UnpackElement(UNPACK_ELEM_LENGTH)(packedCommand[0]);
-
-    // Everything below were packed into the first element.
-    stateIndex <== computedUnpackElement[4];
-    voteOptionIndex <== computedUnpackElement[3];
-    newVoteWeight <== computedUnpackElement[2];
-    nonce <== computedUnpackElement[1];
-    pollId <== computedUnpackElement[0];
-
-    newPubKey[0] <== packedCommand[1];
-    newPubKey[1] <== packedCommand[2];
-    salt <== packedCommand[3];
-
-    sigR8[0] <== computedDecryptor[4];
-    sigR8[1] <== computedDecryptor[5];
-    sigS <== computedDecryptor[6];
-
-    packedCommandOut <== packedCommand;
-}

package/circom/utils/trees/incrementalMerkleTree.circom

@@ -1,198 +0,0 @@
-pragma circom 2.0.0;
-
-// zk-kit imports
-include "./safe-comparators.circom";
-// circomlib import
-include "./mux1.circom";
-include "./comparators.circom";
-// local import
-include "../hashers.circom";
-include "../calculateTotal.circom";
-
-/**
- * Recomputes a Merkle root from a given leaf and its path in a Merkle tree.
- */
-template MerkleTreeInclusionProof(n_levels) {
-    // The leaf node from which the Merkle root is calculated.
-    signal input leaf;
-    // Indices indicating left or right child for each level of the tree.
-    signal input path_index[n_levels];
-    // Sibling node values required to compute the hash at each level.
-    signal input path_elements[n_levels][1];
-
-    signal output root;
-
-     // Stores the hash at each level starting from the leaf to the root.
-    signal levelHashes[n_levels + 1];
-    // Initialize the first level with the given leaf.
-    levelHashes[0] <== leaf;
-
-    for (var i = 0; i < n_levels; i++) {
-        // Validate path_index to be either 0 or 1, ensuring no other values.
-        path_index[i] * (1 - path_index[i]) === 0;
-
-        // Configure the multiplexer based on the path index for the current level.
-        var c[2][2] = [
-            [levelHashes[i], path_elements[i][0]],
-            [path_elements[i][0], levelHashes[i]]
-        ];
-
-        var mux[2] = MultiMux1(2)(
-            c,
-            path_index[i]
-        );
-
-        var computedLevelHash = PoseidonHasher(2)([mux[0], mux[1]]);
-
-        // Store the resulting hash as the next level's hash.
-        levelHashes[i + 1] <== computedLevelHash;
-    }
-
-    // Set the final level hash as the root.
-    root <== levelHashes[n_levels];
-}
-
-/**
- * Ensures that a leaf exists within a Merkle tree with a given root.
- */
-template LeafExists(levels){
-  // The leaf whose existence within the tree is being verified.
-  signal input leaf;
-
-  // The elements along the path needed for the inclusion proof.
-  signal input path_elements[levels][1];
-  // The indices indicating the path taken through the tree for the leaf.
-  signal input path_index[levels];
-  // The root of the Merkle tree, against which the inclusion is verified.
-  signal input root;
-
-  var computedMerkleRoot = MerkleTreeInclusionProof(levels)(
-    leaf,
-    path_index,
-    path_elements
-  );
-
-  root === computedMerkleRoot;
-}
-
-/**
- * Verifies the correct construction of a Merkle tree from a set of leaves.
- * Given a Merkle root and a list of leaves, check if the root is the
- * correct result of inserting all the leaves into the tree (in the given order).
- */
-template CheckRoot(levels) {
-    // The total number of leaves in the Merkle tree, calculated as 2 to the power of `levels`.
-    var totalLeaves = 2 ** levels;
-    // The number of first-level hashers needed, equal to half the total leaves, as each hasher combines two leaves.
-    var numLeafHashers = totalLeaves / 2;
-    // The number of intermediate hashers, one less than the number of leaf hashers, 
-    // as each level of hashing reduces the number of hash elements by about half.
-    var numIntermediateHashers = numLeafHashers - 1;
-    
-    // Array of leaf values input to the circuit.
-    signal input leaves[totalLeaves];
-
-    // Output signal for the Merkle root that results from hashing all the input leaves.
-    signal output root;
-
-    // Total number of hashers used in constructing the tree, one less than the total number of leaves,
-    // since each level of the tree combines two elements into one.
-    var numHashers = totalLeaves - 1;
-    var computedLevelHashers[numHashers];
-
-    // Initialize hashers for the leaves, each taking two adjacent leaves as inputs.
-    for (var i = 0; i < numLeafHashers; i++){
-        computedLevelHashers[i] = PoseidonHasher(2)([leaves[i*2], leaves[i*2+1]]);
-    }
-
-    // Initialize hashers for intermediate levels, each taking the outputs of two hashers from the previous level.
-    var k = 0;
-    for (var i = numLeafHashers; i < numLeafHashers + numIntermediateHashers; i++) {
-        computedLevelHashers[i] = PoseidonHasher(2)([computedLevelHashers[k*2], computedLevelHashers[k*2+1]]);
-        k++;
-    }
-
-    // Connect the output of the final hasher in the array to the root output signal.
-    root <== computedLevelHashers[numHashers-1];
-}
-
-/**
- * Calculates the path indices required for Merkle proof verifications. 
- * Given a node index within an IMT and the total tree levels, it outputs the path indices leading to that node.
- * The template handles the modulo and division operations to break down the tree index into its constituent path indices.
- */
-template MerkleGeneratePathIndices(levels) {
-    var BASE = 2;
-
-    signal input in; 
-    signal output out[levels];
-
-    var m = in;
-    var computedResults[levels];
-
-    for (var i = 0; i < levels; i++) {
-        // circom's best practices suggests to avoid using <-- unless you
-        // are aware of what's going on. This is the only way to do modulo operation.
-        out[i] <-- m % BASE;
-        m = m \ BASE;
-
-        // Check that each output element is less than the base.
-        var computedIsOutputElementLessThanBase = SafeLessThan(3)([out[i], BASE]);
-        computedIsOutputElementLessThanBase === 1;
-
-        // Re-compute the total sum.
-        computedResults[i] = out[i] * (BASE ** i);
-    }
-    
-    // Check that the total sum matches the index.
-    var computedCalculateTotal = CalculateTotal(levels)(computedResults);
-
-    computedCalculateTotal === in;
-}
-
-// @note taken from @zk-kit/circuits
-// if used directly in processMessages circom complains about duplicated
-// templates (Ark, Poseidon, etc.)
-// This circuit is designed to calculate the root of a binary Merkle
-// tree given a leaf, its depth, and the necessary sibling
-// information (aka proof of membership).
-// A circuit is designed without the capability to iterate through
-// a dynamic array. To address this, a parameter with the static maximum
-// tree depth is defined (i.e. 'MAX_DEPTH'). And additionally, the circuit
-// receives a dynamic depth as an input, which is utilized in calculating the
-// true root of the Merkle tree. The actual depth of the Merkle tree
-// may be equal to or less than the static maximum depth.
-// NOTE: This circuit will successfully verify `out = 0` for `depth > MAX_DEPTH`.
-// Make sure to enforce `depth <= MAX_DEPTH` outside the circuit.
-template BinaryMerkleRoot(MAX_DEPTH) {
-    signal input leaf, depth, indices[MAX_DEPTH], siblings[MAX_DEPTH][1];
-
-    signal output out;
-
-    signal nodes[MAX_DEPTH + 1];
-    nodes[0] <== leaf;
-
-    signal roots[MAX_DEPTH];
-    var root = 0;
-
-    for (var i = 0; i < MAX_DEPTH; i++) {
-        var isDepth = IsEqual()([depth, i]);
-
-        roots[i] <== isDepth * nodes[i];
-
-        root += roots[i];
-
-        var c[2][2] = [
-            [nodes[i], siblings[i][0]],
-            [siblings[i][0], nodes[i]]
-        ];
-        
-        var childNodes[2] = MultiMux1(2)(c, indices[i]);
-
-        nodes[i + 1] <== PoseidonHasher(2)(childNodes);
-    }
-
-    var isDepth = IsEqual()([depth, MAX_DEPTH]);
-
-    out <== root + isDepth * nodes[MAX_DEPTH];
-}