@maci-protocol/circuits 0.0.0-ci.ffabe48 → 3.0.0

package/circom/coordinator/qv/{tallyVotes.circom → VoteTally.circom}

@@ -6,9 +6,9 @@ include "./comparators.circom";
 include "./unpack-element.circom";
 // local imports
 include "../../utils/trees/CheckRoot.circom";
-include "../../utils/trees/MerklePathIndicesGenerator.circom";
 include "../../utils/trees/LeafExists.circom";
 include "../../utils/trees/QuinaryCheckRoot.circom";
+include "../../utils/qv/ResultCommitmentVerifier.circom";
 include "../../utils/CalculateTotal.circom";
 include "../../utils/PoseidonHasher.circom";
 
@@ -16,7 +16,7 @@ include "../../utils/PoseidonHasher.circom";
  * Processes batches of votes and verifies their validity in a Merkle tree structure.
  * This template supports Quadratic Voting (QV).
  */
-template TallyVotes(
+template VoteTallyQv(
     stateTreeDepth,
     tallyProcessingStateTreeDepth,
     voteOptionTreeDepth
@@ -101,7 +101,7 @@ template TallyVotes(
     }
 
     var computedBallotSubroot = CheckRoot(tallyProcessingStateTreeDepth)(computedBallotHashers);
-    var computedBallotPathIndices[STATE_TREE_DEPTH_DIFFERENCE] = MerklePathIndicesGenerator(STATE_TREE_DEPTH_DIFFERENCE)(index / batchSize);
+    var computedBallotPathIndices[STATE_TREE_DEPTH_DIFFERENCE] = Num2Bits(STATE_TREE_DEPTH_DIFFERENCE)(index / batchSize);
 
     // Verifies each ballot's existence within the ballot tree.
     LeafExists(STATE_TREE_DEPTH_DIFFERENCE)(
@@ -159,7 +159,7 @@ template TallyVotes(
     }
     
     // Verifies the updated results and spent credits, ensuring consistency and correctness of tally updates.
-    ResultCommitmentVerifier(voteOptionTreeDepth)(
+    ResultCommitmentVerifierQv(voteOptionTreeDepth)(
         computedIsFirstBatch,
         currentTallyCommitment,
         newTallyCommitment,
@@ -177,103 +177,3 @@ template TallyVotes(
         newPerVoteOptionSpentVoiceCreditsRootSalt        
     );
 }
-
-/** 
- * Performs verifications and computations related to current voting results. 
- * Also, computes and outputs a commitment to the new results.
- * This template supports the Quadratic Voting (QV).
- */
-template ResultCommitmentVerifier(voteOptionTreeDepth) {
-    // Number of children per node in the tree, defining the tree's branching factor.
-    var TREE_ARITY = 5;
-    // Number of voting options available, determined by the depth of the vote option tree.
-    var totalVoteOptions = TREE_ARITY ** voteOptionTreeDepth;
-
-    // Equal to 1 if this is the first batch, otherwise 0.
-    signal input isFirstBatch;
-    // Commitment to the current tally before this batch.
-    signal input currentTallyCommitment;
-    // Commitment to the new tally after processing this batch.
-    signal input newTallyCommitment;
-
-    // Current results for each vote option.
-    signal input currentResults[totalVoteOptions];
-    // Salt for the root of the current results.
-    signal input currentResultsRootSalt;
-
-    // New results for each vote option.
-    signal input newResults[totalVoteOptions];
-    // Salt for the root of the new results.
-    signal input newResultsRootSalt;
-
-    // Total voice credits spent so far.
-    signal input currentSpentVoiceCreditSubtotal;
-    // Salt for the total spent voice credits.
-    signal input currentSpentVoiceCreditSubtotalSalt;
-
-    // Total new voice credits spent.
-    signal input newSpentVoiceCreditSubtotal;
-    // Salt for the new total spent voice credits.
-    signal input newSpentVoiceCreditSubtotalSalt;
-
-    // Spent voice credits per vote option.
-    signal input currentPerVoteOptionSpentVoiceCredits[totalVoteOptions];
-    // Salt for the root of spent credits per option.
-    signal input currentPerVoteOptionSpentVoiceCreditsRootSalt;
-
-    // New spent voice credits per vote option.
-    signal input newPerVoteOptionSpentVoiceCredits[totalVoteOptions];
-    // Salt for the root of new spent credits per option.
-    signal input newPerVoteOptionSpentVoiceCreditsRootSalt;
-
-    // Compute the commitment to the current results.
-    var computedCurrentResultsRoot = QuinaryCheckRoot(voteOptionTreeDepth)(currentResults);
-
-    // Verify currentResultsCommitmentHash.
-    var computedCurrentResultsCommitment = PoseidonHasher(2)([computedCurrentResultsRoot, currentResultsRootSalt]);
-
-    // Compute the commitment to the current spent voice credits.
-    var computedCurrentSpentVoiceCreditsCommitment = PoseidonHasher(2)([currentSpentVoiceCreditSubtotal, currentSpentVoiceCreditSubtotalSalt]);
-
-    // Compute the root of the spent voice credits per vote option.
-    var computedCurrentPerVoteOptionSpentVoiceCreditsRoot = QuinaryCheckRoot(voteOptionTreeDepth)(currentPerVoteOptionSpentVoiceCredits);
-    var computedCurrentPerVoteOptionSpentVoiceCreditsCommitment = PoseidonHasher(2)([computedCurrentPerVoteOptionSpentVoiceCreditsRoot, currentPerVoteOptionSpentVoiceCreditsRootSalt]);
-
-    // Commit to the current tally.
-    var computedCurrentTallyCommitment = PoseidonHasher(3)([
-        computedCurrentResultsCommitment, 
-        computedCurrentSpentVoiceCreditsCommitment, 
-        computedCurrentPerVoteOptionSpentVoiceCreditsCommitment
-    ]);
-
-    // Check if the current tally commitment is correct only if this is not the first batch.
-    // computedIsZero.out is 1 if this is not the first batch.
-    // computedIsZero.out is 0 if this is the first batch.
-    var computedIsZero = IsZero()(isFirstBatch);
-
-    // isFirstCommitment is 0 if this is the first batch, currentTallyCommitment should be 0 if this is the first batch.
-    // isFirstCommitment is 1 if this is not the first batch, currentTallyCommitment should not be 0 if this is the first batch.
-    signal isFirstCommitment;
-    isFirstCommitment <== computedIsZero * computedCurrentTallyCommitment;
-    isFirstCommitment === currentTallyCommitment;
-
-    // Compute the root of the new results.
-    var computedNewResultsRoot = QuinaryCheckRoot(voteOptionTreeDepth)(newResults);
-    var computedNewResultsCommitment = PoseidonHasher(2)([computedNewResultsRoot, newResultsRootSalt]);
-
-    // Compute the commitment to the new spent voice credits value.
-    var computedNewSpentVoiceCreditsCommitment = PoseidonHasher(2)([newSpentVoiceCreditSubtotal, newSpentVoiceCreditSubtotalSalt]);
-
-    // Compute the root of the spent voice credits per vote option.
-    var computedNewPerVoteOptionSpentVoiceCreditsRoot = QuinaryCheckRoot(voteOptionTreeDepth)(newPerVoteOptionSpentVoiceCredits);
-    var computedNewPerVoteOptionSpentVoiceCreditsCommitment = PoseidonHasher(2)([computedNewPerVoteOptionSpentVoiceCreditsRoot, newPerVoteOptionSpentVoiceCreditsRootSalt]);
-
-    // Commit to the new tally.
-    var computedNewTallyCommitment = PoseidonHasher(3)([
-        computedNewResultsCommitment,
-        computedNewSpentVoiceCreditsCommitment,
-        computedNewPerVoteOptionSpentVoiceCreditsCommitment
-    ]);
-    
-    computedNewTallyCommitment === newTallyCommitment;
-}

package/circom/coordinator/qv/VoteTallyWithIndividualCounts.circom

@@ -0,0 +1,226 @@
+pragma circom 2.0.0;
+
+// circomlib import
+include "./comparators.circom";
+// zk-kit import
+include "./unpack-element.circom";
+// local imports
+include "../../utils/trees/CheckRoot.circom";
+include "../../utils/trees/LeafExists.circom";
+include "../../utils/trees/QuinaryCheckRoot.circom";
+include "../../utils/qv/ResultCommitmentVerifier.circom";
+include "../../utils/CalculateTotal.circom";
+include "../../utils/PoseidonHasher.circom";
+
+/**
+ * Processes batches of votes and verifies their validity in a Merkle tree structure.
+ * This template supports Quadratic Voting (QV) with individual vote counting.
+ * Note: this circuit is not using right now, this is a part of individual vote counts functionality.
+ * Not finished yet, don't use it in production. It is kept here for future use.
+ */
+template VoteTallyWithIndividualCountsQv(
+    stateTreeDepth,
+    tallyProcessingStateTreeDepth,
+    voteOptionTreeDepth
+) {
+    // Ensure there's at least one level in the vote option tree.
+    assert(voteOptionTreeDepth > 0);
+    // Ensure the intermediate state tree has at least one level.
+    assert(tallyProcessingStateTreeDepth > 0);
+    // The intermediate state tree must be smaller than the full state tree.
+    assert(tallyProcessingStateTreeDepth < stateTreeDepth); 
+
+    // Number of children per node in the tree, defining the tree's branching factor.
+    var TREE_ARITY = 5;
+    var BALLOT_TREE_ARITY = 2;
+    var VOTE_COUNTS_TREE_ARITY = 2;
+
+    // The number of ballots processed at once, determined by the depth of the intermediate state tree.
+    var ballotBatchSize = BALLOT_TREE_ARITY ** tallyProcessingStateTreeDepth;
+    var voteCountsBatchSize = VOTE_COUNTS_TREE_ARITY ** tallyProcessingStateTreeDepth;
+    // Number of voting options available, determined by the depth of the vote option tree.
+    var totalVoteOptions = TREE_ARITY ** voteOptionTreeDepth;
+
+    // Number of elements in each ballot.
+    var BALLOT_LENGTH = 2;
+    // Index for the nonce in the ballot array.
+    var BALLOT_NONCE_INDEX = 0;
+    // Index for the voting option root in the ballot array.
+    var BALLOT_VOTE_OPTION_ROOT_INDEX = 1;
+    // Difference in tree depths, used in path calculations.
+    var STATE_TREE_DEPTH_DIFFERENCE = stateTreeDepth - tallyProcessingStateTreeDepth;
+    // Number of elements in each vote count leaf.
+    var VOTE_COUNTS_LENGTH = 2;
+    // Index for the voting option index.
+    var VOTE_COUNTS_NONCE_INDEX = 0;
+    // Index for root of the vote count per option.
+    var VOTE_COUNTS_ROOT_INDEX = 1;
+
+    // Root of the state Merkle tree, representing the overall state before voting.
+    signal input stateRoot;
+    // Root of the ballot Merkle tree, representing the submitted ballots.
+    signal input ballotRoot;
+    // Root of the vote counts Merkle tree, representing the counts of votes for each option.
+    signal input voteCountsRoot;
+    // Salt used in commitment to secure the ballot data.
+    signal input sbSalt;
+    // Commitment to the state and ballots.
+    signal input sbCommitment;
+    // Commitment to the current tally before this batch.
+    signal input currentTallyCommitment;
+    // Commitment to the new tally after processing this batch.
+    signal input newTallyCommitment;
+    // Start index of given batch
+    signal input index;
+    // Number of users that signup
+    signal input totalSignups;
+    // Ballots and their corresponding path elements for verification in the tree.
+    signal input ballots[ballotBatchSize][BALLOT_LENGTH];
+    signal input ballotPathElements[STATE_TREE_DEPTH_DIFFERENCE][BALLOT_TREE_ARITY - 1];
+    signal input votes[ballotBatchSize][totalVoteOptions];
+    // Individual vote count tree and their corresponding path elements for verification in the tree.
+    signal input voteCounts[voteCountsBatchSize][VOTE_COUNTS_LENGTH];
+    signal input voteCountsPathElements[STATE_TREE_DEPTH_DIFFERENCE][VOTE_COUNTS_TREE_ARITY - 1];
+    signal input voteCountsData[voteCountsBatchSize][totalVoteOptions];
+    // Current results for each vote option.
+    signal input currentResults[totalVoteOptions];
+    // Salt for the root of the current results.
+    signal input currentResultsRootSalt;
+    // Total voice credits spent so far.
+    signal input currentSpentVoiceCreditSubtotal;
+    // Salt for the total spent voice credits.
+    signal input currentSpentVoiceCreditSubtotalSalt;
+    // Spent voice credits per vote option.
+    signal input currentPerVoteOptionSpentVoiceCredits[totalVoteOptions];
+    // Salt for the root of spent credits per option.
+    signal input currentPerVoteOptionSpentVoiceCreditsRootSalt;
+    // Salt for the root of the new results.
+    signal input newResultsRootSalt;
+    // Salt for the new spent credits per vote option root.
+    signal input newPerVoteOptionSpentVoiceCreditsRootSalt;
+    // Salt for the new total spent voice credits root. 
+    signal input newSpentVoiceCreditSubtotalSalt;
+
+    // Verify sbCommitment.
+    var computedSbCommitment = PoseidonHasher(3)([stateRoot, ballotRoot, sbSalt]);
+    computedSbCommitment === sbCommitment;
+
+    // Validates that the index is within the valid range of sign-ups.
+    var totalSignupsValid = LessEqThan(50)([index, totalSignups]);
+    totalSignupsValid === 1;
+
+    // Hashes each ballot for subroot generation, and checks the existence of the leaf in the Merkle tree.    
+    var computedBallotHashers[ballotBatchSize];
+    var computedVoteCountsHashers[voteCountsBatchSize];
+    
+    for (var i = 0; i < ballotBatchSize; i++) {
+        computedBallotHashers[i] = PoseidonHasher(2)([
+            ballots[i][BALLOT_NONCE_INDEX],
+            ballots[i][BALLOT_VOTE_OPTION_ROOT_INDEX]
+        ]);
+    }
+
+    for (var i = 0; i < voteCountsBatchSize; i++) {
+        computedVoteCountsHashers[i] = PoseidonHasher(2)([
+            voteCounts[i][VOTE_COUNTS_NONCE_INDEX],
+            voteCounts[i][VOTE_COUNTS_ROOT_INDEX]
+        ]);
+    }
+
+    var computedBallotSubroot = CheckRoot(tallyProcessingStateTreeDepth)(computedBallotHashers);
+    var computedBallotPathIndices[STATE_TREE_DEPTH_DIFFERENCE] = Num2Bits(STATE_TREE_DEPTH_DIFFERENCE)(index / ballotBatchSize);
+
+    var computedVoteCountsSubroot = CheckRoot(tallyProcessingStateTreeDepth)(computedVoteCountsHashers);
+    var computedVoteCountsPathIndices[STATE_TREE_DEPTH_DIFFERENCE] = Num2Bits(STATE_TREE_DEPTH_DIFFERENCE)(index / voteCountsBatchSize);
+
+    // Verifies each ballot's existence within the ballot tree.
+    LeafExists(STATE_TREE_DEPTH_DIFFERENCE)(
+        computedBallotSubroot,
+        ballotPathElements,
+        computedBallotPathIndices,
+        ballotRoot
+    );
+
+    // Verifies each vote count's existence within the vote count tree.
+    LeafExists(STATE_TREE_DEPTH_DIFFERENCE)(
+        computedVoteCountsSubroot,
+        voteCountsPathElements,
+        computedVoteCountsPathIndices,
+        voteCountsRoot
+    );
+
+    // Processes vote options, verifying each against its declared root.
+    var computedVoteTree[ballotBatchSize];
+
+    for (var i = 0; i < ballotBatchSize; i++) {
+        computedVoteTree[i] = QuinaryCheckRoot(voteOptionTreeDepth)(votes[i]);
+        computedVoteTree[i] === ballots[i][BALLOT_VOTE_OPTION_ROOT_INDEX];
+    }
+
+    // Processes vote counts, verifying each against its declared root.
+    var computedVoteCountsTree[voteCountsBatchSize];
+
+    for (var i = 0; i < voteCountsBatchSize; i++) {
+        computedVoteCountsTree[i] = QuinaryCheckRoot(voteOptionTreeDepth)(voteCountsData[i]);
+        computedVoteCountsTree[i] === voteCounts[i][VOTE_COUNTS_ROOT_INDEX];
+    }
+
+    // Calculates new results and spent voice credits based on the current and incoming votes.
+    var computedIsFirstBatch = IsZero()(index);
+    var computedIsZero = IsZero()(computedIsFirstBatch);
+
+    // Tally the new results.
+    var computedCalculateTotalResult[totalVoteOptions];
+    for (var i = 0; i < totalVoteOptions; i++) {
+        var numsRC[ballotBatchSize + 1];
+        numsRC[ballotBatchSize] = currentResults[i] * computedIsZero;
+        for (var j = 0; j < ballotBatchSize; j++) {
+            numsRC[j] = votes[j][i];
+        }
+
+        computedCalculateTotalResult[i] = CalculateTotal(ballotBatchSize + 1)(numsRC);
+    }
+
+    // Tally the new spent voice credit total.
+    var numsSVC[ballotBatchSize * totalVoteOptions + 1];
+    numsSVC[ballotBatchSize * totalVoteOptions] = currentSpentVoiceCreditSubtotal * computedIsZero;
+    for (var i = 0; i < ballotBatchSize; i++) {
+        for (var j = 0; j < totalVoteOptions; j++) {
+            numsSVC[i * totalVoteOptions + j] = votes[i][j] * votes[i][j];
+        }
+    }
+
+    var computedNewSpentVoiceCreditSubtotal = CalculateTotal(ballotBatchSize * totalVoteOptions + 1)(numsSVC);
+
+    // Tally the spent voice credits per vote option.
+    var computedNewPerVOSpentVoiceCredits[totalVoteOptions];
+
+    for (var i = 0; i < totalVoteOptions; i++) {
+        var computedTotalVoiceCreditSpent[ballotBatchSize + 1];
+        computedTotalVoiceCreditSpent[ballotBatchSize] = currentPerVoteOptionSpentVoiceCredits[i] * computedIsZero;
+        for (var j = 0; j < ballotBatchSize; j++) {
+            computedTotalVoiceCreditSpent[j] = votes[j][i] * votes[j][i];
+        }
+
+        computedNewPerVOSpentVoiceCredits[i] = CalculateTotal(ballotBatchSize + 1)(computedTotalVoiceCreditSpent);
+    }
+    
+    // Verifies the updated results and spent credits, ensuring consistency and correctness of tally updates.
+    ResultCommitmentVerifierQv(voteOptionTreeDepth)(
+        computedIsFirstBatch,
+        currentTallyCommitment,
+        newTallyCommitment,
+        currentResults,
+        currentResultsRootSalt,
+        computedCalculateTotalResult,
+        newResultsRootSalt,
+        currentSpentVoiceCreditSubtotal,
+        currentSpentVoiceCreditSubtotalSalt,
+        computedNewSpentVoiceCreditSubtotal,
+        newSpentVoiceCreditSubtotalSalt,
+        currentPerVoteOptionSpentVoiceCredits,
+        currentPerVoteOptionSpentVoiceCreditsRootSalt,
+        computedNewPerVOSpentVoiceCredits,
+        newPerVoteOptionSpentVoiceCreditsRootSalt        
+    );
+}

package/circom/utils/EdDSAPoseidonVerifier.circom

@@ -9,6 +9,7 @@ include "./escalarmulany.circom";
 include "./escalarmulfix.circom";
 // local imports
 include "./PoseidonHasher.circom";
+include "./IsOnCurve.circom";
 
 /**
  * Variant of the EdDSAPoseidonVerifier template from circomlib
@@ -37,9 +38,13 @@ template EdDSAPoseidonVerifier() {
     // Output signal for the validity of the signature.
     signal output isValid;
 
+    // Verify the public key and signature point are on the BabyJubJub curve.
+    var computedIsPkOnCurve = IsOnCurve()(publicKeyX, publicKeyY);
+    var computedIsSpOnCurve = IsOnCurve()(signaturePointX, signaturePointY);
+
     // Ensure signatureScalar<Subgroup Order.
     // convert the signature scalar signatureScalar into its binary representation.
-    var computedNum2Bits[254] = Num2Bits(254)(signatureScalar);
+    var computedNum2Bits[254] = Num2Bits_strict()(signatureScalar);
 
     var computedCompConstantIn[254] = computedNum2Bits;
     computedCompConstantIn[253] = 0;
@@ -82,10 +87,10 @@ template EdDSAPoseidonVerifier() {
     // Components to handle edge cases and ensure that all conditions 
     // for a valid signature are met, including the 
     // public key not being zero and other integrity checks.
-    var computedIsAxZero = IsZero()(publicKeyX);
+    var computedIsAxZero = IsZero()(computedDouble3XOut);
     var computedIsAxEqual = IsEqual()([computedIsAxZero, 0]);
     var computedIsCcZero = IsZero()(computedCompConstant);
-    var computedIsValid = IsEqual()([computedIsLeftRightValid + computedIsAxEqual + computedIsCcZero, 3]);
+    var computedIsValid = IsEqual()([computedIsLeftRightValid + computedIsAxEqual + computedIsCcZero + computedIsPkOnCurve + computedIsSpOnCurve, 5]);
 
     isValid <== computedIsValid;
 }

package/circom/utils/IsOnCurve.circom

@@ -0,0 +1,40 @@
+pragma circom 2.0.0;
+
+// zk-kit imports
+include "./comparators.circom";
+
+/**
+ * Returns 0 or 1 depending on if the point is on the BabyJubJub curve or not. The point is on the
+ * BabyJubJub curve if the following equation is true: a*x^2 + y^2 == 1 + d*x^2*y^2
+ * This template is identical to the BabyCheck template from circomlib, but it returns 0 or 1
+ * instead of having a hard constraint.
+ * Based on: https://github.com/iden3/circomlib/blob/master/circuits/babyjub.circom
+ */
+template IsOnCurve() {
+    // x coordinate of the point on the BabyJubJub curve.
+    signal input x;
+    // y coordinate of the point on the BabyJubJub curve.
+    signal input y;
+    // True when the point (x, y) satisfies the BabyJubJub curve equation.
+    signal output isValid;
+
+    // x^2 and y^2 intermediate values.
+    signal x2;
+    signal y2;
+    // x^2 * y^2 intermediate value.
+    signal x2y2;
+
+    // BabyJubJub curve parameters.
+    var a = 168700;
+    var d = 168696;
+
+    // Compute x^2 and y^2.
+    x2 <== x * x;
+    y2 <== y * y;
+
+    // Compute x^2 * y^2.
+    x2y2 <== x2 * y2;
+
+    // Check if a*x^2 + y^2 == 1 + d*x^2*y^2.
+    isValid <== IsEqual()([a * x2 + y2, 1 + d * x2y2]);
+}

package/circom/utils/full/StateLeafAndBallotTransformer.circom

@@ -119,4 +119,9 @@ template StateLeafAndBallotTransformerFull() {
     isValid <== computedIsValid;
     isStateLeafIndexValid <== computedIsStateLeafIndexValid;
     isVoteOptionIndexValid <== computedIsVoteOptionIndexValid;
+
+    // Constrain commandPollId and commandSalt using dummy squares.
+    // This binds the proof to a specific poll and salt.
+    signal commandPollIdSquare <== commandPollId * commandPollId;
+    signal commandSaltSquared <== commandSalt * commandSalt;
 }

package/circom/utils/non-qv/ResultCommitmentVerifier.circom

@@ -0,0 +1,84 @@
+pragma circom 2.0.0;
+
+// circomlib import
+include "./comparators.circom";
+// local imports
+include "../trees/QuinaryCheckRoot.circom";
+include "../PoseidonHasher.circom";
+
+/**
+ * Performs verifications and computations related to current voting results. 
+ * Also, computes and outputs a commitment to the new results.
+ * This template does not support Quadratic Voting (QV).
+ */
+ template ResultCommitmentVerifierNonQv(voteOptionTreeDepth) {
+    // Number of children per node in the tree, defining the tree's branching factor.
+    var TREE_ARITY = 5;
+    // Number of voting options available, determined by the depth of the vote option tree.
+    var totalVoteOptions = TREE_ARITY ** voteOptionTreeDepth;
+
+    // Equal to 1 if this is the first batch, otherwise 0.
+    signal input isFirstBatch;
+    // Commitment to the current tally before this batch.
+    signal input currentTallyCommitment;
+    // Commitment to the new tally after processing this batch.
+    signal input newTallyCommitment;
+
+    // Current results for each vote option.
+    signal input currentResults[totalVoteOptions];
+    // Salt for the root of the current results.
+    signal input currentResultsRootSalt;
+
+    // New results for each vote option.
+    signal input newResults[totalVoteOptions];
+    // Salt for the root of the new results.
+    signal input newResultsRootSalt;
+
+    // Total voice credits spent so far.
+    signal input currentSpentVoiceCreditSubtotal;
+    // Salt for the total spent voice credits.
+    signal input currentSpentVoiceCreditSubtotalSalt;
+
+    // Total new voice credits spent.
+    signal input newSpentVoiceCreditSubtotal;
+    // Salt for the new total spent voice credits.
+    signal input newSpentVoiceCreditSubtotalSalt;
+
+    // Compute the commitment to the current results.
+    var computedCurrentResultsRoot = QuinaryCheckRoot(voteOptionTreeDepth)(currentResults);
+
+    // Verify currentResultsCommitmentHash.
+    var computedCurrentResultsCommitment = PoseidonHasher(2)([computedCurrentResultsRoot, currentResultsRootSalt]);
+
+    // Compute the commitment to the current spent voice credits.
+    var computedCurrentSpentVoiceCreditsCommitment = PoseidonHasher(2)([currentSpentVoiceCreditSubtotal, currentSpentVoiceCreditSubtotalSalt]);
+
+    // Commit to the current tally
+    var computedCurrentTallyCommitment = PoseidonHasher(2)([computedCurrentResultsCommitment, computedCurrentSpentVoiceCreditsCommitment]);
+
+    // Check if the current tally commitment is correct only if this is not the first batch.
+    // computedIsZero.out is 1 if this is not the first batch.
+    // computedIsZero.out is 0 if this is the first batch.
+    var computedIsZero = IsZero()(isFirstBatch);
+
+    // isFirstCommitment is 0 if this is the first batch, currentTallyCommitment should be 0 if this is the first batch.
+    // isFirstCommitment is 1 if this is not the first batch, currentTallyCommitment should not be 0 if this is the first batch.
+    signal isFirstCommitment;
+    isFirstCommitment <== computedIsZero * computedCurrentTallyCommitment;
+    isFirstCommitment === currentTallyCommitment;
+
+    // Compute the root of the new results.
+    var computedNewResultsRoot = QuinaryCheckRoot(voteOptionTreeDepth)(newResults);
+    var computedNewResultsCommitment = PoseidonHasher(2)([computedNewResultsRoot, newResultsRootSalt]);
+
+    // Compute the commitment to the new spent voice credits value.
+    var computedNewSpentVoiceCreditsCommitment = PoseidonHasher(2)([newSpentVoiceCreditSubtotal, newSpentVoiceCreditSubtotalSalt]);
+
+    // Commit to the new tally.
+    var computedNewTallyCommitment = PoseidonHasher(2)([
+        computedNewResultsCommitment,
+        computedNewSpentVoiceCreditsCommitment
+    ]);
+    
+    computedNewTallyCommitment === newTallyCommitment;
+}

package/circom/utils/non-qv/StateLeafAndBallotTransformer.circom

@@ -102,4 +102,9 @@ template StateLeafAndBallotTransformerNonQv() {
     isValid <== computedIsValid;
     isStateLeafIndexValid <== computedIsStateLeafIndexValid;
     isVoteOptionIndexValid <== computedIsVoteOptionIndexValid;
+
+    // Constrain commandPollId and commandSalt using dummy squares.
+    // This binds the proof to a specific poll and salt.
+    signal commandPollIdSquare <== commandPollId * commandPollId;
+    signal commandSaltSquared <== commandSalt * commandSalt;
 }

package/circom/utils/qv/ResultCommitmentVerifier.circom

@@ -0,0 +1,107 @@
+pragma circom 2.0.0;
+
+// circomlib import
+include "./comparators.circom";
+// local imports
+include "../trees/QuinaryCheckRoot.circom";
+include "../PoseidonHasher.circom";
+
+/** 
+ * Performs verifications and computations related to current voting results. 
+ * Also, computes and outputs a commitment to the new results.
+ * This template supports the Quadratic Voting (QV).
+ */
+template ResultCommitmentVerifierQv(voteOptionTreeDepth) {
+    // Number of children per node in the tree, defining the tree's branching factor.
+    var TREE_ARITY = 5;
+    // Number of voting options available, determined by the depth of the vote option tree.
+    var totalVoteOptions = TREE_ARITY ** voteOptionTreeDepth;
+
+    // Equal to 1 if this is the first batch, otherwise 0.
+    signal input isFirstBatch;
+    // Commitment to the current tally before this batch.
+    signal input currentTallyCommitment;
+    // Commitment to the new tally after processing this batch.
+    signal input newTallyCommitment;
+
+    // Current results for each vote option.
+    signal input currentResults[totalVoteOptions];
+    // Salt for the root of the current results.
+    signal input currentResultsRootSalt;
+
+    // New results for each vote option.
+    signal input newResults[totalVoteOptions];
+    // Salt for the root of the new results.
+    signal input newResultsRootSalt;
+
+    // Total voice credits spent so far.
+    signal input currentSpentVoiceCreditSubtotal;
+    // Salt for the total spent voice credits.
+    signal input currentSpentVoiceCreditSubtotalSalt;
+
+    // Total new voice credits spent.
+    signal input newSpentVoiceCreditSubtotal;
+    // Salt for the new total spent voice credits.
+    signal input newSpentVoiceCreditSubtotalSalt;
+
+    // Spent voice credits per vote option.
+    signal input currentPerVoteOptionSpentVoiceCredits[totalVoteOptions];
+    // Salt for the root of spent credits per option.
+    signal input currentPerVoteOptionSpentVoiceCreditsRootSalt;
+
+    // New spent voice credits per vote option.
+    signal input newPerVoteOptionSpentVoiceCredits[totalVoteOptions];
+    // Salt for the root of new spent credits per option.
+    signal input newPerVoteOptionSpentVoiceCreditsRootSalt;
+
+    // Compute the commitment to the current results.
+    var computedCurrentResultsRoot = QuinaryCheckRoot(voteOptionTreeDepth)(currentResults);
+
+    // Verify currentResultsCommitmentHash.
+    var computedCurrentResultsCommitment = PoseidonHasher(2)([computedCurrentResultsRoot, currentResultsRootSalt]);
+
+    // Compute the commitment to the current spent voice credits.
+    var computedCurrentSpentVoiceCreditsCommitment = PoseidonHasher(2)([currentSpentVoiceCreditSubtotal, currentSpentVoiceCreditSubtotalSalt]);
+
+    // Compute the root of the spent voice credits per vote option.
+    var computedCurrentPerVoteOptionSpentVoiceCreditsRoot = QuinaryCheckRoot(voteOptionTreeDepth)(currentPerVoteOptionSpentVoiceCredits);
+    var computedCurrentPerVoteOptionSpentVoiceCreditsCommitment = PoseidonHasher(2)([computedCurrentPerVoteOptionSpentVoiceCreditsRoot, currentPerVoteOptionSpentVoiceCreditsRootSalt]);
+
+    // Commit to the current tally.
+    var computedCurrentTallyCommitment = PoseidonHasher(3)([
+        computedCurrentResultsCommitment, 
+        computedCurrentSpentVoiceCreditsCommitment, 
+        computedCurrentPerVoteOptionSpentVoiceCreditsCommitment
+    ]);
+
+    // Check if the current tally commitment is correct only if this is not the first batch.
+    // computedIsZero.out is 1 if this is not the first batch.
+    // computedIsZero.out is 0 if this is the first batch.
+    var computedIsZero = IsZero()(isFirstBatch);
+
+    // isFirstCommitment is 0 if this is the first batch, currentTallyCommitment should be 0 if this is the first batch.
+    // isFirstCommitment is 1 if this is not the first batch, currentTallyCommitment should not be 0 if this is the first batch.
+    signal isFirstCommitment;
+    isFirstCommitment <== computedIsZero * computedCurrentTallyCommitment;
+    isFirstCommitment === currentTallyCommitment;
+
+    // Compute the root of the new results.
+    var computedNewResultsRoot = QuinaryCheckRoot(voteOptionTreeDepth)(newResults);
+    var computedNewResultsCommitment = PoseidonHasher(2)([computedNewResultsRoot, newResultsRootSalt]);
+
+    // Compute the commitment to the new spent voice credits value.
+    var computedNewSpentVoiceCreditsCommitment = PoseidonHasher(2)([newSpentVoiceCreditSubtotal, newSpentVoiceCreditSubtotalSalt]);
+
+    // Compute the root of the spent voice credits per vote option.
+    var computedNewPerVoteOptionSpentVoiceCreditsRoot = QuinaryCheckRoot(voteOptionTreeDepth)(newPerVoteOptionSpentVoiceCredits);
+    var computedNewPerVoteOptionSpentVoiceCreditsCommitment = PoseidonHasher(2)([computedNewPerVoteOptionSpentVoiceCreditsRoot, newPerVoteOptionSpentVoiceCreditsRootSalt]);
+
+    // Commit to the new tally.
+    var computedNewTallyCommitment = PoseidonHasher(3)([
+        computedNewResultsCommitment,
+        computedNewSpentVoiceCreditsCommitment,
+        computedNewPerVoteOptionSpentVoiceCreditsCommitment
+    ]);
+    
+    computedNewTallyCommitment === newTallyCommitment;
+}

package/circom/utils/qv/StateLeafAndBallotTransformer.circom

@@ -102,4 +102,9 @@ template StateLeafAndBallotTransformer() {
     isValid <== computedIsValid;
     isStateLeafIndexValid <== computedIsStateLeafIndexValid;
     isVoteOptionIndexValid <== computedIsVoteOptionIndexValid;
+
+    // Constrain commandPollId and commandSalt using dummy squares.
+    // This binds the proof to a specific poll and salt.
+    signal commandPollIdSquare <== commandPollId * commandPollId;
+    signal commandSaltSquared <== commandSalt * commandSalt;
 }