@semaphore-protocol/contracts 0.1.0

package/Semaphore.sol

@@ -0,0 +1,96 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.4;
+
+import "./interfaces/ISemaphore.sol";
+import "./interfaces/IVerifier.sol";
+import "./base/SemaphoreCore.sol";
+import "./base/SemaphoreGroups.sol";
+
+/// @title Semaphore
+contract Semaphore is ISemaphore, SemaphoreCore, SemaphoreGroups {
+  /// @dev Gets a tree depth and returns its verifier address.
+  mapping(uint8 => IVerifier) public verifiers;
+
+  /// @dev Gets a group id and returns the group admin address.
+  mapping(uint256 => address) public groupAdmins;
+
+  /// @dev Checks if the group admin is the transaction sender.
+  /// @param groupId: Id of the group.
+  modifier onlyGroupAdmin(uint256 groupId) {
+    require(groupAdmins[groupId] == _msgSender(), "Semaphore: caller is not the group admin");
+    _;
+  }
+
+  /// @dev Checks if there is a verifier for the given tree depth.
+  /// @param depth: Depth of the tree.
+  modifier onlySupportedDepth(uint8 depth) {
+    require(address(verifiers[depth]) != address(0), "Semaphore: tree depth is not supported");
+    _;
+  }
+
+  /// @dev Initializes the Semaphore verifiers used to verify the user's ZK proofs.
+  /// @param _verifiers: List of Semaphore verifiers (address and related Merkle tree depth).
+  constructor(Verifier[] memory _verifiers) {
+    for (uint8 i = 0; i < _verifiers.length; i++) {
+      verifiers[_verifiers[i].merkleTreeDepth] = IVerifier(_verifiers[i].contractAddress);
+    }
+  }
+
+  /// @dev See {ISemaphore-createGroup}.
+  function createGroup(
+    uint256 groupId,
+    uint8 depth,
+    uint256 zeroValue,
+    address admin
+  ) external override onlySupportedDepth(depth) {
+    _createGroup(groupId, depth, zeroValue);
+
+    groupAdmins[groupId] = admin;
+
+    emit GroupAdminUpdated(groupId, address(0), admin);
+  }
+
+  /// @dev See {ISemaphore-updateGroupAdmin}.
+  function updateGroupAdmin(uint256 groupId, address newAdmin) external override onlyGroupAdmin(groupId) {
+    groupAdmins[groupId] = newAdmin;
+
+    emit GroupAdminUpdated(groupId, _msgSender(), newAdmin);
+  }
+
+  /// @dev See {ISemaphore-addMember}.
+  function addMember(uint256 groupId, uint256 identityCommitment) external override onlyGroupAdmin(groupId) {
+    _addMember(groupId, identityCommitment);
+  }
+
+  /// @dev See {ISemaphore-removeMember}.
+  function removeMember(
+    uint256 groupId,
+    uint256 identityCommitment,
+    uint256[] calldata proofSiblings,
+    uint8[] calldata proofPathIndices
+  ) external override onlyGroupAdmin(groupId) {
+    _removeMember(groupId, identityCommitment, proofSiblings, proofPathIndices);
+  }
+
+  /// @dev See {ISemaphore-verifyProof}.
+  function verifyProof(
+    uint256 groupId,
+    bytes32 signal,
+    uint256 nullifierHash,
+    uint256 externalNullifier,
+    uint256[8] calldata proof
+  ) external override {
+    uint256 root = getRoot(groupId);
+    uint8 depth = getDepth(groupId);
+
+    require(depth != 0, "Semaphore: group does not exist");
+
+    IVerifier verifier = verifiers[depth];
+
+    _verifyProof(signal, root, nullifierHash, externalNullifier, proof, verifier);
+
+    _saveNullifierHash(nullifierHash);
+
+    emit ProofVerified(groupId, signal);
+  }
+}

package/base/SemaphoreConstants.sol

@@ -0,0 +1,4 @@
+//SPDX-License-Identifier: MIT
+pragma solidity ^0.8.4;
+
+uint256 constant SNARK_SCALAR_FIELD = 21888242871839275222246405745257275088548364400416034343698204186575808495617;

package/base/SemaphoreCore.sol

@@ -0,0 +1,59 @@
+//SPDX-License-Identifier: MIT
+pragma solidity ^0.8.4;
+
+import "../interfaces/ISemaphoreCore.sol";
+import "../interfaces/IVerifier.sol";
+
+/// @title Semaphore core contract.
+/// @notice Minimal code to allow users to signal their endorsement of an arbitrary string.
+/// @dev The following code verifies that the proof is correct and saves the hash of the
+/// nullifier to prevent double-signaling. External nullifier and Merkle trees (i.e. groups) must be
+/// managed externally.
+contract SemaphoreCore is ISemaphoreCore {
+  /// @dev Gets a nullifier hash and returns true or false.
+  /// It is used to prevent double-signaling.
+  mapping(uint256 => bool) internal nullifierHashes;
+
+  /// @dev Asserts that no nullifier already exists and if the zero-knowledge proof is valid.
+  /// Otherwise it reverts.
+  /// @param signal: Semaphore signal.
+  /// @param root: Root of the Merkle tree.
+  /// @param nullifierHash: Nullifier hash.
+  /// @param externalNullifier: External nullifier.
+  /// @param proof: Zero-knowledge proof.
+  /// @param verifier: Verifier address.
+  function _verifyProof(
+    bytes32 signal,
+    uint256 root,
+    uint256 nullifierHash,
+    uint256 externalNullifier,
+    uint256[8] calldata proof,
+    IVerifier verifier
+  ) internal view {
+    require(!nullifierHashes[nullifierHash], "SemaphoreCore: you cannot use the same nullifier twice");
+
+    uint256 signalHash = _hashSignal(signal);
+
+    verifier.verifyProof(
+      [proof[0], proof[1]],
+      [[proof[2], proof[3]], [proof[4], proof[5]]],
+      [proof[6], proof[7]],
+      [root, nullifierHash, signalHash, externalNullifier]
+    );
+  }
+
+  /// @dev Stores the nullifier hash to prevent double-signaling.
+  /// Attention! Remember to call it when you verify a proof if you
+  /// need to prevent double-signaling.
+  /// @param nullifierHash: Semaphore nullifier hash.
+  function _saveNullifierHash(uint256 nullifierHash) internal {
+    nullifierHashes[nullifierHash] = true;
+  }
+
+  /// @dev Creates a keccak256 hash of the signal.
+  /// @param signal: Semaphore signal.
+  /// @return Hash of the signal.
+  function _hashSignal(bytes32 signal) private pure returns (uint256) {
+    return uint256(keccak256(abi.encodePacked(signal))) >> 8;
+  }
+}

package/base/SemaphoreGroups.sol

@@ -0,0 +1,83 @@
+//SPDX-License-Identifier: MIT
+pragma solidity ^0.8.4;
+
+import {SNARK_SCALAR_FIELD} from "./SemaphoreConstants.sol";
+import "../interfaces/ISemaphoreGroups.sol";
+import "@zk-kit/incremental-merkle-tree.sol/contracts/IncrementalBinaryTree.sol";
+import "@openzeppelin/contracts/utils/Context.sol";
+
+/// @title Semaphore groups contract.
+/// @dev The following code allows you to create groups, add and remove members.
+/// You can use getters to obtain informations about groups (root, depth, number of leaves).
+abstract contract SemaphoreGroups is Context, ISemaphoreGroups {
+  using IncrementalBinaryTree for IncrementalTreeData;
+
+  /// @dev Gets a group id and returns the group/tree data.
+  mapping(uint256 => IncrementalTreeData) internal groups;
+
+  /// @dev Creates a new group by initializing the associated tree.
+  /// @param groupId: Id of the group.
+  /// @param depth: Depth of the tree.
+  /// @param zeroValue: Zero value of the tree.
+  function _createGroup(
+    uint256 groupId,
+    uint8 depth,
+    uint256 zeroValue
+  ) internal virtual {
+    require(groupId < SNARK_SCALAR_FIELD, "SemaphoreGroups: group id must be < SNARK_SCALAR_FIELD");
+    require(getDepth(groupId) == 0, "SemaphoreGroups: group already exists");
+
+    groups[groupId].init(depth, zeroValue);
+
+    emit GroupCreated(groupId, depth, zeroValue);
+  }
+
+  /// @dev Adds an identity commitment to an existing group.
+  /// @param groupId: Id of the group.
+  /// @param identityCommitment: New identity commitment.
+  function _addMember(uint256 groupId, uint256 identityCommitment) internal virtual {
+    require(getDepth(groupId) != 0, "SemaphoreGroups: group does not exist");
+
+    groups[groupId].insert(identityCommitment);
+
+    uint256 root = getRoot(groupId);
+
+    emit MemberAdded(groupId, identityCommitment, root);
+  }
+
+  /// @dev Removes an identity commitment from an existing group. A proof of membership is
+  /// needed to check if the node to be deleted is part of the tree.
+  /// @param groupId: Id of the group.
+  /// @param identityCommitment: Existing identity commitment to be deleted.
+  /// @param proofSiblings: Array of the sibling nodes of the proof of membership.
+  /// @param proofPathIndices: Path of the proof of membership.
+  function _removeMember(
+    uint256 groupId,
+    uint256 identityCommitment,
+    uint256[] calldata proofSiblings,
+    uint8[] calldata proofPathIndices
+  ) internal virtual {
+    require(getDepth(groupId) != 0, "SemaphoreGroups: group does not exist");
+
+    groups[groupId].remove(identityCommitment, proofSiblings, proofPathIndices);
+
+    uint256 root = getRoot(groupId);
+
+    emit MemberRemoved(groupId, identityCommitment, root);
+  }
+
+  /// @dev See {ISemaphoreGroups-getRoot}.
+  function getRoot(uint256 groupId) public view virtual override returns (uint256) {
+    return groups[groupId].root;
+  }
+
+  /// @dev See {ISemaphoreGroups-getDepth}.
+  function getDepth(uint256 groupId) public view virtual override returns (uint8) {
+    return groups[groupId].depth;
+  }
+
+  /// @dev See {ISemaphoreGroups-getNumberOfLeaves}.
+  function getNumberOfLeaves(uint256 groupId) public view virtual override returns (uint256) {
+    return groups[groupId].numberOfLeaves;
+  }
+}

package/base/Verifier.sol

@@ -0,0 +1,250 @@
+//
+// Copyright 2017 Christian Reitwiessner
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+// 2019 OKIMS
+//      ported to solidity 0.6
+//      fixed linter warnings
+//      added requiere error messages
+//
+// 2021 Remco Bloemen
+//       cleaned up code
+//       added InvalidProve() error
+//       always revert with InvalidProof() on invalid proof
+//       make Pairing strict
+//
+// SPDX-License-Identifier: GPL-3.0
+pragma solidity ^0.8.4;
+
+library Pairing {
+  error InvalidProof();
+
+  // The prime q in the base field F_q for G1
+  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
+
+  // The prime moludus of the scalar field of G1.
+  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
+
+  struct G1Point {
+    uint256 X;
+    uint256 Y;
+  }
+
+  // Encoding of field elements is: X[0] * z + X[1]
+  struct G2Point {
+    uint256[2] X;
+    uint256[2] Y;
+  }
+
+  /// @return the generator of G1
+  function P1() internal pure returns (G1Point memory) {
+    return G1Point(1, 2);
+  }
+
+  /// @return the generator of G2
+  function P2() internal pure returns (G2Point memory) {
+    return
+      G2Point(
+        [
+          11559732032986387107991004021392285783925812861821192530917403151452391805634,
+          10857046999023057135944570762232829481370756359578518086990519993285655852781
+        ],
+        [
+          4082367875863433681332203403145435568316851327593401208105741076214120093531,
+          8495653923123431417604973247489272438418190587263600148770280649306958101930
+        ]
+      );
+  }
+
+  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
+  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
+    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
+    // Validate input or revert
+    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
+    // We know p.Y > 0 and p.Y < BASE_MODULUS.
+    return G1Point(p.X, BASE_MODULUS - p.Y);
+  }
+
+  /// @return r the sum of two points of G1
+  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
+    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
+    // on the curve.
+    uint256[4] memory input;
+    input[0] = p1.X;
+    input[1] = p1.Y;
+    input[2] = p2.X;
+    input[3] = p2.Y;
+    bool success;
+    // solium-disable-next-line security/no-inline-assembly
+    assembly {
+      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
+    }
+    if (!success) revert InvalidProof();
+  }
+
+  /// @return r the product of a point on G1 and a scalar, i.e.
+  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
+  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
+    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
+    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
+    if (s >= SCALAR_MODULUS) revert InvalidProof();
+    uint256[3] memory input;
+    input[0] = p.X;
+    input[1] = p.Y;
+    input[2] = s;
+    bool success;
+    // solium-disable-next-line security/no-inline-assembly
+    assembly {
+      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
+    }
+    if (!success) revert InvalidProof();
+  }
+
+  /// Asserts the pairing check
+  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
+  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
+  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
+    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
+    // respective groups of the right order.
+    if (p1.length != p2.length) revert InvalidProof();
+    uint256 elements = p1.length;
+    uint256 inputSize = elements * 6;
+    uint256[] memory input = new uint256[](inputSize);
+    for (uint256 i = 0; i < elements; i++) {
+      input[i * 6 + 0] = p1[i].X;
+      input[i * 6 + 1] = p1[i].Y;
+      input[i * 6 + 2] = p2[i].X[0];
+      input[i * 6 + 3] = p2[i].X[1];
+      input[i * 6 + 4] = p2[i].Y[0];
+      input[i * 6 + 5] = p2[i].Y[1];
+    }
+    uint256[1] memory out;
+    bool success;
+    // solium-disable-next-line security/no-inline-assembly
+    assembly {
+      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
+    }
+    if (!success || out[0] != 1) revert InvalidProof();
+  }
+}
+
+contract Verifier {
+  using Pairing for *;
+
+  struct VerifyingKey {
+    Pairing.G1Point alfa1;
+    Pairing.G2Point beta2;
+    Pairing.G2Point gamma2;
+    Pairing.G2Point delta2;
+    Pairing.G1Point[] IC;
+  }
+
+  struct Proof {
+    Pairing.G1Point A;
+    Pairing.G2Point B;
+    Pairing.G1Point C;
+  }
+
+  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
+    vk.alfa1 = Pairing.G1Point(
+      20491192805390485299153009773594534940189261866228447918068658471970481763042,
+      9383485363053290200918347156157836566562967994039712273449902621266178545958
+    );
+
+    vk.beta2 = Pairing.G2Point(
+      [
+        4252822878758300859123897981450591353533073413197771768651442665752259397132,
+        6375614351688725206403948262868962793625744043794305715222011528459656738731
+      ],
+      [
+        21847035105528745403288232691147584728191162732299865338377159692350059136679,
+        10505242626370262277552901082094356697409835680220590971873171140371331206856
+      ]
+    );
+    vk.gamma2 = Pairing.G2Point(
+      [
+        11559732032986387107991004021392285783925812861821192530917403151452391805634,
+        10857046999023057135944570762232829481370756359578518086990519993285655852781
+      ],
+      [
+        4082367875863433681332203403145435568316851327593401208105741076214120093531,
+        8495653923123431417604973247489272438418190587263600148770280649306958101930
+      ]
+    );
+    vk.delta2 = Pairing.G2Point(
+      [
+        12599857379517512478445603412764121041984228075771497593287716170335433683702,
+        7912208710313447447762395792098481825752520616755888860068004689933335666613
+      ],
+      [
+        11502426145685875357967720478366491326865907869902181704031346886834786027007,
+        21679208693936337484429571887537508926366191105267550375038502782696042114705
+      ]
+    );
+    vk.IC = new Pairing.G1Point[](5);
+
+    vk.IC[0] = Pairing.G1Point(
+      19918517214839406678907482305035208173510172567546071380302965459737278553528,
+      7151186077716310064777520690144511885696297127165278362082219441732663131220
+    );
+
+    vk.IC[1] = Pairing.G1Point(
+      690581125971423619528508316402701520070153774868732534279095503611995849608,
+      21271996888576045810415843612869789314680408477068973024786458305950370465558
+    );
+
+    vk.IC[2] = Pairing.G1Point(
+      16461282535702132833442937829027913110152135149151199860671943445720775371319,
+      2814052162479976678403678512565563275428791320557060777323643795017729081887
+    );
+
+    vk.IC[3] = Pairing.G1Point(
+      4319780315499060392574138782191013129592543766464046592208884866569377437627,
+      13920930439395002698339449999482247728129484070642079851312682993555105218086
+    );
+
+    vk.IC[4] = Pairing.G1Point(
+      3554830803181375418665292545416227334138838284686406179598687755626325482686,
+      5951609174746846070367113593675211691311013364421437923470787371738135276998
+    );
+  }
+
+  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
+  function verifyProof(
+    uint256[2] memory a,
+    uint256[2][2] memory b,
+    uint256[2] memory c,
+    uint256[4] memory input
+  ) public view {
+    // If the values are not in the correct range, the Pairing contract will revert.
+    Proof memory proof;
+    proof.A = Pairing.G1Point(a[0], a[1]);
+    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
+    proof.C = Pairing.G1Point(c[0], c[1]);
+
+    VerifyingKey memory vk = verifyingKey();
+
+    // Compute the linear combination vk_x of inputs times IC
+    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
+    Pairing.G1Point memory vk_x = vk.IC[0];
+    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
+    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
+    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
+    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
+
+    // Check pairing
+    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
+    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
+    p1[0] = Pairing.negate(proof.A);
+    p2[0] = proof.B;
+    p1[1] = vk.alfa1;
+    p2[1] = vk.beta2;
+    p1[2] = vk_x;
+    p2[2] = vk.gamma2;
+    p1[3] = proof.C;
+    p2[3] = vk.delta2;
+    Pairing.pairingCheck(p1, p2);
+  }
+}

package/extensions/SemaphoreVoting.sol

@@ -0,0 +1,107 @@
+//SPDX-License-Identifier: MIT
+pragma solidity ^0.8.4;
+
+import "../interfaces/ISemaphoreVoting.sol";
+import "../base/SemaphoreCore.sol";
+import "../base/SemaphoreGroups.sol";
+
+/// @title Semaphore voting contract.
+/// @dev The following code allows you to create polls, add voters and allow them to vote anonymously.
+contract SemaphoreVoting is ISemaphoreVoting, SemaphoreCore, SemaphoreGroups {
+  /// @dev Gets a tree depth and returns its verifier address.
+  mapping(uint8 => IVerifier) internal verifiers;
+
+  /// @dev Gets a poll id and returns the poll data.
+  mapping(uint256 => Poll) internal polls;
+
+  /// @dev Since there can be multiple verifier contracts (each associated with a certain tree depth),
+  /// it is necessary to pass the addresses of the previously deployed contracts with the associated
+  /// tree depth. Depending on the depth chosen when creating the poll, a certain verifier will be
+  /// used to verify that the proof is correct.
+  /// @param depths: Three depths used in verifiers.
+  /// @param verifierAddresses: Verifier addresses.
+  constructor(uint8[] memory depths, address[] memory verifierAddresses) {
+    require(
+      depths.length == verifierAddresses.length,
+      "SemaphoreVoting: parameters lists does not have the same length"
+    );
+
+    for (uint8 i = 0; i < depths.length; i++) {
+      verifiers[depths[i]] = IVerifier(verifierAddresses[i]);
+    }
+  }
+
+  /// @dev Checks if the poll coordinator is the transaction sender.
+  /// @param pollId: Id of the poll.
+  modifier onlyCoordinator(uint256 pollId) {
+    require(polls[pollId].coordinator == _msgSender(), "SemaphoreVoting: caller is not the poll coordinator");
+    _;
+  }
+
+  /// @dev See {ISemaphoreVoting-createPoll}.
+  function createPoll(
+    uint256 pollId,
+    address coordinator,
+    uint8 depth
+  ) public override {
+    require(address(verifiers[depth]) != address(0), "SemaphoreVoting: depth value is not supported");
+
+    _createGroup(pollId, depth, 0);
+
+    Poll memory poll;
+
+    poll.coordinator = coordinator;
+
+    polls[pollId] = poll;
+
+    emit PollCreated(pollId, coordinator);
+  }
+
+  /// @dev See {ISemaphoreVoting-addVoter}.
+  function addVoter(uint256 pollId, uint256 identityCommitment) public override onlyCoordinator(pollId) {
+    require(polls[pollId].state == PollState.Created, "SemaphoreVoting: voters can only be added before voting");
+
+    _addMember(pollId, identityCommitment);
+  }
+
+  /// @dev See {ISemaphoreVoting-addVoter}.
+  function startPoll(uint256 pollId, uint256 encryptionKey) public override onlyCoordinator(pollId) {
+    require(polls[pollId].state == PollState.Created, "SemaphoreVoting: poll has already been started");
+
+    polls[pollId].state = PollState.Ongoing;
+
+    emit PollStarted(pollId, _msgSender(), encryptionKey);
+  }
+
+  /// @dev See {ISemaphoreVoting-castVote}.
+  function castVote(
+    bytes32 vote,
+    uint256 nullifierHash,
+    uint256 pollId,
+    uint256[8] calldata proof
+  ) public override onlyCoordinator(pollId) {
+    Poll memory poll = polls[pollId];
+
+    require(poll.state == PollState.Ongoing, "SemaphoreVoting: vote can only be cast in an ongoing poll");
+
+    uint8 depth = getDepth(pollId);
+    uint256 root = getRoot(pollId);
+    IVerifier verifier = verifiers[depth];
+
+    _verifyProof(vote, root, nullifierHash, pollId, proof, verifier);
+
+    // Prevent double-voting (nullifierHash = hash(pollId + identityNullifier)).
+    _saveNullifierHash(nullifierHash);
+
+    emit VoteAdded(pollId, vote);
+  }
+
+  /// @dev See {ISemaphoreVoting-publishDecryptionKey}.
+  function endPoll(uint256 pollId, uint256 decryptionKey) public override onlyCoordinator(pollId) {
+    require(polls[pollId].state == PollState.Ongoing, "SemaphoreVoting: poll is not ongoing");
+
+    polls[pollId].state = PollState.Ended;
+
+    emit PollEnded(pollId, _msgSender(), decryptionKey);
+  }
+}

package/extensions/SemaphoreWhistleblowing.sol

@@ -0,0 +1,88 @@
+//SPDX-License-Identifier: MIT
+pragma solidity ^0.8.4;
+
+import "../interfaces/ISemaphoreWhistleblowing.sol";
+import "../base/SemaphoreCore.sol";
+import "../base/SemaphoreGroups.sol";
+
+/// @title Semaphore whistleblowing contract.
+/// @dev The following code allows you to create entities for whistleblowers (e.g. non-profit
+/// organization, newspaper) and to allow them to publish news leaks anonymously.
+/// Leaks can be IPFS hashes, permanent links or other kinds of reference.
+contract SemaphoreWhistleblowing is ISemaphoreWhistleblowing, SemaphoreCore, SemaphoreGroups {
+  /// @dev Gets a tree depth and returns its verifier address.
+  mapping(uint8 => IVerifier) internal verifiers;
+
+  /// @dev Gets an editor address and return their entity.
+  mapping(address => uint256) private entities;
+
+  /// @dev Since there can be multiple verifier contracts (each associated with a certain tree depth),
+  /// it is necessary to pass the addresses of the previously deployed contracts with the associated
+  /// tree depth. Depending on the depth chosen when creating the entity, a certain verifier will be
+  /// used to verify that the proof is correct.
+  /// @param depths: Three depths used in verifiers.
+  /// @param verifierAddresses: Verifier addresses.
+  constructor(uint8[] memory depths, address[] memory verifierAddresses) {
+    require(
+      depths.length == verifierAddresses.length,
+      "SemaphoreWhistleblowing: parameters lists does not have the same length"
+    );
+
+    for (uint8 i = 0; i < depths.length; i++) {
+      verifiers[depths[i]] = IVerifier(verifierAddresses[i]);
+    }
+  }
+
+  /// @dev Checks if the editor is the transaction sender.
+  /// @param entityId: Id of the entity.
+  modifier onlyEditor(uint256 entityId) {
+    require(entityId == entities[_msgSender()], "SemaphoreWhistleblowing: caller is not the editor");
+    _;
+  }
+
+  /// @dev See {ISemaphoreWhistleblowing-createEntity}.
+  function createEntity(
+    uint256 entityId,
+    address editor,
+    uint8 depth
+  ) public override {
+    require(address(verifiers[depth]) != address(0), "SemaphoreWhistleblowing: depth value is not supported");
+
+    _createGroup(entityId, depth, 0);
+
+    entities[editor] = entityId;
+
+    emit EntityCreated(entityId, editor);
+  }
+
+  /// @dev See {ISemaphoreWhistleblowing-addWhistleblower}.
+  function addWhistleblower(uint256 entityId, uint256 identityCommitment) public override onlyEditor(entityId) {
+    _addMember(entityId, identityCommitment);
+  }
+
+  /// @dev See {ISemaphoreWhistleblowing-removeWhistleblower}.
+  function removeWhistleblower(
+    uint256 entityId,
+    uint256 identityCommitment,
+    uint256[] calldata proofSiblings,
+    uint8[] calldata proofPathIndices
+  ) public override onlyEditor(entityId) {
+    _removeMember(entityId, identityCommitment, proofSiblings, proofPathIndices);
+  }
+
+  /// @dev See {ISemaphoreWhistleblowing-publishLeak}.
+  function publishLeak(
+    bytes32 leak,
+    uint256 nullifierHash,
+    uint256 entityId,
+    uint256[8] calldata proof
+  ) public override onlyEditor(entityId) {
+    uint8 depth = getDepth(entityId);
+    uint256 root = getRoot(entityId);
+    IVerifier verifier = verifiers[depth];
+
+    _verifyProof(leak, root, nullifierHash, entityId, proof, verifier);
+
+    emit LeakPublished(entityId, leak);
+  }
+}

package/interfaces/ISemaphore.sol

@@ -0,0 +1,72 @@
+//SPDX-License-Identifier: MIT
+pragma solidity ^0.8.4;
+
+/// @title Semaphore interface.
+/// @dev Interface of a Semaphore contract.
+interface ISemaphore {
+  struct Verifier {
+    address contractAddress;
+    uint8 merkleTreeDepth;
+  }
+
+  /// @dev Emitted when an admin is assigned to a group.
+  /// @param groupId: Id of the group.
+  /// @param oldAdmin: Old admin of the group.
+  /// @param newAdmin: New admin of the group.
+  event GroupAdminUpdated(uint256 indexed groupId, address indexed oldAdmin, address indexed newAdmin);
+
+  /// @dev Emitted when a Semaphore proof is verified.
+  /// @param groupId: Id of the group.
+  /// @param signal: Semaphore signal.
+  event ProofVerified(uint256 indexed groupId, bytes32 signal);
+
+  /// @dev Saves the nullifier hash to avoid double signaling and emits an event
+  /// if the zero-knowledge proof is valid.
+  /// @param groupId: Id of the group.
+  /// @param signal: Semaphore signal.
+  /// @param nullifierHash: Nullifier hash.
+  /// @param externalNullifier: External nullifier.
+  /// @param proof: Zero-knowledge proof.
+  function verifyProof(
+    uint256 groupId,
+    bytes32 signal,
+    uint256 nullifierHash,
+    uint256 externalNullifier,
+    uint256[8] calldata proof
+  ) external;
+
+  /// @dev Creates a new group. Only the admin will be able to add or remove members.
+  /// @param groupId: Id of the group.
+  /// @param depth: Depth of the tree.
+  /// @param zeroValue: Zero value of the tree.
+  /// @param admin: Admin of the group.
+  function createGroup(
+    uint256 groupId,
+    uint8 depth,
+    uint256 zeroValue,
+    address admin
+  ) external;
+
+  /// @dev Updates the group admin.
+  /// @param groupId: Id of the group.
+  /// @param newAdmin: New admin of the group.
+  function updateGroupAdmin(uint256 groupId, address newAdmin) external;
+
+  /// @dev Adds a new member to an existing group.
+  /// @param groupId: Id of the group.
+  /// @param identityCommitment: New identity commitment.
+  function addMember(uint256 groupId, uint256 identityCommitment) external;
+
+  /// @dev Removes a member from an existing group. A proof of membership is
+  /// needed to check if the node to be removed is part of the tree.
+  /// @param groupId: Id of the group.
+  /// @param identityCommitment: Identity commitment to be deleted.
+  /// @param proofSiblings: Array of the sibling nodes of the proof of membership.
+  /// @param proofPathIndices: Path of the proof of membership.
+  function removeMember(
+    uint256 groupId,
+    uint256 identityCommitment,
+    uint256[] calldata proofSiblings,
+    uint8[] calldata proofPathIndices
+  ) external;
+}

package/interfaces/ISemaphoreCore.sol

@@ -0,0 +1,10 @@
+//SPDX-License-Identifier: MIT
+pragma solidity ^0.8.4;
+
+/// @title SemaphoreCore interface.
+/// @dev Interface of SemaphoreCore contract.
+interface ISemaphoreCore {
+  /// @notice Emitted when a proof is verified correctly and a new nullifier hash is added.
+  /// @param nullifierHash: Hash of external and identity nullifiers.
+  event NullifierHashAdded(uint256 nullifierHash);
+}

package/interfaces/ISemaphoreGroups.sol

@@ -0,0 +1,39 @@
+//SPDX-License-Identifier: MIT
+pragma solidity ^0.8.4;
+
+/// @title SemaphoreGroups interface.
+/// @dev Interface of a SemaphoreGroups contract.
+interface ISemaphoreGroups {
+  /// @dev Emitted when a new group is created.
+  /// @param groupId: Id of the group.
+  /// @param depth: Depth of the tree.
+  /// @param zeroValue: Zero value of the tree.
+  event GroupCreated(uint256 indexed groupId, uint8 depth, uint256 zeroValue);
+
+  /// @dev Emitted when a new identity commitment is added.
+  /// @param groupId: Group id of the group.
+  /// @param identityCommitment: New identity commitment.
+  /// @param root: New root hash of the tree.
+  event MemberAdded(uint256 indexed groupId, uint256 identityCommitment, uint256 root);
+
+  /// @dev Emitted when a new identity commitment is removed.
+  /// @param groupId: Group id of the group.
+  /// @param identityCommitment: New identity commitment.
+  /// @param root: New root hash of the tree.
+  event MemberRemoved(uint256 indexed groupId, uint256 identityCommitment, uint256 root);
+
+  /// @dev Returns the last root hash of a group.
+  /// @param groupId: Id of the group.
+  /// @return Root hash of the group.
+  function getRoot(uint256 groupId) external view returns (uint256);
+
+  /// @dev Returns the depth of the tree of a group.
+  /// @param groupId: Id of the group.
+  /// @return Depth of the group tree.
+  function getDepth(uint256 groupId) external view returns (uint8);
+
+  /// @dev Returns the number of tree leaves of a group.
+  /// @param groupId: Id of the group.
+  /// @return Number of tree leaves.
+  function getNumberOfLeaves(uint256 groupId) external view returns (uint256);
+}

package/interfaces/ISemaphoreNullifiers.sol

@@ -0,0 +1,14 @@
+//SPDX-License-Identifier: MIT
+pragma solidity ^0.8.4;
+
+/// @title SemaphoreNullifiers interface.
+/// @dev Interface of SemaphoreNullifiers contract.
+interface ISemaphoreNullifiers {
+  /// @dev Emitted when a external nullifier is added.
+  /// @param externalNullifier: External Semaphore nullifier.
+  event ExternalNullifierAdded(uint256 externalNullifier);
+
+  /// @dev Emitted when a external nullifier is removed.
+  /// @param externalNullifier: External Semaphore nullifier.
+  event ExternalNullifierRemoved(uint256 externalNullifier);
+}

package/interfaces/ISemaphoreVoting.sol

@@ -0,0 +1,76 @@
+//SPDX-License-Identifier: MIT
+pragma solidity ^0.8.4;
+
+/// @title SemaphoreVoting interface.
+/// @dev Interface of SemaphoreVoting contract.
+interface ISemaphoreVoting {
+  enum PollState {
+    Created,
+    Ongoing,
+    Ended
+  }
+
+  struct Poll {
+    address coordinator;
+    PollState state;
+  }
+
+  /// @dev Emitted when a new poll is created.
+  /// @param pollId: Id of the poll.
+  /// @param coordinator: Coordinator of the poll.
+  event PollCreated(uint256 pollId, address indexed coordinator);
+
+  /// @dev Emitted when a poll is started.
+  /// @param pollId: Id of the poll.
+  /// @param coordinator: Coordinator of the poll.
+  /// @param encryptionKey: Key to encrypt the poll votes.
+  event PollStarted(uint256 pollId, address indexed coordinator, uint256 encryptionKey);
+
+  /// @dev Emitted when a user votes on a poll.
+  /// @param pollId: Id of the poll.
+  /// @param vote: User encrypted vote.
+  event VoteAdded(uint256 indexed pollId, bytes32 vote);
+
+  /// @dev Emitted when a poll is ended.
+  /// @param pollId: Id of the poll.
+  /// @param coordinator: Coordinator of the poll.
+  /// @param decryptionKey: Key to decrypt the poll votes.
+  event PollEnded(uint256 pollId, address indexed coordinator, uint256 decryptionKey);
+
+  /// @dev Creates a poll and the associated Merkle tree/group.
+  /// @param pollId: Id of the poll.
+  /// @param coordinator: Coordinator of the poll.
+  /// @param depth: Depth of the tree.
+  function createPoll(
+    uint256 pollId,
+    address coordinator,
+    uint8 depth
+  ) external;
+
+  /// @dev Adds a voter to a poll.
+  /// @param pollId: Id of the poll.
+  /// @param identityCommitment: Identity commitment of the group member.
+  function addVoter(uint256 pollId, uint256 identityCommitment) external;
+
+  /// @dev Starts a pull and publishes the key to encrypt the votes.
+  /// @param pollId: Id of the poll.
+  /// @param encryptionKey: Key to encrypt poll votes.
+  function startPoll(uint256 pollId, uint256 encryptionKey) external;
+
+  /// @dev Casts an anonymous vote in a poll.
+  /// @param vote: Encrypted vote.
+  /// @param nullifierHash: Nullifier hash.
+  /// @param pollId: Id of the poll.
+  /// @param proof: Private zk-proof parameters.
+  function castVote(
+    bytes32 vote,
+    uint256 nullifierHash,
+    uint256 pollId,
+    uint256[8] calldata proof
+  ) external;
+
+  /// @dev Ends a pull and publishes the key to decrypt the votes.
+  /// @param pollId: Id of the poll.
+  /// @param decryptionKey: Key to decrypt poll votes.
+  function endPoll(uint256 pollId, uint256 decryptionKey) external;
+}

package/interfaces/ISemaphoreWhistleblowing.sol

@@ -0,0 +1,55 @@
+//SPDX-License-Identifier: MIT
+pragma solidity ^0.8.4;
+
+/// @title SemaphoreWhistleblowing interface.
+/// @dev Interface of SemaphoreWhistleblowing contract.
+interface ISemaphoreWhistleblowing {
+  /// @dev Emitted when a new entity is created.
+  /// @param entityId: Id of the entity.
+  /// @param editor: Editor of the entity.
+  event EntityCreated(uint256 entityId, address indexed editor);
+
+  /// @dev Emitted when a whistleblower publish a new leak.
+  /// @param entityId: Id of the entity.
+  /// @param leak: News leak.
+  event LeakPublished(uint256 indexed entityId, bytes32 leak);
+
+  /// @dev Creates an entity and the associated Merkle tree/group.
+  /// @param entityId: Id of the entity.
+  /// @param editor: Editor of the entity.
+  /// @param depth: Depth of the tree.
+  function createEntity(
+    uint256 entityId,
+    address editor,
+    uint8 depth
+  ) external;
+
+  /// @dev Adds a whistleblower to an entity.
+  /// @param entityId: Id of the entity.
+  /// @param identityCommitment: Identity commitment of the group member.
+  function addWhistleblower(uint256 entityId, uint256 identityCommitment) external;
+
+  /// @dev Removes a whistleblower from an entity.
+  /// @param entityId: Id of the entity.
+  /// @param identityCommitment: Identity commitment of the group member.
+  /// @param proofSiblings: Array of the sibling nodes of the proof of membership.
+  /// @param proofPathIndices: Path of the proof of membership.
+  function removeWhistleblower(
+    uint256 entityId,
+    uint256 identityCommitment,
+    uint256[] calldata proofSiblings,
+    uint8[] calldata proofPathIndices
+  ) external;
+
+  /// @dev Allows whistleblowers to publish leaks anonymously.
+  /// @param leak: News leak.
+  /// @param nullifierHash: Nullifier hash.
+  /// @param entityId: Id of the entity.
+  /// @param proof: Private zk-proof parameters.
+  function publishLeak(
+    bytes32 leak,
+    uint256 nullifierHash,
+    uint256 entityId,
+    uint256[8] calldata proof
+  ) external;
+}

package/interfaces/IVerifier.sol

@@ -0,0 +1,13 @@
+//SPDX-License-Identifier: MIT
+pragma solidity ^0.8.4;
+
+/// @title Verifier interface.
+/// @dev Interface of Verifier contract.
+interface IVerifier {
+  function verifyProof(
+    uint256[2] memory a,
+    uint256[2][2] memory b,
+    uint256[2] memory c,
+    uint256[4] memory input
+  ) external view;
+}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@semaphore-protocol/contracts",
+  "version": "0.1.0",
+  "description": "A privacy gadget for creating anonymous proof of membership on Ethereum.",
+  "license": "MIT",
+  "files": [
+    "**/*.sol"
+  ],
+  "keywords": [
+    "blockchain",
+    "ethereum",
+    "hardhat",
+    "smart-contracts",
+    "semaphore",
+    "identity",
+    "solidity",
+    "zero-knowledge",
+    "zk-snarks",
+    "zero-knowledge-proofs",
+    "circom",
+    "proof-of-membership"
+  ],
+  "homepage": "https://github.com/appliedzkp/semaphore.git#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/appliedzkp/semaphore.git.git"
+  },
+  "bugs": {
+    "url": "https://github.com/appliedzkp/semaphore.git/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@openzeppelin/contracts": "^4.4.2",
+    "@zk-kit/incremental-merkle-tree.sol": "^0.3.1"
+  }
+}