@semaphore-protocol/contracts 3.15.1 → 4.0.0-alpha

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2022 Ethereum Foundation
+Copyright (c) 2024 Ethereum Foundation
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -40,7 +40,7 @@
     </h4>
 </div>
 
-To learn more about contracts visit [semaphore.pse.dev](https://semaphore.pse.dev/docs/technical-reference/contracts).
+To learn more about contracts visit [semaphore.pse.dev](https://docs.semaphore.pse.dev/technical-reference/contracts).
 
 ---
 
@@ -107,14 +107,14 @@ yarn deploy:semaphore --semaphoreVerifier <address>
 > **Note**  
 > Run `yarn deploy:semaphore --help` to see the complete list.
 
-If you want to deploy your contract in a specific network you can set up the `DEFAULT_NETWORK` variable in your `.env` file with the name of one of our supported networks (hardhat, localhost, goerli, arbitrum). Or you can specify it as an option:
+If you want to deploy your contract in a specific network you can set up the `DEFAULT_NETWORK` variable in your `.env` file with the name of one of our supported networks (hardhat, localhost, sepolia, arbitrum). Or you can specify it as an option:
 
 ```bash
-yarn deploy:semaphore --network goerli
 yarn deploy:semaphore --network sepolia
 yarn deploy:semaphore --network mumbai
-yarn deploy:semaphore --network optimism-goerli
+yarn deploy:semaphore --network optimism-sepolia
+yarn deploy:semaphore --network arbitrum-sepolia
 yarn deploy:semaphore --network arbitrum
 ```
 
-If you want to deploy contracts on Goerli or Arbitrum, remember to provide a valid private key and an Infura API in your `.env` file.
+If you want to deploy contracts on Sepolia or Arbitrum, remember to provide a valid private key and an Infura API in your `.env` file.

package/Semaphore.sol

@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: MIT
-pragma solidity 0.8.4;
+pragma solidity 0.8.23;
 
-import "./interfaces/ISemaphore.sol";
-import "./interfaces/ISemaphoreVerifier.sol";
-import "./base/SemaphoreGroups.sol";
+import {ISemaphore} from "./interfaces/ISemaphore.sol";
+import {ISemaphoreVerifier} from "./interfaces/ISemaphoreVerifier.sol";
+import {SemaphoreGroups} from "./base/SemaphoreGroups.sol";
 
 /// @title Semaphore
 /// @dev This contract uses the Semaphore base contracts to provide a complete service
@@ -18,71 +18,36 @@ contract Semaphore is ISemaphore, SemaphoreGroups {
     /// @dev Gets a group id and returns the group parameters.
     mapping(uint256 => Group) public groups;
 
-    /// @dev Checks if the group admin is the transaction sender.
-    /// @param groupId: Id of the group.
-    modifier onlyGroupAdmin(uint256 groupId) {
-        if (groups[groupId].admin != _msgSender()) {
-            revert Semaphore__CallerIsNotTheGroupAdmin();
-        }
-        _;
-    }
-
-    /// @dev Checks if there is a verifier for the given tree depth.
-    /// @param merkleTreeDepth: Depth of the tree.
-    modifier onlySupportedMerkleTreeDepth(uint256 merkleTreeDepth) {
-        if (merkleTreeDepth < 16 || merkleTreeDepth > 32) {
-            revert Semaphore__MerkleTreeDepthIsNotSupported();
-        }
-        _;
-    }
-
     /// @dev Initializes the Semaphore verifier used to verify the user's ZK proofs.
-    /// @param _verifier: Semaphore verifier address.
+    /// @param _verifier: Semaphore verifier addresse.
     constructor(ISemaphoreVerifier _verifier) {
         verifier = _verifier;
     }
 
-    /// @dev See {ISemaphore-createGroup}.
-    function createGroup(
-        uint256 groupId,
-        uint256 merkleTreeDepth,
-        address admin
-    ) external override onlySupportedMerkleTreeDepth(merkleTreeDepth) {
-        _createGroup(groupId, merkleTreeDepth);
+    /// @dev See {SemaphoreGroups-_createGroup}.
+    function createGroup(uint256 groupId, address admin) external override {
+        _createGroup(groupId, admin);
 
-        groups[groupId].admin = admin;
         groups[groupId].merkleTreeDuration = 1 hours;
-
-        emit GroupAdminUpdated(groupId, address(0), admin);
     }
 
     /// @dev See {ISemaphore-createGroup}.
-    function createGroup(
-        uint256 groupId,
-        uint256 merkleTreeDepth,
-        address admin,
-        uint256 merkleTreeDuration
-    ) external override onlySupportedMerkleTreeDepth(merkleTreeDepth) {
-        _createGroup(groupId, merkleTreeDepth);
+    function createGroup(uint256 groupId, address admin, uint256 merkleTreeDuration) external override {
+        _createGroup(groupId, admin);
 
-        groups[groupId].admin = admin;
         groups[groupId].merkleTreeDuration = merkleTreeDuration;
-
-        emit GroupAdminUpdated(groupId, address(0), admin);
     }
 
-    /// @dev See {ISemaphore-updateGroupAdmin}.
-    function updateGroupAdmin(uint256 groupId, address newAdmin) external override onlyGroupAdmin(groupId) {
-        groups[groupId].admin = newAdmin;
-
-        emit GroupAdminUpdated(groupId, _msgSender(), newAdmin);
+    /// @dev See {SemaphoreGroups-_updateGroupAdmin}.
+    function updateGroupAdmin(uint256 groupId, address newAdmin) external override {
+        _updateGroupAdmin(groupId, newAdmin);
     }
 
     /// @dev See {ISemaphore-updateGroupMerkleTreeDuration}.
     function updateGroupMerkleTreeDuration(
         uint256 groupId,
         uint256 newMerkleTreeDuration
-    ) external override onlyGroupAdmin(groupId) {
+    ) external override onlyExistingGroup(groupId) onlyGroupAdmin(groupId) {
         uint256 oldMerkleTreeDuration = groups[groupId].merkleTreeDuration;
 
         groups[groupId].merkleTreeDuration = newMerkleTreeDuration;
@@ -90,8 +55,8 @@ contract Semaphore is ISemaphore, SemaphoreGroups {
         emit GroupMerkleTreeDurationUpdated(groupId, oldMerkleTreeDuration, newMerkleTreeDuration);
     }
 
-    /// @dev See {ISemaphore-addMember}.
-    function addMember(uint256 groupId, uint256 identityCommitment) external override onlyGroupAdmin(groupId) {
+    /// @dev See {SemaphoreGroups-_addMember}.
+    function addMember(uint256 groupId, uint256 identityCommitment) external override {
         _addMember(groupId, identityCommitment);
 
         uint256 merkleTreeRoot = getMerkleTreeRoot(groupId);
@@ -99,66 +64,81 @@ contract Semaphore is ISemaphore, SemaphoreGroups {
         groups[groupId].merkleRootCreationDates[merkleTreeRoot] = block.timestamp;
     }
 
-    /// @dev See {ISemaphore-addMembers}.
-    function addMembers(
-        uint256 groupId,
-        uint256[] calldata identityCommitments
-    ) external override onlyGroupAdmin(groupId) {
-        for (uint256 i = 0; i < identityCommitments.length; ) {
-            _addMember(groupId, identityCommitments[i]);
-
-            unchecked {
-                ++i;
-            }
-        }
+    /// @dev See {SemaphoreGroups-_addMembers}.
+    function addMembers(uint256 groupId, uint256[] calldata identityCommitments) external override {
+        _addMembers(groupId, identityCommitments);
 
         uint256 merkleTreeRoot = getMerkleTreeRoot(groupId);
 
         groups[groupId].merkleRootCreationDates[merkleTreeRoot] = block.timestamp;
     }
 
-    /// @dev See {ISemaphore-updateMember}.
+    /// @dev See {SemaphoreGroups-_updateMember}.
     function updateMember(
         uint256 groupId,
         uint256 identityCommitment,
         uint256 newIdentityCommitment,
-        uint256[] calldata proofSiblings,
-        uint8[] calldata proofPathIndices
-    ) external override onlyGroupAdmin(groupId) {
-        _updateMember(groupId, identityCommitment, newIdentityCommitment, proofSiblings, proofPathIndices);
+        uint256[] calldata merkleProofSiblings
+    ) external override {
+        _updateMember(groupId, identityCommitment, newIdentityCommitment, merkleProofSiblings);
 
         uint256 merkleTreeRoot = getMerkleTreeRoot(groupId);
 
         groups[groupId].merkleRootCreationDates[merkleTreeRoot] = block.timestamp;
     }
 
-    /// @dev See {ISemaphore-removeMember}.
+    /// @dev See {SemaphoreGroups-_removeMember}.
     function removeMember(
         uint256 groupId,
         uint256 identityCommitment,
-        uint256[] calldata proofSiblings,
-        uint8[] calldata proofPathIndices
-    ) external override onlyGroupAdmin(groupId) {
-        _removeMember(groupId, identityCommitment, proofSiblings, proofPathIndices);
+        uint256[] calldata merkleProofSiblings
+    ) external override {
+        _removeMember(groupId, identityCommitment, merkleProofSiblings);
 
         uint256 merkleTreeRoot = getMerkleTreeRoot(groupId);
 
         groups[groupId].merkleRootCreationDates[merkleTreeRoot] = block.timestamp;
     }
 
-    /// @dev See {ISemaphore-verifyProof}.
+    function validateProof(
+        uint256 groupId,
+        uint256 merkleTreeDepth,
+        uint256 merkleTreeRoot,
+        uint256 nullifier,
+        uint256 message,
+        uint256 scope,
+        uint256[8] calldata proof
+    ) external override onlyExistingGroup(groupId) {
+        if (groups[groupId].nullifiers[nullifier]) {
+            revert Semaphore__YouAreUsingTheSameNullifierTwice();
+        }
+
+        if (!verifyProof(groupId, merkleTreeDepth, merkleTreeRoot, nullifier, message, scope, proof)) {
+            revert Semaphore__InvalidProof();
+        }
+
+        groups[groupId].nullifiers[nullifier] = true;
+
+        emit ProofValidated(groupId, merkleTreeDepth, merkleTreeRoot, nullifier, message, scope, proof);
+    }
+
     function verifyProof(
         uint256 groupId,
+        uint256 merkleTreeDepth,
         uint256 merkleTreeRoot,
-        uint256 signal,
-        uint256 nullifierHash,
-        uint256 externalNullifier,
+        uint256 nullifier,
+        uint256 message,
+        uint256 scope,
         uint256[8] calldata proof
-    ) external override {
-        uint256 merkleTreeDepth = getMerkleTreeDepth(groupId);
+    ) public view override onlyExistingGroup(groupId) returns (bool) {
+        if (merkleTreeDepth < 1 || merkleTreeDepth > 12) {
+            revert Semaphore__MerkleTreeDepthIsNotSupported();
+        }
 
-        if (merkleTreeDepth == 0) {
-            revert Semaphore__GroupDoesNotExist();
+        uint256 merkleTreeSize = getMerkleTreeSize(groupId);
+
+        if (merkleTreeSize == 0) {
+            revert Semaphore__GroupHasNoMembers();
         }
 
         uint256 currentMerkleTreeRoot = getMerkleTreeRoot(groupId);
@@ -178,14 +158,20 @@ contract Semaphore is ISemaphore, SemaphoreGroups {
             }
         }
 
-        if (groups[groupId].nullifierHashes[nullifierHash]) {
-            revert Semaphore__YouAreUsingTheSameNillifierTwice();
-        }
-
-        verifier.verifyProof(merkleTreeRoot, nullifierHash, signal, externalNullifier, proof, merkleTreeDepth);
-
-        groups[groupId].nullifierHashes[nullifierHash] = true;
+        return
+            verifier.verifyProof(
+                [proof[0], proof[1]],
+                [[proof[2], proof[3]], [proof[4], proof[5]]],
+                [proof[6], proof[7]],
+                [merkleTreeRoot, nullifier, _hash(message), _hash(scope)],
+                merkleTreeDepth
+            );
+    }
 
-        emit ProofVerified(groupId, merkleTreeRoot, nullifierHash, externalNullifier, signal);
+    /// @dev Creates a keccak256 hash of a message compatible with the SNARK scalar modulus.
+    /// @param message: Message to be hashed.
+    /// @return Message digest.
+    function _hash(uint256 message) private pure returns (uint256) {
+        return uint256(keccak256(abi.encodePacked(message))) >> 8;
     }
 }

package/base/SemaphoreGroups.sol

@@ -1,106 +1,141 @@
 //SPDX-License-Identifier: MIT
-pragma solidity 0.8.4;
+pragma solidity 0.8.23;
 
-import "../interfaces/ISemaphoreGroups.sol";
-import "@zk-kit/incremental-merkle-tree.sol/IncrementalBinaryTree.sol";
-import "@openzeppelin/contracts/utils/Context.sol";
+import {ISemaphoreGroups} from "../interfaces/ISemaphoreGroups.sol";
+import {InternalLeanIMT, LeanIMTData} from "@zk-kit/imt.sol/internal/InternalLeanIMT.sol";
 
 /// @title Semaphore groups contract.
 /// @dev This contract allows you to create groups, add, remove and update members.
 /// You can use getters to obtain informations about groups (root, depth, number of leaves).
-abstract contract SemaphoreGroups is Context, ISemaphoreGroups {
-    using IncrementalBinaryTree for IncrementalTreeData;
+abstract contract SemaphoreGroups is ISemaphoreGroups {
+    using InternalLeanIMT for LeanIMTData;
 
-    /// @dev Gets a group id and returns the tree data.
-    mapping(uint256 => IncrementalTreeData) internal merkleTrees;
+    /// @dev Gets a group id and returns its tree data.
+    mapping(uint256 => LeanIMTData) internal merkleTrees;
 
-    /// @dev Creates a new group by initializing the associated tree.
+    /// @dev Gets a group id and returns its admin.
+    mapping(uint256 => address) internal admins;
+
+    /// @dev Checks if the group admin is the transaction sender.
+    /// @param groupId: Id of the group.
+    modifier onlyGroupAdmin(uint256 groupId) {
+        if (admins[groupId] != msg.sender) {
+            revert Semaphore__CallerIsNotTheGroupAdmin();
+        }
+        _;
+    }
+
+    /// @dev Checks if the group exists.
+    /// @param groupId: Id of the group.
+    modifier onlyExistingGroup(uint256 groupId) {
+        if (admins[groupId] == address(0)) {
+            revert Semaphore__GroupDoesNotExist();
+        }
+
+        _;
+    }
+
+    /// @dev Creates a new group. Only the admin will be able to add or remove members.
     /// @param groupId: Id of the group.
-    /// @param merkleTreeDepth: Depth of the tree.
-    function _createGroup(uint256 groupId, uint256 merkleTreeDepth) internal virtual {
-        if (getMerkleTreeDepth(groupId) != 0) {
+    /// @param admin: Admin of the group.
+    function _createGroup(uint256 groupId, address admin) internal virtual {
+        if (admins[groupId] != address(0)) {
             revert Semaphore__GroupAlreadyExists();
         }
 
-        // The zeroValue is an implicit member of the group, or an implicit leaf of the Merkle tree.
-        // Although there is a remote possibility that the preimage of
-        // the hash may be calculated, using this value we aim to minimize the risk.
-        uint256 zeroValue = uint256(keccak256(abi.encodePacked(groupId))) >> 8;
+        admins[groupId] = admin;
 
-        merkleTrees[groupId].init(merkleTreeDepth, zeroValue);
+        emit GroupCreated(groupId);
+        emit GroupAdminUpdated(groupId, address(0), admin);
+    }
 
-        emit GroupCreated(groupId, merkleTreeDepth, zeroValue);
+    /// @dev Updates the group admin.
+    /// @param groupId: Id of the group.
+    /// @param newAdmin: New admin of the group.
+    function _updateGroupAdmin(
+        uint256 groupId,
+        address newAdmin
+    ) internal virtual onlyExistingGroup(groupId) onlyGroupAdmin(groupId) {
+        admins[groupId] = newAdmin;
+
+        emit GroupAdminUpdated(groupId, msg.sender, newAdmin);
     }
 
     /// @dev Adds an identity commitment to an existing group.
     /// @param groupId: Id of the group.
     /// @param identityCommitment: New identity commitment.
-    function _addMember(uint256 groupId, uint256 identityCommitment) internal virtual {
-        if (getMerkleTreeDepth(groupId) == 0) {
-            revert Semaphore__GroupDoesNotExist();
-        }
+    function _addMember(
+        uint256 groupId,
+        uint256 identityCommitment
+    ) internal virtual onlyExistingGroup(groupId) onlyGroupAdmin(groupId) {
+        uint256 index = getMerkleTreeSize(groupId);
+        uint256 merkleTreeRoot = merkleTrees[groupId]._insert(identityCommitment);
 
-        merkleTrees[groupId].insert(identityCommitment);
+        emit MemberAdded(groupId, index, identityCommitment, merkleTreeRoot);
+    }
 
-        uint256 merkleTreeRoot = getMerkleTreeRoot(groupId);
-        uint256 index = getNumberOfMerkleTreeLeaves(groupId) - 1;
+    /// @dev Adds new members to an existing group.
+    /// @param groupId: Id of the group.
+    /// @param identityCommitments: New identity commitments.
+    function _addMembers(uint256 groupId, uint256[] calldata identityCommitments) internal virtual {
+        uint256 startIndex = getMerkleTreeSize(groupId);
+        uint256 merkleTreeRoot = merkleTrees[groupId]._insertMany(identityCommitments);
 
-        emit MemberAdded(groupId, index, identityCommitment, merkleTreeRoot);
+        emit MembersAdded(groupId, startIndex, identityCommitments, merkleTreeRoot);
     }
 
     /// @dev Updates an identity commitment of an existing group. A proof of membership is
     /// needed to check if the node to be updated is part of the tree.
     /// @param groupId: Id of the group.
-    /// @param identityCommitment: Existing identity commitment to be updated.
+    /// @param oldIdentityCommitment: Existing identity commitment to be updated.
     /// @param newIdentityCommitment: New identity commitment.
-    /// @param proofSiblings: Array of the sibling nodes of the proof of membership.
-    /// @param proofPathIndices: Path of the proof of membership.
+    /// @param merkleProofSiblings: Array of the sibling nodes of the proof of membership.
     function _updateMember(
         uint256 groupId,
-        uint256 identityCommitment,
+        uint256 oldIdentityCommitment,
         uint256 newIdentityCommitment,
-        uint256[] calldata proofSiblings,
-        uint8[] calldata proofPathIndices
-    ) internal virtual {
-        if (getMerkleTreeDepth(groupId) == 0) {
-            revert Semaphore__GroupDoesNotExist();
-        }
-
-        merkleTrees[groupId].update(identityCommitment, newIdentityCommitment, proofSiblings, proofPathIndices);
-
-        uint256 merkleTreeRoot = getMerkleTreeRoot(groupId);
-        uint256 index = proofPathIndicesToMemberIndex(proofPathIndices);
-
-        emit MemberUpdated(groupId, index, identityCommitment, newIdentityCommitment, merkleTreeRoot);
+        uint256[] calldata merkleProofSiblings
+    ) internal virtual onlyExistingGroup(groupId) onlyGroupAdmin(groupId) {
+        uint256 index = merkleTrees[groupId]._indexOf(oldIdentityCommitment);
+        uint256 merkleTreeRoot = merkleTrees[groupId]._update(
+            oldIdentityCommitment,
+            newIdentityCommitment,
+            merkleProofSiblings
+        );
+
+        emit MemberUpdated(groupId, index, oldIdentityCommitment, newIdentityCommitment, merkleTreeRoot);
     }
 
     /// @dev Removes an identity commitment from an existing group. A proof of membership is
     /// needed to check if the node to be deleted is part of the tree.
     /// @param groupId: Id of the group.
     /// @param identityCommitment: Existing identity commitment to be removed.
-    /// @param proofSiblings: Array of the sibling nodes of the proof of membership.
-    /// @param proofPathIndices: Path of the proof of membership.
+    /// @param merkleProofSiblings: Array of the sibling nodes of the proof of membership.
     function _removeMember(
         uint256 groupId,
         uint256 identityCommitment,
-        uint256[] calldata proofSiblings,
-        uint8[] calldata proofPathIndices
-    ) internal virtual {
-        if (getMerkleTreeDepth(groupId) == 0) {
-            revert Semaphore__GroupDoesNotExist();
-        }
+        uint256[] calldata merkleProofSiblings
+    ) internal virtual onlyExistingGroup(groupId) onlyGroupAdmin(groupId) {
+        uint256 index = merkleTrees[groupId]._indexOf(identityCommitment);
 
-        merkleTrees[groupId].remove(identityCommitment, proofSiblings, proofPathIndices);
-
-        uint256 merkleTreeRoot = getMerkleTreeRoot(groupId);
-        uint256 index = proofPathIndicesToMemberIndex(proofPathIndices);
+        uint256 merkleTreeRoot = merkleTrees[groupId]._remove(identityCommitment, merkleProofSiblings);
 
         emit MemberRemoved(groupId, index, identityCommitment, merkleTreeRoot);
     }
 
+    /// @dev See {ISemaphoreGroups-hasMember}.
+    function hasMember(uint256 groupId, uint256 identityCommitment) public view virtual override returns (bool) {
+        return merkleTrees[groupId]._has(identityCommitment);
+    }
+
+    /// @dev See {ISemaphoreGroups-indexOf}.
+    function indexOf(uint256 groupId, uint256 identityCommitment) public view virtual override returns (uint256) {
+        return merkleTrees[groupId]._indexOf(identityCommitment);
+    }
+
     /// @dev See {ISemaphoreGroups-getMerkleTreeRoot}.
     function getMerkleTreeRoot(uint256 groupId) public view virtual override returns (uint256) {
-        return merkleTrees[groupId].root;
+        return merkleTrees[groupId]._root();
     }
 
     /// @dev See {ISemaphoreGroups-getMerkleTreeDepth}.
@@ -108,31 +143,8 @@ abstract contract SemaphoreGroups is Context, ISemaphoreGroups {
         return merkleTrees[groupId].depth;
     }
 
-    /// @dev See {ISemaphoreGroups-getNumberOfMerkleTreeLeaves}.
-    function getNumberOfMerkleTreeLeaves(uint256 groupId) public view virtual override returns (uint256) {
-        return merkleTrees[groupId].numberOfLeaves;
-    }
-
-    /// @dev Converts the path indices of a Merkle proof to the identity commitment index in the tree.
-    /// @param proofPathIndices: Path of the proof of membership.
-    /// @return Index of a group member.
-    function proofPathIndicesToMemberIndex(uint8[] calldata proofPathIndices) private pure returns (uint256) {
-        uint256 memberIndex = 0;
-
-        for (uint8 i = uint8(proofPathIndices.length); i > 0; ) {
-            if (memberIndex > 0 || proofPathIndices[i - 1] != 0) {
-                memberIndex *= 2;
-
-                if (proofPathIndices[i - 1] == 1) {
-                    memberIndex += 1;
-                }
-            }
-
-            unchecked {
-                --i;
-            }
-        }
-
-        return memberIndex;
+    /// @dev See {ISemaphoreGroups-getMerkleTreeSize}.
+    function getMerkleTreeSize(uint256 groupId) public view virtual override returns (uint256) {
+        return merkleTrees[groupId].size;
     }
 }