tests: Add isolated test for consensus proposal proof.

tests/consensus_prop.rs

@@ -0,0 +1,164 @@
+/* This file is part of DarkFi (https://dark.fi)
+ *
+ * Copyright (C) 2020-2023 Dyne.org foundation
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+use darkfi::{
+    zk::{empty_witnesses, halo2::Value, Proof, ProvingKey, VerifyingKey, Witness, ZkCircuit},
+    zkas::ZkBinary,
+    Result,
+};
+use darkfi_sdk::{
+    crypto::{
+        pasta_prelude::{Curve, CurveAffine, Field},
+        pedersen_commitment_u64, poseidon_hash, MerkleNode, MerkleTree, PublicKey, SecretKey,
+    },
+    pasta::pallas,
+};
+use halo2_proofs::dev::MockProver;
+use log::info;
+use rand::rngs::OsRng;
+
+pub const SECRET_KEY_PREFIX: pallas::Base = pallas::Base::from_raw([4, 0, 0, 0]);
+pub const SEED_PREFIX: pallas::Base = pallas::Base::from_raw([3, 0, 0, 0]);
+pub const SERIAL_PREFIX: pallas::Base = pallas::Base::from_raw([2, 0, 0, 0]);
+pub const MU_Y_PREFIX: pallas::Base = pallas::Base::from_raw([22, 0, 0, 0]);
+pub const MU_RHO_PREFIX: pallas::Base = pallas::Base::from_raw([5, 0, 0, 0]);
+pub const HEADSTART: pallas::Base = pallas::Base::from_raw([
+    11731824086999220879,
+    11830614503713258191,
+    737869762948382064,
+    46116860184273879,
+]);
+
+#[test]
+fn consensus_prop() -> Result<()> {
+    simplelog::TermLogger::init(
+        simplelog::LevelFilter::Info,
+        //simplelog::LevelFilter::Trace,
+        simplelog::ConfigBuilder::new().build(),
+        simplelog::TerminalMode::Mixed,
+        simplelog::ColorChoice::Auto,
+    )
+    .unwrap();
+
+    let input_serial = pallas::Base::from(pallas::Base::from(10));
+    //let input_serial = pallas::Base::from(pallas::Base::from(2));
+
+    let mut merkle_tree = MerkleTree::new(1);
+
+    let input_secret_key = SecretKey::from(pallas::Base::from(42));
+    let input_value = 100_000_000_000;
+    let epoch = pallas::Base::from(0);
+    let reward = 100_000_000;
+    let input_value_blind = pallas::Scalar::random(&mut OsRng);
+    let output_reward_blind = pallas::Scalar::random(&mut OsRng);
+    let output_value_blind = input_value_blind + output_reward_blind;
+    let output_value = input_value + reward;
+
+    let (input_x, input_y) = PublicKey::from_secret(input_secret_key).xy();
+    let input_coin = poseidon_hash([input_x, input_y, input_value.into(), epoch, input_serial]);
+
+    assert!(merkle_tree.append(MerkleNode::from(input_coin)));
+    let input_leaf_pos = merkle_tree.mark().unwrap();
+    let merkle_path = merkle_tree.witness(input_leaf_pos, 0).unwrap();
+
+    // Public inputs
+    let nullifier = poseidon_hash([input_secret_key.inner(), input_serial]);
+    let root = merkle_tree.root(0).unwrap();
+    let input_value_commit = pedersen_commitment_u64(input_value, input_value_blind);
+    let output_value_commit = pedersen_commitment_u64(output_value, output_value_blind);
+    let output_secret_key =
+        SecretKey::from(poseidon_hash([SECRET_KEY_PREFIX, input_secret_key.inner()]));
+    let output_serial = poseidon_hash([SERIAL_PREFIX, input_secret_key.inner(), input_serial]);
+    let (output_x, output_y) = PublicKey::from_secret(output_secret_key).xy();
+    let output_coin =
+        poseidon_hash([output_x, output_y, output_value.into(), pallas::Base::ZERO, output_serial]);
+
+    let mu_y = pallas::Base::from(1);
+    let mu_rho = pallas::Base::from(1);
+    let seed = poseidon_hash([SEED_PREFIX, input_serial]);
+    let y = poseidon_hash([seed, mu_y]);
+    let rho = poseidon_hash([seed, mu_rho]);
+
+    let sigma1 = pallas::Base::from(1);
+    let sigma2 = pallas::Base::from(1);
+    let value = pallas::Base::from(input_value);
+    let shifted_target = sigma1 * value + sigma2 * value * value + HEADSTART;
+
+    info!("y = {:?}", y);
+    info!("T = {:?}", shifted_target);
+    info!("y < T == {}", y < shifted_target);
+
+    let zkbin = include_bytes!("../src/contract/consensus/proof/consensus_proposal_v1.zk.bin");
+    let zkbin = ZkBinary::decode(&zkbin[..])?;
+
+    let prover_witnesses = vec![
+        Witness::Base(Value::known(input_secret_key.inner())),
+        Witness::Base(Value::known(input_serial)),
+        Witness::Base(Value::known(pallas::Base::from(input_value))),
+        Witness::Base(Value::known(epoch)),
+        Witness::Base(Value::known(pallas::Base::from(reward))),
+        Witness::Scalar(Value::known(input_value_blind)),
+        Witness::Uint32(Value::known(u64::from(input_leaf_pos).try_into().unwrap())),
+        Witness::MerklePath(Value::known(merkle_path.try_into().unwrap())),
+        Witness::Scalar(Value::known(output_value_blind)),
+        Witness::Base(Value::known(mu_y)),
+        Witness::Base(Value::known(mu_rho)),
+        Witness::Base(Value::known(sigma1)),
+        Witness::Base(Value::known(sigma2)),
+        Witness::Base(Value::known(HEADSTART)),
+    ];
+
+    let input_value_coords = input_value_commit.to_affine().coordinates().unwrap();
+    let output_value_coords = output_value_commit.to_affine().coordinates().unwrap();
+
+    let public_inputs = vec![
+        nullifier,
+        epoch,
+        input_x,
+        input_y,
+        root.inner(),
+        *input_value_coords.x(),
+        *input_value_coords.y(),
+        pallas::Base::from(reward),
+        *output_value_coords.x(),
+        *output_value_coords.y(),
+        output_coin,
+        mu_y,
+        y,
+        mu_rho,
+        rho,
+        sigma1,
+        sigma2,
+        HEADSTART,
+    ];
+
+    let prover_circuit = ZkCircuit::new(prover_witnesses, zkbin.clone());
+    let mockprover = MockProver::run(13, &prover_circuit, vec![public_inputs.clone()])?;
+    mockprover.assert_satisfied();
+
+    let verifier_witnesses = empty_witnesses(&zkbin);
+    let circuit = ZkCircuit::new(verifier_witnesses, zkbin);
+
+    let proving_key = ProvingKey::build(13, &circuit);
+    let verifying_key = VerifyingKey::build(13, &circuit);
+
+    let proof = Proof::create(&proving_key, &[prover_circuit], &public_inputs, &mut OsRng)?;
+    proof.verify(&verifying_key, &public_inputs)?;
+
+    Ok(())
+}