[contract/money] lead burn/mint proofs

src/contract/money/proof/lead_burn.zk

@@ -0,0 +1,79 @@
+constant "LeadBurn" {
+         EcFixedPointShort VALUE_COMMIT_VALUE,
+         EcFixedPoint VALUE_COMMIT_RANDOM,
+         EcFixedPointBase NULLIFIER_K,
+}
+
+contract "LeadBurn" {
+         MerklePath c1_cm_path,
+         Uint32 c1_cm_pos,
+         Uint32 c1_sk_pos,
+         Base c1_sk,
+         Base c1_sk_root,
+         MerklePath c1_sk_path,
+         Base c1_tau,
+         Base c1_rho,
+         Scalar c1_opening,
+         Base value,
+         Scalar value_blind,
+}
+
+circuit "LeadBurn" {
+        ZERO = witness_base(0);
+        PREFIX_CM = witness_base(4);
+        PREFIX_PK = witness_base(5);
+        PREFIX_SN = witness_base(6);
+
+        # value commitment
+        # necessary anonymously validading value state transition
+	vcv = ec_mul_short(value, VALUE_COMMIT_VALUE);
+	vcr = ec_mul(value_blind, VALUE_COMMIT_RANDOM);
+	value_commit = ec_add(vcv, vcr);
+	constrain_instance(ec_get_x(value_commit));
+	constrain_instance(ec_get_y(value_commit));
+        
+        # coin (1) pk
+        pk = poseidon_hash(
+           PREFIX_PK,
+           c1_sk_root,
+           c1_tau,
+           ZERO
+        );
+        constrain_instance(pk);
+        
+        # coin (1) cm/commitment
+        c1_cm_msg = poseidon_hash(
+                  PREFIX_CM,
+                  pk,
+                  value,
+                  c1_rho
+        );
+        c1_cm_v = ec_mul_base(c1_cm_msg, NULLIFIER_K);
+        c1_cm_r = ec_mul(c1_opening, VALUE_COMMIT_RANDOM);
+        c1_cm = ec_add(c1_cm_v, c1_cm_r);
+        c1_cm_x = ec_get_x(c1_cm);
+        c1_cm_y = ec_get_y(c1_cm);
+        c1_cm_hash = poseidon_hash(
+                   c1_cm_x,
+                   c1_cm_y
+        );
+        constrain_instance(c1_cm_x);
+        constrain_instance(c1_cm_y);
+        
+        # root of path to burnt coin commitment at given pos
+        root = merkle_root(c1_cm_pos, c1_cm_path, c1_cm_hash);
+        constrain_instance(root);
+        
+        # root of path at c1_sk_pos
+        root_sk = merkle_root(c1_sk_pos, c1_sk_path, c1_sk);
+        constrain_instance(root_sk);
+        
+        # coin (1) sn/nullifier
+        sn = poseidon_hash(
+           PREFIX_SN,
+           c1_sk_root,
+           c1_rho,
+           ZERO
+        );
+        constrain_instance(sn);
+}

src/contract/money/proof/lead_mint.zk

@@ -0,0 +1,44 @@
+constant "LeadMint" {
+         EcFixedPointShort VALUE_COMMIT_VALUE,
+         EcFixedPoint VALUE_COMMIT_RANDOM,
+         EcFixedPointBase NULLIFIER_K,
+}
+
+contract "LeadMint" {
+         Base c1_sk,
+         Base c1_sk_root,
+         Base c1_tau,
+         Base c1_rho,
+         Scalar c1_opening,
+         Base value,
+         Scalar value_blind,
+}
+
+circuit "LeadMint" {
+        ZERO = witness_base(0);
+        PREFIX_CM = witness_base(4);
+        PREFIX_PK = witness_base(5);
+
+        # value commitment
+        # necessary anonymously validading value state transition
+	vcv = ec_mul_short(value, VALUE_COMMIT_VALUE);
+	vcr = ec_mul(value_blind, VALUE_COMMIT_RANDOM);
+	value_commit = ec_add(vcv, vcr);
+	constrain_instance(ec_get_x(value_commit));
+	constrain_instance(ec_get_y(value_commit));
+        
+        # coin (1) pk
+        pk = poseidon_hash(PREFIX_PK, c1_sk_root, c1_tau, ZERO);
+        constrain_instance(pk);
+        
+        # coin (1) cm/commitment
+        c1_cm_msg = poseidon_hash(PREFIX_CM, pk, value, c1_rho);
+        c1_cm_v = ec_mul_base(c1_cm_msg, NULLIFIER_K);
+        c1_cm_r = ec_mul(c1_opening, VALUE_COMMIT_RANDOM);
+        c1_cm = ec_add(c1_cm_v, c1_cm_r);
+        c1_cm_x = ec_get_x(c1_cm);
+        c1_cm_y = ec_get_y(c1_cm);
+        c1_cm_hash = poseidon_hash(c1_cm_x, c1_cm_y);
+        constrain_instance(c1_cm_x);
+        constrain_instance(c1_cm_y);
+}