book: git mv spec2 spec

doc/src/SUMMARY.md

@@ -75,48 +75,13 @@
 
 # Specs
 
-- [Payment](spec/payment/payment.md)
-  - [burn](spec/payment/burn.md)
-  - [mint](spec/payment/mint.md)
-  - [coin](spec/payment/coin.md)
-  - [token id](spec/payment/token_id.md)
-  - [freeze token](spec/payment/freeze_token.md)
-  - [token mint](spec/payment/token_mint.md)
-
-- [Dao](spec/dao/index.md)
-  - [bulla](spec/dao/bulla.md)
-  - [proposal](spec/dao/proposal.md)
-  - [dao proposal](spec/dao/dao_propose.md)
-  - [dao proposal burn](spec/dao/dao_propose_burn.md)
-  - [mint](spec/dao/mint.md)
-  - [vote](spec/dao/vote.md)
-  - [vote burn](spec/dao/vote_burn.md)
-  - [exec](spec/dao/dao_exec.md)
-
-- [Proof of Stake](spec/pos/index.md)
-  - [burn](spec/pos/burn.md)
-  - [mint](spec/pos/mint.md)
-  - [lottery](spec/pos/proposal.md)
-
-- [Crypto](spec/crypto/index.md)
-  - [commitment](spec/crypto/commitment.md)
-  - [keypair](spec/crypto/keypair.md)
-  - [Signature](spec/crypto/signature.md)
-  - [hash](spec/crypto/hash.md)
-  - [merkletree](spec/crypto/merkletree.md)
-  - [note](spec/crypto/note.md)
-  - [vrf](spec/crypto/vrf.md)
-  - [nullifier](spec/crypto/nullifier.md)
-
-# Specs
-
-- [Notation](spec2/notation.md)
-- [Concepts](spec2/concepts.md)
-- [Cryptographic Schemes](spec2/crypto-schemes.md)
+- [Notation](spec/notation.md)
+- [Concepts](spec/concepts.md)
+- [Cryptographic Schemes](spec/crypto-schemes.md)
 - [Contracts]()
-  - [DAO](spec2/contracts/dao/dao.md)
-    - [Concepts](spec2/contracts/dao/concepts.md)
-    - [Model](spec2/contracts/dao/model.md)
+  - [DAO](spec/contracts/dao/dao.md)
+    - [Concepts](spec/contracts/dao/concepts.md)
+    - [Model](spec/contracts/dao/model.md)
 
 # P2P API Tutorial
 

doc/src/spec/crypto/commitment.md

@@ -1,12 +0,0 @@
-# Commitment
-
-Darkfi contract uses computationally binding, perfectly hiding pedersen commitment function in both money, and consensus contracts.
-
-cm = comm(m, r), m is data encrypted as curve field element, r is a random curve scalar blinding factor, `comm` is a computationally hiding, computationally binding commitment.
-
-## Curve point commitment
-
-Commitment to a curve point pt is tuple $(cm_x,cm_y)$, after conversion to affine coordinates of pt: $(pt_x, pt_y)$
-
-$$cm_x = comm(pt_x, r_x)$$
-$$cm_y = comm(pt_y, r_x)$$

doc/src/spec/crypto/hash.md

@@ -1,6 +0,0 @@
-# Hash
-
-Required by the signature scheme to be:
-
-- random-prefix preimage resistant.
-- random-prefix second-preimage resistant

doc/src/spec/crypto/keypair.md

@@ -1,11 +0,0 @@
-# Keypair
-
-Key pair over the elliptic curve finite field with generator `g`
-
-## Secret key
-
-Secret key `sk` is a finite field element over the elliptic curve.
-
-## Public key
-
-Public key `pk` is a finite field element over the elliptic curve: $g*sk$

doc/src/spec/crypto/merkletree.md

@@ -1,23 +0,0 @@
-# Merkle-tree
-
-Append only merkle-tree `tree`
-
-## Merkle-node
-
-A node `node` is a field element on the elliptic curve
-
-## Merkle root
-
-Hash of leaf up to certain depth root(tree, depth), hash the leafs including the empty nodes up to given `depth`,
-
-## Witness
-
-Authentication path to given `depth`, and bridge frontier, or position.
-
-## Sparse merkle tree
-
-Is a merkle-tree with leafs stored in a search tree, has advantage over merkle-tree that is a allow non-inclusion proof, through membership proof to index of data in the search tree.
-
-### Membership proof
-
-Given `index` the proof is a `path` from the leaf at `index` to the root.

doc/src/spec/crypto/note.md

@@ -1,20 +0,0 @@
-# Note
-
-note is stream cipher encrypted with symmetric key `key`, derived from shared key[^1].
-`key` = hash(sharedSecret, ephemeralKey)
-$sharedSecret = ephemeralSecret * publicKey$ where `publicKey` is recipient public key. based off diffie-hellman shared secret.
-
-## Payment Note
-
-Note = (sn, value, tokenId, spendHook, data, $blind^{value}$, $blind^{token}$, memo)
-
-| Note            | Description                    |
-|-----------------|--------------------------------|
-| sn              | serial number sampled at random|
-| value           | payment value                  |
-| tokenId         | token id                       |
-| spendHook       | coin related contract          |
-| data            | data used by the coin contract |
-| $blind^{value}$ | value commitment blinding term |
-| $blind^{token}$ | token commitment blinding term |
-| memo            | arbitrary data                 |

doc/src/spec/crypto/nullifier.md

@@ -1,4 +0,0 @@
-# Nullifier
-
-It's [commitment](commitment.md) to [coin](../payment/coin.md), or [bulla](../dao/bulla.md)'s [secret key](keypair.md), and serial number: [commit](commitment.md)(sk||sn)
-each [coin](../payment/coin.md), [bulla](../dao/bulla.md) has unique private secret key, and unique serial, preventing double spending can be implemented through validation that nullifier have never been seen, proof that nullifer isn't included under current nullifiers [sparse merkle tree](merkletree.md) root.

doc/src/spec/crypto/signature.md

@@ -1,8 +0,0 @@
-# Signature
-Signature for keypair over the elliptic curve, it's security hinged on the security of hash random oracle.
-
-# Signature protocol
-Signature = sign(sk, msg), `sk` private key used for message signature generation, `msg` message to be signed, signature as response, and challenge pair. to verify call verify(pk, msg, signature) with `pk` public key corresponding to message signing private key,  validate signature is valid for given msg and signature public key.
-
-# Nonce leakage
-Make sure the nonce or source of randomness is true random every time call to signature sign is called with the same keypair, otherwise the secret key can be leaked given just two signatures, $response_1 - response_2  = mask - sk * challenge_1 - mask + sk * challenge_2 = sk * (challenge_2 - challenge_1)$

doc/src/spec/crypto/vdf.md

@@ -1 +0,0 @@
-# verifiable delay function (VDF)

doc/src/spec/crypto/vrf.md

@@ -1,22 +0,0 @@
-# ECVRF
-
-ecvrf[^1] is elliptic curve verifiable random function that satisfies:
-
-- trusted uniqueness [^2]
-- trusted collision resistance [^3]
-- full pseudo-randomness [^4]
-
-## ECVRF protocol
-
-### Proof generation
-
-$proof = prove(sk, data)$, `sk` is VRF private key, `data` is input data as stream of bytes, proof is the vrf output.
-generate a vrf proof, that can be publicly verified.
-
-### Proof verification
-$verify(pk, proof, data)$, `pk` is VRF public key, validate that the proof is correct.
-
-[^1]: https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-vrf-04#section-5
-[^2]: https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-vrf-04#section-3.1
-[^3]: https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-vrf-04#section-3.2
-[^4]: https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-vrf-04#section-3.3

doc/src/spec/dao/bulla.md

@@ -1,14 +0,0 @@
-# Bulla
-
-Similar to the payment [coin](../payment/coin.md), bulla is EC field element [commitment](../crypto/commitment.md) to: (proposerLimit, quorum, $approvalRatio_{quot}$, $approvalRatio_{base}$, tokenId, $pub_x$, $pub_y$) with blinding factor  $blind^{bulla}$
-
-| Bulla                  | Description                                            |
-|------------------------|--------------------------------------------------------|
-| proposerLimit          | governance token necessary for the vote to be valid    |
-| quorum                 | minimum number of votes necessary to pass the [proposal](proposal.md) |
-| $approvalRatio_{quot}$ | [proposal](proposal.md) approval ratio quotient                       |
-| $approvalRatio_{base}$ | [proposal](proposal.md) approval ratio base                           |
-| tokenId                | governance [token id](../payment/token_id.md)                                    |
-| $pub_x$                | dao [public key](../crypto/keypair.md) x coordinate                            |
-| $pub_y$                | dao [public key](../crypto/keypair.md) y coordinate                            |
-| $blind^{bulla}$        | bulla [commitment](../crypto/commitment.md) blinding factor                       |

doc/src/spec/dao/dao_exec.md

@@ -1,71 +0,0 @@
-# DAO execution
-
-DAO execution proof once quorum, and yes vote required have been met.
-
-$$ X = (bulla, coin^{proposal}, coin^{dao}, cm^{vote^{yes}}_x, cm^{vote^{yes}}_y, cm^{vote^{all}}_x, cm^{vote^{all}}_y, cm^{value^{proposal}}_x, cm^{value^{prososal}}_y, spendHook^{dao}, spendHook^{proposal}, data^{proposal}) $$
-
-$$ W = (proposal^{destination}_x, proposal^{destination}_y, proposal^{amount}, proposal^{tokenId}, blind^{proposal}, proposerLimit, quorum, approvalRatio_{quot}, approvalRatio_{base}, tokenId, pub_x, pub_y, blind^{bulla}, vote^{yes}, vote^{all}, blind^{vote^{yes}}, blind^{vote^{all}}, sn^{proposal}, sn^{dao}, value^{dao}, blind^{value^{dao}}, spendHook^{dao}, spendHook^{proposal}, data^{proposal}) $$
-
-$$ \mathcal{L}= \{X:(X,W)\in \mathcal{R}\} $$
-
-## Execution proof.
-
-- Derive, and reveal [bulla](bulla.md)
-- Derive, and reveal [proposal](proposal.md) input [coin](../payment/coin.md)
-- Calculate, and  Reveal yes-vote 0/1 for no/yes [commitment](../crypto/commitment.md): $vote^{yes}*vote^{all}$
-- Reveal all-vote value [commitment](../crypto/commitment.md)
-- Calculate, and reveal [proposal](proposal.md) coin value [commitment](../crypto/commitment.md)
-- Reveal dao execution spendHook
-- Reveal proposal spendHook
-- Reveal proposal spendHook input data
-- Reveal dao spendHook input data: [bulla](bulla.md) [commitment](../crypto/commitment.md)
-
-| Public inputs              | Description                                                          |
-|----------------------------|----------------------------------------------------------------------|
-| bulla                      | dao [bulla](bulla.md)                                                |
-| $coin^{proposal}$          | [proposal](proposal.md) input [coin](../payment/coin.md)             |
-| $coin^{dao}$               | dao [coin](../payment/coin.md)                                       |
-| $cm^{vote^{yes}}_x$        |  yes vote [commitment](../crypto/commitment.md) x coordinate          |
-| $cm^{vote^{yes}}_y$        | yes vote [commitment](../crypto/commitment.md) y coordinate           |
-| $cm^{vote^{all}}_x$        | all votes [commitment](../crypto/commitment.md) x coordinate          |
-| $cm^{vote^{all}}_y$        | all votes [commitment](../crypto/commitment.md) y coordinate          |
-| $cm^{value^{proposal}}_x$  | x-coordinate of [commitment](../crypto/commitment.md) to $value^{proposal}$                      |
-| $cm^{value^{proposal}}_y$  | y-coordinate of [commitment](../crypto/commitment.md) to $value^{proposal}$                      |
-| $spendHook^{dao}$          | dao spendhook                                                        |
-| $spendHook^{proposal}$     | [proposal](proposal.md) spendhook                                                   |
-| $data^{proposal}$          | input data for $spendhook^{proposal}$ contract                       |
-| $data^{dao}$               | input data for $spendhook^{proposal}$ contract                       |
-
-
-| Witnesses                  | Destination                                            |
-|----------------------------|--------------------------------------------------------|
-| $proposal^{destination}_x$ | [proposal](proposal.md) destination [public key](../payment/keypair.md) x coordinate           |
-| $proposal^{destination}_y$ | [proposal](proposal.md) destination [public key](../payment/keypair.md) y coordinate           |
-| $proposal^{amount}$        | [proposal](proposal.md) amount in proposal token                      |
-| $proposal^{tokenId}$       | [proposal](proposal.md) [token id](../payment/token_id.md)            |
-| $blind^{proposal}$         | [proposal](proposal.md) [commitment](../crypto/commitment.md) blind factor|
-| proposerLimit              | governance token necessary for the vote to be valid                   |
-| quorum                     | minimum number of votes necessary to pass the [proposal](proposal.md) |
-| $approvalRatio_{quot}$     | [proposal](proposal.md) approval ratio quotient                       |
-| $approvalRatio_{base}$     | [proposal](proposal.md) approval ratio base                           |
-| tokenId                    | governance [token id](../payment/token_id.md)                         |
-| $pub_x$                    | dao [public key](../payment/keypair.md) x coordinate                  |
-| $pub_y$                    | dao [public key](../payment/keypair.md) y coordinate                  |
-| $blind^{bulla}$            | [bulla](bulla.md) [commitment](../crypto/commitment.md) blinding factor|
-| $vote^{yes}$               | yes vote a boolean as either 0, or 1                                  |
-| $vote^{all}$               | all votes value                                                       |
-| $blind^{vote^{yes}}$       | yes vote [commitment](../crypto/commitment.md) blinding factor        |
-| $blind^{vote^{all}}$       | blinding term for all votes [commitment](../crypto/commitment.md)s    |
-| $sn^{proposal}$            | serial number for [proposal](proposal.md) [coin](../payment/coin.md)  |
-| $sn^{dao}$                 | dao input [coin](../payment/coin.md) serial number                    |
-| $value^{dao}$              | dao input [coin](../payment/coin.md) value                            |
-| $blind^{value^{dao}}$       | dao [coin](../payment/coin.md)  value blinding term                  |
-| $spendHook^{dao}$          | dao spendhook                                                         |
-| $spendHook^{proposal}$     | [proposal](proposal.md) spendhook                                                    |
-| $data^{proposal}$          | input data for $spendhook^{proposal}$ contract                        |
-
-
-# Circuit checks
-
-- $ quorum <= vote^{all}$
-- $ \frac{approvalRatio^{quot}}{approvalRatio^{base}} <= \frac{vote^{yes}}{vote^{all}} $

doc/src/spec/dao/dao_propose.md

@@ -1,48 +0,0 @@
-# Dao propose
-
-$$ X = (cm^{token}, root^{bulla}, proposal, cm^{value^{total}}_x, cm^{value^{total}}_y) $$
-
-$$ W = (value^{total}, blind^{value^{total}}, blind^{token}, proposal^{destination}_x, proposal^{destination}_y, proposal^{amount}, proposal^{tokenId}, blind^{proposal}, proposerLimit, quorum, approvalRatio_{quot}, approvalRatio_{base}, tokenId, pub_x, pub_y, blind^{bulla}, pos, path) $$
-
-$$ \mathcal{L}= \{X:(X,W)\in \mathcal{R}\} $$
-
-## Create dao proposal
-
-- Calculate, and reveal [token](../payment/tokne_id.md) [commitment](../crypto/commitment.md)
-- Calculate, and reveal [bulla](bulla.md)
-- Calculate, and reveal [proposal](proposal.md)
-- Calculate, and reveal total proposers funds [commitment](../crypto/commitment.md)
-
-| Public input               | Description                                  |
-|----------------------------|-----------------------------------------------|
-| $cm^{token}$               | [proposal](proposal.md) [token](../payment/token_id.md) [commitment](../crypto/commitment.md) as field element    |
-| $root^{bulla}$             | root of [bulla](bulla.md) in [merkle tree](../crypto/merkletree.md)                  |
-| proposal                   | dao proposer [proposal](proposal.md)                         |
-| $cm^{value^{total}}_x$          | total funds [commitment](../crypto/commitment.md)'s x coordinate          |
-| $cm^{value^{total}}_y$          | total funds [commitment](../crypto/commitment.md)'s y coordinate          |
-
-| Witnesses                | Description                                               |
-|--------------------------|-----------------------------------------------------------|
-| $value^{total}$          | total [proposal](proposal.md) funds value                 |
-| $blind^{value^{total}}$  | blinding value for $value^{total}$ [commitment](../crypto/commitment.md)  |
-| $blind^{token}$          | token [commitment](../crypto/commitment.md) blinding factor  |
-|$proposal^{destination}_x$| destination [public key](../crypto/keypair.md) x coordinate           |
-|$proposal^{destination}_y$| destination [public key](../crypto/keypair.md) y coordinate           |
-| $proposal^{amount}$      | amount in [proposal](proposal.md) token                      |
-| $proposal^{tokenId}$     | [proposal](proposal.md) [token id](../payment/token_id.md)   |
-| $blind^{proposal}$       | [proposal](proposal.md) [commitment](../crypto/commitment.md) blinding term             |
-| proposerLimit            | governance token necessary for the vote to be valid    |
-| quorum                   | minimum number of votes necessary to pass the [proposal](proposal.md) |
-| $approvalRatio_{quot}$   | [proposal](proposal.md) approval ratio quotient                       |
-| $approvalRatio_{base}$   | [proposal](proposal.md) approval ratio base                           |
-| tokenId                  | governance [token id](../payment/token_id.md)                                    |
-| $pub_x$                  | [proposal](proposal.md) [public key](../crypto/keypair.md) x coordinate                       |
-| $pub_y$                  | [proposal](proposal.md) [public key](../crypto/keypair.md) y coordinate                       |
-| $blind^{bulla}$          | [bulla](bulla.md) [commitment](../crypto/commitment.md) blinding factor                       |
-| pos                      | [bulla](bulla.md) leaf position in the [merkle tree](../crypto/merkletree.md)                 |
-| path                     | path of the [bulla](bulla.md) leaf at pos |
-
-# Circuit checks
-
-- $proposal^{amount} > 0$
-- $proposerLimit <= value^{total}$

doc/src/spec/dao/dao_propose_burn.md

@@ -1,41 +0,0 @@
-# Dao propose burn
-
-$$ X = (nullifier, cm^{value}_x, cm^{value}_y, cm^{token}, root,  signature^{public}_x, signature^{public}_y)$$
-
-$$ W = (sk, sn, spendHook, data, value, tokenId, blind^{value}, blind^{token}, pos, path, signature^{secret}) $$
-
-$$ \mathcal{L}= \{X:(X,W)\in \mathcal{R}\} $$
-
-## Burn dao proposal
-- Derive, and reveal [nullifier](../crypto/nullifier.md)
-- Calculate, and reveal value [commitment](../crypto/commitment.md)
-- Calculate, and reveal [token](../payment/token_id.md) [commitment](../crypto/commitment.md)
-- Add input [coin](../payment/coin.md) to [merkle tree](../crypto/merkletree.md), and reveal it's root.
-- Reveal associated spendHook contract.
-- Derive, and reveal [signature](../crypto/signature.md) public key [$signature^{public}$](../crypto/keypair.md)
-
-
-| Public Input         | Description                                                                                 |
-|----------------------|---------------------------------------------------------------------------------------------|
-| nullifier            | dao's proposal [coin](../payment/coin.md) [nullifier](../crypto/nullifier.md)                                             |
-| $cm^{value}_x$       | x coordinate of value point [commitment](../crypto/commitment.md)                           |
-| $cm^{value}_y$       | y coordinate of value point [commitment](../crypto/commitment.md)                           |
-| $cm^{token}$         | [commitment](../crypto/commitment.md) of [tokenId](../payment/token_id.md) as field element |
-| root                 | root of commitments [merkle tree](../crypto/merkletree.md) of [coin](../payment/coin.md)s   |
-|$signature^{public}_x$| [signature](../crypto/signature.md) [public key](../crypto/keypair.md) x coordinate         |
-|$signature^{public}_y$| [signature](../crypto/signature.md) [public key](../crypto/keypair.md) y coordinate         |
-
-
-| Witnesses            | Description                                          |
-|----------------------|------------------------------------------------------|
-| sk                   | [proposal](proposal.md) [coin](../payment/coin.md) [secret key](../crypto/keypair.md)     |
-| sn                   | [proposal](proposal.md) [coin](../payment/coin.md) serial number                          |
-| spendHook            | burn spendHook contract                                |
-| data                 | spendHook contract input data                        |
-| value                | [proposal](proposal.md) [coin](../payment/coin.md) value                                  |
-| tokenId              | [proposal](proposal.md) [coin](../payment/coin.md) [token id](../payment/token_id.md)                                    |
-| $blind^{value}$      | [proposal](proposal.md) value [commitment](../crypto/commitment.md) blinding term              |
-| $blind^{token}$      | [token](../payment/token_id.md) [commitment](../crypto/commitment.md) blinding term                       |
-| pos                  | [proposal](proposal.md) [coin](../payment/coin.md) leaf position in [merkle tree](../crypto/merkletree.md)           |
-| path                 | [proposal](proposal.md) [coin](../payment/coin.md) path in [merkle tree](../crypto/merkletree.md)                    |
-| $signature^{secret}$ | [proposal](proposal.md) [signature](../crypto/signature.md) [secret key](../crypto/keypair.md)                            |

doc/src/spec/dao/index.md

@@ -1,6 +0,0 @@
-# Dao contract functions
-
-- Mint (0x00)
-- Propose (0x01)
-- Vote (0x02)
-- Exec (0x03)

doc/src/spec/dao/mint.md

@@ -1,30 +0,0 @@
-# Mint contract
-
-Mint a new dao [bulla](bulla.md).
-
-$$ X = (pub_x, pub_y, bulla) $$
-
-$$ W = (proposerLimit, quorum, approvalRatio_{quot}, approvalRatio_{base}, tokenId, sk, blind^{bulla}) $$
-
-$$ \mathcal{L}= \{X:(X,W)\in \mathcal{R}\} $$
-
-## Mint bulla
-
-- Derive, and reveal dao authority [public key](../crypto/keypair.md).
-- Calculate, and reveal [bulla](bulla.md).
-
-| Public input | Description                          |
-|--------------|--------------------------------------|
-| $pub_x$      | dao [public key](../crypto/keypair.md) EC point x coordinate |
-| $pub_y$      | dao [public key](../crypto/keypair.md) EC point y coordinate |
-| bulla        | [bulla](bulla.md) field element [commitment](../crypto/commitment.md)       |
-
-| Witnesses              | Description                                            |
-|------------------------|--------------------------------------------------------|
-| proposerLimit          | governance token necessary for the vote to be valid    |
-| quorum                 | minimum number of votes necessary to pass the [proposal](proposal.md) |
-| $approvalRatio_{quot}$ | [proposal](proposal.md) approval ratio quotient                       |
-| $approvalRatio_{base}$ | [proposal](proposal.md) approval ratio base                           |
-| tokenId                | governance [token id](../payment/token_id.md)                                    |
-| sk                     | dao [secret key](../crypto/keypair.md)                                         |
-| $blind^{bulla}$        | [bulla](bulla.md) [commitment](../crypto/commitment.md) blinding factor                       |

doc/src/spec/dao/proposal.md

@@ -1,12 +0,0 @@
-# Proposal
-
-EC field element [commitment](../crypto/commitment.md) to: $(proposal^{destination}_x, proposal^{destination}_y, proposal^{amount}, proposal^{tokenId}, bulla)$ with blinding factor $blind^{proposal}$
-
-| Proposal                   | Destination                                   |
-|----------------------------|-----------------------------------------------|
-| $proposal^{destination}_x$ | proposal destination [public key](../crypto/keypair.md) x coordinate  |
-| $proposal^{destination}_y$ | proposal destination [public key](../crypto/keypair.md) y coordinate  |
-| $proposal^{amount}$        | proposal amount in proposal token             |
-| $proposal^{tokenId}$       | proposal [token id](../payment/token_id.md)                             |
-| bulla                      | dao [bulla](bulla.md)                                     |
-| $blind^{proposal}$         | proposal [commitment](../crypto/commitment.md) blind factor              |

doc/src/spec/dao/vote.md

@@ -1,52 +0,0 @@
-# Vote
-
-Vote on [proposal](proposal.md) by yes, or no by $proposal^{amount}$ of dao tokens.
-
-$$ X = (cm^{token}, proposal, cm^{vote^{yes}}_x, cm^{vote^{yes}}_y, cm^{vote^{all}}_x, cm^{vote^{all}}_y) $$
-
-$$ W = (proposal^{destination}_x, proposal^{destination}_y, proposal^{amount}, tokenId, blind^{proposal}, proposerLimit, quorum, approvalRatio_{quot}, approvalRatio_{base}, tokenId, pub_x, pub_y, blind^{bulla}, vote^{yes}, blind^{vote^{yes}}, vote^{yes}, vote^{all}, blind^{vote^{all}}, blind^{token}) $$
-
-$$ \mathcal{L}= \{X:(X,W)\in \mathcal{R}\} $$
-
-## Dao vote proof
-
-- Calculate, and reveal [proposal](proposal.md) [token](../payment/token_id.md) [commitment](../crypto/commitment.md) to vote on
-- Derive, and reveal [proposal](proposal.md)
-- Calculate, and  Reveal yes-vote 0/1 for no/yes [commitment](../crypto/commitment.md) $=vote^{yes}*vote^{all^}$
-- Reveal all-vote value [commitment](../crypto/commitment.md)
-
-
-| Public inputs       | Description                                |
-|---------------------|--------------------------------------------|
-| $cm^{token}$        | [proposal](proposal.md) token [commitment](../crypto/commitment.md) as field element |
-| proposal            | [proposal](proposal.md) [commitment](../crypto/commitment.md) as field element       |
-| $cm^{vote^{yes}}_x$ |  yes vote [commitment](../crypto/commitment.md) x coordinate            |
-| $cm^{vote^{yes}}_y$ | yes vote [commitment](../crypto/commitment.md) y coordinate           |
-| $cm^{vote^{all}}_x$ | all votes [commitment](../crypto/commitment.md) x coordinate          |
-| $cm^{vote^{all}}_y$ | all votes [commitment](../crypto/commitment.md) y coordinate          |
-
-
-| Witnesses                  | Description                                            |
-|----------------------------|--------------------------------------------------------|
-| $proposal^{destination}_x$ | [proposal](proposal.md) destination [public key](../crypto/keypair.md) x coordinate           |
-| $proposal^{destination}_y$ | [proposal](proposal.md) destination [public key](../crypto/keypair.md) y coordinate           |
-| $proposal^{amount}$        |  amount in [proposal](proposal.md) token                      |
-| tokenId                    | [proposal](proposal.md) token id                                      |
-| $blind^{proposal}$         | [proposal](proposal.md) [commitment](../crypto/commitment.md) blinding factor                    |
-| proposerLimit              | governance token necessary for the vote to be valid    |
-| quorum                     | minimum number of votes necessary to pass the [proposal](proposal.md) |
-| $approvalRatio_{quot}$     | [proposal](proposal.md) approval ratio quotient                       |
-| $approvalRatio_{base}$     | [proposal](proposal.md) approval ratio base                           |
-| tokenId                    | governance [token id](../payment/token_id.md)                                    |
-| $pub_x$                    | dao [public key](../crypto/keypair.md) x coordinate                            |
-| $pub_y$                    | dao [public key](../crypto/keypair.md) y coordinate                            |
-| $blind^{bulla}$            | [bulla](bulla.md) [commitment](../crypto/commitment.md) blinding factor                       |
-| $vote^{yes}$               | yes vote direction a boolean as either 0/1 for no/yes  |
-| $blind^{vote^{yes}}$       | yes vote [commitment](../crypto/commitment.md) blinding factor                    |
-| $vote^{all}$               | all votes value                                       |
-| $blind^{vote^{all}}$       | blinding term for all votes [commitment](../crypto/commitment.md)s                |
-| $blind^{token}$            | governance token blinding term                        |
-
-# Circuit checks
-
-- Validate that $vote^{yes}$ is either 0, or 1.

doc/src/spec/dao/vote_burn.md

@@ -1,41 +0,0 @@
-# Vote burn
-
-Burn proposal vote.
-
-$$ X = (nullifier, cm^{value}_x, cm^{value}_y, cm^{token}, root,  signature^{public}_x, signature^{public}_y) $$
-
-$$ W = (sk, sn, spendHook, data, value, tokenId, blind^{value}, blind^{token}, pos, path, signature^{secret}) $$
-
-$$ \mathcal{L}= \{X:(X,W)\in \mathcal{R}\} $$
-
-## Vote Burn proof
-
-- Derive, and reveal [nullifier](../crypto/nullifier.md)
-- Calculate, and reveal value [commitment](../crypto/commitment.md)
-- Calculate, and reveal [token](../payment/token_id.md) [commitment](../crypto/commitment.md)
-- Add input [coin](../payment/coin.md) to [merkle tree](../crypto/merkletree.md), and reveal it's root.
-- Derive, and reveal [signature](../crypto/signature.md) public key [$signature^{public}$](../crypto/keypair.md)
-
-| Public Input         | Description                                             |
-|----------------------|---------------------------------------------------------|
-| nullifier            |  dao's proposal [coin](../payment/coin.md) [nullifier](../crypto/nullifier.md)                                             |
-| $cm^{value}_x$       | x coordinate of value point [commitment](../crypto/commitment.md)                           |
-| $cm^{value}_y$       | y coordinate of value point [commitment](../crypto/commitment.md)                           |
-| $cm^{token}$         | [commitment](../crypto/commitment.md) of [tokenId](../payment/token_id.md) as field element |
-| root                 | root of commitments [merkle tree](../crypto/merkletree.md) of [coin](../payment/coin.md)s   |
-|$signature^{public}_x$| [signature](../crypto/signature.md) [public key](../crypto/keypair.md) x coordinate         |
-|$signature^{public}_y$| [signature](../crypto/signature.md) [public key](../crypto/keypair.md) y coordinate         |
-
-| Witnesses            | Description                                          |
-|----------------------|------------------------------------------------------|
-| sk                   | [proposal](proposal.md) [coin](../payment/coin.md) [secret key](../crypto/keypair.md)     |
-| sn                   | [proposal](proposal.md) [coin](../payment/coin.md) serial number                          |
-| spendHook            | burn spendHook contract                                |
-| data                 | spendHook contract input data                        |
-| value                | [proposal](proposal.md) [coin](../payment/coin.md) value                                  |
-| tokenId              | [proposal](proposal.md) [coin](../payment/coin.md) [token id](../payment/token_id.md)                                    |
-| $blind^{value}$      | [proposal](proposal.md) value [commitment](../crypto/commitment.md) blinding term              |
-| $blind^{token}$      | [token](../payment/token_id.md) [commitment](../crypto/commitment.md) blinding term                       |
-| pos                  | [proposal](proposal.md) [coin](../payment/coin.md) leaf position in [merkle tree](../crypto/merkletree.md)           |
-| path                 | [proposal](proposal.md) [coin](../payment/coin.md) path in [merkle tree](../crypto/merkletree.md)                    |
-| $signature^{secret}$ | [proposal](proposal.md) [signature](../crypto/signature.md) [secret key](../crypto/keypair.md)                            |

doc/src/spec/payment/burn.md

@@ -1,48 +0,0 @@
-# Burn contract
-
-$$ X = (nullifier, cm^{value}_x, cm^{value}_y, cm^{token}, root, data, spendHook, signature^{public}_x, signature^{public}_y) $$
-
-$$ W = (value, token, blind^{value}, blind^{token}, sn, spendHook, data, blind^{data}, sk, pos, path, signature^{secret}) $$
-
-$$ \mathcal{L} = \{X: (W,W) \in \mathcal{R}\} $$
-
-## Burning a coin
-
-- Publish [coin](coin.md)'s [nullifier](../crypto/nullifier.md) to avoid double-spending.
-- [Commit](../crypto/commitment.md) to [coin](coin.md)'s value $(cm^{value}_x, cm^{value}_y)$
-- [Commit](../crypto/commitment.md) to [tokenId](token_id.md)
-- Add [coin](coin.md) to [merkle tree](../crypto/merkletree.md), and set it's root it as instance.
-- Set spendHook as instance
-- Calculate [$Signature^{public}$](../crypto/signature.md), and set it as instance.
-
-
-| Public Input         | Description                                                                                           |
-|----------------------|-------------------------------------------------------------------------------------------------------|
-| nullifier            | coin [nullifier](../crypto/nullifier.md)                                                              |
-| $cm^{value}_x$       | x coordinate of value point [commitment](../crypto/commitment.md)                                     |
-| $cm^{value}_y$       | y coordinate of value point [commitment](../crypto/commitment.md)                                     |
-| $cm^{token}$         | [commitment](../crypto/commitment.md] of [tokenId](token_id.md) as field element                      |
-| root                 | root of [coin](coin.md) [commitment](../crypto/commitment.md)s [merkle tree](../crypto/merkletree.md) |
-| data                 | data read during execution of burn spendHook contract                                                 |
-| spendHook            | burn related contract                                                                                 |
-|$signature^{public}_x$| [signature](../crypto/signature.md) public x coordinate                                               |
-|$signature^{public}_y$| [signature](../crypto/signature.md) public y coordinate                                               |
-
-| Witnesses            | Description                                                                                                       |
-|----------------------|-------------------------------------------------------------------------------------------------------------------|
-| value                | burn value                                                                                                        |
-| token                | [tokenId](token_id.md)                                                                                            |
-| $blind^{value}$      | blinding term for burn value [commitment](../crypto/commitment.md)                                                |
-| $blind^{token}$      | blinding term for [tokenId](token_id.md) [commitment](../crypto/commitment.md)                                    |
-| sn                   | serial number for burn [coin](coin.md)                                                                            |
-| spendHook            | contract related contract                                                                                         |
-| data                 | data read during spendHook execution                                                                              |
-| $blind^{data}$       | blinding term for data [commitment](../crypto/commitment.md)                                                      |
-| sk                   | [coin](coin.md) [private key](../crypto/keypair.md)                                                                                       |
-| pos                  | [coin](coin.md) [commitment](../crypto/commitment.md) leaf position in the [merkle tree](../crypto/merkletree.md) |
-| path                 | [coin](coin.md) [commitment](../crypto/commitment.md) path in the [merkle tree](../crypto/merkletree.md)          |
-| $signature^{secret}$ | [signature](../crypto/signature.md) [secret key](../crypto/keypair.md)                                                                    |
-
-# Circuit checks
-
-- If the [coin](coin.md) has value zero, then [coin](coin.md) is set to zero, with leaf position 0 in the [sparse merkle tree](../crypto/merkletree.md), the aim is prevent burning zero value [coin](coin.md)s.

doc/src/spec/payment/coin.md

@@ -1,13 +0,0 @@
-# Coin
-
-Field element [commitment](../crypto/commitment.md) to $(pub_x, pub_y, value, token, sn, spendHook, data)$
-
-| Coin inputs          | Description                                       |
-|----------------------|---------------------------------------------------|
-| $pub_x$              | [public key](../crypto/keypair.md) x coordinate                           |
-| $pub_y$              | [public key](../crypto/keypair.md) y coordinate                           |
-| value                | coin value                                        |
-| token                | coin [token id](token_id.md)                                     |
-| sn                   | coin serial number                                |
-| spendHook            | contract to be executed upon minting that coin    |
-| data                 | data required by spendHook                        |

doc/src/spec/payment/freeze_token.md

@@ -1,24 +0,0 @@
-# Freeze contract
-
-Burn minted [coin](coin.md)s
-
-$$ X = (authority^{public}_x, authority^{public}_y, token) $$
-
-$$ W = (authority^{secret}) $$
-
-$$ \mathcal{L}= \{X:(X,W)\in \mathcal{R}\} $$
-
-## Freeze token
-- Derive mint authority [public key](../crypto/keypair.md) from witness $authority^{secret}$, and set it as instance.
-- Calculate, and reveal [tokenId](token_id.md) of the tokens.
-
-
-| Public Input         | Description                                             |
-|----------------------|---------------------------------------------------------|
-|$authority^{public}_y$| minting authority [public key](../crypto/keypair.md) y-coordinate               |
-|$authority^{public}_x$| minting authority [public key](../crypto/keypair.md) x-coordinate               |
-| token                | derived [tokenId](token_id.md)                                        |
-
-| Witnesses            | Description                                         |
-|----------------------|-----------------------------------------------------|
-| $authority^{secret}$ | minting authority [secret key](../crypto/keypair.md)|

doc/src/spec/payment/mint.md

@@ -1,33 +0,0 @@
-# Mint contract
-
-$$ X = (cm^{coin}, cm^{value}_x, cm^{value}_y, cm^{token} $$
-
-$$ W = (pk_x, pk_y, value, token, sn, spendHook, data, blind^{value}, blind^{token}) $$
-
-$$ \mathcal{L}= \{X:(X,W)\in \mathcal{R}\} $$
-
-## Minting a coin
-
-- Calculate, and set [coin](coin.md) as instance.
-- Calculate [coin](coin.md)'s value [commitment](../crypto/commitment.md), and set it as instance.
-- Calculate [coin](coin.md)'s [tokenId](token_id.md) [commitment](../crypto/commitment.md), and set is as instance.
-
-
-| Public Input         | Description                                                                       |
-|----------------------|-----------------------------------------------------------------------------------|
-| $cm^{coin}$          | [coin](coin.md) [commitment](../crypto/commitment.md) as field element            |
-| $cm^{value}_x$       | x coordinate of value point [commitment](../crypto/commitment.md)                 |
-| $cm^{value}_y$       | y coordinate of value point [commitment](../crypto/commitment.md)                 |
-| $cm^{token}$         | [commitment](../crypto/commitment.md) of [tokenId](token_id.md) as field element  |
-
-| Witnesses            | Description                                                                    |
-|----------------------|--------------------------------------------------------------------------------|
-| $pk_x$               | [coin](coin.md) [public key](../crypto/keypair.md) x coordinate                                        |
-| $pk_y$               | [coin](coin.md) [public key](../crypto/keypair.md) y coordinate                                        |
-| value                | burn value                                                                     |
-| token                | [tokenId](token_id.md)                                                         |
-| sn                   | [coin](coin.md) serial number                                                  |
-| spendHook            | contract related contract                                                      |
-| data                 | data read during spendHook execution                                           |
-| $blind^{value}$      | blinding term for burn value [commitment](../crypto/commitment.md)             |
-| $blind^{token}$      | blinding term for [tokenId](token_id.md) [commitment](../crypto/commitment.md) |

doc/src/spec/payment/payment.md

@@ -1,5 +0,0 @@
-# Payment
-
-Implements zcash sapling payment scheme [^1], payment involve burning old sender's coin, and minting new recipient's coin.
-
-[^1]: https://zips.z.cash/protocol/protocol.pdf

doc/src/spec/payment/token_id.md

@@ -1,7 +0,0 @@
-# Token Id
-
-Each token has unique [token id](token_id.md) derived as
-
-$$ hash(PREFIX || key^{public}_x || key^{public}_y) $$
-
-[$key^{public}$](../crypto/keypair.md) is [authority key, or public key](../crypto/keypair.md).

doc/src/spec/payment/token_mint.md

@@ -1,40 +0,0 @@
-# Arbitrary token mint
-
-mint new tokens with arbitrary supply to given recipient.
-
-
-$$ X = (authority^{public}_x, authority^{public}_y, token, cm^{coin}, cm^{value}_x, cm^{value}_y, cm^{token}) $$
-
-$$ W = (authority^{secret}, value, rcpt_x, rcpt_y, sn, spendHook, data, blind^{value}, blind^{token}) $$
-
-$$ \mathcal{L}= \{X:(X,W)\in \mathcal{R}\} $$
-
-## New token mint
-
-- Derive, and reveal mint authority [public key](../crypto/keypair.md).
-- Derive, and reveal new [tokenId](token_id.md)
-- Calculate, and reveal new token's [coin](coin.md).
-- Calculate, and reveal [coin](coin.md)'s [tokenId](token_id.md) [commitment](../crypto/commitment.md).
-
-
-| Public Input         | Description                                                            |
-|----------------------|------------------------------------------------------------------------|
-|$authority^{public}_y$| minting authority [public key](../crypto/keypair.md) y-coordinate                              |
-|$authority^{public}_x$| minting authority [public key](../crypto/keypair.md) x-coordinate                              |
-| token                | derived [tokenId](token_id.md)                                                       |
-| $cm^{coin}$          | [coin](coin.md) [commitment](../crypto/commitment.md) as field element |
-| $cm^{value}_x$       | x coordinate of supply point [commitment](../crypto/commitment.md)     |
-| $cm^{value}_y$       | y coordinate of supply point [commitment](../crypto/commitment.md)     |
-| $cm^{token}$         | [commitment](../crypto/commitment.md) of [tokenId](token_id.md) as field element      |
-
-| Witnesses            | Description                                                        |
-|----------------------|--------------------------------------------------------------------|
-| $authority^{secret}$ | minting authority [secret key](../crypto/keypair.md)                                       |
-| value                | token minted supply value                                          |
-| $rcpt_x$             | token recipient [public key](../crypto/keypair.md) x coordinate                            |
-| $rcpt_y$             | token recipient [public key](../crypto/keypair.md) y coordinate                            |
-| sn                   | [coin](coin.md) serial number                                      |
-| spendHook            | contract related contract                                          |
-| data                 | input data for spendHook contract                                  |
-| $blind^{value}$      | blinding term for burn value [commitment](../crypto/commitment.md) |
-| $blind^{token}$      | blinding term for [tokenId](token_id.md) [commitment](../crypto/commitment.md)   |

doc/src/spec/pos/burn.md

@@ -1,41 +0,0 @@
-# leadership burn proof
-
-proof of burn of staked coin.
-
-$$ X = (sn, ep, pk_x, pk_y, root, cm_x^{value}, cm_y^{value}) $$
-$$ W = (value, ep, nonce, value_{blind}, sk, \tau ,path) $$
-$$ \mathcal{L}= \{X:W\in \mathcal{R}\} $$
-
-| Public Input | Description                                                |
-|--------------|------------------------------------------------------------|
-|     sn[^1]       | nullifier is hash of nonce nonce, and sk                   |
-|     ep       | epoch index                                                |
-|    $pk_x$    | coin public key pk affine x coordinate                     |
-|    $pk_y$    | coin public key pk affine y coordinate                     |
-|     root     | root of coins commitments tree                             |
-|$cm_x^{value}$| value commitment affine x coordinate                       |
-|$cm_y^{value}$| value commitment affine y coordinate                       |
-
-
-
-|  Witnesses   | Description                                                |
-|--------------|------------------------------------------------------------|
-|    value     | coin value $\in \mathbb{Z}$ or u64                         |
-|     ep       | epoch index                                                |
-|   nonce[^2]      | random nonce derived from previous coin                    |
-| $value_{blind}$  | blinding scalar for value commitment                   |
-|     sk       | coin secret key                                            |
-|    $\tau$    | C position rooted by root                                  |
-|    path      | path of C at position $\tau$                               |
-
-
-
-| Functions    | Description                                                |
-|--------------|------------------------------------------------------------|
-| pk           | commitment to sk                                           |
-| C            | $hash(pk_x||pk_y||value||ep|nonce)$                        |
-| $cm^{value}$ | commitment to value                                        |
-
-
-[^1]: if you read this after zerocash which crypsinous is based off, both papers calls nullifiers serial numbers. and serial number is nonce, `sn` in the table below can be called `nullifier` in our contract using zcash sapling terminology which is used in our money contract (sapling contract).
-[^2]: if you read this after zerocash which crypsinous is based off, both papers calls nullifiers serial numbers. and serial number is nonce, `nonce` can be called `input/output serial` in our contracts using zcash sapling terminology which is used in our money contract (sapling contract).

doc/src/spec/pos/mint.md

@@ -1,31 +0,0 @@
-# leadership mint proof
-
-$$ X = (ep, C, cm_x^{value}, cm_y^{value}) $$
-$$ W = (pk_x, pk_y, value, ep, nonce, value_{blind}) $$
-$$ \mathcal{L}= \{X:W\in \mathcal{R}\} $$
-
-| Public Input | Description                                                |
-|--------------|------------------------------------------------------------|
-|     ep       | epoch index                                                |
-|     C        | coin commitment                                            |
-|$cm_x^{value}$| value commitment affine x coordinate                       |
-|$cm_y^{value}$| value commitment affine y coordinate                       |
-
-|  Witnesses    | Description                                                |
-|---------------|------------------------------------------------------------|
-|    $pk_x$     | coin public key pk affine x coordinate                     |
-|    $pk_y$     | coin public key pk affine y coordinate                     |
-|    value      | coin value $\in \mathbb{Z}$ or u64                         |
-|     ep        | epoch index                                                |
-|   nonce[^1]       | random nonce derived from previous coin                    |
-|$value_{blind}$| blinding scalar for value commitment                       |
------------------------------------------------------------------------------------
-
-
-| Functions    | Description                                                |
-|--------------|------------------------------------------------------------|
-| pk           | commitment to sk                                           |
-| C            | $hash(pk_x||pk_y||value||ep|nonce)$                        |
-| $cm^{value}$ | commitment to value                                        |
-
-[^1]: if you read this after zerocash which crypsinous is based off, both papers calls nullifiers serial numbers. and serial number is nonce, `sn` in the table below can be called `nullifier` in our contract using zcash sapling terminology which is used in our money contract (sapling contract).

doc/src/spec/pos/proposal.md

@@ -1,60 +0,0 @@
-# Proposal
-
-
-$$ X = (sn, ep, pk_x, pk_y, root, cm_x^{value}, cm_y^{value}, reward, cm_x^{value^{out}}, cm_y^{value^{out}}, C, \mu_y, y, \mu_{\rho}, \rho,\sigma_1, \sigma_2, headstart) $$
-$$ W = (sk, nonce, value, ep, reward, value_{blind}, \tau, path, value_{blind}^{out}, \mu_y, \mu_{\rho}, \sigma1, \sigma2, headstart) $$
-$$ \mathcal{L}= \{X:W\in \mathcal{R}\} $$
-
-
-| Public Input       | Description                                                |
-|--------------------|------------------------------------------------------------|
-|     sn[^1]         | nullifier is hash of nonce nonce, and sk                   |
-|     ep             | epoch index                                                |
-|    $pk_x$          | coin public key pk affine x coordinate                     |
-|    $pk_y$          | coin public key pk affine y coordinate                     |
-|     root           | root of coins commitments tree                             |
-|$cm_x^{value}$      | value commitment affine x coordinate                       |
-|$cm_y^{value}$      | value commitment affine y coordinate                       |
-| reward             | lottery reward value $\in \mathbb{Z}$ of type u64          |
-|$cm_x^{value^{out}}$| value commitment affine x coordinate                       |
-|$cm_y^{value^{out}}$| value commitment affine y coordinate                       |
-|     $C^{out}$      | coin commitment                                            |
-| $\mu_y$            | random, deterministic PRF output                           |
-| $\mu_{\rho}$       | random, deterministic PRF output                           |
-| $\rho$             | on-chain entropy as hash of nonce, and $\mu_{\rho}$        |
-| $\sigma_1$         | target function approximation first term coefficient       |
-| $\sigma_2$         | target function approximation second term coefficient      |
------------------------------------------------------------------------------------
-
-
-
-|  Witnesses          | Description                                                |
-|---------------------|------------------------------------------------------------|
-| sk                  | coin secret key derived from previous coin sk              |
-|   nonce[^2]         | random nonce derived from previous coin                    |
-|    value            | coin value $\in \mathbb{Z}$ or u64                         |
-|     ep              | epoch index                                                |
-| reward              | lottery reward value $\in \mathbb{Z}$ of type u64          |
-| $value_{blind}$     | blinding scalar for value commitment                       |
-|    $\tau$           | C position rooted by root                                  |
-|    path             | path of C at position $\tau$                               |
-|$value_{blind}^{out}$| blinding scalar for value commitment of newly minted coin  |
-| $\mu_y$             | random, deterministic PRF output                           |
-| $\mu_{\rho}$        | random, deterministic PRF output                           |
-| $\sigma_1$          | target function approximation first term coefficient       |
-| $\sigma_2$          | target function approximation second term coefficient      |
-| headstart           | competitive advantage added to target T                    |
------------------------------------------------------------------------------------
-
-Table: if you read this after zerocash which crypsinous is based off, both papers calls nullifiers serial numbers. and serial number is nonce, `sn` in the table below can be called `nullifier` in our contract, similarly `nonce` can be called `input/output serial` using zcash sapling terminology which is used in our money contract (sapling contract).
-
-
-
-| Functions    | Description                                                |
-|--------------|------------------------------------------------------------|
-| $value^{out}$| value + reward                                             |
-| $nonce^{out}$| $hash(sk||nonce)$                                          |
-| $sk^{out}$   | $hash(sk)$                                                 |
-| $pk^{out}$   | commitment to $sk^{out}$                                   |
-| $C^{out}$    | $hash(pk_x^{out}||pk_y^{out}||value^{out}||ep|nonce^{out})$|
-| $cm^{value}$ | commitment to $value^{out}$                                |