|
|
@@ -1,7 +1,7 @@
|
|
|
use halo2_gadgets::{
|
|
|
ecc::{
|
|
|
chip::{EccChip, EccConfig},
|
|
|
- FixedPoint, FixedPointShort,NonIdentityPoint,Point
|
|
|
+ FixedPoint, FixedPointShort, NonIdentityPoint, Point,
|
|
|
},
|
|
|
poseidon::{Hash as PoseidonHash, Pow5Chip as PoseidonChip, Pow5Config as PoseidonConfig},
|
|
|
primitives::poseidon::{ConstantLength, P128Pow5T3},
|
|
|
@@ -18,7 +18,7 @@ use halo2_gadgets::{
|
|
|
use halo2_proofs::{
|
|
|
circuit::{AssignedCell, Layouter, SimpleFloorPlanner},
|
|
|
plonk,
|
|
|
- plonk::{Advice, Circuit, Column, ConstraintSystem, Instance as InstanceColumn, Error},
|
|
|
+ plonk::{Advice, Circuit, Column, ConstraintSystem, Error, Instance as InstanceColumn},
|
|
|
};
|
|
|
|
|
|
use pasta_curves::{pallas, Fp};
|
|
|
@@ -32,47 +32,41 @@ use crate::crypto::{
|
|
|
merkle_node::MerkleNode,
|
|
|
};
|
|
|
|
|
|
-
|
|
|
use crate::zk::{
|
|
|
- arith_chip::{ArithmeticChipConfig, ArithmeticChip},
|
|
|
- greater_than::{GreaterThanChip, GreaterThanConfig, GreaterThanInstruction},
|
|
|
+ arith_chip::{ArithmeticChip, ArithmeticChipConfig},
|
|
|
even_bits::{EvenBitsChip, EvenBitsConfig, EvenBitsLookup},
|
|
|
+ greater_than::{GreaterThanChip, GreaterThanConfig, GreaterThanInstruction},
|
|
|
};
|
|
|
|
|
|
-use pasta_curves::group::Curve;
|
|
|
-use pasta_curves::arithmetic::CurveAffine;
|
|
|
+use pasta_curves::{arithmetic::CurveAffine, group::Curve};
|
|
|
//use halo2_proofs::arithmetic::CurveAffine;
|
|
|
-use pasta_curves::group::ff::PrimeField;
|
|
|
-use pasta_curves::group::GroupEncoding;
|
|
|
+use pasta_curves::group::{ff::PrimeField, GroupEncoding};
|
|
|
|
|
|
+const WORD_BITS: u32 = 24;
|
|
|
|
|
|
-const WORD_BITS : u32 = 24;
|
|
|
-
|
|
|
-#[derive(Clone,Debug)]
|
|
|
-pub struct LeadConfig
|
|
|
-{
|
|
|
+#[derive(Clone, Debug)]
|
|
|
+pub struct LeadConfig {
|
|
|
primary: Column<InstanceColumn>,
|
|
|
- advices: [Column<Advice>;12],
|
|
|
+ advices: [Column<Advice>; 12],
|
|
|
ecc_config: EccConfig<OrchardFixedBases>,
|
|
|
- poseidon_config: PoseidonConfig<pallas::Base,3,2>,
|
|
|
+ poseidon_config: PoseidonConfig<pallas::Base, 3, 2>,
|
|
|
merkle_config_1: MerkleConfig<OrchardHashDomains, OrchardCommitDomains, OrchardFixedBases>,
|
|
|
merkle_config_2: MerkleConfig<OrchardHashDomains, OrchardCommitDomains, OrchardFixedBases>,
|
|
|
- sinsemilla_config_1: SinsemillaConfig<OrchardHashDomains, OrchardCommitDomains, OrchardFixedBases>,
|
|
|
- sinsemilla_config_2: SinsemillaConfig<OrchardHashDomains, OrchardCommitDomains, OrchardFixedBases>,
|
|
|
+ sinsemilla_config_1:
|
|
|
+ SinsemillaConfig<OrchardHashDomains, OrchardCommitDomains, OrchardFixedBases>,
|
|
|
+ sinsemilla_config_2:
|
|
|
+ SinsemillaConfig<OrchardHashDomains, OrchardCommitDomains, OrchardFixedBases>,
|
|
|
greaterthan_config: GreaterThanConfig,
|
|
|
evenbits_config: EvenBitsConfig,
|
|
|
arith_config: ArithmeticChipConfig,
|
|
|
}
|
|
|
|
|
|
-impl LeadConfig
|
|
|
-{
|
|
|
- fn ecc_chip(&self) -> EccChip<OrchardFixedBases>
|
|
|
- {
|
|
|
+impl LeadConfig {
|
|
|
+ fn ecc_chip(&self) -> EccChip<OrchardFixedBases> {
|
|
|
EccChip::construct(self.ecc_config.clone())
|
|
|
}
|
|
|
|
|
|
- fn poseidon_chip(&self) -> PoseidonChip<pallas::Base, 3, 2>
|
|
|
- {
|
|
|
+ fn poseidon_chip(&self) -> PoseidonChip<pallas::Base, 3, 2> {
|
|
|
PoseidonChip::construct(self.poseidon_config.clone())
|
|
|
}
|
|
|
|
|
|
@@ -96,7 +90,6 @@ impl LeadConfig
|
|
|
EvenBitsChip::construct(self.evenbits_config.clone())
|
|
|
}
|
|
|
|
|
|
-
|
|
|
fn arith_chip(&self) -> ArithmeticChip {
|
|
|
ArithmeticChip::construct(self.arith_config.clone())
|
|
|
}
|
|
|
@@ -108,41 +101,41 @@ const LEAD_COIN_PK_X_OFFSET: usize = 2;
|
|
|
const LEAD_COIN_PK_Y_OFFSET: usize = 3;
|
|
|
const LEAD_COIN_SERIAL_NUMBER_X_OFFSET: usize = 4;
|
|
|
const LEAD_COIN_SERIAL_NUMBER_Y_OFFSET: usize = 5;
|
|
|
-const LEAD_COIN_COMMIT_X_OFFSET : usize = 6;
|
|
|
-const LEAD_COIN_COMMIT_Y_OFFSET : usize = 7;
|
|
|
-const LEAD_COIN_COMMIT2_X_OFFSET : usize = 8;
|
|
|
-const LEAD_COIN_COMMIT2_Y_OFFSET : usize = 9;
|
|
|
+const LEAD_COIN_COMMIT_X_OFFSET: usize = 6;
|
|
|
+const LEAD_COIN_COMMIT_Y_OFFSET: usize = 7;
|
|
|
+const LEAD_COIN_COMMIT2_X_OFFSET: usize = 8;
|
|
|
+const LEAD_COIN_COMMIT2_Y_OFFSET: usize = 9;
|
|
|
const LEAD_COIN_COMMIT_PATH_OFFSET: usize = 10;
|
|
|
const LEAD_THRESHOLD_OFFSET: usize = 11;
|
|
|
|
|
|
-#[derive(Debug,Default)]
|
|
|
+#[derive(Debug, Default)]
|
|
|
pub struct LeadContract {
|
|
|
// witness
|
|
|
- pub path : Option<[MerkleNode;MERKLE_DEPTH_ORCHARD]>,
|
|
|
- pub root_sk : Option<pallas::Scalar>, // coins merkle tree secret key of coin1
|
|
|
- pub path_sk : Option<[MerkleNode; MERKLE_DEPTH_ORCHARD]>, // path to the secret key root_sk
|
|
|
+ pub path: Option<[MerkleNode; MERKLE_DEPTH_ORCHARD]>,
|
|
|
+ pub root_sk: Option<pallas::Scalar>, // coins merkle tree secret key of coin1
|
|
|
+ pub path_sk: Option<[MerkleNode; MERKLE_DEPTH_ORCHARD]>, // path to the secret key root_sk
|
|
|
pub coin_timestamp: Option<pallas::Base>,
|
|
|
- pub coin_nonce : Option<pallas::Base>,
|
|
|
- pub coin_opening_1 :Option<pallas::Scalar>,
|
|
|
+ pub coin_nonce: Option<pallas::Base>,
|
|
|
+ pub coin_opening_1: Option<pallas::Scalar>,
|
|
|
pub value: Option<pallas::Base>,
|
|
|
- pub coin_opening_2 :Option<pallas::Scalar>,
|
|
|
+ pub coin_opening_2: Option<pallas::Scalar>,
|
|
|
// public advices
|
|
|
//
|
|
|
//TODO implement two version of load_private one or point, other for base
|
|
|
// or templated load_private. then you would be able to read (x,y) from cm_c
|
|
|
- pub cm_c1_x : Option<pallas::Base>,
|
|
|
- pub cm_c1_y : Option<pallas::Base>,
|
|
|
+ pub cm_c1_x: Option<pallas::Base>,
|
|
|
+ pub cm_c1_y: Option<pallas::Base>,
|
|
|
//
|
|
|
- pub cm_c2_x : Option<pallas::Base>,
|
|
|
- pub cm_c2_y : Option<pallas::Base>,
|
|
|
+ pub cm_c2_x: Option<pallas::Base>,
|
|
|
+ pub cm_c2_y: Option<pallas::Base>,
|
|
|
//
|
|
|
- pub cm_pos : Option<u32>,
|
|
|
+ pub cm_pos: Option<u32>,
|
|
|
//
|
|
|
//pub sn_c1 : Option<pallas::Base>,
|
|
|
- pub slot : Option<pallas::Base>,
|
|
|
+ pub slot: Option<pallas::Base>,
|
|
|
pub mau_rho: Option<pallas::Scalar>,
|
|
|
pub mau_y: Option<pallas::Scalar>,
|
|
|
- pub root_cm : Option<pallas::Scalar>,
|
|
|
+ pub root_cm: Option<pallas::Scalar>,
|
|
|
//pub eta : Option<u32>,
|
|
|
//pub rho : Option<u32>,
|
|
|
//pub h : Option<u32>, // hash of this data
|
|
|
@@ -204,7 +197,12 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
meta.enable_constant(lagrange_coeffs[0]);
|
|
|
let range_check = LookupRangeCheckConfig::configure(meta, advices[9], table_idx);
|
|
|
|
|
|
- let ecc_config = EccChip::<OrchardFixedBases>::configure(meta, advices[0..10].try_into().expect("wrong slice size"), lagrange_coeffs, range_check);
|
|
|
+ let ecc_config = EccChip::<OrchardFixedBases>::configure(
|
|
|
+ meta,
|
|
|
+ advices[0..10].try_into().expect("wrong slice size"),
|
|
|
+ lagrange_coeffs,
|
|
|
+ range_check,
|
|
|
+ );
|
|
|
|
|
|
let poseidon_config = PoseidonChip::configure::<P128Pow5T3>(
|
|
|
meta,
|
|
|
@@ -241,11 +239,14 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
(sinsemilla_config_2, merkle_config_2)
|
|
|
};
|
|
|
|
|
|
- let greaterthan_config = GreaterThanChip::<pallas::Base, WORD_BITS>::configure(meta, advices[10..12].try_into().unwrap(), primary);
|
|
|
+ let greaterthan_config = GreaterThanChip::<pallas::Base, WORD_BITS>::configure(
|
|
|
+ meta,
|
|
|
+ advices[10..12].try_into().unwrap(),
|
|
|
+ primary,
|
|
|
+ );
|
|
|
let evenbits_config = EvenBitsChip::<pallas::Base, WORD_BITS>::configure(meta);
|
|
|
let arith_config = ArithmeticChip::configure(meta);
|
|
|
|
|
|
-
|
|
|
LeadConfig {
|
|
|
primary,
|
|
|
advices,
|
|
|
@@ -261,9 +262,10 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
}
|
|
|
}
|
|
|
|
|
|
- fn synthesize(&self,
|
|
|
- config: Self::Config,
|
|
|
- mut layouter: impl Layouter<pallas::Base>,
|
|
|
+ fn synthesize(
|
|
|
+ &self,
|
|
|
+ config: Self::Config,
|
|
|
+ mut layouter: impl Layouter<pallas::Base>,
|
|
|
) -> Result<(), Error> {
|
|
|
SinsemillaChip::load(config.sinsemilla_config_1.clone(), &mut layouter)?;
|
|
|
let ecc_chip = config.ecc_chip();
|
|
|
@@ -322,32 +324,18 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
)?;
|
|
|
*/
|
|
|
|
|
|
-
|
|
|
//let cm_c1_point : pallas::Point = pallas::Point::from(1);
|
|
|
//let cm_c1 : AssignedCell<pallas::Point, pallas::Point> = cm_c1_point;
|
|
|
|
|
|
+ let cm_c1_x =
|
|
|
+ self.load_private(layouter.namespace(|| ""), config.advices[0], self.cm_c1_x)?;
|
|
|
+ let cm_c1_y =
|
|
|
+ self.load_private(layouter.namespace(|| ""), config.advices[0], self.cm_c1_y)?;
|
|
|
|
|
|
- let cm_c1_x = self.load_private(
|
|
|
- layouter.namespace(|| ""),
|
|
|
- config.advices[0],
|
|
|
- self.cm_c1_x,
|
|
|
- )?;
|
|
|
- let cm_c1_y = self.load_private(
|
|
|
- layouter.namespace(|| ""),
|
|
|
- config.advices[0],
|
|
|
- self.cm_c1_y,
|
|
|
- )?;
|
|
|
-
|
|
|
- let cm_c2_x = self.load_private(
|
|
|
- layouter.namespace(|| ""),
|
|
|
- config.advices[0],
|
|
|
- self.cm_c2_x,
|
|
|
- )?;
|
|
|
- let cm_c2_y = self.load_private(
|
|
|
- layouter.namespace(|| ""),
|
|
|
- config.advices[0],
|
|
|
- self.cm_c2_y,
|
|
|
- )?;
|
|
|
+ let cm_c2_x =
|
|
|
+ self.load_private(layouter.namespace(|| ""), config.advices[0], self.cm_c2_x)?;
|
|
|
+ let cm_c2_y =
|
|
|
+ self.load_private(layouter.namespace(|| ""), config.advices[0], self.cm_c2_y)?;
|
|
|
|
|
|
/*
|
|
|
let cm_pos = self.load_private(
|
|
|
@@ -371,11 +359,7 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
)?;
|
|
|
*/
|
|
|
|
|
|
- let slot = self.load_private(
|
|
|
- layouter.namespace(|| ""),
|
|
|
- config.advices[0],
|
|
|
- self.slot,
|
|
|
- )?;
|
|
|
+ let slot = self.load_private(layouter.namespace(|| ""), config.advices[0], self.slot)?;
|
|
|
|
|
|
/*
|
|
|
let rho = self.load_private(
|
|
|
@@ -432,10 +416,11 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
// coin 2 nonce
|
|
|
// ===============
|
|
|
// m*G_1
|
|
|
- let (com, _ ) = {
|
|
|
+ let (com, _) = {
|
|
|
let nonce2_commit_v = ValueCommitV;
|
|
|
let nonce2_commit_v = FixedPointShort::from_inner(ecc_chip.clone(), nonce2_commit_v);
|
|
|
- nonce2_commit_v.mul(layouter.namespace(|| "coin_pk commit v"), (coin_nonce.clone(), one.clone()))?
|
|
|
+ nonce2_commit_v
|
|
|
+ .mul(layouter.namespace(|| "coin_pk commit v"), (coin_nonce.clone(), one.clone()))?
|
|
|
};
|
|
|
// r*G_2
|
|
|
let (blind, _) = {
|
|
|
@@ -461,12 +446,12 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
// coin public key constraints derived from the coin timestamp
|
|
|
// ================
|
|
|
|
|
|
-
|
|
|
// m*G_1
|
|
|
- let (com, _ ) = {
|
|
|
+ let (com, _) = {
|
|
|
let coin_pk_commit_v = ValueCommitV;
|
|
|
let coin_pk_commit_v = FixedPointShort::from_inner(ecc_chip.clone(), coin_pk_commit_v);
|
|
|
- coin_pk_commit_v.mul(layouter.namespace(|| "coin_pk commit v"), (coin_timestamp, one.clone()))?
|
|
|
+ coin_pk_commit_v
|
|
|
+ .mul(layouter.namespace(|| "coin_pk commit v"), (coin_timestamp, one.clone()))?
|
|
|
};
|
|
|
// r*G_2
|
|
|
let (blind, _) = {
|
|
|
@@ -493,15 +478,17 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
// nonce constraints derived from previous coin's nonce
|
|
|
// =================
|
|
|
|
|
|
-
|
|
|
// =============
|
|
|
// constrain coin c1 serial number
|
|
|
// =============
|
|
|
// m*G_1
|
|
|
- let (com, _ ) = {
|
|
|
+ let (com, _) = {
|
|
|
let sn_commit_v = ValueCommitV;
|
|
|
let sn_commit_v = FixedPointShort::from_inner(ecc_chip.clone(), sn_commit_v);
|
|
|
- sn_commit_v.mul(layouter.namespace(|| "coin serial number commit v"), (coin_nonce.clone(), one.clone()))?
|
|
|
+ sn_commit_v.mul(
|
|
|
+ layouter.namespace(|| "coin serial number commit v"),
|
|
|
+ (coin_nonce.clone(), one.clone()),
|
|
|
+ )?
|
|
|
};
|
|
|
// r*G_2
|
|
|
let (blind, _) = {
|
|
|
@@ -541,10 +528,11 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
//but only single value is in witness.
|
|
|
|
|
|
let coin_hash = {
|
|
|
- let poseidon_message = [coin_pk_commit.inner().x(),
|
|
|
- coin_pk_commit.inner().y(),
|
|
|
- coin_value.clone(),
|
|
|
- coin_nonce.clone()
|
|
|
+ let poseidon_message = [
|
|
|
+ coin_pk_commit.inner().x(),
|
|
|
+ coin_pk_commit.inner().y(),
|
|
|
+ coin_value.clone(),
|
|
|
+ coin_nonce.clone(),
|
|
|
];
|
|
|
|
|
|
let poseidon_hasher = PoseidonHash::<_, _, P128Pow5T3, ConstantLength<4>, 3, 2>::init(
|
|
|
@@ -558,7 +546,7 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
let poseidon_output: AssignedCell<Fp, Fp> = poseidon_output;
|
|
|
poseidon_output
|
|
|
};
|
|
|
- let (com, _ ) = {
|
|
|
+ let (com, _) = {
|
|
|
let coin_commit_v = ValueCommitV;
|
|
|
let coin_commit_v = FixedPointShort::from_inner(ecc_chip.clone(), coin_commit_v);
|
|
|
coin_commit_v.mul(layouter.namespace(|| "coin commit v"), (coin_hash, one.clone()))?
|
|
|
@@ -567,15 +555,18 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
let (blind, _) = {
|
|
|
let coin_commit_r = OrchardFixedBasesFull::ValueCommitR;
|
|
|
let coin_commit_r = FixedPoint::from_inner(ecc_chip.clone(), coin_commit_r);
|
|
|
- coin_commit_r.mul(layouter.namespace(|| "coin serial number commit R"), self.coin_opening_1)?
|
|
|
+ coin_commit_r
|
|
|
+ .mul(layouter.namespace(|| "coin serial number commit R"), self.coin_opening_1)?
|
|
|
};
|
|
|
- let coin_commit = com.add(layouter.namespace(|| "nonce commit"), &blind)?;
|
|
|
+ let coin_commit = com.add(layouter.namespace(|| "nonce commit"), &blind)?;
|
|
|
|
|
|
- let coin_commit_x : AssignedCell<Fp, Fp> = coin_commit.inner().x();
|
|
|
- let coin_commit_y : AssignedCell<Fp, Fp> = coin_commit.inner().y();
|
|
|
+ let coin_commit_x: AssignedCell<Fp, Fp> = coin_commit.inner().x();
|
|
|
+ let coin_commit_y: AssignedCell<Fp, Fp> = coin_commit.inner().y();
|
|
|
|
|
|
- let cm1_zero_out_x = ar_chip.sub(layouter.namespace(|| "sub to zero"), coin_commit_x.clone(), cm_c1_x)?;
|
|
|
- let cm1_zero_out_y = ar_chip.sub(layouter.namespace(|| "sub to zero"), coin_commit_y.clone(), cm_c1_y)?;
|
|
|
+ let cm1_zero_out_x =
|
|
|
+ ar_chip.sub(layouter.namespace(|| "sub to zero"), coin_commit_x.clone(), cm_c1_x)?;
|
|
|
+ let cm1_zero_out_y =
|
|
|
+ ar_chip.sub(layouter.namespace(|| "sub to zero"), coin_commit_y.clone(), cm_c1_y)?;
|
|
|
|
|
|
// constrain coin's pub key x value
|
|
|
layouter.constrain_instance(
|
|
|
@@ -592,11 +583,12 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
|
|
|
//
|
|
|
let coin2_hash = {
|
|
|
- let poseidon_message = [coin_pk_commit.inner().x(),
|
|
|
- coin_pk_commit.inner().y(),
|
|
|
- coin_value.clone(),
|
|
|
- coin2_nonce.inner().x(),
|
|
|
- coin2_nonce.inner().y(),
|
|
|
+ let poseidon_message = [
|
|
|
+ coin_pk_commit.inner().x(),
|
|
|
+ coin_pk_commit.inner().y(),
|
|
|
+ coin_value.clone(),
|
|
|
+ coin2_nonce.inner().x(),
|
|
|
+ coin2_nonce.inner().y(),
|
|
|
];
|
|
|
|
|
|
let poseidon_hasher = PoseidonHash::<_, _, P128Pow5T3, ConstantLength<5>, 3, 2>::init(
|
|
|
@@ -610,7 +602,7 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
let poseidon_output: AssignedCell<Fp, Fp> = poseidon_output;
|
|
|
poseidon_output
|
|
|
};
|
|
|
- let (com, _ ) = {
|
|
|
+ let (com, _) = {
|
|
|
let coin_commit_v = ValueCommitV;
|
|
|
let coin_commit_v = FixedPointShort::from_inner(ecc_chip.clone(), coin_commit_v);
|
|
|
coin_commit_v.mul(layouter.namespace(|| "coin commit v"), (coin2_hash, one.clone()))?
|
|
|
@@ -619,14 +611,16 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
let (blind, _) = {
|
|
|
let coin_commit_r = OrchardFixedBasesFull::ValueCommitR;
|
|
|
let coin_commit_r = FixedPoint::from_inner(ecc_chip.clone(), coin_commit_r);
|
|
|
- coin_commit_r.mul(layouter.namespace(|| "coin serial number commit R"), self.coin_opening_2)?
|
|
|
+ coin_commit_r
|
|
|
+ .mul(layouter.namespace(|| "coin serial number commit R"), self.coin_opening_2)?
|
|
|
};
|
|
|
- let coin2_commit = com.add(layouter.namespace(|| "nonce commit"), &blind)?;
|
|
|
- let coin2_commit_x : AssignedCell<Fp, Fp> = coin2_commit.inner().x();
|
|
|
- let coin2_commit_y : AssignedCell<Fp, Fp> = coin2_commit.inner().y();
|
|
|
- let cm2_zero_out_x = ar_chip.sub(layouter.namespace(|| "sub to zero"), coin2_commit_x, cm_c2_x)?;
|
|
|
- let cm2_zero_out_y = ar_chip.sub(layouter.namespace(|| "sub to zero"), coin2_commit_y, cm_c2_y)?;
|
|
|
-
|
|
|
+ let coin2_commit = com.add(layouter.namespace(|| "nonce commit"), &blind)?;
|
|
|
+ let coin2_commit_x: AssignedCell<Fp, Fp> = coin2_commit.inner().x();
|
|
|
+ let coin2_commit_y: AssignedCell<Fp, Fp> = coin2_commit.inner().y();
|
|
|
+ let cm2_zero_out_x =
|
|
|
+ ar_chip.sub(layouter.namespace(|| "sub to zero"), coin2_commit_x, cm_c2_x)?;
|
|
|
+ let cm2_zero_out_y =
|
|
|
+ ar_chip.sub(layouter.namespace(|| "sub to zero"), coin2_commit_y, cm_c2_y)?;
|
|
|
|
|
|
layouter.constrain_instance(
|
|
|
cm2_zero_out_x.cell(),
|
|
|
@@ -652,7 +646,7 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
path,
|
|
|
);
|
|
|
|
|
|
- let coin_commit_hash : AssignedCell<Fp, Fp> = {
|
|
|
+ let coin_commit_hash: AssignedCell<Fp, Fp> = {
|
|
|
let poseidon_message = [coin_commit_x.clone(), coin_commit_y.clone()];
|
|
|
|
|
|
let poseidon_hasher = PoseidonHash::<_, _, P128Pow5T3, ConstantLength<2>, 3, 2>::init(
|
|
|
@@ -666,8 +660,8 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
let poseidon_output: AssignedCell<Fp, Fp> = poseidon_output;
|
|
|
poseidon_output
|
|
|
};
|
|
|
- let computed_final_root =
|
|
|
- merkle_inputs.calculate_root(layouter.namespace(|| "calculate root"), coin_commit_hash )?;
|
|
|
+ let computed_final_root = merkle_inputs
|
|
|
+ .calculate_root(layouter.namespace(|| "calculate root"), coin_commit_hash)?;
|
|
|
|
|
|
layouter.constrain_instance(
|
|
|
computed_final_root.cell(),
|
|
|
@@ -675,12 +669,14 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
LEAD_COIN_COMMIT_PATH_OFFSET,
|
|
|
)?;
|
|
|
|
|
|
-
|
|
|
let message = {
|
|
|
- let (com, _ ) = {
|
|
|
+ let (com, _) = {
|
|
|
let commit_v = ValueCommitV;
|
|
|
let commit_v = FixedPointShort::from_inner(ecc_chip.clone(), commit_v);
|
|
|
- commit_v.mul(layouter.namespace(|| "coin commit v"), (coin_nonce.clone(), one.clone()))?
|
|
|
+ commit_v.mul(
|
|
|
+ layouter.namespace(|| "coin commit v"),
|
|
|
+ (coin_nonce.clone(), one.clone()),
|
|
|
+ )?
|
|
|
};
|
|
|
// r*G_2
|
|
|
let (blind, _) = {
|
|
|
@@ -689,17 +685,18 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
commit_r.mul(layouter.namespace(|| "coin serial number commit R"), self.root_sk)?
|
|
|
};
|
|
|
com.add(layouter.namespace(|| "nonce commit"), &blind)?
|
|
|
-
|
|
|
};
|
|
|
- let message_sum = ar_chip.add(layouter.namespace(|| "msg x + y"),
|
|
|
- message.inner().x(),
|
|
|
- message.inner().y(),
|
|
|
+ let message_sum = ar_chip.add(
|
|
|
+ layouter.namespace(|| "msg x + y"),
|
|
|
+ message.inner().x(),
|
|
|
+ message.inner().y(),
|
|
|
)?;
|
|
|
|
|
|
- let (com, _ ) = {
|
|
|
+ let (com, _) = {
|
|
|
let y_commit_v = ValueCommitV;
|
|
|
let y_commit_v = FixedPointShort::from_inner(ecc_chip.clone(), y_commit_v);
|
|
|
- y_commit_v.mul(layouter.namespace(|| "coin commit v"), (message_sum.clone(), one.clone()))?
|
|
|
+ y_commit_v
|
|
|
+ .mul(layouter.namespace(|| "coin commit v"), (message_sum.clone(), one.clone()))?
|
|
|
};
|
|
|
// r*G_2
|
|
|
let (blind, _) = {
|
|
|
@@ -712,8 +709,9 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
//let y_commit_base : AssignedCell<Fp,Fp> = pallas::Base::from_repr(y_commit.inner().to_bytes()).unwrap();
|
|
|
//let y_commit_x : AssignedCell<Fp,Fp> = y_commit.inner().x();
|
|
|
//let y_commit_x_base = y_commit.inner().x().value().unwrap();
|
|
|
- let y_commit_base_temp = pallas::Base::from_repr(y_commit.inner().point().unwrap().to_bytes()).unwrap();
|
|
|
- let y_commit_base = self.load_private(
|
|
|
+ let y_commit_base_temp =
|
|
|
+ pallas::Base::from_repr(y_commit.inner().point().unwrap().to_bytes()).unwrap();
|
|
|
+ let y_commit_base = self.load_private(
|
|
|
layouter.namespace(|| "load coin y commit as pallas::base"),
|
|
|
config.advices[0],
|
|
|
Some(y_commit_base_temp),
|
|
|
@@ -722,7 +720,7 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
// ============================
|
|
|
// constraint rho
|
|
|
// ============================
|
|
|
- let (com, _ ) = {
|
|
|
+ let (com, _) = {
|
|
|
let rho_commit_v = ValueCommitV;
|
|
|
let rho_commit_v = FixedPointShort::from_inner(ecc_chip.clone(), rho_commit_v);
|
|
|
rho_commit_v.mul(layouter.namespace(|| "coin commit v"), (message_sum, one.clone()))?
|
|
|
@@ -739,19 +737,22 @@ impl Circuit<pallas::Base> for LeadContract {
|
|
|
// that the coin value never get past it.
|
|
|
|
|
|
let scalar = self.load_private(
|
|
|
- layouter.namespace(||"load scalar "),
|
|
|
+ layouter.namespace(|| "load scalar "),
|
|
|
config.advices[0],
|
|
|
- Some(pallas::Base::from(1024))
|
|
|
+ Some(pallas::Base::from(1024)),
|
|
|
)?;
|
|
|
let c = pallas::Scalar::from(3); // leadership coefficient
|
|
|
- let target : AssignedCell<Fp,Fp> = ar_chip.mul(layouter.namespace(|| "calculate target"), scalar, coin_value)?;
|
|
|
-
|
|
|
+ let target: AssignedCell<Fp, Fp> =
|
|
|
+ ar_chip.mul(layouter.namespace(|| "calculate target"), scalar, coin_value)?;
|
|
|
|
|
|
eb_chip.decompose(layouter.namespace(|| "target range check"), target.clone())?;
|
|
|
eb_chip.decompose(layouter.namespace(|| "y_commit range check"), y_commit_base.clone())?;
|
|
|
|
|
|
-
|
|
|
- let (helper, is_gt) = greater_than_chip.greater_than(layouter.namespace(||"t>y"), target.into() , y_commit_base.into())?; //note assuming x,y coordinates are true random each?
|
|
|
+ let (helper, is_gt) = greater_than_chip.greater_than(
|
|
|
+ layouter.namespace(|| "t>y"),
|
|
|
+ target.into(),
|
|
|
+ y_commit_base.into(),
|
|
|
+ )?; //note assuming x,y coordinates are true random each?
|
|
|
eb_chip.decompose(layouter.namespace(|| "helper range check"), helper.0)?;
|
|
|
layouter.constrain_instance(is_gt.0.cell(), config.primary, LEAD_THRESHOLD_OFFSET)?;
|
|
|
Ok(())
|