# :set syntax=pism
# :source ../scripts/pism.vim
constant G_VCV FixedGenerator
constant G_VCR FixedGenerator
constant G_SPEND FixedGenerator
constant G_PROOF FixedGenerator
constant G_NOTE_COMMIT_R FixedGenerator
constant G_NULL FixedGenerator
constant CRH_IVK BlakePersonalization
constant NOTE_COMMIT PedersenPersonalization
constant MERKLE_0 PedersenPersonalization
constant MERKLE_1 PedersenPersonalization
constant MERKLE_2 PedersenPersonalization
constant MERKLE_3 PedersenPersonalization
# ...
constant PRF_NF BlakePersonalization
constant JUBJUB_FR_CAPACITY ByteSize

contract input_spend
param secret Fr

#param value U64
#param randomness Fr
#param ak Point
#param ar Fr
#param nsk Fr
#param g_d Point
#param commitment_randomness Fr
#param auth_path_0_0 Scalar
#param auth_path_0_1 Bool
#param auth_path_1_0 Scalar
#param auth_path_1_1 Bool
## ...
#param anchor Scalar
start
fr_as_binary_le secret param:secret
ec_mul_const public secret G_SPEND
emit_ec public

# let rk: Point = ak + ar * G_SPEND
#witness ak param:ak
#assert_not_small_order ak
#fr_as_binary_le ar param:ar
#ec_mul_const ar ar G_SPEND
#ec_add rk ak ar
## emit rk
#emit_ec rk
#
## let nk: Point = nsk * G_PROOF
#fr_as_binary_le nsk param:nsk
#ec_mul_const nk nsk G_PROOF
#
## let mut ivk_preimage: BinaryNumber = []
#alloc_binary ivk_preimage
## ivk_preimage.put(ak)
#ec_repr repr_ak ak
#binary_extend ivk_preimage repr_ak
#
## let mut nf_preimage: BinaryNumber = []
#alloc_binary nf_preimage
#ec_repr repr_nk nk
#binary_clone repr_nk repr_nk2
## ivk_preimage.put(nk)
#binary_extend ivk_preimage repr_nk
## nf_preimage.put(nk)
#binary_extend ivk_preimage repr_nk2
#
## assert ivk_preimage.len() == 512
#static_assert_binary_size ivk_preimage 512
## assert nf_preimage.len() == 256
#static_assert_binary_size nf_preimage 256
#
## let mut ivk = blake2s(ivk_preimage, CRH_IVK)
#blake2s ivk ivk_preimage CRH_IVK
## ivk.truncate(JUBJUB_FR_CAPACITY)
#binary_truncate ivk JUBJUB_FR_CAPACITY
#
## let pk_d: Point = ivk * g_d
#witness g_d param:g_d
#assert_not_small_order g_d
#ec_mul pk_d ivk g_d
#
## let cv: Point = value * G_VCV + rcv * G_VCR
#u64_as_binary_le value_bits param:value
#ec_mul_const value value_bits G_VCV
#fr_as_binary_le rcv param:randomness
#ec_mul_const rcv rcv G_VCR
#ec_add cv value rcv
## emit cv
#emit_ec cv
#
## let mut note_contents: BinaryNumber = []
#alloc_binary note_contents
#
## note_contents.put(value)
#binary_extend note_contents value
## note_contents.put(g_d)
#ec_repr repr_g_d g_d
#binary_extend note_contents repr_g_d
## note_contents.put(p_k)
#ec_repr repr_p_k p_k
#binary_extend note_contents repr_p_k
## assert note_contents.len() == 64 + 256 + 256
#static_assert_binary_size ivk_preimage 576
#
## let mut cm = pedersen_hash(note_contents, NOTE_COMMIT)
#pedersen_hash cm note_contents NOTE_COMMIT
## cm += commitment_randomness * G_NOTE_COMMIT_R
#fr_as_binary_le rcm param:commitment_randomness
#ec_mul_const cm1 rcm G_NOTE_COMMIT_R
#ec_add cm cm cm1
#
## let mut position = []
#alloc_binary position
## let mut cur: Scalar = cm.u
#ec_get_u cur cm
#
## There are no loops in this language.
## ZK proofs must have a fixed size.
## So in this assembly we UNROLL all loops.
## for i in range(auth_path.size()):
##
## Here we give the example of loop 0.
## Replace the indexes with the value i
## Below line is auth_path[0].1
#
## let (node: Scalar, is_right: Bool) = auth_path[i]
## position.push(is_right)
#alloc_bit cur_is_right param:auth_path_0_1
#clone_bit cur_is_right2 cur_is_right
#binary_push position cur_is_right2
#alloc_num path_element param:auth_path_0_0
## let (left: Scalar, right: Scalar) = swap_if(is_right, cur, node)
#conditionally_reverse ulur cur path_element is_right
#get_0 ul ulur
#get_1 ur ulur
## let mut preimage: BinaryNumber = []
#alloc_binary preimage
## preimage.put(left)
#num_to_binary ul_bits ul
#binary_extend preimage ul_bits
## preimage.put(right)
#num_to_binary ur_bits ur
#binary_extend preimage ur_bits
## cur = pedersen_hash(MERKLE_TREE[i], preimage).u
#pedersen_hash curhash preimage MERKLE_0
#ec_get_u cur curhash
## ... repeat the above N times
#
## enforce cur == rt
#alloc_num rt param:anchor
#num_enforce_equal cur rt
## emit rt
#emit_num rt
#
## let rho: Point = rho + position * G_NULL
#ec_mul_const position position_bits G_NULL
#ec_add rho rho position
## nf_preimage.put(rho)
#ec_repr repr_rho rho
#binary_extend nf_preimage repr_rho
## assert nf_preimage.len() == 512
#static_assert_binary_size nf_preimage 512
#
## let nf: BinaryNumber = blake2s(nf_preimage, PRF_NF)
#blake2s nf nf_preimage PRF_NF
#emit_binary nf
end