Scheme

Let $\t{Params}\t{VC}, \t{Bulla}\t{VC}$ be defined as in Vesting Configuration Model.

Let $\t{Coin}$ be defined as in the section Coin.

Let $ℙₚ, 𝔽ₚ, \mathcal{X}, \mathcal{Y}, \t{𝔹⁶⁴2𝔽ₚ}$ be defined as in the section Pallas and Vesta.

Let $t₀ = \t{BlockWindow} ∈ 𝔽ₚ$ be the current blockwindow as defined in Blockwindow.

Let $\t{PoseidonHash}$ be defined as in the section PoseidonHash Function.

Let $\t{ElGamal.Encrypt}, \t{ElGamalEncNote}ₖ$ be defined as in the section Verifiable In-Band Secret Distribution.

Denote the Vesting contract ID by $\t{CID}\t{V} ∈ 𝔽ₚ$ and its Exec function spend hook by $\t{SH}\t{V} ∈ 𝔽ₚ$.

Vest

This function creates a vesting configuration bulla $ℬ_\t{VC}$. We commit to the vesting configuration params and then add the bulla to the set, along with the vested coin $\t{Coin}$ minted by the child Money::transfer() call. Each vesting configuration keeps track of its minted coins, to ensure that only those can be burned in next actions, creating a sequence of coins, enabling the contract to keep track of remaining balances anonymously. Additionally, we verify the minted vesting coin is encrypted for the configuration shared secret key, ensuring both parties have access to it.

Wallet builder: TODO: add client path
WASM VM code: TODO: add entrypoint path
ZK proof: TODO: add proof path

Function Params

Define the vest function params $$ \begin{aligned} ℬ\t{VC} &∈ \t{im}(\t{Bulla}\t{VC}) \ \t{SPK} &∈ ℙₚ \end{aligned} $$

TODO: Add call params path

Contract Statement

Vesting configuration bulla uniqueness whether $ℬ_\t{VC}$ already exists. If yes then fail.

Let there be a prover auxiliary witness inputs: $$ \begin{aligned} VAx &∈ 𝔽ₚ \ VPK &∈ 𝔽ₚ \ Sx &∈ 𝔽ₚ \ τ &∈ 𝔽ₚ \ T &∈ ℕ₆₄ \ C &∈ ℕ₆₄ \ S &∈ ℕ₆₄ \ E &∈ ℕ₆₄ \ V &∈ ℕ₆₄ \ b\t{VC} &∈ 𝔽ₚ \ b\t{Coin} &∈ 𝔽ₚ \end{aligned} $$

Attach a proof $π$ such that the following relations hold:

Proof that start blockwindow is greater than current blockwindow $S > t₀$.

Proof that end blockwindow is greater than start blockwindow $E > S$.

Proof that total is greater than cliff $T >= C$.

Proof that blockwindow value is valid $T == (E - S) * V + C$.

Proof of vesting authority public key ownership $\t{VAPK} = \t{DerivePubKey}(VAx)$.

Proof of shared secret public key ownership $\t{SPK} = \t{DerivePubKey}(Sx)$.

Vesting configuration bulla integrity $ℬ = \t{Bulla}\t{VC}(\mathcal{X}(p.\t{VAPK}), \mathcal{Y}(p.\t{VAPK}), \mathcal{X}(p.\t{VPK}), \mathcal{Y}(p.\t{VPK}), \mathcal{X}(p.\t{SPK}), \mathcal{Y}(p.\t{SPK}), t, T, C, S, E, V, b\t{VC})$

Minted vested coin integrity $Coin = \t{PoseidonHash}(\mathcal{X}(p.\t{SPK}), \mathcal{Y}(p.\t{SPK}), T, t, \t{CID}\t{V}, \t{SH}\t{V}, ℬ, b_\t{Coin})$

Verifiable vested coin note encryption let $𝐧 = (c.v, c.τ, c.\t{SH}, c.\t{UD}, c.n)$, and verify $a = \t{ElGamal}.\t{Encrypt}(𝐧, \t{esk}, d.\t{SPK})$.

Signatures

There should be a single signature attached, which uses $\t{SPK}$ as the signature public key.

Withdraw

This function enables the vestee to withdraw the corresponding unlocked value up to that blockwindow. The child Money::transfer() call must contain a single input, the vested coin we burn, and two outputs. The first one being the withdrawed one while the second one is the remaining vested balance coin. Both coins values are verified by the vesting configuration rules, and we store the second one as the current vested coin, to burn in next actions. Additionally, we verify the second/vested coin is encrypted for the configuration shared secret key, ensuring both parties have access to it.

Wallet builder: TODO: add client path
WASM VM code: TODO: add entrypoint path
ZK proof: TODO: add proof path

Function Params

Define the withdraw function params $$ \begin{aligned} ℬ\t{VC} &∈ \t{im}(\t{Bulla}\t{VC}) \ \t{SPK} &∈ ℙₚ \end{aligned} $$

TODO: Add call params path

Contract Statement

Vesting configuration bulla existance whether $ℬ_\t{VC}$ exists. If no then fail.

Burned vested coin existance whether the burned coin $\t{BCoin}$ matches the vesting configuration record one. If no then fail.

Let there be a prover auxiliary witness inputs: $$ \begin{aligned} VAPK &∈ 𝔽ₚ \ Vx &∈ 𝔽ₚ \ Sx &∈ 𝔽ₚ \ τ &∈ 𝔽ₚ \ T &∈ ℕ₆₄ \ C &∈ ℕ₆₄ \ S &∈ ℕ₆₄ \ E &∈ ℕ₆₄ \ V &∈ ℕ₆₄ \ b\t{VC} &∈ 𝔽ₚ \ Bv &∈ ℕ₆₄ \ b\t{BCoin} &∈ 𝔽ₚ \ xc &∈ 𝔽ₚ \ Cv &∈ ℕ₆₄ \ b\t{Coin} &∈ 𝔽ₚ \end{aligned} $$

Attach a proof $π$ such that the following relations hold:

Proof of vestee public key ownership $\t{VPK} = \t{DerivePubKey}(Vx)$.

Proof of shared secret public key ownership $\t{SPK} = \t{DerivePubKey}(Sx)$.

Proof that current blockwindow is greater than start blockwindow $t₀ >= S$.

TODO: cond_select statement to pick current or end blockwindow

Proof of withdraw amount correctness $$ \begin{aligned} CurrentBlockwindow = CondSelect(BlockwindowCond, t₀, E); \ BlockwindowsPassed = CurrentBlockwindow - S; \ Available = (BlockwindowsPassed * V) + C; \ Withdrawn = T - Bv; \ WithdrawlCoinValue = Available - Withdrawn; \ VestingChangeValue = T - (Withdrawn + WithdrawlCoinValue); \end{aligned} $$

Verify the child Money::transfer() call correctnes:

Burned vested coin integrity $BCoin = \t{PoseidonHash}(\mathcal{X}(p.\t{SPK}), \mathcal{Y}(p.\t{SPK}), Bv, t, \t{CID}\t{V}, \t{SH}\t{V}, ℬ, b_\t{Coin})$

Burned vested coin nullifier integrity $\cN = \t{PoseidonHash}(x_c, BCoin)$

Minted vested coin integrity $Coin = \t{PoseidonHash}(\mathcal{X}(p.\t{SPK}), \mathcal{Y}(p.\t{SPK}), VestingChangeValue, t, \t{CID}\t{V}, \t{SH}\t{V}, ℬ, b_\t{Coin})$

Verifiable vested coin note encryption let $𝐧 = (c.v, c.τ, c.\t{SH}, c.\t{UD}, c.n)$, and verify $a = \t{ElGamal}.\t{Encrypt}(𝐧, \t{esk}, d.\t{SPK})$.

Signatures

There should be a single signature attached, which uses $\t{SPK}$ as the signature public key.

Forfeit

This function enables the vesting authority to forfeit a vesting configuration, withdrawing the rest of vested value. The child Money::transfer() call must containg a single input, the vested coin we burn, and a single output, the newlly minted coin. Both coins values are verified by the vesting configuration rules, and we remove the vesting configuration bulla $ℬ_\t{VC}$ entry from the set.

Wallet builder: TODO: add client path
WASM VM code: TODO: add entrypoint path
ZK proof: TODO: add proof path

Function Params

Define the vest function params $$ \begin{aligned} ℬ\t{VC} &∈ \t{im}(\t{Bulla}\t{VC}) \ \t{SPK} &∈ ℙₚ \end{aligned} $$

TODO: Add call params path

Contract Statement

Vesting configuration bulla existance whether $ℬ_\t{VC}$ exists. If no then fail.

Burned vested coin existance whether the burned coin $\t{BCoin}$ matches the vesting configuration record one. If no then fail.

Let there be a prover auxiliary witness inputs: $$ \begin{aligned} VAx &∈ 𝔽ₚ \ VPK &∈ 𝔽ₚ \ Sx &∈ 𝔽ₚ \ τ &∈ 𝔽ₚ \ T &∈ ℕ₆₄ \ C &∈ ℕ₆₄ \ S &∈ ℕ₆₄ \ E &∈ ℕ₆₄ \ V &∈ ℕ₆₄ \ b\t{VC} &∈ 𝔽ₚ Bv &∈ ℕ₆₄ \ b\t{BCoin} &∈ 𝔽ₚ \ x_c &∈ 𝔽ₚ \end{aligned} $$

Attach a proof $π$ such that the following relations hold:

Proof of vesting authority public key ownership $\t{VAPK} = \t{DerivePubKey}(VAx)$.

Proof of shared secret public key ownership $\t{SPK} = \t{DerivePubKey}(Sx)$.

Proof of forfeit amount correctness $ForfeitValue = T - Bv$

Verify the child Money::transfer() call correctnes:

Burned vested coin integrity $BCoin = \t{PoseidonHash}(\mathcal{X}(p.\t{SPK}), \mathcal{Y}(p.\t{SPK}), ForfeitValue, t, \t{CID}\t{V}, \t{SH}\t{V}, ℬ, b_\t{Coin})$

Burned vested coin nullifier integrity $\cN = \t{PoseidonHash}(x_c, BCoin)$

Minted coin integrity let $c.\t{CID}, c.\t{SH}, c.\t{UD}$ be the vesting authority chosen Contract ID, spend hook and user data for the minted coin, and verify $Coin = \t{PoseidonHash}(\mathcal{X}(p.\t{VAPK}), \mathcal{Y}(p.\t{VAPK}), ForfeitValue, t, \t{CID}, \t{SH}, \t{UD}, b_\t{Coin})$

Signatures

There should be a single signature attached, which uses $\t{SPK}$ as the signature public key.

scheme.md 9.4 KB History Raw

Scheme

Vest

Function Params

Contract Statement

Signatures

Withdraw

Function Params

Contract Statement

Signatures

Forfeit

Function Params

Contract Statement

Signatures

scheme.md 9.4 KB

History Raw