darkfi/proof/dao.zk

constant "DAO" {
	EcFixedPoint VALUE_COMMIT_VALUE,
	EcFixedPoint VALUE_COMMIT_RANDOM,
}

contract "DAO" {
	Base a, # contract address
	Base s,  # serial number
	Base T, # treasury balance
	Base B_b, # bulla blinding

	Uint32 leaf_pos,
	MerklePath W, # merkle path to DAO

	Base u, # output 0 value
	Base P_x, # output 0 addr x
	Base P_y, # output 0 addr y
	Base b_m, # output blinding

	Base votes,
	Scalar vote_blinds,

	Scalar output_1_blind,
}

circuit "DAO" {
	# Reveal serial number
	constrain_instance(s);

	# Poseidon hash of the Bulla
	bulla = poseidon_hash(a, s, T, B_b);
	D = calculate_merkle_root(leaf_pos, W, bulla);
	constrain_instance(D);

	# Output 0:
	M = poseidon_hash(u, P_x, P_y, b_m);
	constrain_instance(M);

	vcv = ec_mul_short(votes, VALUE_COMMIT_VALUE);
	vcr = ec_mul(vote_blinds, VALUE_COMMIT_RANDOM);
	vote_commit = ec_add(vcv, vcr);
	vote_commit_x = ec_get_x(vote_commit);
	vote_commit_y = ec_get_y(vote_commit);
	constrain_instance(vote_commit_x);
	constrain_instance(vote_commit_y);
}