darkfi/doc/src/spec/contracts/dao/contract.md

Contract

Let $\t{PoseidonHash}$ be defined as in the section PoseidonHash Function.

Let $ℙₚ$ be defined as in the section Pallas and Vesta.

Let $\t{Params}\t{DAO}, \t{Bulla}\t{DAO}, \t{Params}\t{Proposal}, \t{Bulla}\t{Proposal}$ be defined as in DAO Model.

TODO: add derivepubkey fn

TODO: add merkle section to crypto-schemes with merklepos, merklepath, MerkleRoot

TODO: add pedersencommit

TODO: need params coin

TODO: document current day = $𝔽ₚ$ CurrentDay

Mint

Function Params

Define the DAO mint function params $$ \begin{aligned} ℬ &∈ \t{im}(\t{Bulla}_\t{DAO}) \ \t{PK} &∈ ℙₚ \end{aligned} $$

{{#include ../../../../../src/contract/dao/src/model.rs:dao-mint-params}}

Contract Statement

DAO bulla uniqueness   whether $ℬ $ already exists. If yes then fail.

Let there be a prover auxiliary witness inputs: $$ \begin{aligned} \t{Params}\t{DAO}.L &∈ ℕ₆₄ \ \t{Params}\t{DAO}.Q &∈ ℕ₆₄ \ \t{Params}\t{DAO}.A^\% &∈ ℕ₆₄ × ℕ₆₄ \ \t{Params}\t{DAO}.T &∈ 𝔽ₚ \ x &∈ 𝔽ₚ \ b_\t{DAO} &∈ 𝔽ₚ \end{aligned} $$

Attach a proof $π = { 𝐯, 𝐱 : R(𝐯, 𝐱) = 1 }$ such that the following relations hold:

Proof of public key ownership   $\t{PK} = \t{DerivePubKey}(x)$.

DAO bulla integrity   $ℬ = \t{Bulla}\t{DAO}(\t{Params}\t{DAO}, b_\t{DAO})$

Signatures

There should be a single signature attached, which uses $\t{PK}$ as the signature public key.

Propose

Function Params

Define the DAO propose function params $$ \begin{aligned} R\t{DAO} &∈ 𝔽ₚ \ T &∈ 𝔽ₚ \ 𝒫 &∈ \t{im}(\t{Bulla}\t{Proposal}) \ \t{EncNote} &∈ ⟂ \ 𝐢 &∈ \t{ProposeInput}^* \end{aligned} $$

Define the DAO propose input function params $$ \begin{aligned} \t{ProposeInput}.V &∈ ℙₚ \ \t{ProposeInput}.R_\t{coin} &∈ 𝔽ₚ \ \t{ProposeInput}.\t{PK}_σ &∈ ℙₚ \end{aligned} $$

{{#include ../../../../../src/contract/dao/src/model.rs:dao-propose-params}}

{{#include ../../../../../src/contract/dao/src/model.rs:dao-propose-input-params}}

Contract Statement

Let $t₀ = \t{CurrentDay} ∈ 𝔽ₚ$ be the current day.

Valid DAO bulla merkle root   check that $R_\t{DAO}$ is a previously seen merkle root in the DAO contract merkle roots DB.

Proposal bulla uniqueness   whether $𝒫 $ already exists. If yes then fail.

Let there be a prover auxiliary witness inputs: $$ \begin{aligned} v &∈ 𝔽ₚ \ bᵥ &∈ 𝔽ᵥ \ bτ &∈ 𝔽ₚ \ p &∈ \t{Params}\t{Proposal} \ pd &∈ 𝔽ₚ \ d &∈ \t{Params}\t{DAO} \ bd &∈ 𝔽ₚ \ (ψ, Π) &∈ \t{MerklePos} × \t{MerklePath} \ \end{aligned} $$ Attach a proof $π\t{𝒫 }$ such that the following relations hold:

Governance token commit   export the DAO token ID as an encrypted pedersen commit $T = \t{PedersenCommit}(d.τ, d.bτ)$ where $T = ∑{i ∈ 𝐢} Tᵢ$.

DAO bulla integrity   $ℬ = \t{Bulla}_\t{DAO}(d, b_d)$

DAO existence   $R_\t{DAO} = \t{MerkleRoot}(ψ, Π, ℬ )$

Proposal bulla integrity   $𝒫 = \t{Bulla}_\t{Proposal}(p, p_d)$ where $p.t₀ = t₀$.

Proposer limit threshold met   check the proposer has supplied enough inputs that the required funds for the proposer limit set in the DAO is met. Let the total funds $v = ∑_{i ∈ 𝐢} i.v$, then check $d.L ≤ v$.

Total funds value commit   $V = \t{PedersenCommit}(v, bᵥ)$ where $V = ∑{i ∈ 𝐢} i.V$. We use this to check that $v = ∑{i ∈ 𝐢} i.v$ as claimed in the proposer limit threshold met check.

For each input $i ∈ 𝐢$,

  Valid input coins merkle root   check that $i.R_\t{coin}$ is a previously seen merkle root in the money contract merkle roots DB.

  Let there be a prover auxiliary witness inputs: $$ \begin{aligned} xσ &∈ 𝔽ₚ \ c &∈ \t{Params}\t{Coin} \ bᵥ &∈ 𝔽ᵥ \ b_τ &∈ 𝔽ₚ \ (ψᵢ, Πᵢ) &∈ \t{MerklePos} × \t{MerklePath} \ \end{aligned} $$   Attach a proof $π_i$ such that the following relations hold:

  Coin value commit   $i.V = \t{PedersenCommit}(c.v, bᵥ)$.

  Token commit   $T = \t{PoseidonHash}(c.τ, b_τ)$.

  Valid coin   let $C = \t{Commit}(c)$. Check $i.R_\t{coin} = \t{MerkleRoot}(ψᵢ, Πᵢ, C)$.

  Proof of signature public key ownership   $i.\t{PK}_σ = \t{DerivePubKey}(x_σ)$.