darkfi/proofs/spend.pism

constant G_VCV FixedGenerator
constant G_VCR FixedGenerator
constant G_SPEND FixedGenerator
constant PRF_NF BlakePersonalization
constant CRH_IVK BlakePersonalization
constant NOTE_COMMIT PedersenPersonalization
{% for i in range(4) %}
    constant MERKLE_{{ i }} PedersenPersonalization
{% endfor %}

contract spend_contract
    # Value commitment
    param value U64
    param randomness_value Fr

    param serial Fr
    param randomness_coin Fr
    param secret Fr
    param signature_secret Fr

{% for i in range(4) %}
    param branch_{{ i }} Scalar
    param is_right_{{ i }} Bool
{% endfor %}
start
    # Witness input values
    u64_as_binary_le value param:value
    fr_as_binary_le randomness_value param:randomness_value

    # Make value commitment
    # V = v * G_VCV + r * G_VCR

    ec_mul_const vcv value G_VCV
    ec_mul_const rcv randomness_value G_VCR
    ec_add cv vcv rcv
    # emit cv
    emit_ec cv

    # Make the nullifier
    # N = Hash(secret, serial)
    fr_as_binary_le serial param:serial
    fr_as_binary_le secret param:secret

    alloc_binary nf_preimage

# Fr values are 252 bits so we need to pad it with extra 0s
# to match the Rust values which are 256 bits
{% macro binary_put_fr(binary, var) -%}
    binary_extend {{ binary }} {{ var }}
    {% for n in range(4) %}
        alloc_const_bit zero_bit false
        binary_push {{ binary }} zero_bit
    {% endfor %}
{%- endmacro %}

    # secret
    binary_clone secret2 secret
    {{ binary_put_fr("nf_preimage", "secret2") }}

    # serial
    binary_clone serial2 serial
    {{ binary_put_fr("nf_preimage", "serial2") }}

    # Secret:           Fr              = 252 + 4 bits padding
    # Serial:           Fr              = 252 + 4 bits padding
    # TOTAL: 512 bits for preimage
    static_assert_binary_size nf_preimage 512
    blake2s nf nf_preimage PRF_NF
    emit_binary nf

    # Derive the public key
    # P = secret * G
    ec_mul_const public secret G_SPEND

    # Make the coin (same as mint contract)
    # C = Hash(public_key, value, serial, randomness_coin)
    fr_as_binary_le randomness_coin param:randomness_coin

    # Build the preimage to hash
    alloc_binary preimage

    # public_key
    ec_repr repr_public public
    binary_extend preimage repr_public

    # value
    binary_extend preimage value

    # serial
    {{ binary_put_fr("preimage", "serial") }}

    # randomness_coin
    {{ binary_put_fr("preimage", "randomness_coin") }}

    # Public key:       SubgroupPoint   = 256 bits
    # Value:            u64             = 64 bits
    # Serial:           Fr              = 252 + 4 bits padding
    # Randomness coin   Fr              = 252 + 4 bits padding
    # TOTAL: 832 bits for preimage
    static_assert_binary_size preimage 832
    blake2s coin preimage CRH_IVK
    # Debug stuff. Normally we don't reveal the coin in the spend proof.
    #binary_clone coin2 coin
    #emit_binary coin2

    # coin_commit = PedersenHash(coin)
    pedersen_hash cm coin NOTE_COMMIT
    # left = coin_commit.u
    ec_get_u current cm

    # Our merkle tree has a height of 4
{% for i in range(4) %}
    # left = current
    # right = branch[{{ i }}]
    alloc_scalar branch param:branch_{{ i }}

    # is_right = is_right[{{ i }}]
    alloc_bit is_right param:is_right_{{ i }}

    # reverse(a, b, condition) = if condition (b, a) else (a, b)
    conditionally_reverse left right current branch is_right

    # coin_commit = PedersenHash(left || right)
    scalar_as_binary left left
    scalar_as_binary right right
    alloc_binary preimage
    binary_extend preimage left
    binary_extend preimage right
    pedersen_hash cm preimage MERKLE_{{ i }}
    # current = coin_commit.u
    ec_get_u current cm
{% endfor %}
    # Reveal the merkle root
    emit_scalar current

    # Emit the signature public key
    fr_as_binary_le signature_secret param:signature_secret
    ec_mul_const signature_public signature_secret G_SPEND
    emit_ec signature_public
end