darkfi/proof/lead.zk

constant "Lead" {
         EcFixedPointShort VALUE_COMMIT_VALUE,
         EcFixedPoint VALUE_COMMIT_RANDOM,
         EcFixedPointBase NULLIFIER_K,
}

contract "Lead" {
         MerklePath c1_cm_path,
         Uint32 c1_cm_pos,
         Uint32 c1_sk_pos,
         Base c1_sk,
         Base c1_sk_root,
         MerklePath c1_sk_path,
         Base c1_tau,
         Base c1_rho,
         Scalar c1_opening,
         Base value,
         Scalar c2_opening,
         Scalar rho_opening,
         Scalar y_opening,
         Base sigma1,
         Base sigma2,
}

circuit "Lead" {
        ZERO = witness_base(0);
        ONE = witness_base(1);
        PREFIX_EVL = witness_base(2);
        PREFIX_SEED = witness_base(3);
        PREFIX_CM = witness_base(4);
        PREFIX_PK = witness_base(5);
        PREFIX_SN = witness_base(6);
        # coin (1) pk
        pk = poseidon_hash(PREFIX_PK, c1_sk_root, c1_tau, ZERO);
        constrain_instance(pk);
        # coin (2) rho/nonce 
        c2_rho = poseidon_hash(PREFIX_EVL, c1_sk_root, c1_rho, ZERO);
        constrain_instance(c2_rho);
        # coin (1) cm/commitment
        c1_cm_msg = poseidon_hash(PREFIX_CM, pk, value, c1_rho);
        c1_cm_v = ec_mul_base(c1_cm_msg, NULLIFIER_K);
        c1_cm_r = ec_mul(c1_opening, VALUE_COMMIT_RANDOM);
        c1_cm = ec_add(c1_cm_v, c1_cm_r);
        c1_cm_x = ec_get_x(c1_cm);
        c1_cm_y = ec_get_y(c1_cm);
        c1_cm_hash = poseidon_hash(c1_cm_x, c1_cm_y);
        constrain_instance(c1_cm_x);
        constrain_instance(c1_cm_y);
        # coin (2) cm/commitment
        c2_cm_msg = poseidon_hash(PREFIX_CM, pk, value, c2_rho);
        c2_cm_v = ec_mul_base(c2_cm_msg, NULLIFIER_K);
        c2_cm_r = ec_mul(c2_opening, VALUE_COMMIT_RANDOM);
        c2_cm = ec_add(c2_cm_v, c2_cm_r);
        c2_cm_x = ec_get_x(c2_cm);
        c2_cm_y = ec_get_y(c2_cm);
        constrain_instance(c2_cm_x);
        constrain_instance(c2_cm_y);
        # root of path to burnt coin commitment at given pos
        root = merkle_root(c1_cm_pos, c1_cm_path, c1_cm_hash);
        constrain_instance(root);
        # root of path at c1_sk_pos
        root_sk = merkle_root(c1_sk_pos, c1_sk_path, c1_sk);
        constrain_instance(root_sk);
        # coin (1) sn/nullifier
        sn = poseidon_hash(PREFIX_SN, c1_sk_root, c1_rho, ZERO);
        constrain_instance(sn);
        # lottery seed
        seed = poseidon_hash(PREFIX_SEED, c1_sk_root, c1_rho, ZERO);
        # y
        y_v = ec_mul_base(seed, NULLIFIER_K);
        y_r = ec_mul(y_opening, VALUE_COMMIT_RANDOM);
        y = ec_add(y_v, y_r);
        y_x = ec_get_x(y);
        y_y = ec_get_y(y);
        y_hash = poseidon_hash(y_x, y_y);
        constrain_instance(y_x);
        constrain_instance(y_y);
        # rho
        rho_v = ec_mul_base(seed, NULLIFIER_K);
        rho_r = ec_mul(rho_opening, VALUE_COMMIT_RANDOM);
        rho = ec_add(rho_v, rho_r);
        rho_x = ec_get_x(rho);
        rho_y = ec_get_y(rho);
        constrain_instance(rho_x);
        constrain_instance(rho_y);
        # target
        term1 =  base_mul(sigma1, value);
        term2_1 = base_mul(sigma2, value);
        term2 = base_mul(term2_1, value);
        target = base_add(term1, term2);
        #lottery
        less_than(y_hash, target);
}