darkfi/proofs/spend.pism

constant G_VCV FixedGenerator
constant G_VCR FixedGenerator
constant G_SPEND FixedGenerator
constant PRF_NF BlakePersonalization
constant CRH_IVK BlakePersonalization
constant NOTE_COMMIT PedersenPersonalization

contract spend_contract
    # Value commitment
    param value U64
    param randomness_value Fr

    param serial Fr
    param randomness_coin Fr
    param secret Fr

{% for i in range(4) %}
    param branch_{{ i }} Scalar
    param is_right_{{ i }} Bool
{% endfor %}
start
    # Witness input values
    u64_as_binary_le value param:value
    fr_as_binary_le randomness_value param:randomness_value

    # Make value commitment
    # V = v * G_VCV + r * G_VCR

    ec_mul_const vcv value G_VCV
    ec_mul_const rcv randomness_value G_VCR
    ec_add cv vcv rcv
    # emit cv
    emit_ec cv

    # Make the nullifier
    # N = Hash(secret, serial)
    fr_as_binary_le serial param:serial
    fr_as_binary_le secret param:secret

    alloc_binary nf_preimage

# Fr values are 252 bits so we need to pad it with extra 0s
# to match the Rust values which are 256 bits
{% macro binary_put_fr(binary, var) -%}
    binary_extend {{ binary }} {{ var }}
    {% for n in range(4) %}
        alloc_const_bit zero_bit false
        binary_push {{ binary }} zero_bit
    {% endfor %}
{%- endmacro %}

    # secret
    binary_clone secret2 secret
    {{ binary_put_fr("nf_preimage", "secret2") }}

    # serial
    binary_clone serial2 serial
    {{ binary_put_fr("nf_preimage", "serial2") }}

    # Secret:           Fr              = 252 + 4 bits padding
    # Serial:           Fr              = 252 + 4 bits padding
    # TOTAL: 512 bits for preimage
    static_assert_binary_size nf_preimage 512
    blake2s nf nf_preimage PRF_NF
    emit_binary nf

    # Derive the public key
    # P = secret * G
    ec_mul_const public secret G_SPEND

    # Make the coin (same as mint contract)
    # C = Hash(public_key, value, serial, randomness_coin)
    fr_as_binary_le randomness_coin param:randomness_coin

    # Build the preimage to hash
    alloc_binary preimage

    # public_key
    ec_repr repr_public public
    binary_extend preimage repr_public

    # value
    binary_extend preimage value

    # serial
    {{ binary_put_fr("preimage", "serial") }}

    # randomness_coin
    {{ binary_put_fr("preimage", "randomness_coin") }}

    # Public key:       SubgroupPoint   = 256 bits
    # Value:            u64             = 64 bits
    # Serial:           Fr              = 252 + 4 bits padding
    # Randomness coin   Fr              = 252 + 4 bits padding
    # TOTAL: 832 bits for preimage
    static_assert_binary_size preimage 832
    blake2s coin preimage CRH_IVK
    binary_clone coin2 coin
    emit_binary coin2

    # coin_commit = PedersenHash(coin)
    pedersen_hash cm coin NOTE_COMMIT
    # left = coin_commit.u
    ec_get_u left cm
    emit_scalar left

    # Our merkle tree has a height of 4
{% for i in range(4) %}
    # right = branch[{{ i }}]
    # is_right = is_right[{{ i }}]
    # if is_right:
    #     left, right = right, left
    # coin_commit = PedersenHash(left || right)
    # left = coin_commit.u
{% endfor %}
    # Reveal the merkle root
end