A coin mixer implementation based on ZKP for privacy-preserving DeFi and DAO. NOTE that it's not production ready.
-
Circuits
- mixer.circom
- get_merkle_root.circom
-
Contracts
- Mixer
- Merkle
requirement: circom version>=2.1.2
$ npm run build
$ cd circuit && ./run.sh main
Run the UT by npm run test
Mixer is built on PlonK
and Merkle Tree
.
- PlonK
PlonK is a universal SNARK construction with fully succinct verification, and significantly lower prover running time (roughly 7.5-20 times fewer group exponentiations than MBKM19 in the fully succinct verifier mode depending on circuit structure).
-
MIMC MiMC is a block cipher and hash function family designed specifically for SNARK applications. The low multiplicative complexity of MiMC over prime fields makes it suitable for ZK-SNARK applications such as ZCash. More details are here.
-
npm run generate
This operation produces 4 files in circuit directory:
- input.json : secret for mixer to generate witness, a sample is as below:
{
"root": "6006452839415899035733807029325942815929888768074345937414569668512067894100",
"nullifierHash": "3701224944747537563701225775873437347582519438989321326160774689502152321319",
"secret": "10",
"paths2_root": [
3174904703,
1831855034,
2927866351,
3904382600,
4026780824,
2259814112,
3460561431,
3054720229
],
"paths2_root_pos": [
1,
1,
1,
1,
1,
1,
1,
1
]
}
where path2_root is generated by call getMerkleProof
, and root
is the merkle root, and nullifierHash
is nullifier to check whether the commitment has been withdrawed. The secret is used to generate the commitment by hash function in binary format, paths2_root is the salt for each non-leaf node to compute it's hash. And paths2_root_pos is 0 or 1, used as a sign function to choose whether paths2_root as xIn
and previous path2_root as k
, and vice versa. The circom code shown as below:
merkle_root[v].x_in <== paths2_root[v] - paths2_root_pos[v] * (paths2_root[v] - merkle_root[v-1].out);
merkle_root[v].k<== merkle_root[v-1].out - paths2_root_pos[v]* (merkle_root[v-1].out - paths2_root[v]);
- public.json: includes nullifierHash and root.
- cmt.json: the parameter of deposit
./run.sh main
Here we use PlonK
and curve bn128 to generate verification key and proof key. More details are presented in reference 1. One point should be mentioned is powersoftau, which adopts MPC to generate verifiable Random Beacon as CRS, to secure their secret randomness throughout the duration of the protocol.
npx hardhat node
Start the local node.
npm run test
Run the test.
Use solium to format the solidity code.
- fix the circuits to verify the new root
The solution is inserting the commitment
from index 0 to 2^depth, so the root would be updated in way in circuit and contract.
This works because the MT.cur is same as the commitment index.
- tx origin check before deposit