hermez-node/common/zk.go
common/zk.goRaw
1// Package common contains all the common data structures used at the
2// hermez-node, zk.go contains the zkSnark inputs used to generate the proof
3//nolint:deadcode,structcheck,unused
4package common
5
6import (
7 "encoding/json"
8 "math/big"
9
10 "github.com/hermeznetwork/hermez-node/log"
11 "github.com/mitchellh/mapstructure"
12)
13
14// circuit parameters
15// absolute maximum of L1 or L2 transactions allowed
16type nTx uint32
17
18// merkle tree depth
19type nLevels uint32
20
21// absolute maximum of L1 transaction allowed
22type maxL1Tx uint32
23
24//absolute maximum of fee transactions allowed
25type maxFeeTx uint32
26
27// ZKInputs represents the inputs that will be used to generate the zkSNARK proof
28type ZKInputs struct {
29 //
30 // General
31 //
32
33 // inputs for final `hashGlobalInputs`
34 // OldLastIdx is the last index assigned to an account
35 OldLastIdx *big.Int `json:"oldLastIdx"` // uint64 (max nLevels bits)
36 // OldStateRoot is the current state merkle tree root
37 OldStateRoot *big.Int `json:"oldStateRoot"` // Hash
38 // GlobalChainID is the blockchain ID (0 for Ethereum mainnet). This value can be get from the smart contract.
39 GlobalChainID *big.Int `json:"globalChainID"` // uint16
40 // FeeIdxs is an array of merkle tree indexes where the coordinator will receive the accumulated fees
41 FeeIdxs []*big.Int `json:"feeIdxs"` // uint64 (max nLevels bits), len: [maxFeeTx]
42
43 // accumulate fees
44 // FeePlanTokens contains all the tokenIDs for which the fees are being accumulated
45 FeePlanTokens []*big.Int `json:"feePlanTokens"` // uint32 (max 32 bits), len: [maxFeeTx]
46
47 //
48 // Txs (L1&L2)
49 //
50
51 // transaction L1-L2
52 // TxCompressedData
53 TxCompressedData []*big.Int `json:"txCompressedData"` // big.Int (max 251 bits), len: [nTx]
54 // TxCompressedDataV2, only used in L2Txs, in L1Txs is set to 0
55 TxCompressedDataV2 []*big.Int `json:"txCompressedDataV2"` // big.Int (max 193 bits), len: [nTx]
56
57 // FromIdx
58 FromIdx []*big.Int `json:"fromIdx"` // uint64 (max nLevels bits), len: [nTx]
59 // AuxFromIdx is the Idx of the new created account which is consequence of a L1CreateAccountTx
60 AuxFromIdx []*big.Int `json:"auxFromIdx"` // uint64 (max nLevels bits), len: [nTx]
61
62 // ToIdx
63 ToIdx []*big.Int `json:"toIdx"` // uint64 (max nLevels bits), len: [nTx]
64 // AuxToIdx is the Idx of the Tx that has 'toIdx==0', is the coordinator who will find which Idx corresponds to the 'toBJJAy' or 'toEthAddr'
65 AuxToIdx []*big.Int `json:"auxToIdx"` // uint64 (max nLevels bits), len: [nTx]
66 // ToBJJAy
67 ToBJJAy []*big.Int `json:"toBjjAy"` // big.Int, len: [nTx]
68 // ToEthAddr
69 ToEthAddr []*big.Int `json:"toEthAddr"` // ethCommon.Address, len: [nTx]
70
71 // OnChain determines if is L1 (1/true) or L2 (0/false)
72 OnChain []*big.Int `json:"onChain"` // bool, len: [nTx]
73
74 //
75 // Txs/L1Txs
76 //
77 // NewAccount boolean (0/1) flag set 'true' when L1 tx creates a new account (fromIdx==0)
78 NewAccount []*big.Int `json:"newAccount"` // bool, len: [nTx]
79 // LoadAmountF encoded as float16
80 LoadAmountF []*big.Int `json:"loadAmountF"` // uint16, len: [nTx]
81 // FromEthAddr
82 FromEthAddr []*big.Int `json:"fromEthAddr"` // ethCommon.Address, len: [nTx]
83 // FromBJJCompressed boolean encoded where each value is a *big.Int
84 FromBJJCompressed [][256]*big.Int `json:"fromBjjCompressed"` // bool array, len: [nTx][256]
85
86 //
87 // Txs/L2Txs
88 //
89
90 // RqOffset relative transaction position to be linked. Used to perform atomic transactions.
91 RqOffset []*big.Int `json:"rqOffset"` // uint8 (max 3 bits), len: [nTx]
92
93 // transaction L2 request data
94 // RqTxCompressedDataV2
95 RqTxCompressedDataV2 []*big.Int `json:"rqTxCompressedDataV2"` // big.Int (max 251 bits), len: [nTx]
96 // RqToEthAddr
97 RqToEthAddr []*big.Int `json:"rqToEthAddr"` // ethCommon.Address, len: [nTx]
98 // RqToBJJAy
99 RqToBJJAy []*big.Int `json:"rqToBjjAy"` // big.Int, len: [nTx]
100
101 // transaction L2 signature
102 // S
103 S []*big.Int `json:"s"` // big.Int, len: [nTx]
104 // R8x
105 R8x []*big.Int `json:"r8x"` // big.Int, len: [nTx]
106 // R8y
107 R8y []*big.Int `json:"r8y"` // big.Int, len: [nTx]
108
109 //
110 // State MerkleTree Leafs transitions
111 //
112
113 // state 1, value of the sender (from) account leaf
114 TokenID1 []*big.Int `json:"tokenID1"` // uint32, len: [nTx]
115 Nonce1 []*big.Int `json:"nonce1"` // uint64 (max 40 bits), len: [nTx]
116 Sign1 []*big.Int `json:"sign1"` // bool, len: [nTx]
117 Ay1 []*big.Int `json:"ay1"` // big.Int, len: [nTx]
118 Balance1 []*big.Int `json:"balance1"` // big.Int (max 192 bits), len: [nTx]
119 EthAddr1 []*big.Int `json:"ethAddr1"` // ethCommon.Address, len: [nTx]
120 Siblings1 [][]*big.Int `json:"siblings1"` // big.Int, len: [nTx][nLevels + 1]
121 // Required for inserts and deletes, values of the CircomProcessorProof (smt insert proof)
122 IsOld0_1 []*big.Int `json:"isOld0_1"` // bool, len: [nTx]
123 OldKey1 []*big.Int `json:"oldKey1"` // uint64 (max 40 bits), len: [nTx]
124 OldValue1 []*big.Int `json:"oldValue1"` // Hash, len: [nTx]
125
126 // state 2, value of the receiver (to) account leaf
127 // if Tx is an Exit, state 2 is used for the Exit Merkle Proof
128 TokenID2 []*big.Int `json:"tokenID2"` // uint32, len: [nTx]
129 Nonce2 []*big.Int `json:"nonce2"` // uint64 (max 40 bits), len: [nTx]
130 Sign2 []*big.Int `json:"sign2"` // bool, len: [nTx]
131 Ay2 []*big.Int `json:"ay2"` // big.Int, len: [nTx]
132 Balance2 []*big.Int `json:"balance2"` // big.Int (max 192 bits), len: [nTx]
133 EthAddr2 []*big.Int `json:"ethAddr2"` // ethCommon.Address, len: [nTx]
134 Siblings2 [][]*big.Int `json:"siblings2"` // big.Int, len: [nTx][nLevels + 1]
135 // newExit determines if an exit transaction has to create a new leaf in the exit tree
136 NewExit []*big.Int `json:"newExit"` // bool, len: [nTx]
137 // Required for inserts and deletes, values of the CircomProcessorProof (smt insert proof)
138 IsOld0_2 []*big.Int `json:"isOld0_2"` // bool, len: [nTx]
139 OldKey2 []*big.Int `json:"oldKey2"` // uint64 (max 40 bits), len: [nTx]
140 OldValue2 []*big.Int `json:"oldValue2"` // Hash, len: [nTx]
141
142 // state 3, value of the account leaf receiver of the Fees
143 // fee tx
144 // State fees
145 TokenID3 []*big.Int `json:"tokenID3"` // uint32, len: [maxFeeTx]
146 Nonce3 []*big.Int `json:"nonce3"` // uint64 (max 40 bits), len: [maxFeeTx]
147 Sign3 []*big.Int `json:"sign3"` // bool, len: [maxFeeTx]
148 Ay3 []*big.Int `json:"ay3"` // big.Int, len: [maxFeeTx]
149 Balance3 []*big.Int `json:"balance3"` // big.Int (max 192 bits), len: [maxFeeTx]
150 EthAddr3 []*big.Int `json:"ethAddr3"` // ethCommon.Address, len: [maxFeeTx]
151 Siblings3 [][]*big.Int `json:"siblings3"` // Hash, len: [maxFeeTx][nLevels + 1]
152
153 //
154 // Intermediate States
155 //
156
157 // Intermediate States to parallelize witness computation
158 // Note: the Intermediate States (IS) of the last transaction does not
159 // exist. Meaning that transaction 3 (4th) will fill the parameters
160 // FromIdx[3] and ISOnChain[3], but last transaction (nTx-1) will fill
161 // FromIdx[nTx-1] but will not fill ISOnChain. That's why IS have
162 // length of nTx-1, while the other parameters have length of nTx.
163 // Last transaction does not need intermediate state since its output
164 // will not be used.
165
166 // decode-tx
167 // ISOnChain indicates if tx is L1 (true) or L2 (false)
168 ISOnChain []*big.Int `json:"imOnChain"` // bool, len: [nTx - 1]
169 // ISOutIdx current index account for each Tx
170 ISOutIdx []*big.Int `json:"imOutIdx"` // uint64 (max nLevels bits), len: [nTx - 1]
171 // rollup-tx
172 // ISStateRoot root at the moment of the Tx, the state root value once the Tx is processed into the state tree
173 ISStateRoot []*big.Int `json:"imStateRoot"` // Hash, len: [nTx - 1]
174 // ISExitTree root at the moment of the Tx the value once the Tx is processed into the exit tree
175 ISExitRoot []*big.Int `json:"imExitRoot"` // Hash, len: [nTx - 1]
176 // ISAccFeeOut accumulated fees once the Tx is processed
177 ISAccFeeOut [][]*big.Int `json:"imAccFeeOut"` // big.Int, len: [nTx - 1][maxFeeTx]
178 // fee-tx
179 // ISStateRootFee root at the moment of the Tx, the state root value once the Tx is processed into the state tree
180 ISStateRootFee []*big.Int `json:"imStateRootFee"` // Hash, len: [maxFeeTx - 1]
181 // ISInitStateRootFee state root once all L1-L2 tx are processed (before computing the fees-tx)
182 ISInitStateRootFee *big.Int `json:"imInitStateRootFee"` // Hash
183 // ISFinalAccFee final accumulated fees (before computing the fees-tx)
184 ISFinalAccFee []*big.Int `json:"imFinalAccFee"` // big.Int, len: [maxFeeTx - 1]
185}
186
187func bigIntsToStrings(v interface{}) interface{} {
188 switch c := v.(type) {
189 case *big.Int:
190 return c.String()
191 case []*big.Int:
192 r := make([]interface{}, len(c))
193 for i := range c {
194 r[i] = bigIntsToStrings(c[i])
195 }
196 return r
197 case [256]*big.Int:
198 r := make([]interface{}, len(c))
199 for i := range c {
200 r[i] = bigIntsToStrings(c[i])
201 }
202 return r
203 case [][]*big.Int:
204 r := make([]interface{}, len(c))
205 for i := range c {
206 r[i] = bigIntsToStrings(c[i])
207 }
208 return r
209 case [][256]*big.Int:
210 r := make([]interface{}, len(c))
211 for i := range c {
212 r[i] = bigIntsToStrings(c[i])
213 }
214 return r
215 default:
216 log.Warnf("bigIntsToStrings unexpected type: %T\n", v)
217 }
218 return nil
219}
220
221// MarshalJSON implements the json marshaler for ZKInputs
222func (z ZKInputs) MarshalJSON() ([]byte, error) {
223 var m map[string]interface{}
224 dec, err := mapstructure.NewDecoder(&mapstructure.DecoderConfig{
225 TagName: "json",
226 Result: &m,
227 })
228 if err != nil {
229 return nil, err
230 }
231 err = dec.Decode(z)
232 if err != nil {
233 return nil, err
234 }
235
236 for k, v := range m {
237 m[k] = bigIntsToStrings(v)
238 }
239 return json.Marshal(m)
240}
241
242// NewZKInputs returns a pointer to an initialized struct of ZKInputs
243func NewZKInputs(nTx, maxFeeTx, nLevels int) *ZKInputs {
244 zki := &ZKInputs{}
245
246 // General
247 zki.OldLastIdx = big.NewInt(0)
248 zki.OldStateRoot = big.NewInt(0)
249 zki.GlobalChainID = big.NewInt(0)
250 zki.FeeIdxs = newSlice(maxFeeTx)
251 zki.FeePlanTokens = newSlice(maxFeeTx)
252
253 // Txs
254 zki.TxCompressedData = newSlice(nTx)
255 zki.TxCompressedDataV2 = newSlice(nTx)
256 zki.FromIdx = newSlice(nTx)
257 zki.AuxFromIdx = newSlice(nTx)
258 zki.ToIdx = newSlice(nTx)
259 zki.AuxToIdx = newSlice(nTx)
260 zki.ToBJJAy = newSlice(nTx)
261 zki.ToEthAddr = newSlice(nTx)
262 zki.OnChain = newSlice(nTx)
263 zki.NewAccount = newSlice(nTx)
264
265 // L1
266 zki.LoadAmountF = newSlice(nTx)
267 zki.FromEthAddr = newSlice(nTx)
268 zki.FromBJJCompressed = make([][256]*big.Int, nTx)
269 for i := 0; i < len(zki.FromBJJCompressed); i++ {
270 // zki.FromBJJCompressed[i] = newSlice(256)
271 for j := 0; j < 256; j++ {
272 zki.FromBJJCompressed[i][j] = big.NewInt(0)
273 }
274 }
275
276 // L2
277 zki.RqOffset = newSlice(nTx)
278 zki.RqTxCompressedDataV2 = newSlice(nTx)
279 zki.RqToEthAddr = newSlice(nTx)
280 zki.RqToBJJAy = newSlice(nTx)
281 zki.S = newSlice(nTx)
282 zki.R8x = newSlice(nTx)
283 zki.R8y = newSlice(nTx)
284
285 // State MerkleTree Leafs transitions
286 zki.TokenID1 = newSlice(nTx)
287 zki.Nonce1 = newSlice(nTx)
288 zki.Sign1 = newSlice(nTx)
289 zki.Ay1 = newSlice(nTx)
290 zki.Balance1 = newSlice(nTx)
291 zki.EthAddr1 = newSlice(nTx)
292 zki.Siblings1 = make([][]*big.Int, nTx)
293 for i := 0; i < len(zki.Siblings1); i++ {
294 zki.Siblings1[i] = newSlice(nLevels + 1)
295 }
296 zki.IsOld0_1 = newSlice(nTx)
297 zki.OldKey1 = newSlice(nTx)
298 zki.OldValue1 = newSlice(nTx)
299
300 zki.TokenID2 = newSlice(nTx)
301 zki.Nonce2 = newSlice(nTx)
302 zki.Sign2 = newSlice(nTx)
303 zki.Ay2 = newSlice(nTx)
304 zki.Balance2 = newSlice(nTx)
305 zki.EthAddr2 = newSlice(nTx)
306 zki.Siblings2 = make([][]*big.Int, nTx)
307 for i := 0; i < len(zki.Siblings2); i++ {
308 zki.Siblings2[i] = newSlice(nLevels + 1)
309 }
310 zki.NewExit = newSlice(nTx)
311 zki.IsOld0_2 = newSlice(nTx)
312 zki.OldKey2 = newSlice(nTx)
313 zki.OldValue2 = newSlice(nTx)
314
315 zki.TokenID3 = newSlice(maxFeeTx)
316 zki.Nonce3 = newSlice(maxFeeTx)
317 zki.Sign3 = newSlice(maxFeeTx)
318 zki.Ay3 = newSlice(maxFeeTx)
319 zki.Balance3 = newSlice(maxFeeTx)
320 zki.EthAddr3 = newSlice(maxFeeTx)
321 zki.Siblings3 = make([][]*big.Int, maxFeeTx)
322 for i := 0; i < len(zki.Siblings3); i++ {
323 zki.Siblings3[i] = newSlice(nLevels + 1)
324 }
325
326 // Intermediate States
327 zki.ISOnChain = newSlice(nTx - 1)
328 zki.ISOutIdx = newSlice(nTx - 1)
329 zki.ISStateRoot = newSlice(nTx - 1)
330 zki.ISExitRoot = newSlice(nTx - 1)
331 zki.ISAccFeeOut = make([][]*big.Int, nTx-1)
332 for i := 0; i < len(zki.ISAccFeeOut); i++ {
333 zki.ISAccFeeOut[i] = newSlice(maxFeeTx)
334 }
335 zki.ISStateRootFee = newSlice(maxFeeTx - 1)
336 zki.ISInitStateRootFee = big.NewInt(0)
337 zki.ISFinalAccFee = newSlice(maxFeeTx - 1)
338
339 return zki
340}
341
342// newSlice returns a []*big.Int slice of length n with values initialized at
343// 0.
344// Is used to initialize all *big.Ints of the ZKInputs data structure, so when
345// the transactions are processed and the ZKInputs filled, there is no need to
346// set all the elements, and if a transaction does not use a parameter, can be
347// leaved as it is in the ZKInputs, as will be 0, so later when using the
348// ZKInputs to generate the zkSnark proof there is no 'nil'/'null' values.
349func newSlice(n int) []*big.Int {
350 s := make([]*big.Int, n)
351 for i := 0; i < len(s); i++ {
352 s[i] = big.NewInt(0)
353 }
354 return s
355}