miksi-core/contracts/withdraw-verifier.sol
contracts/withdraw-verifier.solRaw
1//
2// Copyright 2017 Christian Reitwiessner
3// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
4// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
5// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
6//
7// 2019 OKIMS
8// ported to solidity 0.5
9// fixed linter warnings
10// added requiere error messages
11//
12pragma solidity ^0.6.0;
13library WithdrawPairing {
14 struct G1Point {
15 uint X;
16 uint Y;
17 }
18 // Encoding of field elements is: X[0] * z + X[1]
19 struct G2Point {
20 uint[2] X;
21 uint[2] Y;
22 }
23 /// @return the generator of G1
24 function P1() internal pure returns (G1Point memory) {
25 return G1Point(1, 2);
26 }
27 /// @return the generator of G2
28 function P2() internal pure returns (G2Point memory) {
29 // Original code point
30 return G2Point(
31 [11559732032986387107991004021392285783925812861821192530917403151452391805634,
32 10857046999023057135944570762232829481370756359578518086990519993285655852781],
33 [4082367875863433681332203403145435568316851327593401208105741076214120093531,
34 8495653923123431417604973247489272438418190587263600148770280649306958101930]
35 );
36
37/*
38 // Changed by Jordi point
39 return G2Point(
40 [10857046999023057135944570762232829481370756359578518086990519993285655852781,
41 11559732032986387107991004021392285783925812861821192530917403151452391805634],
42 [8495653923123431417604973247489272438418190587263600148770280649306958101930,
43 4082367875863433681332203403145435568316851327593401208105741076214120093531]
44 );
45*/
46 }
47 /// @return the negation of p, i.e. p.addition(p.negate()) should be zero.
48 function negate(G1Point memory p) internal pure returns (G1Point memory) {
49 // The prime q in the base field F_q for G1
50 uint q = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
51 if (p.X == 0 && p.Y == 0)
52 return G1Point(0, 0);
53 return G1Point(p.X, q - (p.Y % q));
54 }
55 /// @return r the sum of two points of G1
56 function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
57 uint[4] memory input;
58 input[0] = p1.X;
59 input[1] = p1.Y;
60 input[2] = p2.X;
61 input[3] = p2.Y;
62 bool success;
63 // solium-disable-next-line security/no-inline-assembly
64 assembly {
65 success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
66 // Use "invalid" to make gas() estimation work
67 switch success case 0 { invalid() }
68 }
69 require(success,"pairing-add-failed");
70 }
71 /// @return r the product of a point on G1 and a scalar, i.e.
72 /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
73 function scalar_mul(G1Point memory p, uint s) internal view returns (G1Point memory r) {
74 uint[3] memory input;
75 input[0] = p.X;
76 input[1] = p.Y;
77 input[2] = s;
78 bool success;
79 // solium-disable-next-line security/no-inline-assembly
80 assembly {
81 success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
82 // Use "invalid" to make gas() estimation work
83 switch success case 0 { invalid() }
84 }
85 require (success,"pairing-mul-failed");
86 }
87 /// @return the result of computing the pairing check
88 /// e(p1[0], p2[0]) * .... * e(p1[n], p2[n]) == 1
89 /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should
90 /// return true.
91 function pairing(G1Point[] memory p1, G2Point[] memory p2) internal view returns (bool) {
92 require(p1.length == p2.length,"pairing-lengths-failed");
93 uint elements = p1.length;
94 uint inputSize = elements * 6;
95 uint[] memory input = new uint[](inputSize);
96 for (uint i = 0; i < elements; i++)
97 {
98 input[i * 6 + 0] = p1[i].X;
99 input[i * 6 + 1] = p1[i].Y;
100 input[i * 6 + 2] = p2[i].X[0];
101 input[i * 6 + 3] = p2[i].X[1];
102 input[i * 6 + 4] = p2[i].Y[0];
103 input[i * 6 + 5] = p2[i].Y[1];
104 }
105 uint[1] memory out;
106 bool success;
107 // solium-disable-next-line security/no-inline-assembly
108 assembly {
109 success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
110 // Use "invalid" to make gas() estimation work
111 switch success case 0 { invalid() }
112 }
113 require(success,"pairing-opcode-failed");
114 return out[0] != 0;
115 }
116 /// Convenience method for a pairing check for two pairs.
117 function pairingProd2(G1Point memory a1, G2Point memory a2, G1Point memory b1, G2Point memory b2) internal view returns (bool) {
118 G1Point[] memory p1 = new G1Point[](2);
119 G2Point[] memory p2 = new G2Point[](2);
120 p1[0] = a1;
121 p1[1] = b1;
122 p2[0] = a2;
123 p2[1] = b2;
124 return pairing(p1, p2);
125 }
126 /// Convenience method for a pairing check for three pairs.
127 function pairingProd3(
128 G1Point memory a1, G2Point memory a2,
129 G1Point memory b1, G2Point memory b2,
130 G1Point memory c1, G2Point memory c2
131 ) internal view returns (bool) {
132 G1Point[] memory p1 = new G1Point[](3);
133 G2Point[] memory p2 = new G2Point[](3);
134 p1[0] = a1;
135 p1[1] = b1;
136 p1[2] = c1;
137 p2[0] = a2;
138 p2[1] = b2;
139 p2[2] = c2;
140 return pairing(p1, p2);
141 }
142 /// Convenience method for a pairing check for four pairs.
143 function pairingProd4(
144 G1Point memory a1, G2Point memory a2,
145 G1Point memory b1, G2Point memory b2,
146 G1Point memory c1, G2Point memory c2,
147 G1Point memory d1, G2Point memory d2
148 ) internal view returns (bool) {
149 G1Point[] memory p1 = new G1Point[](4);
150 G2Point[] memory p2 = new G2Point[](4);
151 p1[0] = a1;
152 p1[1] = b1;
153 p1[2] = c1;
154 p1[3] = d1;
155 p2[0] = a2;
156 p2[1] = b2;
157 p2[2] = c2;
158 p2[3] = d2;
159 return pairing(p1, p2);
160 }
161}
162contract WithdrawVerifier {
163 using WithdrawPairing for *;
164 struct VerifyingKey {
165 WithdrawPairing.G1Point alfa1;
166 WithdrawPairing.G2Point beta2;
167 WithdrawPairing.G2Point gamma2;
168 WithdrawPairing.G2Point delta2;
169 WithdrawPairing.G1Point[] IC;
170 }
171 struct Proof {
172 WithdrawPairing.G1Point A;
173 WithdrawPairing.G2Point B;
174 WithdrawPairing.G1Point C;
175 }
176 function verifyingKey() internal pure returns (VerifyingKey memory vk) {
177 vk.alfa1 = WithdrawPairing.G1Point(4297056733213219859343595902911474212531679066691174515518566289296862448444,4118210981440029225166132201111655761091977199270131833660894679466015902790);
178 vk.beta2 = WithdrawPairing.G2Point([8432401178610715017522187095017141452256968060720655001943681144704681203162,20225339942421781890739814367503015805021408029816534384568975989447323618511], [4834758580575986670881233088235906918937658419326998231175019058718340643738,18563021167708801438919497910470781384291873402945244720127030262991586019354]);
179 vk.gamma2 = WithdrawPairing.G2Point([12216917316860064359319225214672707506982145717785585352407055318045791852406,16166539837790779483464664514892121904759368139188876537264973277846536919241], [20490357584101774634267615913836176478875767727346317112419586614764063234950,16010134726469276935755880346958799379053190723590701758427883606793091122235]);
180 vk.delta2 = WithdrawPairing.G2Point([10474213958708183921155086977680302183767751804928195354437737122452000530775,9773108273173417325339709698942421365637766622753869523317186054233667618378], [16147854964572048164082375837809824945742203950104688071859656285754596010250,11100262415558015426093541731679959772584136240842322421838884270434696620945]);
181 vk.IC = new WithdrawPairing.G1Point[](6);
182 vk.IC[0] = WithdrawPairing.G1Point(12549035287950018826389227128124648821309642448046081194740867551414746445936,16568684014919445974100333544046090587350141595344577637675040655062709518493);
183 vk.IC[1] = WithdrawPairing.G1Point(12115083684378263354532293492903135977611827458752142958704830075120237564442,20870100634266963726587012268331775772515090702290901068079447765002759133309);
184 vk.IC[2] = WithdrawPairing.G1Point(5812745461009917344575852755312885578454227891300545343869244275304038771554,20292323840549344370214519296853977558551052789143029493431728787305104927396);
185 vk.IC[3] = WithdrawPairing.G1Point(4547260115459198012764009325266310410529115043680958732580932197784570644367,10715056277994978617773043139980635251314875156509544440091005842529235092175);
186 vk.IC[4] = WithdrawPairing.G1Point(1917397956416751861666133718730009968886977460807568824355482458793905843210,3701368891299580862131264739399266552453491844311287913354184906669407062679);
187 vk.IC[5] = WithdrawPairing.G1Point(9794226343300072560298373762652188441793658526495383382310165666486106285885,13609131229374196873721534431966454573967113169445854598703174909986898964199);
188
189 }
190 function verify(uint[] memory input, Proof memory proof) internal view returns (uint) {
191 uint256 snark_scalar_field = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
192 VerifyingKey memory vk = verifyingKey();
193 require(input.length + 1 == vk.IC.length,"verifier-bad-input");
194 // Compute the linear combination vk_x
195 WithdrawPairing.G1Point memory vk_x = WithdrawPairing.G1Point(0, 0);
196 for (uint i = 0; i < input.length; i++) {
197 require(input[i] < snark_scalar_field,"verifier-gte-snark-scalar-field");
198 vk_x = WithdrawPairing.addition(vk_x, WithdrawPairing.scalar_mul(vk.IC[i + 1], input[i]));
199 }
200 vk_x = WithdrawPairing.addition(vk_x, vk.IC[0]);
201 if (!WithdrawPairing.pairingProd4(
202 WithdrawPairing.negate(proof.A), proof.B,
203 vk.alfa1, vk.beta2,
204 vk_x, vk.gamma2,
205 proof.C, vk.delta2
206 )) return 1;
207 return 0;
208 }
209 function verifyProof(
210 uint[2] memory a,
211 uint[2][2] memory b,
212 uint[2] memory c,
213 uint[5] memory input
214 ) public view returns (bool r) {
215 Proof memory proof;
216 proof.A = WithdrawPairing.G1Point(a[0], a[1]);
217 proof.B = WithdrawPairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
218 proof.C = WithdrawPairing.G1Point(c[0], c[1]);
219 uint[] memory inputValues = new uint[](input.length);
220 for(uint i = 0; i < input.length; i++){
221 inputValues[i] = input[i];
222 }
223 if (verify(inputValues, proof) == 0) {
224 return true;
225 } else {
226 return false;
227 }
228 }
229}