1# miksi [![Test](https://github.com/miksi-labs/miksi-core/workflows/Test/badge.svg)](https://github.com/miksi-labs/miksi-core/actions?query=workflow%3ATest)
 2
 3Ethereum zk mixer where all the computation & constructions are done offchain and then proved inside a zkSNARK to the smart-contract (both to *deposit* and *withdraw*).
 4
 5## Overview
 6
 7*From Esperanto, **miksi** (miks·i): to mingle, to blend, to mix, to shuffle*
 8
 9The client builds a MerkleTree, carries out the required computation, and then generates a zk-proof proving that the offchain computation has been done correctly (no leaf deletion, and only one correctly formatted leaf addition).
10This approach requires only `~325.000 gas` to *deposit* (compared to `~1M gas` for an onchain computation approach) , and `~308.000 gas` to *withdraw*.
11
12These gas savings come from the fact that we don't need to carry out the MerkleTree computations onchain. Instead, we prove the correctness of these offchain computations inside the snark proof, and verify this proof onchain. It's much cheaper to verify the proof than to carry out the necessary computations onchain.
13
14![](miksi-logo00-small.png)
15
16**Warning:** This repository is in a very early stage. The current version works, but is not finished. There are some improvements in the works.
17
18The WebApp to use miksi-core can be found at https://github.com/arnaucube/miksi-app, and a live-demo with the smart contract deployed at Goerli Ethereum testnet can be used here: https://arnaucube.github.io/miksi-app/
19
20## Run
21- Circuits tests
22```
23npm run test-circuits
24```
25
26- Smart Contracts tests
27```
28npm run test-sc
29```
30
31- javascript lib tests
32```
33npm run test
34```
35
36- Compile circom circuit & generate Groth16 verifier contract
37```
38./compile-circuits.sh
39```
40
41
42## Spec draft
43**Note:** Both the spec and the code are works in progress. There are some pending improvements in the works, and some diagrams are needed to better explain things.
44
45### Deposit
46*All computations and constructions are done offchain and then proved inside a zkSNARK to the smart-contract*
47
48From the depositer's perspective, the interface facilitates the following flow:
49
501. Generate a random `secret` & `nullifier`
512. Compute the `commitment`, which is the Poseidon hash: `commitment = H(coinCode, amount, secret, nullifier)`, where:
52	- `coinCode`: code that specifies which currency is being used (`0`==ETH)
53	- `amount`: the amount to be deposited
54	- `secret`: random, private
55	- `nullifier`: random
563. Fetch all the commitments from the smart-contract
574. Build the MerkleTree with the fetched commitments
585. Add the newly computed `commitment` to the MerkleTree
596. Generate a zkSNARK proof, which proves:
60	- you know the `secret` & `nullifier` for the `commitment` contained in the leaf you've just added to the MerkleTree
61	- the transition from `RootOld` (the current one in the smart-contract) to `RootNew` has been done following the rules (no leaf deletion, and only one correctly formatted leaf addition, etc.)
627. Send ETH to the smart-contract `deposit` call, together with the zkProof data
63
64Once these steps have been carried out, the smart-contract verifies the zkProof of the deposit, and if everything checks out ok, stores the commitment and the new root.
65
66The deposit circuit can be found [here](https://github.com/miksi-labs/miksi-core/blob/master/circuits/deposit.circom).
67
68### Withdraw
69*As before, all computations and constructions are done offchain and then proved inside a zkSNARK to the Smart Contract*
70
71From the withdrawer's perspective, the interface facilitates the following flow:
72
731. Fetch all the commitments from the smart-contract
742. Build the MerkleTree with the fetched commitments
753. Generate the siblings (merkle proof) for the `commitment` whose `secret` & `nullifier` you know
764. Generate a zkSNARK proof, which proves:
77        - you know a `secret` for a `nullifier` you reveal, whose `commitment` is in a MerkleTree with `root` matching the one stored in the smart-contract
78	
79If the zkProof verification passes, and the nullifier has not already been used, the smart-contract sends the ETH to the specified address.
80
81The withdraw circuit can be found [here](https://github.com/miksi-labs/miksi-core/blob/master/circuits/withdraw.circom).
82
83
84# Thanks
85Miksi is made possible thanks to [circom](https://github.com/iden3/circom), [circomlib](https://github.com/iden3/circomlib), [wasmsnark](https://github.com/iden3/wasmsnark), and the ideas developed in the [Zexe paper](https://eprint.iacr.org/2018/962.pdf).