ZKMixer: A Solidity repository from BC-A

Mixer

A coin mixer implementation based on ZKP for privacy-preserving DeFi and DAO. NOTE that it's not production ready.

Components

Circuits
- mixer.circom
- get_merkle_root.circom
Contracts
- Mixer
- Merkle

Compile circuits

$ cd circuit && ./run.sh mixer

Wait until you are asked to type in the secret phase, twice!!

Then run the UT by yarn test

How it work

Mixer is built on PlonK and Merkle Tree.

PlonK

PlonK is a universal SNARK construction with fully succinct verification, and significantly lower prover running time (roughly 7.5-20 times fewer group exponentiations than MBKM19 in the fully succinct verifier mode depending on circuit structure).

MIMC MiMC is a block cipher and hash function family designed specifically for SNARK applications. The low multiplicative complexity of MiMC over prime fields makes it suitable for ZK-SNARK applications such as ZCash. More details are here.
yarn generate This operation produces 4 files in circuit directory:

input.json : secret for mixer to generate witness, a sample is as below:

{
    "root": "6006452839415899035733807029325942815929888768074345937414569668512067894100",
    "nullifierHash": "3701224944747537563701225775873437347582519438989321326160774689502152321319",
    "secret": "10",
    "paths2_root": [
        3174904703,
        1831855034,
        2927866351,
        3904382600,
        4026780824,
        2259814112,
        3460561431,
        3054720229
    ],
    "paths2_root_pos": [
        1,
        1,
        1,
        1,
        1,
        1,
        1,
        1
    ]
}

where path2_root is generated by call getMerkleProof, and root is the merkle root, and nullifierHash is nullifier to check whether the commitment has been withdrawed. The secret is used to generate the commitment by hash function in binary format, paths2_root is the salt for each non-leaf node to compute it's hash. And paths2_root_pos is 0 or 1, used as a sign function to choose whether paths2_root as xIn and previous path2_root as k, and vice versa. The circom code shown as below:

merkle_root[v].x_in <== paths2_root[v] - paths2_root_pos[v] * (paths2_root[v] - merkle_root[v-1].out);
merkle_root[v].k<== merkle_root[v-1].out - paths2_root_pos[v]* (merkle_root[v-1].out - paths2_root[v]);

public.json: includes nullifierHash and root.

cmt.json: the parameter of deposit

./run.sh mixer

Here we use PlonK and curve bn128 to generate verification key and proof key. More details are presented in reference 1. One point should be mentioned is powersoftau, which adopts MPC to generate verifiable Random Beacon as CRS, to secure their secret randomness throughout the duration of the protocol.

npx hardhat node

Start the local node.

yarn test

Run the test.

Contribution

Use solium to format the solidity code.

Notices

fix the circuits to verify the new root

The solution is inserting the commitment from index 0 to 2^depth, so the root would be updated in way in circuit and contract. This works because the MT.cur is same as the commitment index.

tx origin check before deposit

BC-A/ZKMixer