Squashed commit of the following:

commit 97a67ac88dba76eabb78f844be83a94d147939bf
Author: Jim Zhang <[email protected]>
Date:   Wed Jan 8 16:46:48 2025 -0500

    update locking for nullifier based tokens

    Signed-off-by: Jim Zhang <[email protected]>

commit dc5de95cc538736fbb2d4156ad952f51020a60a2
Author: Jim Zhang <[email protected]>
Date:   Wed Jan 8 16:45:38 2025 -0500

    spend inputs when locking

    Signed-off-by: Jim Zhang <[email protected]>

commit 07b42e72db8c94c81ec87c11c1b419507b858550
Merge: 7751a58 cb39891
Author: Jim Zhang <[email protected]>
Date:   Mon Jan 6 11:18:22 2025 -0500

    Merge branch 'main' into locking

commit 7751a5808ddcbf54db643d9f8c969d86b84677a3
Author: Jim Zhang <[email protected]>
Date:   Sun Jan 5 21:50:45 2025 -0500

    --amend

commit 5d1314b1262531a8cc4af9d084e5016e0984d2a8
Author: Jim Zhang <[email protected]>
Date:   Fri Jan 3 17:17:31 2025 -0500

    enhance locking with outputs

    Signed-off-by: Jim Zhang <[email protected]>

Signed-off-by: Jim Zhang <[email protected]>

solidity/contracts/lib/zeto_lock.sol

@@ -16,7 +16,7 @@
 pragma solidity ^0.8.27;
 
 import {IZetoBase} from "./interfaces/izeto_base.sol";
-import {IZetoLockable, ILockVerifier, IBatchLockVerifier} from "./interfaces/izeto_lockable.sol";
+import {IZetoLockable} from "./interfaces/izeto_lockable.sol";
 import {Commonlib} from "./common.sol";
 import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
 
@@ -32,16 +32,10 @@ abstract contract ZetoLock is IZetoBase, IZetoLockable, OwnableUpgradeable {
     // by the same party that did the locking.
     mapping(uint256 => address) internal lockedUTXOs;
 
-    ILockVerifier internal _lockVerifier;
-    IBatchLockVerifier internal _batchLockVerifier;
-
     function __ZetoLock_init(
-        ILockVerifier lockVerifier,
-        IBatchLockVerifier batchLockVerifier
-    ) public onlyInitializing {
-        _lockVerifier = lockVerifier;
-        _batchLockVerifier = batchLockVerifier;
-    }
+        address lockVerifier,
+        address batchLockVerifier
+    ) public onlyInitializing {}
 
     // Locks the UTXOs so that they can only be spent by submitting the appropriate
     // proof from the Eth account designated as the "delegate". This function
@@ -117,19 +111,4 @@ abstract contract ZetoLock is IZetoBase, IZetoLockable, OwnableUpgradeable {
         }
         return true;
     }
-
-    function _verifyLockProof(
-        uint256[2] memory utxos,
-        Commonlib.Proof calldata proof
-    ) internal view returns (bool) {
-        return _lockVerifier.verifyProof(proof.pA, proof.pB, proof.pC, utxos);
-    }
-
-    function _verifyBatchLockProof(
-        uint256[10] memory utxos,
-        Commonlib.Proof calldata proof
-    ) internal view returns (bool) {
-        return
-            _batchLockVerifier.verifyProof(proof.pA, proof.pB, proof.pC, utxos);
-    }
 }

solidity/contracts/lib/zeto_lock_nullifier.sol

@@ -0,0 +1,124 @@
+// Copyright © 2024 Kaleido, Inc.
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+pragma solidity ^0.8.27;
+
+import {IZetoBase} from "./interfaces/izeto_base.sol";
+import {IZetoLockable, ILockVerifier, IBatchLockVerifier} from "./interfaces/izeto_lockable.sol";
+import {Commonlib} from "./common.sol";
+import {SmtLib} from "@iden3/contracts/lib/SmtLib.sol";
+import {OwnableUpgradeable} from "@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol";
+
+/// @title A sample base implementation of a Zeto based token contract
+///        without using nullifiers. Each UTXO's spending status is explicitly tracked.
+/// @author Kaleido, Inc.
+/// @dev Implements common functionalities of Zeto based tokens without nullifiers
+abstract contract ZetoLock is IZetoBase, IZetoLockable, OwnableUpgradeable {
+    // used for multi-step transaction flows that require counterparties
+    // to upload proofs. To protect the party that uploads their proof first,
+    // and prevent any other party from utilizing the uploaded proof to execute
+    // a transaction, the input UTXOs or nullifiers can be locked and only usable
+    // by the same party that did the locking.
+    SmtLib.Data internal _lockedCommitmentsTree;
+    using SmtLib for SmtLib.Data;
+    mapping(uint256 => bool) private _nullifiersForLockedCommitments;
+
+    ILockVerifier internal _lockVerifier;
+    IBatchLockVerifier internal _batchLockVerifier;
+
+    function __ZetoLock_init(
+        ILockVerifier lockVerifier,
+        IBatchLockVerifier batchLockVerifier
+    ) public onlyInitializing {
+        _lockVerifier = lockVerifier;
+        _batchLockVerifier = batchLockVerifier;
+        _lockedCommitmentsTree.initialize(MAX_SMT_DEPTH);
+    }
+
+    // Locks the UTXOs so that they can only be spent by submitting the appropriate
+    // proof from the Eth account designated as the "delegate". This function
+    // should be called by escrow contracts that will use uploaded proofs
+    // to execute transactions, in order to prevent the proof from being used
+    // by parties other than the escrow contract.
+    function _lock(
+        uint256[] memory inputs,
+        uint256[] memory outputs,
+        uint256[] memory lockedOutputs,
+        address delegate,
+        bytes calldata data
+    ) public {
+        for (uint256 i = 0; i < lockedOutputs.length; ++i) {
+            if (lockedOutputs[i] == 0) {
+                continue;
+            }
+            if (
+                lockedUTXOs[lockedOutputs[i]] != address(0) &&
+                lockedUTXOs[lockedOutputs[i]] != msg.sender
+            ) {
+                revert UTXOAlreadyLocked(lockedOutputs[i]);
+            }
+            lockedUTXOs[lockedOutputs[i]] = delegate;
+        }
+
+        emit UTXOsLocked(
+            inputs,
+            outputs,
+            lockedOutputs,
+            delegate,
+            msg.sender,
+            data
+        );
+    }
+
+    // move the ability to spend the locked UTXOs to the delegate account.
+    // The sender must be the current delegate.
+    //
+    // Setting the delegate to address(0) will unlock the UTXOs.
+    function delegateLock(
+        uint256[] memory utxos,
+        address delegate,
+        bytes calldata data
+    ) public {
+        for (uint256 i = 0; i < utxos.length; ++i) {
+            if (utxos[i] == 0) {
+                continue;
+            }
+            if (lockedUTXOs[utxos[i]] != msg.sender) {
+                revert NotLockDelegate(utxos[i], delegate, msg.sender);
+            }
+            lockedUTXOs[utxos[i]] = delegate;
+        }
+
+        emit LockDelegateChanged(utxos, msg.sender, delegate, data);
+    }
+
+    function validateLockedStates(
+        uint256[] memory utxos
+    ) internal returns (bool) {
+        for (uint256 i = 0; i < utxos.length; ++i) {
+            if (utxos[i] == 0) {
+                continue;
+            }
+            // check if the UTXO has been locked
+            if (lockedUTXOs[utxos[i]] != address(0)) {
+                if (lockedUTXOs[utxos[i]] != msg.sender) {
+                    revert UTXOAlreadyLocked(utxos[i]);
+                }
+                delete lockedUTXOs[utxos[i]];
+            }
+        }
+        return true;
+    }
+}

solidity/contracts/lib/zeto_nullifier.sol

@@ -16,6 +16,7 @@
 pragma solidity ^0.8.27;
 
 import {IZetoBase} from "./interfaces/izeto_base.sol";
+import {MAX_SMT_DEPTH} from "./interfaces/izeto_nullifier.sol";
 import {ZetoCommon} from "./zeto_common.sol";
 import {SmtLib} from "@iden3/contracts/lib/SmtLib.sol";
 import {PoseidonUnit3L} from "@iden3/contracts/lib/Poseidon.sol";
@@ -24,7 +25,6 @@ import {PoseidonUnit3L} from "@iden3/contracts/lib/Poseidon.sol";
 /// @author Kaleido, Inc.
 /// @dev Implements common functionalities of Zeto based tokens using nullifiers
 abstract contract ZetoNullifier is IZetoBase, ZetoCommon {
-    uint256 public constant MAX_SMT_DEPTH = 64;
     SmtLib.Data internal _commitmentsTree;
     using SmtLib for SmtLib.Data;
     mapping(uint256 => bool) private _nullifiers;