Locking by spending and creating UTXOs #121

jimthematrix · 2025-01-14T22:04:42Z

per discussions in #119, re-implementing state locking with the following functions:

lock(inputs, outputs, lockedOutputs, delegate) will spend the unlocked inputs and create a combination of unlocked inputs and locked inputs. Locked UTXOs must be spent by submitting the proper proof from the delegate account. The delegate account with be an EOA or a contract
delegateLock(utxos, newDelegate) allows the current delegate to move the lock to a new delegate
transfer(inputs, outputs, proof) is updated to spend only unlocked UTXOs
transferLocked(inputs, outputs, proof) is added to spend locked UTXOs

Note: to allow time to test out the new locking design, and avoid unnecessary re-implementation in the future, we only implement locking for the following token varieties, the remaining token implementations will be enhanced with locking after we have successfully proven the new locking mechanism:

Zeto_Anon
Zeto_AnonNullifier
Zeto_NfAnon
Zeto_NfAnonNullifier

Signed-off-by: Jim Zhang <[email protected]>

commit 97a67ac88dba76eabb78f844be83a94d147939bf Author: Jim Zhang <[email protected]> Date: Wed Jan 8 16:46:48 2025 -0500 update locking for nullifier based tokens Signed-off-by: Jim Zhang <[email protected]> commit dc5de95cc538736fbb2d4156ad952f51020a60a2 Author: Jim Zhang <[email protected]> Date: Wed Jan 8 16:45:38 2025 -0500 spend inputs when locking Signed-off-by: Jim Zhang <[email protected]> commit 07b42e72db8c94c81ec87c11c1b419507b858550 Merge: 7751a58 cb39891 Author: Jim Zhang <[email protected]> Date: Mon Jan 6 11:18:22 2025 -0500 Merge branch 'main' into locking commit 7751a5808ddcbf54db643d9f8c969d86b84677a3 Author: Jim Zhang <[email protected]> Date: Sun Jan 5 21:50:45 2025 -0500 --amend commit 5d1314b1262531a8cc4af9d084e5016e0984d2a8 Author: Jim Zhang <[email protected]> Date: Fri Jan 3 17:17:31 2025 -0500 enhance locking with outputs Signed-off-by: Jim Zhang <[email protected]> Signed-off-by: Jim Zhang <[email protected]>

Signed-off-by: Jim Zhang <[email protected]>

awrichar · 2025-01-22T01:37:10Z

solidity/contracts/lib/zeto_base.sol

+            ) {
+                revert UTXOAlreadyLocked(sortedInputs[i]);
+            }
+            if (


Feels like all these "if" statements could be nested into a big if (inputsLocked) {} else {} block. It's almost entirely different checks for locked inputs vs unlocked ones.

awrichar · 2025-01-22T01:39:55Z

solidity/contracts/lib/zeto_base.sol

@@ -118,4 +190,67 @@ abstract contract ZetoBase is IZetoBase, ZetoCommon {
        }
        emit UTXOMint(utxos, msg.sender, data);
    }
+    // Locks the UTXOs so that they can only be spent by submitting the appropriate
+    // proof from the Eth account designated as the "delegate". This function
+    // should be called by escrow contracts that will use uploaded proofs


Small note, but "lock" wouldn't actually be called by the escrow contract - it would have to be called by the account owner establishing the the escrow contract.

awrichar · 2025-01-22T01:40:31Z

solidity/contracts/lib/zeto_base.sol

+                delegates[lockedOutputs[i]] != address(0) &&
+                delegates[lockedOutputs[i]] != msg.sender
+            ) {
+                revert UTXOAlreadyLocked(lockedOutputs[i]);


Should this be NotLockDelegate?

awrichar · 2025-01-22T01:41:57Z

solidity/contracts/lib/zeto_base.sol

+            ) {
+                revert UTXOAlreadyLocked(lockedOutputs[i]);
+            }
+            delegates[lockedOutputs[i]] = delegate;


Where do we set _lockedUtxos?

OK I see that it's in another method, processInputsAndOutputs. It's slightly confusing that the setup of the locked states is split up. Maybe this method just needs a different name?

awrichar · 2025-01-22T01:47:28Z

solidity/contracts/lib/zeto_nullifier.sol

@@ -59,6 +69,8 @@ abstract contract ZetoNullifier is IZetoBase, ZetoCommon {
                revert UTXODuplicate(sortedInputs[i]);
            }
            if (_nullifiers[sortedInputs[i]] == true) {
+                console.log("nullifier");
+                console.log(sortedInputs[i]);


should these stay here?

awrichar · 2025-01-22T01:49:56Z

solidity/contracts/test/escrow2.sol

+
+/// @title A sample on-chain implementation of an escrow contract using Zeto tokens
+/// @author Kaleido, Inc.
+/// @dev Implements escrow based payment flows with Zeto_Anon tokens


This is with Zeto_AnonNullifier

awrichar · 2025-01-22T01:51:40Z

I like the direction here, and I think it makes sense. Since it's in draft state, I've mainly reviewed the documentation and looked through the contracts at a high level. I haven't yet done a detailed review of the contracts and circuits.

Signed-off-by: Jim Zhang <[email protected]>

doc-site/docs/advanced/erc20-tokens-integration.md

Chengxuan · 2025-01-28T13:09:50Z

doc-site/docs/images/overview.jpg

couldn't spot the difference here

it's the spelling of "woner" vs. "owner" in the label on the bottom 😄

Chengxuan · 2025-01-28T13:46:09Z

solidity/contracts/lib/zeto_base.sol

+            if (
+                _lockedUtxos[sortedInputs[i]] == UTXOStatus.SPENT ||
+                _utxos[sortedInputs[i]] == UTXOStatus.SPENT
+            ) {


Reading the logic, it feels like:
we allow the same UTXO hash to exist in both the regular and locked UTXO tracking map.
but once one of the UTXO with that hash is spent, the other UTXO will not be spendable.

@jimthematrix did I miss a uniqueness check somewhere

we don't allow the same UTXO to exist in both maps at the same time. if you think that's a possibility due to a hole in the current validation logic, please provide the details

At the first read, it wasn't clear to me the whether someone can use the lock function to generate same utxos that are in different maps. I added a test to prove that's not possible: 8ced077

Co-authored-by: Chengxuan Xing <[email protected]> Signed-off-by: jimthematrix <[email protected]>

Signed-off-by: Chengxuan Xing <[email protected]>

Chengxuan · 2025-01-29T11:26:25Z

zkp/circuits/basetokens/anon_nullifier__transferLocked_base.circom

+  // With the above steps, we demonstrated that the nullifiers
+  // are securely bound to the input commitments. Now we need to
+  // demonstrate that the input commitments belong to the Sparse
+  // Merkle Tree with the root `root`.


I'm not sure these comments are up to date, I don't see any above steps

for the rest of the comments, it's unclear what's the relationship between delegates & root

zkp/circuits/basetokens/anon_nullifier__transferLocked_base.circom

Chengxuan

Changes look good to me. Usage of node values for enhance circuit security for locked UTXOs is great.

Signed-off-by: Jim Zhang <[email protected]>

spend inputs for locking

97f3894

Signed-off-by: Jim Zhang <[email protected]>

jimthematrix requested review from Chengxuan and awrichar January 14, 2025 22:06

jimthematrix added 4 commits January 14, 2025 17:12

zeto lock with nullifiers

5a8e9f2

Signed-off-by: Jim Zhang <[email protected]>

remove lock verifiers

ac8c0f9

Signed-off-by: Jim Zhang <[email protected]>

transfer() and transferLocked() with new circuits

4725fba

Signed-off-by: Jim Zhang <[email protected]>

jimthematrix force-pushed the lock-nullifiers branch from 6706e9e to 4725fba Compare January 14, 2025 22:15

jimthematrix marked this pull request as draft January 15, 2025 14:19

jimthematrix added 4 commits January 15, 2025 15:03

fix anon_nullifier and add locking support to nf_anon

61a0902

Signed-off-by: Jim Zhang <[email protected]>

add locking support for NF token implementations

e710d01

Signed-off-by: Jim Zhang <[email protected]>

Add escrow contract based on Zeto_Anon for testing purposes

8a2504e

Signed-off-by: Jim Zhang <[email protected]>

add escrow contracts to test locking flows

444a062

Signed-off-by: Jim Zhang <[email protected]>

awrichar reviewed Jan 22, 2025

View reviewed changes

jimthematrix added 2 commits January 21, 2025 21:20

fix tests

1a5a3a9

Signed-off-by: Jim Zhang <[email protected]>

fix circuit tests

eb8723f

Signed-off-by: Jim Zhang <[email protected]>

jimthematrix marked this pull request as ready for review January 22, 2025 02:37

jimthematrix added 7 commits January 22, 2025 09:03

fix go-sdk integration test

7660df1

Signed-off-by: Jim Zhang <[email protected]>

update checks of inputs and output

7b3861b

Signed-off-by: Jim Zhang <[email protected]>

update circuit integration tests

a6a911e

Signed-off-by: Jim Zhang <[email protected]>

fix nf nullifier integration test

121185b

Signed-off-by: Jim Zhang <[email protected]>

fix nf anon nullifier integration test

518cd5b

Signed-off-by: Jim Zhang <[email protected]>

fix test for the escrow flow

ff3fe10

Signed-off-by: Jim Zhang <[email protected]>

fix anon_nullifier build and tests for batching

63a902a

Signed-off-by: Jim Zhang <[email protected]>

jimthematrix mentioned this pull request Jan 23, 2025

Update support in Paladin for zeto locking LF-Decentralized-Trust-labs/paladin#524

Open

jimthematrix added 8 commits January 23, 2025 10:02

fix deployment parameters for the factory

5f1a2df

Signed-off-by: Jim Zhang <[email protected]>

change the verifier initialization params to a struct

f4dff77

Signed-off-by: Jim Zhang <[email protected]>

move verifiers to the contracts/verifiers folder

64966b5

Signed-off-by: Jim Zhang <[email protected]>

fix factory unit tests

c6c2d7e

Signed-off-by: Jim Zhang <[email protected]>

fix tests for using the cloneable factory

e7e96b7

Signed-off-by: Jim Zhang <[email protected]>

consolidate solidity interfaces

073918c

Signed-off-by: Jim Zhang <[email protected]>

use proof to check for existence in the locked commitments tree

7323357

Signed-off-by: Jim Zhang <[email protected]>

renaming of internal variables

a9c95c7

Signed-off-by: Jim Zhang <[email protected]>

Chengxuan reviewed Jan 28, 2025

View reviewed changes

jimthematrix and others added 2 commits January 28, 2025 13:48

Update doc-site/docs/advanced/erc20-tokens-integration.md

1c54398

Co-authored-by: Chengxuan Xing <[email protected]> Signed-off-by: jimthematrix <[email protected]>

test for duplicate output utxos

8ced077

Signed-off-by: Chengxuan Xing <[email protected]>

Chengxuan reviewed Jan 29, 2025

View reviewed changes

zkp/circuits/basetokens/anon_nullifier__transferLocked_base.circom Outdated Show resolved Hide resolved

Chengxuan approved these changes Jan 29, 2025

View reviewed changes

Update inline comments in the transferLocked circuit

925ee0c

Signed-off-by: Jim Zhang <[email protected]>

jimthematrix merged commit f962f1c into main Jan 29, 2025
7 checks passed

jimthematrix deleted the lock-nullifiers branch January 29, 2025 20:55

jimthematrix mentioned this pull request Jan 29, 2025

Add output to the lockStates() function #118

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Locking by spending and creating UTXOs #121

Locking by spending and creating UTXOs #121

jimthematrix commented Jan 14, 2025 •

edited

Loading

awrichar Jan 22, 2025

awrichar Jan 22, 2025

awrichar Jan 22, 2025

awrichar Jan 22, 2025 •

edited

Loading

awrichar Jan 22, 2025

awrichar Jan 22, 2025

awrichar Jan 22, 2025

awrichar commented Jan 22, 2025

Chengxuan Jan 28, 2025

jimthematrix Jan 29, 2025

Chengxuan Jan 28, 2025

jimthematrix Jan 28, 2025

Chengxuan Jan 29, 2025 •

edited

Loading

Chengxuan Jan 29, 2025 •

edited

Loading

Chengxuan left a comment

Locking by spending and creating UTXOs #121

Locking by spending and creating UTXOs #121

Conversation

jimthematrix commented Jan 14, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

awrichar Jan 22, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

awrichar commented Jan 22, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Chengxuan Jan 29, 2025 • edited Loading

Choose a reason for hiding this comment

Chengxuan Jan 29, 2025 • edited Loading

Choose a reason for hiding this comment

Chengxuan left a comment

Choose a reason for hiding this comment

jimthematrix commented Jan 14, 2025 •

edited

Loading

awrichar Jan 22, 2025 •

edited

Loading

Chengxuan Jan 29, 2025 •

edited

Loading

Chengxuan Jan 29, 2025 •

edited

Loading