feat(zkatsnark): add commitment for token types in actions

Signed-off-by: Ankit Basu <ankitbasu14@gmail.com>

Author: neetance

x/token/core/zkatsnark/circuit/migration.go

@@ -23,11 +23,12 @@ import (
 // zkatsnark token (MiMC commitment + Jubjub value commitment) has been
 // correctly created for the same value, in zero knowledge.
 //
-// It enforces four constraint groups:
+// It enforces five constraint groups:
 //  1. Pedersen opening: CommitmentPedersen == TokenTypePed·G[0] + Value·G[1] + RandomnessPed·G[2]
 //  2. MiMC commitment: CommitmentMiMC == MiMC(Value, TokenType, RandomnessNew)
 //  3. Value commitment: (ValueCommitOutX, ValueCommitOutY) == Value·V + RCV·R
 //  4. Range check: Value ∈ [1, 2^MaxBits)
+//  5. Type commitment: TypeCommitment == MiMC(TokenType, TypeRandomness)
 //
 // The shared Value witness variable across groups 1–3 is the structural
 // binding that proves the same denomination carries over (Decision C:
@@ -56,17 +57,22 @@ type MigrationCircuit struct {
 	// commitment.
 	ValueCommitOutY frontend.Variable `gnark:",public"`
 
-	// TokenType is the canonical field-element encoding of the token type,
-	// produced by EncodeTokenType (SetBytes). Public for type-homogeneity
-	// checks, consistent with SpendCircuit/OutputCircuit.
-	TokenType frontend.Variable `gnark:",public"`
+	// TypeCommitment is the hiding commitment to the token type:
+	// MiMC(EncodeTokenType(tokenType), TypeRandomness). Public for
+	// type-homogeneity checks, consistent with SpendCircuit/OutputCircuit.
+	TypeCommitment frontend.Variable `gnark:",public"`
 
 	// ── Private inputs ──────────────────────────────────────────────────
 
-	// Value is the token denomination, shared across all four constraint
+	// Value is the token denomination, shared across all five constraint
 	// groups. This shared variable is the conservation proof.
 	Value frontend.Variable
 
+	// TokenType is the canonical field-element encoding of the token type,
+	// produced by EncodeTokenType (SetBytes). Private — the validator
+	// only sees the TypeCommitment, not the plaintext type.
+	TokenType frontend.Variable
+
 	// TokenTypePed is the zkatdlog encoding of the token type:
 	// HashToZr(tokenType) = SHA256(tokenType) mod r. This is a DIFFERENT
 	// encoding from the public TokenType field (which uses EncodeTokenType).
@@ -84,6 +90,10 @@ type MigrationCircuit struct {
 	// this proof.
 	RCV frontend.Variable
 
+	// TypeRandomness is the randomness used to hide the token type in
+	// the TypeCommitment. Shared across all descriptions in one action.
+	TypeRandomness frontend.Variable
+
 	// ── Compile-time parameters ─────────────────────────────────────────
 
 	// MaxBits is the bit-width of the value range constraint, sourced from
@@ -223,5 +233,17 @@ func (c *MigrationCircuit) Define(api frontend.API) error {
 	_ = api.ToBinary(c.Value, maxBits)
 	api.AssertIsDifferent(c.Value, 0)
 
+	// ── Constraint Group 5: Type Commitment Integrity ───────────────────
+	// Enforce: TypeCommitment == MiMC(TokenType, TypeRandomness)
+	//
+	// The same TokenType private variable used in Group 2 (MiMC commitment)
+	// appears here, so the ZK proof structurally binds the committed type
+	// to the type encoded in the note commitment.
+	tc, err := gadgets.HashCircuit(api, c.TokenType, c.TypeRandomness)
+	if err != nil {
+		return err
+	}
+	api.AssertIsEqual(tc, c.TypeCommitment)
+
 	return nil
 }

x/token/core/zkatsnark/circuit/migration_test.go

@@ -106,13 +106,14 @@ func setupMigration(t *testing.T) {
 // ── Test inputs ─────────────────────────────────────────────────────────────
 
 type migrationInputs struct {
-	value         uint64
-	tokenType     string
-	tokenTypeFr   fr.Element // EncodeTokenType(tokenType)
-	tokenTypePed  fr.Element // HashToZr(tokenType) for Pedersen
-	randomnessPed fr.Element // Pedersen blinding factor
-	randomnessNew fr.Element // MiMC randomness
-	rcv           fr.Element // Jubjub value-commitment randomness
+	value          uint64
+	tokenType      string
+	tokenTypeFr    fr.Element // EncodeTokenType(tokenType)
+	tokenTypePed   fr.Element // HashToZr(tokenType) for Pedersen
+	randomnessPed  fr.Element // Pedersen blinding factor
+	randomnessNew  fr.Element // MiMC randomness
+	rcv            fr.Element // Jubjub value-commitment randomness
+	typeRandomness fr.Element // TypeCommitment randomness
 }
 
 func newRandomMigrationInputs(t *testing.T) migrationInputs {
@@ -131,22 +132,25 @@ func newRandomMigrationInputs(t *testing.T) migrationInputs {
 	var tokenTypePed fr.Element
 	tokenTypePed.SetBigInt(digestBig)
 
-	var randomnessPed, randomnessNew, rcv fr.Element
+	var randomnessPed, randomnessNew, rcv, typeRandomness fr.Element
 	_, err := randomnessPed.SetRandom()
 	require.NoError(t, err)
 	_, err = randomnessNew.SetRandom()
 	require.NoError(t, err)
 	_, err = rcv.SetRandom()
 	require.NoError(t, err)
+	_, err = typeRandomness.SetRandom()
+	require.NoError(t, err)
 
 	return migrationInputs{
-		value:         value,
-		tokenType:     tokenType,
-		tokenTypeFr:   tokenTypeFr,
-		tokenTypePed:  tokenTypePed,
-		randomnessPed: randomnessPed,
-		randomnessNew: randomnessNew,
-		rcv:           rcv,
+		value:          value,
+		tokenType:      tokenType,
+		tokenTypeFr:    tokenTypeFr,
+		tokenTypePed:   tokenTypePed,
+		randomnessPed:  randomnessPed,
+		randomnessNew:  randomnessNew,
+		rcv:            rcv,
+		typeRandomness: typeRandomness,
 	}
 }
 
@@ -210,20 +214,26 @@ func buildMigrationAssignment(t *testing.T, inp migrationInputs) *circuit.Migrat
 	cv, err := jubjub.ValueCommit(inp.value, inp.rcv)
 	require.NoError(t, err, "jubjub.ValueCommit failed")
 
+	// Compute type commitment: MiMC(TokenType, TypeRandomness)
+	tc, err := mimc.Hash(inp.tokenTypeFr, inp.typeRandomness)
+	require.NoError(t, err, "mimc.Hash failed for type commitment")
+
 	return &circuit.MigrationCircuit{
 		// Public inputs
 		CommitmentPedersenX: emulated.ValueOf[emulated.BLS12381Fp](pedXBig),
 		CommitmentPedersenY: emulated.ValueOf[emulated.BLS12381Fp](pedYBig),
 		CommitmentMiMC:      cm,
 		ValueCommitOutX:     cv.X,
 		ValueCommitOutY:     cv.Y,
-		TokenType:           inp.tokenTypeFr,
+		TypeCommitment:      tc,
 		// Private inputs
-		Value:         vField,
-		TokenTypePed:  inp.tokenTypePed,
-		RandomnessPed: inp.randomnessPed,
-		RandomnessNew: inp.randomnessNew,
-		RCV:           inp.rcv,
+		Value:          vField,
+		TokenType:      inp.tokenTypeFr,
+		TokenTypePed:   inp.tokenTypePed,
+		RandomnessPed:  inp.randomnessPed,
+		RandomnessNew:  inp.randomnessNew,
+		RCV:            inp.rcv,
+		TypeRandomness: inp.typeRandomness,
 		// Compile-time parameters
 		MaxBits: params.DefaultMaxBits,
 		PedG0X:  testPedGens.G0X, PedG0Y: testPedGens.G0Y,
@@ -410,6 +420,10 @@ func TestMigrationCircuitInvalid_OverflowValue(t *testing.T) {
 	cm, err := mimc.Hash(overflowValue, inp.tokenTypeFr, inp.randomnessNew)
 	require.NoError(t, err)
 
+	// Compute type commitment
+	tc, err := mimc.Hash(inp.tokenTypeFr, inp.typeRandomness)
+	require.NoError(t, err)
+
 	pedXBig := pedCommit.X.BigInt(new(big.Int))
 	pedYBig := pedCommit.Y.BigInt(new(big.Int))
 
@@ -426,12 +440,14 @@ func TestMigrationCircuitInvalid_OverflowValue(t *testing.T) {
 		CommitmentMiMC:      cm,
 		ValueCommitOutX:     fakeCVX,
 		ValueCommitOutY:     fakeCVY,
-		TokenType:           inp.tokenTypeFr,
+		TypeCommitment:      tc,
 		Value:               overflowValue,
+		TokenType:           inp.tokenTypeFr,
 		TokenTypePed:        inp.tokenTypePed,
 		RandomnessPed:       inp.randomnessPed,
 		RandomnessNew:       inp.randomnessNew,
 		RCV:                 inp.rcv,
+		TypeRandomness:      inp.typeRandomness,
 		MaxBits:             params.DefaultMaxBits,
 		PedG0X:              testPedGens.G0X, PedG0Y: testPedGens.G0Y,
 		PedG1X: testPedGens.G1X, PedG1Y: testPedGens.G1Y,
@@ -445,3 +461,22 @@ func TestMigrationCircuitInvalid_OverflowValue(t *testing.T) {
 	require.Error(t, err,
 		"MigrationCircuit must reject values >= 2^MaxBits, overflow attack possible if not")
 }
+
+func TestMigrationCircuitInvalid_WrongTypeRandomness(t *testing.T) {
+	setupMigration(t)
+
+	inp := newRandomMigrationInputs(t)
+	assignment := buildMigrationAssignment(t, inp)
+
+	var wrongTR fr.Element
+	_, err := wrongTR.SetRandom()
+	require.NoError(t, err)
+	assignment.TypeRandomness = wrongTR
+
+	witness, err := frontend.NewWitness(assignment, ecc.BLS12_381.ScalarField())
+	require.NoError(t, err)
+
+	err = migrationCS.IsSolved(witness)
+	require.Error(t, err,
+		"MigrationCircuit must reject a witness where TypeRandomness doesn't produce the public TypeCommitment")
+}

x/token/core/zkatsnark/circuit/output.go

@@ -16,21 +16,24 @@ import (
 
 // OutputCircuit proves that a newly created output token is well-formed.
 //
-// It enforces three constraint groups:
+// It enforces four constraint groups:
 //  1. CommitmentOut == MiMC(Value, TokenType, Randomness)
 //  2. (ValueCommitOutX, ValueCommitOutY) == Value·V + RCV·R
 //  3. Value ∈ [1, 2^MaxBits)
+//  4. TypeCommitment == MiMC(TokenType, TypeRandomness)
 type OutputCircuit struct {
 	// Public inputs
 	CommitmentOut   frontend.Variable `gnark:"public"`
 	ValueCommitOutX frontend.Variable `gnark:"public"`
 	ValueCommitOutY frontend.Variable `gnark:"public"`
-	TokenType       frontend.Variable `gnark:"public"`
+	TypeCommitment  frontend.Variable `gnark:"public"`
 
 	// Private inputs
-	Value      frontend.Variable
-	Randomness frontend.Variable
-	RCV        frontend.Variable
+	Value          frontend.Variable
+	TokenType      frontend.Variable
+	Randomness     frontend.Variable
+	RCV            frontend.Variable
+	TypeRandomness frontend.Variable
 
 	// Compile-time parameter
 	// MaxBits is the bit-width of the value range constraint.
@@ -77,5 +80,18 @@ func (c *OutputCircuit) Define(api frontend.API) error {
 	_ = api.ToBinary(c.Value, maxBits)
 	api.AssertIsDifferent(c.Value, 0)
 
+	// ── Constraint Group 4: Type Commitment Integrity ───────────────────────
+	// Enforce: TypeCommitment == MiMC(TokenType, TypeRandomness)
+	//
+	// The same TokenType private variable used in Group 1 (note commitment)
+	// appears here, so the ZK proof structurally binds the committed type
+	// to the type encoded in the note commitment. The validator only sees
+	// TypeCommitment (a hiding commitment) — not the plaintext type.
+	tc, err := gadgets.HashCircuit(api, c.TokenType, c.TypeRandomness)
+	if err != nil {
+		return err
+	}
+	api.AssertIsEqual(tc, c.TypeCommitment)
+
 	return nil
 }