chap02-sec05.tex

% !TEX root = ../zeth-protocol-specification.tex

\section{Processing $\zethTx$}\label{zeth-protocol:process-tx}

When a $\zethTx$ is mined (hence assuming that $\ethVerifyTx(\zethTx)$ returns $\true$), the state transition specified by the $\mix$ function of $\mixer$ is executed.

To preserve the soundness of \zeth, and make sure that no $\zparty{U}$ is able to create value by double spending $\zethnotes$, various checks need to be satisfied. The function $\zethVerifyTx$ is defined as the function that returns $\true$ if all the checks are satisfied, and $\false$ otherwise.

If $\zethVerifyTx(\zethTx)$ returns $\true$, then $\mix$ modifies the ``World state'' $\wstate$ to account for the spent $\zethnotes$ and the newly generated ones. However, if $\zethVerifyTx(\zethTx)$ returns $\false$, then the state transition ends.

\begin{notebox}
    Even if $\zethVerifyTx(\zethTx)$ returns $\false$, $\wstate$ is modified since the \ethereum~balances of the transaction originator is decremented by the sum of $\txDefaultGas$ and the gas consumed by the $\zethVerifyTx$ function, and the balance of the \ethereum~account of the miner gets incremented by the same amount.
\end{notebox}

Thus, $\mix$ proceeds as follows:
\begin{enumerate}
    \item Check that all the values of the primary inputs' ($\inp{\mix}.\primInp$) entries are elements of the scalar field over which the zk-proof is generated:
        \[
            \inp{\mix}.\primInp \in \FFx{\rCURVE}^*
        \]
    \item Unpack the nullifiers, signature hash and public values (see~\cref{instantiation:statement:pack} for the definitions of the $\unpack{}{}$ functions):
        \begin{align*}
            \nf{i} &= \unpack{\inp{\mix}.\primInp.\nfs{i}, \inp{\mix}.\primInp.\resbits}{\nf{}}\ \forall i \in [\jsin] \\
            \vin &= \decode{\unpack{(), \inp{\mix}.\primInp.\resbits}{\vin}}{\NN} \\
            \vout &= \decode{\unpack{(), \inp{\mix}.\primInp.\resbits}{\vout}}{\NN} \\
            \hsig &= \unpack{\inp{\mix}.\primInp.\hsig, \inp{\mix}.\primInp.\resbits}{\hsig}
        \end{align*}
    \item Check the validity of the $\zethTx$ object ($\zethVerifyTx$):
        \begin{enumerate}
            \item Check that $\inp{\mix}.\primInp.\hsig$ is correctly computed, i.e.~check that the following equation holds (to prevent transaction malleability, see~\cref{appendix:trnm}):
                \[
                    \hsig = \crhhsig{\inp{\mix}.\primInp.\nfs{}, \inp{\mix}.\otsvk}
                \]
            \item\label{zeth-protocol:process-tx:verify-zkp} Check that $\zkp$ is a valid zk-SNARK proof for $\inp{\mix}.\primInp$, i.e.~check that:
                \[
                    \zksnark.\verifier(\pparams_{\zksnark}, \zkp, \inp{\mix}.\primInp) = \true
                \]
            \item Check that none of the nullifiers in $\inp{\mix}.\primInp.\nfs{}$ have already been used, i.e.~check that:
                \[
                    \nf{i} \not\in \nullifierset, \forall i \in [\jsin]
                \]
                where $\nullifierset$ is the set of all nullifiers that are ``declared'' on $\mixer$.
            \item\label{zeth-protocol:process-tx:check-otsig} Check that $\inp{\mix}.\otssig$ is a valid signature of the $\ethereum{}$ sender's address $\addr$ (see~\cref{zeth-protocol:create-tx}) and the attributes of $\inp{\mix}$, to prevent transaction malleability (see~\cref{appendix:trnm}), i.e.~check that:
                \begin{align*}
                    & \otsigscheme.\verify(\inp{\mix}.\otsvk, \msg, \inp{\mix}.\otssig) = \true \\
                    & \text{where} \ \datatobesigned = \addr \concat \inp{\mix}.\primInp \concat \inp{\mix}.\zkp \concat \inp{\mix}.\ciphers, \\
                    & \text{and} \ \msg = \crhots{\datatobesigned}
                \end{align*}
            \item Check that $\inp{\mix}.\primInp.\mkroot$ corresponds to a valid state of the Merkle tree held on $\mixer$, i.e.~check that:
                \[
                    \inp{\mix}.\primInp.\mkroot \in \rootset'
                \]
                where $\rootset'$ is the set of all Merkle roots corresponding to one of the states of the Merkle tree.
            \item Check that $\vin$ corresponds to the value $\val$ of the transaction object, i.e.~check that:
                \[
                    \vin = \zethTx.\val
                \]
        \end{enumerate}
    \item If all checks above pass, i.e.~if $\zethVerifyTx(\zethTx)$ returns $\true$, then the following additional modifications are made in $\wstate$:
        \begin{enumerate}
            \item Add the commitments $\inp{\mix}.\primInp.\cms{}$ to the Merkle tree held on $\mixer$.
            \item $\rootset' \gets \rootset' \cup \smallset{\mkroot'}$, where $\mkroot'$ is the Merkle root of the Merkle tree after insertion of the commitments $\inp{\mix}.\primInp.\cms{}$ in the Merkle tree.
            \item $\nullifierset \gets \nullifierset \cup \indexedset{\nf{i}}{i \in [\jsin]}$, i.e.~the nullifiers $\nfs{}$ become ``declared''.
            \item Modify the \ethereum~balances according to the public values:
                \begin{itemize}
                    \item $\wstate[\eparty{S}.\addr].\balance = \wstate[\eparty{S}.\addr].\balance - \vin$
                    \item $\wstate[\eparty{S}.\addr].\balance = \wstate[\eparty{S}.\addr].\balance + \vout$
                    \item $\mixer.\balance = \mixer.\balance + \vin$
                    \item $\mixer.\balance = \mixer.\balance - \vout$
                \end{itemize}
            \item Emit an event (\cref{sssec:ethereum-events}) $\evMixOut$ of type \mixEventDType, containing the new root $\mkroot'$ of the Merkle tree of commitments, the nullifiers $\indexedset{\nf{i}}{i \in [\jsin]}$, commitments to the newly created \zethnotes $\inp{\mix}.\primInp.\cms{}$, and the corresponding ciphertexts $\inp{\mix}.\primInp.\ciphers$.
        \end{enumerate}
\end{enumerate}

\begin{remark}\label{zeth-protocol:process-tx:dispatch-call}
  In some deployments, verification of the zk-SNARK proof $\zkp$ may be delegated to an external mechanism (in such a way that integrity of the system can still be guaranteed), and $\zkp$ may not appear as public data on-chain. For example, where multiple \zeth~transactions are aggregated by a system such as that described in \cite{rondelet2020zecale}, the original zk-SNARK proofs become auxiliary inputs to a ``wrapping'' SNARK, which checks their validity via a single proof verification. A modified version of the \mix~function receives \mix~parameters from a specific contract (known to behave correctly with respect to the delegation protocol) without $\inp{\mix}.\zkp$.

  In this case, the value of $\datatobesigned$ in \cref{zeth-protocol:process-tx:check-otsig} may be replaced by:
  \[
  \datatobesigned = \addr \concat \inp{\mix}.\primInp \concat \inp{\mix}.\ciphers, \\
  \]
  and the equivalent change must be made when generating the \mix~parameters, as described in \cref{zeth-protocol:mix-inp:otsig-for-dispatch-call}. The transaction, as presented to an aggregator, is malleable since the $\groth$ proofs can be modified in a way that preserves the validity. However, once aggregated, the transaction proof data for the transaction does not appear on chain (it is an auxiliary input to some externally generated ``wrapping'' poof). Hence, the transaction can only be identified by the remaining public data, which is protected by the one-time signature $\otsSigma$, and hence non-malleable.

  The external scheme used to verify the zk-SNARK proof must specify the exact requirements of the contact and how it should be modified, including any further checks that must be carried out. Thus, this modification is not part of the core \zeth~protocol described in this document, but an augmentation forming part of an external protocol. However, for completeness, we briefly describe a \emph{dispatch} entry point in the proof-of-concept \mixer~implementation which supports delegation of proof verification, as described above. The \emph{dispatch} entry point performs the following checks:
  \begin{itemize}
  \item Check that the \mixer~has been deployed with the (immutable) address of a trusted contract, permitted to call this entry point. Otherwise, abort.
  \item Check that the caller $msg.sender$ matches the permitted caller set at deployment time, otherwise abort.
  \item Perform all checks related to the \mix~parameters, except \cref{zeth-protocol:process-tx:verify-zkp}, with the modification to \cref{zeth-protocol:process-tx:check-otsig} described in this remark.
  \end{itemize}
  After these checks, the state-transition continues as normal.

  The \zeth~client implementation is also augmented to include a flag to enable the corresponding change described in \cref{zeth-protocol:mix-inp:otsig-for-dispatch-call} (to generate a signature on the modified $\datatobesigned$). Naturally, the \emph{dispatch} entry point can only be used with parameters generated using this flag (otherwise the signature check will fail).

  Such modifications \MUSTNOT{} be implemented except as described by the secure external scheme for delegating proof verification.
\end{remark}