chap04-sec02.tex

% !TEX root = ../zeth-protocol-specification.tex

\section{Contract security considerations}\label{contract-security}

\cref{client-security} mentions several considerations for client implementations, concerning how they interact with the contract. These must be taken into account when authoring the contract code, to ensure that clients can securely retrieve the information they need to operate without encouraging them to perform insecure operations.

\begin{enumerate}
  \item $\mixer$ \MUST{} validate inputs, the contract needs to ensure that the primary inputs are elements of the scalar field \FFx{\rCURVE} (that is, they are in the range $\range{0}{\rCURVE - 1}$).
  \item $\mixer$ \MUST{} output events for valid $\mix$ calls, including:
      \begin{enumerate}
        \item commitment for each new note;
        \item nullifier for each spent note;
        \item value of new Merkle root of commitments;
        \item ciphertexts for each new note;
        \item implementation-specific data (such as the one-time sender public key specified in~\cref{instantiation:enc}, required to decrypt the ciphertexts).
      \end{enumerate}
  \item\label{contract-security:mixer-payable} The $\mix$ function \MUST{} be \emph{payable}\footnote{see~\url{https://solidity.readthedocs.io/en/v0.6.2/types.html?highlight=payable\#function-types}}, to support non-zero $\vin$.
  \item $\mixer$ \MUSTNOT{} expose any public methods except for $\mix$.
\end{enumerate}