[CHECKLIST] PLONK Circuits implementation

[lazovicff]

Overview

We want to extend our suite of protococl implementations to one using PLONK as the zkSNARK backend. This requires rewriting our gadgets in the language of PLONK gates, using the external library developed against arkworks:

• https://github.com/rust-zkp/ark-plonk

We will continue to build out our toolchain in our repo below in a plonk folder.

• https://github.com/webb-tools/arkworks-gadgets

General Protocol sketches

For each of these circuits, we apply roughly the same set of constraints. We have an object called notes or UTXOs that we use to represent private transaction data. We require a prover to prove that they possess a note or a UTXO in order to satisfy the circuit. The proof of knowledge of the note or the UTXO amounts to proving knowledge of the preimage of the hash of the note or UTXO.

Then, we must prove that this note or UTXO commitment is inside a set of merkle tree roots. This is done by providing a merkle tree proof path, constructing a root, and then providing a set of difference values (needed for the next step) in order to prove that an element, the root, is inside a set of roots.

We have all these gadgets and components implemented in a few places, so there should be enough resources to begin to understand this further.

VAnchor Circuit

The VAnchor circuit is a UTXO based zk-circuit. It verifies that a public input, a set of UTXOs, and a set of output UTXO commitments are properly formatted and ensures the values of inputs match the values of outputs. We then verify that each input is in one of many merkle trees.

The reference implementations for these circuits currently can be found here:

• https://github.com/webb-tools/protocol-solidity/blob/main/circuits/vanchor/transaction.circom
• https://github.com/webb-tools/arkworks-gadgets/blob/master/src/circuit/vanchor.rs

Anchor Circuit

The Anchor circuit is a fixed sized transaction system, meaning it only supports a specific fixed value deposit. This means that notes on this system don't contain asset values. This circuit only verifies that a deposit is formatted correctly and that it exists in one of many merkle trees.

The reference implementations for these circuits currently can be found here:

• https://github.com/webb-tools/protocol-solidity/blob/main/circuits/anchor/withdraw.circom
• https://github.com/webb-tools/arkworks-gadgets/blob/master/src/circuit/bridge.rs

Notes

• Start specific before generalising.
• Poseidon circuit: https://github.com/webb-tools/arkworks-gadgets/blob/master/src/circuit/poseidon.rs
  • map generate_constraints to gadget
• Implement a Poseidon gadget

Checklist

• [TASK] PLONK Poseidon Gadget #93
• [TASK] PLONK Path gadget #75
• [TASK] PLONK SetGadget #120
• [SPEC] is_eq gadget #76
• [TASK] PLONK Mixer circuit #121
• [TASK] PLONK Anchor circuit #86
• [TASK] PLONK Utxo struct #85
• [TASK] PLONK VAnchor circuit #87
• [TASK] Mixer API #171
• [TASK] Anchor API #172
• [TASK] VAnchor API #173
• [TASK] Benchmark against R1CS implementations. #90

Auxiliary resources

Poseidon implementations

• https://github.com/iden3/circomlib/blob/master/circuits/poseidon.circom
• https://github.com/webb-tools/arkworks-gadgets/blob/master/src/poseidon/circom/constraints.rs
• https://github.com/webb-tools/arkworks-gadgets/blob/master/src/poseidon/circom/mod.rs

Questions / Issues