Tornado Cash Decoding [English]

Transcript

please okay um so let's make a start uh and uh a couple people down the line just entering so uh we need to help you uh yeah I just let another one so um hi everyone my name is Chichen and welcome to uh the second episode of the decoding series um the first one was unisot V2 for those who would like to um would like to review the first session which is no issue to this they can do so in our YouTube channel but today we are going to talk about tornado cash uh it's been a while and I apologize but now I think we are back so um just a very quick um one two minutes high level intro of

throwing the cash for those for the benefit of those who do not know uh what donated cash is so um Tunica is commonly known as a mixer why do I say a mixer well we have a bunch of inputs these are basically deposits so we're actually depositing some some amount of tokens or some erc20 tokens into a pool and then um any some someone is able to um withdraw from the pool anonymously and what's actually going on is that um you you are we are not able to track between the inputs and outputs because there's this little the pool in the middle in between that attempts to mix the Imp uh the inputs in a rather uh around so what can I say is

that let's say Alice has deposited one is and they won't deposit one if and um now there are like five four inputs in the pool and let's say someone X withdraw one if we are not able to know who's one if belong uh does it comes from because all four individuals um deposit has already been mixed around in a pool so yeah therefore it's known as mixer so with that in mind um you definitely need uh to let your deposit uh stay in the pool for early a bit of time so that it can be properly mixed before depositing so that people will not be able to trace um between the output and the input yeah so

um let's jump straight into the Core Concepts so um there are three things which I would like to highlight uh which are used in uh total Cash number one is the it's a hash the concept of hashing functions um number two it's uh Merkel trees and number three it's a commitments uh oh yeah I forgot to mention uh for those who want to ask questions uh just written down in the chat box or you can disadvit yourself and ask questions yeah Okay so what are hash functions um hashes are basically like like a like a function that takes us some input and returns an output well this basically it's uh like the function that we normally learn in algebra school but a good hashing function has some certain nice

properties such as the input can be anything and the outputs are deterministic so um the same input will always predict oh sorry we always put uh return the same output but the output is not predictable and as a fixed line so in the case of 256 the output will always be 256 bits chart 256 also being shot 25 to 246 bits and regardless of the length of the input the output will always be uh at the same like bit length so that is one of the criteria for a good hashing function and um it is not not predictable so let's say I'm trying to Hash the word apple and

before putting in um the input Apple into the hash function it is certainly almost impossible for me to like know the output without actually performing the calculation and um this is a bit out of scope but uh some people do use like hash functions to uh as a sort of like a random Oracle uh you see that a lot in uh in ZK security related protocols and a good hash function ideally is a one-way function now what do I mean by that is that given the output and you know the test function that you use it is um very very very difficult to figure out what the input is so um you can if people always use the word one-way

function or trap raw function it basically means that a given output and the type of hashing function it is very hard for you to um know what the input is we are actually uh the way the input already um before before you put in function and uh one very important thing for a good hashing function is that the output has to is a sort of collision resistant so uh when I say that I do mean that it is very hard for two inputs to produce the same output yeah we will be uh relying this on this a lot later so um what are the general uh hash functions that you may have you may have heard of so shot 256 for example is very commonly used contract 256 is being used in a lot of um in a in solidity and a

lot of like smart contract related stuff you've probably seen this a lot um these two are actually different so do not the way they are calculated different but we don't go do that and Patterson hash means CM Poseidon so um we'll be looking a lot where we look uh prototype uses pep Addison and Mimsy but there is also a group of hash functions called Poseidon which I will not go into um the reason why they are like the reason the difference between BMC and Poseidon and the traditional ones like this is that they are known to be uh slug friendly so it's a the so when you try to use that in a in a in a circuit that you'll be building these two will generate like less constraints so just to let you know and

uh why why there are like so many types and yeah so the next excuse me so the next um thing that um we are we'll be talking about would be Mercury um so Michael trees are basically like an efficient way of storing data so um over here I have two illustrations one is a simple four block linked list and one is like a tree structure so let's say uh when we try to query uh the data and our Target happens to be at the end of the uh the fourth block so in the linked list we will need to uh we don't you need to iterate through the four blocks this one this one this one this one and um basically uh in terms of time complexity this is known as a

linear time complexity o of n and uh for three so basically uh when you come here you just need to make the decisions whether to go left or right and when you're here you just make an addition to go left or right so you can see that we're only making like two steps and um the time complexity is uh it's a logarithmic logarithmetic type so a big O of lockhead so uh you can see that in terms of query um Mercury is um sorry a tree structure number between a tree structure is definitely uh more efficient so now let's look into the specifics of a Mercury so um what um how does a mercury look like so um

the base layer which is the top bottom most layer is uh what we call what we normally call as the leaf node because they are like the end of the tree like they're starting uh branching out from here and the rest are rest are branches these are these two are Branch notes and this is what we call the root node so um how do we uh what are these like this weird like catch kind of thing um that is on in the note they are like the hash that like the header hash of the of each of the node so um let a b c d be the content that we want to store let's say I'm storing um some information like my my account balance is a I will hash a using the

hash function that I one of the astronauts that I mentioned before and then it will return the result W and uh likewise I do it for all the leaf nodes and then with the with the header of w and X I will combine these two and hashing hash them together to form another um another area hash and this will be the uh the the header head for this Branch node and the same goes to the to the other side of the tree and finally I will just combine the two Branch notes together and have them and this will be the group of the uh the Merkel tree so um why do we want to do that with us so um say that I want to prove that

um a exists in a tree I do not need to look through all the leaf nodes all I need to do is that I produce this thing called the Moco path I wish you already know the route because it's publicly available to everyone and what I will need to do is that I will need to um provide you with this one the hash here and the hash here and knowing that this thing exists you are able to reconstruct um the roots from uh from The Sibling so when I have this and I have this hash I'm able to combine these two to form the hash of this one and I'm able to combine this one and this one uh to form the root and all I need to do is I can compare the roots that I calculated and

the roots that is publicly available and if they match then we are very quite very well we are quite certain that a uh indeed does exist in a tree so um that's why the Collision resistance property of hashing fund is important because if any of these uh thing changes the root will be entire different and we we are we can say that hey it doesn't exist in a tree or you give me like the incorrect path cool so uh so far any questions no okay cool um next up um will be uh commitment so commitments are basically um what we use for me a lot in what we

call the comment review scheme so um yeah these are to worry but let me explain in a very limited so let's say I'm trying to I'm telling you that I know what's going to happen in uh tomorrow at 2 pm but I don't tell exactly because I don't want you to know what's going on but I I want to I want you to trust me that I know so how do I how do I do it I write write on a paper and I fold the paper I like kind of like frame it somewhere publicly so that everyone knows that uh I have I will not touch the paper until tomorrow 2PM and this is what what we call the commit phase and when the event happens at tomorrow 2PM I'm able to like show you the result of paper and say hey

look uh what whatever happens uh has been described by me like yesterday or something and this is what we call the review scheme so um in our internal cache we use a lot of hash functions as a kind of like a commit comment review scheme uh thing so uh yeah so these three are like uh basically what I can see that what we need to know in order to understand uh how the protocol works so um sorry uh where was I yeah here so putting them all together um we will have the commitment to be one of the notes one of the leaf notes and the commitment is made out of the

nullifier and the secret so the secret is um is is something that the user the depositor will need to generate and keep it so that they so that no one knows and uh the withdrawal will need the secret to withdraw uh from the pool so the nullifier is something that used to prevent double spending but uh we'll talk about it more in the in the code but what's going to happen is that I'm combining my Notifier and secret and I'm going to Hash them together sorry I'm gonna this will be the commitment I'm going to Hash them together and I'm going to like insert them into the the Merkel tree and of course we know that if something in the root Leaf node changes the root changes accordingly so um this is how tornado case is going to look like later

so um to withdraw the user will need to provide the local path so they need to provide here here this this hash of this and hedge of this uh and of course they need to provide the leaf node that they are they want to refer from and for that they need the secret and and then uh this is something that will not be done in the smart contract but they will generate a proof locally and they will just need to submit the proof to a Smart contract have verified that the proof is correct and then um the referring process can take place so um these three steps uh sorry to construct the multiple path they definitely have to read from the

from their own chain data but to calculate to prove that the marker path is correct um all they need to do is that they need to um generate the proof locally using a circuit like a snug like a bike using a snap to that sorry by generally you think of it's not proof locally using some circuit that uh that has been constructed previously and then yeah okay and uh okay cool my country is always a binary two lists um this is a good question well um there are like a lot of types of mercury is like binary Market trees that we have seen now and uh ethereum users see what uh I I forgot like 16 nearly I I don't remember how I don't know how

it's being like correctly but 69 Mercury so there can be a lot of branches but um reasons why they do that uh the reason is because whenever you want to prove you want to prove the the path you don't have to provide 15 other siblings you need to provide one sibling so the proof size can be like X smaller so this is actually a huge problem uh faced by the ATM right now that you need to provide a lot of siblings so it's a it's a large large overhead yeah good question um so how the tornado cash goes will look like so um over here you can see

that there are like multiple trees and these three represents a type of token and the denomination of the token for example 0.1 if has its own pool that has its uh and that has its own like a local tree and one second and uh one is has also has its own pool attended for his own pool and of course it supports other esc-20 tokens and each different type of token plus uh the value has its own pool so uh in reality we direct many many trees out there and we can pick and choose which tree that we want to uh to to participate in of course the value

has to be the same foreign walkthrough of uh how what how how when a tornado cache like works so let's look into the code so um there are actually two parts of the code one is the contract part and another one is the CLI part uh we'll go through both but we won't go through everything in the cr5 because this is a used to generate like the proof and stuff so we are going to do that later but let's go through the the contract type because uh because why not so over here they are at the Puerto Dash core Ripple there are two folders one is

the circuits folder and one is the contracts folder which is uh which has a bunch of soluble files the circuit folders are basically some circum files uh which we'll see later and this will will allow us to generate um we'll be used to generate proofs and stuff and yeah and then we can use this to prove that our combination is done currently locally so uh so for final contract um um right away you can see that there are like erc20 and uh if if tornado or this is blocking my view so um before that I mentioned that uh there can be like uh various types of tokens

like erc20s and each of them you need their own pool but we know that if it's like a native token in uh in the blockchain so it deserves its own uh its own implementation because uh because one thing is because the things are being handled a bit differently in the case of if so we have message thought value which we definitely do not see in uh we definitely do not need a C20 over here is just to ensure that we don't uh we don't get get if by accident and then there's the fees also being paid if so we need to take into account in the in this uh in this thing so these two are basically uh child contracts of the of the base contract

the tornado.zone so uh we they are like internal override function so right away we know that uh most of the Logics uh for these pupils are very very similar so yeah only overwriting the process deposit and the process withdrawal function yeah and uh the Logics is basically very straightforward I won't go into that oh yeah before that I need to mention that that is a layer um that really exists and uh I will I will go through the importance of the layer later foreign so yeah let's look into the uh the um the main information of the contract so over here

um we can see that there are two um parent contract one is mercury history and one is really interesting God uh really really interesting guide it's just a simple uh protection against uh we actually see attacks so it's a very standard opens the Play library which I will not go into we're going to so the way you use it is to put this modifier and not re-entry in detail and Mercury history is where we are able to insert and to compute the uh the local route which we'll also go into later let me check the questions no so

um so now um there are two main functions in uh in this base uh in this space implementation one is a deposit function and one is the withdrawal function just let me check if they are not yeah all these are I just uh I'm not essential so let's go into the deposit one first um so what's going to happen is that okay remember our commitment that is made up by the 95 secret so we are going to pass out our appointments here and then the first thing the contract will check is check if the nullifier has been submitted sorry the commitment submitted before if it has of course it doesn't allow it to happen

and then you insert the commitment into uh this is uh into the tree and then it will store the commitment into um into one of the mappings so that we know that he has been used before and then we process deposit so what is interest what is the most interesting part will be the insert internal function over here uh it's it's very messy so to make things much easier let me jump back to the slides so um so um just let me have a silver water well so uh we remember that each pool has its

own vocal tree and in Toledo cash um the amount of leaves in the mercury has been fixed to um I can't remember exactly how much how many I think it's 2 12 32 so it means that it can only have up to two to power 32 um commitments or deposits so once you hit the limit uh it won't be able to um accept any more deposits and that a new tree has to be deployed so that's the limitation it has and but it's a very large number so um it won't be hitting that limit uh soon so so yeah

and and by default when the tree is empty um there has to be some sort of like a hack Associated to each node so um in this case we can see that the hashes are like this one for the for the base layer this one for the second second lowest layer so and so forth and the root layer will be this hash so um how do we know uh sorry how do we know that uh this thing exists so this thing is actually uh the zero values uh when the when this the the node is empty so because in the new in the new tree everything is

empty so we but we uh by default assign like this value to be the default value so these two I mean all these leaves will have two c7a blah blah blah whatever as the hash and we know the same hash has together will form this one and then um this one has this one will form uh some other layers and finally it will have this layer so when you see that the the tree has this root it means that basically it's an empty tree so the the reason why they want to do that is that they don't want to look through everything to initiate uh the the the hash form or uh for all the uh notes because they're like two to power

32 so it's very very not efficient to do so so what they do is that whenever they see it's an empty note they just assign the value uh that is according to the layer so let's jump back to the code to see uh what do you mean by that so yeah there you go so um there's this uh zero function that um that that defines the the value when it's when the node is empty at a specific level so at the lowest level is 2c78 blah blah blah and the highest level is 2ft 2f blah blah blah so I basically copied these three values and put it into my slides but yeah and uh what's going to happen next okay

so now someone on the current index is zero because because everything is empty so we'll be inserting into the zero root release mode so what happened if I were to add something to the tree so let's say our commitment is a and we were to add a into the poison zero so so um we'll add to the leftmost note so everything that means everything on the right remains to be zero and we know that zero stands for two c seven a blah blah nine CC so we kind of already know the hash for this one so all we need to do is that we get the um the hash of this one and then uh combine with uh these two two C7 to form

the half of the branch node and then we get the branch note that we just calculated and then we have the zero value again for that level one F three blah blah and then we form the hash of the of the parent of these two Branch load then afterwards the current X we update to one so that now um we know that the next complement will be inserted into the one position which is this one so then what's going to happen next if we were to add another uh commitment to the tree so notice that just now it was the left leftmost note and now it's the right note of this this

little Branch so now the index is one so we put B into the ones position and we update that to two so that we know that a bit over here and and then we we know a already because we we have um we have calculated before here and then we can use this one and this one to form a b Prime and then we use this one and the zeroth note on the shipping because these two are all empty so this one will will be zero as well so we combine these two to form a b double Prime and so and so forth and um a note that you'll see later is that the left sibling did they only store like they don't need to store the left sibling of the tree

because you basically do not need to know like what comes before because we don't need we don't have we're going to need it again you need to know like this one so the community store this uh here according to a level so um at level 32 this one will be a and level three one it will be a b and uh so and so forth yeah we'll see that later uh red in action but I just want to highlight that uh they are using this uh mapping to store the left hash less sibling hash of less sibling so so um so notice that um this one uses zero value but this one

uses the left sibling so uh how do how does the code determine which one to use they actually uh rely on the index so if the index is an even number uh if ring zero we hash it with a zero value because that's that's going to be the recipe if it's an odd number like in this case the index is one is an odd number we hash it against the left sibling and and the index is uh specific for the current level as it moves up the level the index needs to be changed how is it going to be changed it's basically the index of the current level divided by two and we flow it so um in this case this one was one and then if you divide

by two it's going to be 0.5 but we flow it to make it zero so now this one is the zero index and we know from our example zero index will be hashed against a zero value at the current level so as you can see this is a very efficient way to reconstruct the Mercury without having to uh do a lot of queries and uh and um yeah and a lot of like very heavy process because they only need they only really they already know the zero value and they have already stored their left siblings and they only need to do some some small operations to recalculate the Mercury so it's it's rather efficient I would say and by playing around the index they know which saving to choose either it's

left already so that also means that the index of the commitment is important that you need to store that as well uh when it comes to storing Roots so we know that each complement has the um has the will definitely modify modify the roots in some way so when I have a commitment I will change the route another comment I'll change the route so what if we have like a lot of um a lot of transactions uh and that and then uh sorry and to withdraw we you need to know the current route because we need to match our path against the road and what happens is when we are trying to withdraw the root changes

so in tornado cash they actually saw this thing called a root history whereby they will store the 30th 30 last uh route that that the contract has seen so for example right now um so right now the uh yes until like yeah stop 28 was previously and the road index is over here so the next time someone deposits it will start at the 29th position and then someone deposits again it will just you just replace the um the zeroth position and with the latest and of course the current decks current root decks will Point towards the latest one so that also means that when you withdraw you will check against all the histories to see if the root that you

are trying to match a match against uh exists in the in this um how can I say like a finite uh finite net because you cannot go past 30 elements so if it exists then we know that hey uh yeah we will compare the path against this tree it's a ring buffer okay I didn't know yeah good to know so so yeah that's how you um how you store The Roots okay I explained over here so so now we have looked into the high level uh explanation of how the code Works let's dive into the actual code so

um oh sorry insert yeah so just now we are trying to insert a leaf into the tree and uh over here it's we are checking if the the screen is full remember that um to no cash my country is can only support like a certain amount of uh it's only fixed size it can you cannot like have too many deposits but it's big enough so that like it can uh sustain itself for like a very long period of time and then this is where the index comes into play it uh it gets it this one checks if it's an even number so if it's even number the less the less part of the tree will be the commitment that we

the recommend that we submit and then the right will always be zero and likewise uh conversely on the other end if it is odd this left part will be from our field subtree which is the left part of the shipping that we stopped previously and then the right will be our commitment and then this one starts from the base layer and because it's a for Loop it just um it just moves up uh moves up the tree so the base layer and then it will be the second lowest layer the lowest layer and so on and so forth until finally when you reach the topmost layer um we we are able to know that uh the current level hash is now our route and

then we store it into our root ring buffer and yeah this is the root history site that I was talking about it's supposedly like 30. and yeah so uh okay I forgot to mention this hash lesson right so this is uh the hashing function that we uh that we mentioned before they hatch the left shipping and right saving together so that you can form the uh the hash of the parent uh parent node so uh under the vote it uses this mean c hash function and uh you don't have to like know how nimc works just know that it's a that this function is basically trying to Hash the less shipping and receiving

okay so um so that basically uh describes how we uh insert a deposit and insert into the uh the tree of a tornado cash any questions cool no questions and once that is done you will meet an event called deposit and this one will uh will show the the instant index and the commitment uh and later on we'll see that this one will be used to uh to help us generate our motor path so yeah we'll see that in the in the CLI that's it let me just have to save water

or my C5 any questions cool no questions um so moving on uh when after you deposit you definitely will want to withdraw so uh withdrawing is much simpler because all you do is that you need to provide a proof this proof is um generated off chain like I mentioned before and we'll see how it is generated later but know that we just need to provide a proof and then it checks if the proof is valid so uh all these things are what we call the public input they're allowed to be shared

and if this is valid we will check if the nullifier hash has been spent oh sorry actually it's recognized by 95 hash first so if the 95 hash exists in the record we know that the node has already been spent and we are not allowed to um to process because uh this is basically what what what what what what's going to happen if you allow the processes why we call it double spending attack um because we are always able to generate um the same the correct muscle path for a root and uh but but we need to have some sort some way to know that the one of the notes have been spent so what they do is they store it as a variable in the smart

contract and they use that to check and over here it's it's called Uh it requires each mode root basically it's known root is um is checking against the the ring buffer that we uh that we uh has looked into just now so uh you look through the link ring buffer to see that if our root exists if it it exists is it true if not it will just written false and if it's false we just revert and we said cannot find your local group afterwards we verify the proof if it's correct then we we set the 95 has to be true because we the node has been spent and then we uh proceed uh process the

withdrawal so um I'm going to talk about the relayer now and why is it important um so let me let me just jump back to the first page so um when we deposit we are basically calling calling us making a transaction and we need to pay a guess so same goes withdrawal we are calling a transaction and we need to play guess but for the withdrawal to have if to pay guests basically there has to be you have to somehow transfer a certain amount if uh through the account and if you're able to already transfer the if anonymously to the account that you want to withdraw

there's really no need for you to use tornado cash so the relayer acts as like the service like over here so what you can do is that you can publish a proof to the relay and the relay will be strong um the funds on the behalf and send it to you so that maintains the anonymity between the input the deposited and the withdrawal because um if you need to get some issue over here you you someone have to translate to you and for sure there's some way to track so so yeah you rely on a very related Network to do that for you and in return they will require a small amount of fee like like a commission and of course they need to pay cash so they need to cover that cost as well how to nullify generated right after

spend function is called we will go into that later in the uh the CRI part so yeah but good question so um so yeah once it's done we will withdraw we are able to withdraw our nodes and then we admit anything uh this is a pretty standard okay so aside from the verifier hash questions uh are there any questions uh regarding these two uh functions because it's not how do you move on to this setting it's the Mixels you can't relate no um

mixer is basically um the role of tornado cash it mixes the deposits so that uh you're not able to track like the depositor and withdrawal because everything every of the deposits in Java there's no way there's no way for you to tell which deposits uh belongs to who a relayer is yeah yeah foreign tokens to you in return for a small amount of commission or fee yes is a mixer okay no questions okay cool okay so that was the solidy land so we

will not look in the solico anymore um instead we look into a circle code um for those who are not familiar with second code is a pretty weird the logic is also pretty weird you're seeing this like double arrows and like like double equals and one little arrow triangle thing uh these are basically what we call the uh we are assigning and we are constraining the thing but you don't have to know that for now um so the main the main uh core function will be this withdrawal because it's declared as the main component so um we are going to use this circuit

to generate the proof for us so what do we need to do is that we need to provide all the inputs to the circuit we'll see how later but just know that we need to provide all the inputs and all the private inputs as well uh okay uh let me get that one the report address is another form of contract address or UA it can be any uh address you just have to let the relayer know where they want to withdraw to yeah but if you set a contract address without the uh the fallback or the receipt function then I think the transaction will fail so if you want to like refer to a contract address make

sure that you're able to pay that contract yes foreign Okay so um the difference between okay this is the the older version of circle um but the difference between a private input and the public input is that you are the primary inputs are not known to the public so whenever you generate the proof using all these inputs no one is able to know what the what private inputs you use to generate the the computation the publics are are the ones that everyone is able to see and you definitely need people to see some public inputs such as the route because you want to compete against uh

the history and we want to compare the notify hash to see if we have already spent another hash before so that's the reason why sometimes things are public and sometimes things are private because we don't want people to see the secret we don't want to be perceived the the nullifier before we hash it and we don't want people to see the tough because if people see the path they're able to know which index are we trying to withdraw and then they are able to map the index to whoever that is the depositor so the path and the indices are definitely Secret uh get this one circum is a normal it's very long I'll let you read that uh yes uh I think this one is sponsor

you can also use C plus plus oh yes mentioned but normally if you want to use in some like a like a JavaScript environment uh people use swaza because there's a web assembly thing which is kind of convenient so yeah what is what is happening in the circuit is that um it will this Mercury Checker it will try to record re prove that the root I mean proof that the path that you provide provide uh will match with the root so we don't have to do that now on in the solid side because we have to do it in the circumcise and and it basically saves a lot of computation because you're putting off chain plus you're able to get the Privacy that you want

because people are not able to know the element indices that you use to uh prove that the root is correct so this is basically the meat of the logic yeah these are just uh as you can see the comment is uh probably not required but it's there so yeah so any questions so far when it comes to the uh circumcision and why is it needed don't be shy to admit yourself to ask questions because sometimes that may be more efficient oh I think it's a no so okay so now finally we'll see the uh CL iPad and this is where we are able to

see how the um how we generate uh the commitment and how do we generate the proofs using uh this circle circuit so okay oh yeah before I move on once it compiles uh it will uh spit out like a wasm kind of like binary and then you use that once in in your in your uh CLI to derivative proofs and it also speeds out like a verifier solid contract and uh you have seen uh sorry I'm going back going back to this again you'll see that this one calls uh the verifier verify proof contract it's basically this one so the circum will

also speeds out this contract and all you need to do is that to provide the proof into this function hang on raise it uh sorry wrong one this contract yeah sorry and all you need to do is to um provide a proof it to this function and return a Boolean true or false to say that hey your proof is value or not and under the hood it does a lot of like a lot of a mess to prove that your your proof is correct uh okay uh the common question is kind of nice uh let's start from the top uh let me read this still baby it's about contract why do we use the com

what's it for um we used to come because we want that kind of privacy right and um because if you were to submit the the root and the index to the um to the smart contract directly they're able to reconstruct we are able to trace back uh who the uh is so by using a circum circuit and the private input we are not able to do that because it's all like nicely hidden because it's CK yeah no questions probably because it's allowed to actually want to go oh yeah sorry about that for question on the withdrawal since there's only missed number slots how does the withdrawal free up and stuff no it doesn't free up if you just keep it it will just keep appending until the end and finally if

it's filled up that's it you have to deploy a new um a new a new Mercury circum circuit values passes to the 20. soul functions uh uh circumcision values I I assume you mean the uh let's see what is it the proof so um the output of the uh of the wasm will have this proof and then you pass it to the um to the surgery function and then it will check that the proof is valid against the verifier here I said some I searched some Google just

like it's a compiler for circuits what's the role for circuits here um not the role of this circuit is to uh to uh in this case is to give you the zero knowledgeness so everything that is done in this circuit uh you are not able to know what the private input is and you're able to prove that the inputs that you provided are correct did I just uh repeat oh okay yeah that's that's probably deposit increases as mercury score or is it the same regardless of which level um it's roughly the same because we all starts at the base layer so it's all going to be at a 32 layer so it's going

to be roughly the same area there can be a bit different such as like when you hash against the left or asteroid but I was I would assume that it's all going to be like roughly the same our circuits only involved when we want to generate proof locally uh now that's a good question um for this yes but um basically okay uh for this yes uh they're only involved in one is very proof locally and the proofs Can it can be in the case that we want GK we have zero knowledgeness we want to hide the prime inputs and in the case where we want we want like to to not execute a heavy process in the smart contract so we can say that we have done the education execution

correctly locally and then we just give the proof to the smart contract saying that we have done it correctly so the smart conflict doesn't have to execute everything so they are like the scalability part and the Zero knowledgeness part as to why second is needed uh I think I love this questions keep them coming guys so we got I think there's enough time to go through the clip I know it's a bit fast because we only have one hour and there's a lot of things cover but uh there's always the YouTube recording if you can refer to and you can always ask me in a telegram uh so what we want to look in this year is a deposit hang on if sorry generate I can't remember the name just let me look

uh create yes create deposit actually not create a voice so to to create like the commitment and the um the secret we will call the grid device we throw in the chain ID the amount and the currency and then it will call this create deposit function which you have seen over here so it will anyway what is it oh yeah it uh the Jolly fire and the secret will be randomized by you so these two are actually generated by you but in a randomized manner but you can also you can also put in your values that you want but make sure that it doesn't it's

not the same so and this one will I mean if you're used to another catch before after you have like generally you have like tried to deposit the Auto download like a doc file that contains your secret information so you need you you'll need the secret and Notifier to be drawn so that's why they ask you to keep the little text text file so yeah that's about it so uh deposit is just to it's just to create a commitment which is a nullified plus secret and then it it just helps you to back up your your stuff so that you you so you don't lose them in case you want to withdraw that's that's really straightforward

and now how do we withdraw so okay total withdrawal um we will call this generate proof function now we remember that all these are done locally so the first thing it does is that we will pass in like the currency the amount whatever information that we need and um you'll need to generate the local proof so we recall the local proof is the local path which is the siblings that we need

um to reconstruct the root and then we will compare the root against um the route that is sold in history so the first thing we do is that we need to generate the the muscle path so what essentially is going on is that it's calling the blockchain to fetch the deposit event so um it will try to uh get all the events that is deposited into the pool and then you'll reconstruct uh the the tree locally and then from the tree we are able to get our path according to our list index so what uh this is just to validate we just don't care what is going on is that we are actually reconstructing the Merkel tree locally by reading from the event logs

we remember the event of the deposit event that has our index the commitment and uh so and so forth so we are actually using that to um to reconstruct our paths so yeah we definitely need uh we definitely need uh we need to read from blockchain and uh this is this is why when you deposit it takes like a few minutes because it's trying to crack everything and read everything from the blockchain and to recalculate that's why it's very slow yeah and over here it uh it will try to uh search for your your commitment so whenever say hey this is your commitment that you that you want to withdraw from you will know that this is the the index of the leaf and then from there you will know

um how to create a path so yeah this is a very um very Troublesome a very lengthy search right you have to do it so once you have created your uh let's see by the way where was I yeah once we have created your sorry sorry about that once you have created your I've said it three times once you've created your path uh this is the interesting part so this is where a circums comes into play so you will call the your construct the inputs remember this is the inputs that we need to input in the

circuit this is a private input and this is the public in private sorry this is the public input and this is a private input uh yes nicely be converted out to to let us know one is private and one is not and then we will call this um generated windows and proof and uh this circuit is basically oh pretty good body sign foreign to have a circuit

and then with the input basically what happens behind the city system was something going on so and with your proving key pulling key it's it's like a trusted setup kind of thing I will not go into that and just unless I'm asked and then uh by doing this computation with a circuit you're able to get your your proof data and then this is just formatting and after you have formatted the proof data you're able to get this proof and send the proof to uh to the function that we have seen so uh so the mid of uh this function comes from this thing which is to generate the path and then to and this thing which is generally the proof

and and yeah once you've done that you are able to withdraw your uh you're able to deposit and withdraw from 200 to another cash and let's see what I have and yeah okay cool uh that's the end of the presentation I put it here to remind myself that it's a feedback form that I need to share uh so uh please feel free to drop your feedbacks and um and yeah talk to uh hope you enjoy a session and uh we got we got some time left so uh if you have any questions uh just feel free to

to voice sound thanks for sharing you're welcome or are they processed RDX process flow chart available to illustrate the code execution flow uh [Music] I don't know because I made this on my own right so if I I don't know if they're good enough for you to understand but this is all I have if if there's a better one I definitely have included in the slides but I I did not see any but I don't know you have to uh you have to do the hard work I'm so sorry gonna re-watch the session uh sorry sorry that is a bit confusing

okay [Music] um cool uh there's no question so um I am going to stop recording and how do I start recording and uh we'll call it a day