Scheme

• Mint
  • Function Params
  • Contract Statement
  • Signatures
• Propose
  • Function Params
  • Contract Statement
  • Signatures
• Vote
  • Function Params
  • Contract Statement
  • Signatures
• Exec
  • Function Params
  • Contract Statement
  • Signatures
• AuthMoneyTransfer
  • Function Params
  • Contract Statement
  • Signatures

Let $\text{PoseidonHash}$ be defined as in the section PoseidonHash Function.

Let ${\mathbb{F}}_p,P_p,\text{DerivePubKey},{\text{Lift}}_q,G_N,\mathcal{X},\mathcal{Y}$ be defined as in the section Pallas and Vesta.

Let $\text{PedersenCommit}$ be defined as in the section Homomorphic Pedersen Commitments.

Let $\text{MerklePos},\text{MerklePath},\text{MerkleRoot}$ be defined as in the section Incremental Merkle Tree.

Let ${\text{Params}}_{\text{DAO}},{\text{Bulla}}_{\text{DAO}},{\text{Params}}_{\text{Proposal}},{\text{Bulla}}_{\text{Proposal}}$ be defined as in DAO Model.

Let $\text{AeadEncNote}$ be defined as in In-band Secret Distribution.

Let $\text{ElGamal.Encrypt},{\text{ElGamalEncNote}}_k$ be defined as in the section Verifiable In-Band Secret Distribution.

Mint

This function creates a DAO bulla $\mathcal{D}$. It's comparatively simple- we commit to the DAO params and then add the bulla to the set.

• Wallet builder: src/contract/dao/src/client/mint.rs
• WASM VM code: src/contract/dao/src/entrypoint/mint.rs
• ZK proof: src/contract/dao/proof/dao-mint.zk

Function Params

Define the DAO mint function params $$\begin{array}{rl}\mathcal{D}& \in \text{im}({\text{Bulla}}_{\text{DAO}})\\ \text{PK}& \in P_p\end{array}$$

/// Parameters for `Dao::Mint`
pub struct DaoMintParams {
    /// The DAO bulla
    pub dao_bulla: DaoBulla,
    /// The DAO public key
    pub dao_pubkey: PublicKey,
}

Contract Statement

DAO bulla uniqueness   whether $\mathcal{B}$ already exists. If yes then fail.

Let there be a prover auxiliary witness inputs: $$\begin{array}{rl}L& \in N_{64}\\ Q& \in N_{64}\\ A^{\%}& \in N_{64}\times N_{64}\\ \tau & \in {\mathbb{F}}_p\\ x& \in {\mathbb{F}}_p\\ b_{\text{DAO}}& \in {\mathbb{F}}_p\end{array}$$

Attach a proof $\pi$ such that the following relations hold:

Proof of public key ownership   $\text{PK}=\text{DerivePubKey}(x)$.

DAO bulla integrity   $\mathcal{B}={\text{Bulla}}_{\text{DAO}}((L,Q,A^{\%},\tau ,\text{PK}),b_{\text{DAO}})$

Signatures

There should be a single signature attached, which uses $\text{PK}$ as the signature public key.

Propose

This contract function creates a DAO proposal. It takes a merkle root $R_{\text{DAO}}$ which contains the DAO bulla created in the Mint phase.

Several inputs are attached containing proof of ownership for the governance token. This is to satisfy the proposer limit value set in the DAO. We construct the nullifier $\mathcal{N}$ which can leak anonymity when those same coins are spent. To workaround this, wallet implementers can attach an additional Money::transfer() call to the transaction.

The nullifier $\mathcal{N}$ proves the coin isn't already spent in the set determined by $R_{\text{coin}}$. Each value commit $V$ exported by the input is summed and used in the main proof to determine the total value attached in the inputs crosses the proposer limit threshold.

This is merely a proof of ownership of holding a certain amount of value. Coins are not locked and continue to be spendable.

Additionally the encrypted note $\text{note}$ is used to send the proposal values to the DAO members using the public key set inside the DAO.

A proposal contains a list of auth calls as specified in Auth Calls. This specifies the contract call executed by the DAO on passing.

• Wallet builder: src/contract/dao/src/client/propose.rs
• WASM VM code: src/contract/dao/src/entrypoint/propose.rs
• ZK proofs:
  • src/contract/dao/proof/dao-propose-main.zk
  • src/contract/dao/proof/dao-propose-input.zk

Function Params

Define the DAO propose function params $$\begin{array}{rl}{R}_{\text{DAO}}& \in {\mathbb{F}}_p\\ T& \in {\mathbb{F}}_p\\ \mathcal{P}& \in \text{im}({\text{Bulla}}_{\text{Proposal}})\\ \text{note}& \in \text{AeadEncNote}\\ \mathbf{i}& \in {\text{ProposeInput}}^{\ast }\end{array}$$

Define the DAO propose-input function params $$\begin{array}{rl}\text{ProposeInput}.\mathcal{N}& \in {\mathbb{F}}_p\\ \text{ProposeInput}.V& \in P_p\\ \text{ProposeInput}.R_{\text{coin}}& \in {\mathbb{F}}_p\\ \text{ProposeInput}.{\text{PK}}_{\sigma }& \in P_p\end{array}$$

/// Parameters for `Dao::Propose`
pub struct DaoProposeParams {
    /// Merkle root of the DAO in the DAO state
    pub dao_merkle_root: MerkleNode,
    /// Token ID commitment for the proposal
    pub token_commit: pallas::Base,
    /// Bulla of the DAO proposal
    pub proposal_bulla: DaoProposalBulla,
    /// Encrypted note
    pub note: AeadEncryptedNote,
    /// Inputs for the proposal
    pub inputs: Vec<DaoProposeParamsInput>,
}

/// Input for a DAO proposal
pub struct DaoProposeParamsInput {
    /// Value commitment for the input
    pub value_commit: pallas::Point,
    /// Merkle root for the input's coin inclusion proof
    pub merkle_coin_root: MerkleNode,
    /// SMT root for the input's nullifier exclusion proof
    pub smt_null_root: pallas::Base,
    /// Public key used for signing
    pub signature_public: PublicKey,
}

Contract Statement

Let $t_0=\text{BlockWindow}\in {\mathbb{F}}_p$ be the current blockwindow as defined in Blockwindow.

Let ${\text{Attrs}}_{\text{Coin}}$ be defined as in Coin.

Valid DAO bulla merkle root   check that $R_{\text{DAO}}$ is a previously seen merkle root in the DAO contract merkle roots DB.

Proposal bulla uniqueness   whether $\mathcal{P}$ already exists. If yes then fail.

Let there be prover auxiliary witness inputs: $$\begin{array}{rl}v& \in {\mathbb{F}}_p\\ b_v& \in {\mathbb{F}}_v\\ b_{\tau }& \in {\mathbb{F}}_p\\ p& \in {\text{Params}}_{\text{Proposal}}\\ b_p& \in {\mathbb{F}}_p\\ d& \in {\text{Params}}_{\text{DAO}}\\ b_d& \in {\mathbb{F}}_p\\ (\psi ,\Pi )& \in \text{MerklePos}\times \text{MerklePath}\end{array}$$ Attach a proof ${\pi }_{\mathcal{P}}$ such that the following relations hold:

Governance token commit   export the DAO token ID as an encrypted pedersen commit $T=\text{PedersenCommit}(d.\tau ,b_{\tau })$ where $T={\sum }_{i\in \mathbf{i}}{T}_i$.

DAO bulla integrity   $\mathcal{D}={\text{Bulla}}_{\text{DAO}}(d,b_d)$

DAO existence   $R_{\text{DAO}}=\text{MerkleRoot}(\psi ,\Pi ,\mathcal{D})$

Proposal bulla integrity   $\mathcal{P}={\text{Bulla}}_{\text{Proposal}}(p,b_p)$ where $p.t_0=t_0$.

Proposer limit threshold met   check the proposer has supplied enough inputs that the required funds for the proposer limit set in the DAO is met. Let the total funds $v={\sum }_{i\in \mathbf{i}}i.v$, then check $d.L\le v$.

Total funds value commit   $V=\text{PedersenCommit}(v,b_v)$ where $V={\sum }_{i\in \mathbf{i}}i.V$. We use this to check that $v={\sum }_{i\in \mathbf{i}}i.v$ as claimed in the proposer limit threshold met check.

For each input $i\in \mathbf{i}$, perform the following checks:

  Unused nullifier   check that $\mathcal{N}$ does not exist in the money contract nullifiers DB.

  Valid input coins merkle root   check that $i.R_{\text{coin}}$ is a previously seen merkle root in the money contract merkle roots DB.

  Let there be a prover auxiliary witness inputs: $$\begin{array}{rl}{x}_c& \in {\mathbb{F}}_p\\ c& \in {\text{Attrs}}_{\text{Coin}}\\ b_v& \in {\mathbb{F}}_v\\ b_{\tau }& \in {\mathbb{F}}_p\\ ({\psi }_i,{\Pi }_i)& \in \text{MerklePos}\times \text{MerklePath}\\ x_{\sigma }& \in {\mathbb{F}}_p\end{array}$$   Attach a proof ${\pi }_i$ such that the following relations hold:

  Nullifier integrity   $\mathcal{N}=\text{PoseidonHash}(x_c,C)$

  Coin value commit   $i.V=\text{PedersenCommit}(c.v,b_v)$.

  Token commit   $T=\text{PoseidonHash}(c.\tau ,b_{\tau })$.

  Valid coin   Check $c.P=\text{DerivePubKey}(x_c)$. Let $C=\text{Coin}(c)$. Check $i.R_{\text{coin}}=\text{MerkleRoot}({\psi }_i,{\Pi }_i,C)$.

  Proof of signature public key ownership   $i.{\text{PK}}_{\sigma }=\text{DerivePubKey}(x_{\sigma })$.

Signatures

For each $i\in \mathbf{i}$, attach a signature corresponding to the public key $i.{\text{PK}}_{\sigma }$.

Vote

After DAO::propose() is called, DAO members can then call this contract function. Using a similar method as before, they attach inputs proving ownership of a certain value of governance tokens. This is how we achieve token weighted voting. The result of the vote is communicated to other DAO members through the encrypted note $\text{note}$.

Each nullifier $\mathcal{N}$ is stored uniquely per proposal. Additionally as before, there is a leakage here connecting the coins when spent. However prodigious usage of Money::transfer() to wash the coins after calling DAO::vote() should mitigate against this attack. In the future this can be fixed using set nonmembership primitives.

Another leakage is that the proposal bulla $\mathcal{P}$ is public. To ensure every vote is discoverable by verifiers (who cannot decrypt values) and protect against 'nothing up my sleeve', we link them all together. This is so the final tally used for executing proposals is accurate.

The total sum of votes is represented by the commit $V_{\text{all}}={\sum }_{i\in \mathbf{i}}i.V$ and the yes votes by $V_{\text{yes}}$.

• Wallet builder: src/contract/dao/src/client/vote.rs
• WASM VM code: src/contract/dao/src/entrypoint/vote.rs
• ZK proofs:
  • src/contract/dao/proof/dao-vote-main.zk
  • src/contract/dao/proof/dao-vote-input.zk

Function Params

Define the DAO vote function params $$\begin{array}{rl}\tau & \in {\mathbb{F}}_p\\ \mathcal{P}& \in \text{im}({\text{Bulla}}_{\text{Proposal}})\\ V_{\text{yes}}& \in P_p\\ \text{enc\_vote}& \in {\text{ElGamalEncNote}}_4\\ \mathbf{i}& \in {\text{VoteInput}}^{\ast }\end{array}$$

Define the DAO vote-input function params $$\begin{array}{rl}\text{VoteInput}.\mathcal{N}& \in {\mathbb{F}}_p\\ \text{VoteInput}.V& \in P_p\\ \text{VoteInput}.R_{\text{coin}}& \in {\mathbb{F}}_p\\ \text{VoteInput}.{\text{PK}}_{\sigma }& \in P_p\end{array}$$

Note: $\text{VoteInput}.V$ is a pedersen commitment, where the blinds are selected such that their sum is a valid field element in ${\mathbb{F}}_p$ so the blind for $\sum V$ can be verifiably encrypted. Likewise we do the same for the blind used to calculate $V_{\text{yes}}$.

This allows DAO members to securely receive all secrets for votes on a proposal. This is then used in the Exec phase when we work on the sum of DAO votes.

/// Parameters for `Dao::Vote`
pub struct DaoVoteParams {
    /// Token commitment for the vote inputs
    pub token_commit: pallas::Base,
    /// Proposal bulla being voted on
    pub proposal_bulla: DaoProposalBulla,
    /// Commitment for yes votes
    pub yes_vote_commit: pallas::Point,
    /// Encrypted note
    pub note: ElGamalEncryptedNote<4>,
    /// Inputs for the vote
    pub inputs: Vec<DaoVoteParamsInput>,
}

/// Input for a DAO proposal vote
pub struct DaoVoteParamsInput {
    /// Vote commitment
    pub vote_commit: pallas::Point,
    /// Vote nullifier
    pub vote_nullifier: Nullifier,
    /// Public key used for signing
    pub signature_public: PublicKey,
}

Contract Statement

Let $t_0=\text{BlockWindow}\in {\mathbb{F}}_p$ be the current blockwindow as defined in Blockwindow.

Proposal bulla exists   check $\mathcal{P}$ exists in the DAO contract proposal bullas DB.

Let there be prover auxiliary witness inputs: $$\begin{array}{rl}p& \in {\text{Params}}_{\text{Proposal}}\\ b_p& \in {\mathbb{F}}_p\\ d& \in {\text{Params}}_{\text{DAO}}\\ b_d& \in {\mathbb{F}}_p\\ o& \in {\mathbb{F}}_p\\ b_y& \in {\mathbb{F}}_p\\ v& \in {\mathbb{F}}_p\\ b_v& \in {\mathbb{F}}_p\\ b_{\tau }& \in {\mathbb{F}}_p\\ t_{\text{now}}& \in {\mathbb{F}}_p\\ \text{esk}& \in {\mathbb{F}}_p\end{array}$$ Attach a proof ${\pi }_{\mathcal{V}}$ such that the following relations hold:

Governance token commit   export the DAO token ID as an encrypted pedersen commit $T=\text{PedersenCommit}(d.\tau ,b_{\tau })$ where $T={\sum }_{i\in \mathbf{i}}{T}_i$.

DAO bulla integrity   $\mathcal{D}={\text{Bulla}}_{\text{DAO}}(d,b_d)$

Proposal bulla integrity   $\mathcal{P}={\text{Bulla}}_{\text{Proposal}}(p,b_p)$

Yes vote commit   $V_{\text{yes}}=\text{PedersenCommit}(ov,{\text{Lift}}_q(b_y))$

Total vote value commit   $V_{\text{all}}=\text{PedersenCommit}(v,{\text{Lift}}_q(b_v))$ where $V_{\text{all}}={\sum }_{i\in \mathbf{i}}i.V$ should also hold.

Vote option boolean   enforce $o\in \{0,1\}$.

Proposal not expired   let $t_{\text{end}}=N_{64}2{\mathbb{F}}_p(p.t_0)+N_{64}2{\mathbb{F}}_p(p.D)$, and then check $t_{\text{now}}<t_{\text{end}}$.

Verifiable encryption of vote commit secrets   let $\mathbf{n}=(o,b_y,v,b_v)$, and verify $\text{enc\_vote}=\text{ElGamal}.\text{Encrypt}(\mathbf{n},\text{esk},d.\text{PK})$.

For each input $i\in \mathbf{i}$, perform the following checks:

  Valid input merkle root   check that $i.R_{\text{coin}}$ is the previously seen merkle root in the proposal snapshot merkle root.

  Unused nullifier (money)   check that $\mathcal{N}$ does not exist in the money contract nullifiers DB.

  Unused nullifier (proposal)   check that $\mathcal{N}$ does not exist in the DAO contract nullifiers DB for this specific proposal.

Let there be prover auxiliary witness inputs: $$\begin{array}{rl}{x}_c& \in {\mathbb{F}}_p\\ c& \in {\text{Attrs}}_{\text{Coin}}\\ b_v& \in {\mathbb{F}}_v\\ b_{\tau }& \in {\mathbb{F}}_p\\ ({\psi }_i,{\Pi }_i)& \in \text{MerklePos}\times \text{MerklePath}\\ x_{\sigma }& \in {\mathbb{F}}_p\end{array}$$ Attach a proof ${\pi }_i$ such that the following relations hold:

  Nullifier integrity   $\mathcal{N}=\text{PoseidonHash}(x_c,C)$

  Coin value commit   $i.V=\text{PedersenCommit}(c.v,b_v)$.

  Token commit   $T=\text{PoseidonHash}(c.\tau ,b_{\tau })$.

  Valid coin   Check $c.P=\text{DerivePubKey}(x_c)$. Let $C=\text{Coin}(c)$. Check $i.R_{\text{coin}}=\text{MerkleRoot}({\psi }_i,{\Pi }_i,C)$.

  Proof of signature public key ownership   $i.{\text{PK}}_{\sigma }=\text{DerivePubKey}(x_{\sigma })$.

Signatures

For each $i\in \mathbf{i}$, attach a signature corresponding to the public key $i.{\text{PK}}_{\sigma }$.

Exec

Exec is the final stage after voting is Accepted.

It checks the correct voting conditions have been met in accordance with the DAO params such as quorum and approval ratio. $V_{\text{yes}}$ and $V_{\text{all}}$ are pedersen commits to $v_{\text{yes}}$ and $v_{\text{all}}$ respectively.

It also checks that child calls have been attached in accordance with the auth calls set inside the proposal. One of these will usually be an auth module function. Currently the DAO provides a single preset for executing Money::transfer() calls so DAOs can manage anonymous treasuries.

• Wallet builder: src/contract/dao/src/client/exec.rs
• WASM VM code: src/contract/dao/src/entrypoint/exec.rs
• ZK proof: src/contract/dao/proof/dao-exec.zk

Function Params

Let $\text{AuthCall},{\text{Commit}}_{{\text{Auth}}^{\ast }}$ be defined as in the section Auth Calls.

Define the DAO exec function params $$\begin{array}{rl}\mathcal{P}& \in \text{im}({\text{Bulla}}_{\text{Proposal}})\\ \mathcal{A}& \in {\text{AuthCall}}^{\ast }\\ V_{\text{yes}}& \in P_p\\ V_{\text{all}}& \in P_p\end{array}$$

/// Parameters for `Dao::Exec`
pub struct DaoExecParams {
    /// The proposal bulla
    pub proposal_bulla: DaoProposalBulla,
    pub proposal_auth_calls: Vec<DaoAuthCall>,
    /// Aggregated blinds for the vote commitments
    pub blind_total_vote: DaoBlindAggregateVote,
    /// Public key for the signature.
    /// The signature ensures this DAO::exec call cannot be modified with other calls.
    pub signature_public: PublicKey,
}

/// Represents a single or multiple blinded votes.
/// These can be summed together.
pub struct DaoBlindAggregateVote {
    /// Weighted vote commit
    pub yes_vote_commit: pallas::Point,
    /// All value staked in the vote
    pub all_vote_commit: pallas::Point,
}

Contract Statement

There are two phases to Exec. In the first we check the calling format of this transaction matches what is specified in the proposal. Then in the second phase, we verify the correct voting rules.

Auth call spec match   denote the child calls of Exec by $C$. If $\#C\ne \#\mathcal{A}$ then exit. Otherwise, for each $c\in C$ and $a\in \mathcal{A}$, check the function ID of $c$ is $a$.

Aggregate votes lookup   using the proposal bulla, fetch the aggregated votes from the DB and verify $V_{\text{yes}}$ and $V_{\text{all}}$ are set correctly.

Let there be prover auxiliary witness inputs: $$\begin{array}{rl}p& \in {\text{Params}}_{\text{Proposal}}\\ b_p& \in {\mathbb{F}}_p\\ d& \in {\text{Params}}_{\text{DAO}}\\ b_d& \in {\mathbb{F}}_p\\ v_y& \in {\mathbb{F}}_p\\ v_a& \in {\mathbb{F}}_p\\ b_y& \in {\mathbb{F}}_v\\ b_a& \in {\mathbb{F}}_v\end{array}$$ Attach a proof $\pi$ such that the following relations hold:

DAO bulla integrity   $\mathcal{D}={\text{Bulla}}_{\text{DAO}}(d,b_d)$

Proposal bulla integrity   $\mathcal{P}={\text{Bulla}}_{\text{Proposal}}(p,b_p)$ where $p.\mathcal{A}=\mathcal{A}$.

Yes vote commit   $V_{\text{yes}}=\text{PedersenCommit}(v_y,b_y)$

All vote commit   $V_{\text{all}}=\text{PedersenCommit}(v_a,b_a)$

All votes pass quorum   $Q\le v_a$

Approval ratio satisfied   we wish to check that $\frac{A_q^{\%}}{A_b^{\%}}\le \frac{v_y}{v_a}$. Instead we perform the equivalent check that $v_a{A}_q^{\%}\le v_y{A}_b^{\%}$.

Signatures

No signatures are attached.

AuthMoneyTransfer

This is a child call for Exec which can be used for DAO treasuries. It checks the next sibling call is Money::transfer() and accordingly verifies the first $n-1$ output coins match the data set in this call's auth data.

Additionally we provide a note with the coin params that are verifiably encrypted to mitigate the attack where Exec is called, but the supplied Money::transfer() call contains an invalid note which cannot be decrypted by the receiver. In this case, the money would still leave the DAO treasury but be unspendable.

• Wallet builder: src/contract/dao/src/client/auth_xfer.rs
• WASM VM code: src/contract/dao/src/entrypoint/auth_xfer.rs
• ZK proofs:
  • src/contract/dao/proof/dao-auth-money-transfer.zk
  • src/contract/dao/proof/dao-auth-money-transfer-enc-coin.zk

Function Params

Define the DAO AuthMoneyTransfer function params $$\begin{array}{rl}{\mathcal{C}}_{\text{enc}}& \in {\text{ElGamalEncNote}}_5^{\ast }\\ {\mathcal{D}}_{\text{enc}}& \in {\text{ElGamalEncNote}}_3\end{array}$$

This provides verifiable note encryption for all output coins in the sibling Money::transfer() call as well as the DAO change coin.

/// Parameters for `Dao::AuthMoneyTransfer`
pub struct DaoAuthMoneyTransferParams {
    pub enc_attrs: Vec<ElGamalEncryptedNote<5>>,
    pub dao_change_attrs: ElGamalEncryptedNote<3>,
}

Contract Statement

Denote the DAO contract ID by ${\text{CID}}_{\text{DAO}}\in {\mathbb{F}}_p$.

Sibling call is Money::transfer()   load the sibling call and check the contract ID and function code match Money::transfer().

Money originates from the same DAO   check all the input's user_data for the sibling Money::transfer() encode the same DAO. We do this by using the same blind for all user_data. Denote this value by ${\text{UD}}_{\text{enc}}$.

Output coins match proposal   check there are $n+1$ output coins, with the first $n$ coins exactly matching those set in the auth data in the parent DAO::exec() call. Denote these proposal auth calls by $\mathcal{A}$.

Let there be a prover auxiliary witness inputs: $$\begin{array}{rl}p& \in {\text{Params}}_{\text{Proposal}}\\ b_p& \in {\mathbb{F}}_p\\ d& \in {\text{Params}}_{\text{DAO}}\\ b_d& \in {\mathbb{F}}_p\\ b_{\text{UD}}& \in {\mathbb{F}}_p\\ v_{\text{DAO}}& \in {\mathbb{F}}_p\\ {\tau }_{\text{DAO}}& \in {\mathbb{F}}_p\\ b_{\text{DAO}}& \in {\mathbb{F}}_p\\ \text{esk}& \in {\mathbb{F}}_p\end{array}$$

Attach a proof ${\pi }_{\text{auth}}$ such that the following relations hold:

DAO bulla integrity   $\mathcal{D}={\text{Bulla}}_{\text{DAO}}(d,b_d)$

Proposal bulla integrity   $\mathcal{P}={\text{Bulla}}_{\text{Proposal}}(p,b_p)$ where $\mathcal{P}$ matches the value in DAO::exec(), and $p.\mathcal{A}=\mathcal{A}$.

Input user data commits to DAO bulla   ${\text{UD}}_{\text{enc}}=\text{PoseidonHash}(\mathcal{D},b_{\text{UD}})$

DAO change coin integrity   denote the last coin in the Money::transfer() outputs by $C_{\text{DAO}}$. Then check $$C_{\text{DAO}}=\text{Coin}(d.\text{PK},v_{\text{DAO}},{\tau }_{\text{DAO}},{\text{CID}}_{\text{DAO}},\mathcal{D},b_{\text{DAO}})$$

Verifiable DAO change coin note encryption   let $\mathbf{n}=(v_{\text{DAO}},{\tau }_{\text{DAO}},b_{\text{DAO}})$, and verify ${\mathcal{D}}_{\text{enc}}=\text{ElGamal}.\text{Encrypt}(\mathbf{n},\text{esk},d.\text{PK})$.

Then we do the same for each output coin of Money::transfer(). For $k\in [n]$, let $a=({\mathcal{C}}_{\text{enc}}{)}_k$ and $C$ be the $k$th output coin from Money::transfer(). Let there be prover auxiliary witness inputs: $$\begin{array}{rl}c& \in {\text{Attrs}}_{\text{Coin}}\\ e& \in {\mathbb{F}}_p\end{array}$$ Attach a proof ${\pi }_k$ such that the following relations hold:

  Coin integrity   $C=\text{Coin}(c)$

  Verifiable output coin note encryption   let $\mathbf{n}=(c.v,c.\tau ,c.\text{SH},c.\text{UD},c.n)$, and verify $a=\text{ElGamal}.\text{Encrypt}(\mathbf{n},\text{esk},d.\text{PK})$.

Signatures

No signatures are attached.