Model

Let $\text{Bulla}$ be defined as in the section Bulla Commitments.

Let $P_p,{\mathbb{F}}_p$ be defined as in the section Pallas and Vesta.

Coin

The coin contains the main parameters that define the Money::transfer() operation:

• The public key $\text{PK}$ serves a dual role.
  1. Protects receiver privacy from the sender since the corresponding secret key is used in the nullifier.
  2. Authorizes the creation of the nullifier by the receiver.
• The core parameters are the value $v$ and the token ID $\tau$.
• The blinding factor $b$ is randomly selected, and guarantees uniqueness of the coin which is used in the nullifier.
• To enable protocol owned liquidity, we define the spend hook $\text{SH}$ which adds a constraint that when the coin is spent, it must be called by the contract specified. The user data $\text{UD}$ can then be used by the parent contract to store additional parameters in the coin. If the parameter length exceeds the size of ${\mathbb{F}}_p$ then a commit can be used here instead.

Define the coin attributes $$\begin{array}{rl}{\text{Attrs}}_{\text{Coin}}.\text{PK}& \in P_p\\ {\text{Attrs}}_{\text{Coin}}.v& \in N_{64}\\ {\text{Attrs}}_{\text{Coin}}.\tau & \in {\mathbb{F}}_p\\ {\text{Attrs}}_{\text{Coin}}.\text{SH}& \in {\mathbb{F}}_p\\ {\text{Attrs}}_{\text{Coin}}.\text{UD}& \in {\mathbb{F}}_p\\ {\text{Attrs}}_{\text{Coin}}.b& \in {\mathbb{F}}_p\end{array}$$

pub struct CoinAttributes {
    pub public_key: PublicKey,
    pub value: u64,
    pub token_id: TokenId,
    pub spend_hook: FuncId,
    pub user_data: pallas::Base,
    /// Simultaneously blinds the coin and ensures uniqueness
    pub blind: BaseBlind,
}

$$\text{Coin}:{\text{Attrs}}_{\text{Coin}}\to {\mathbb{F}}_p$$ $$\text{Coin}(p)=\text{Bulla}(\mathcal{X}(p.\text{PK}),\mathcal{Y}(p.\text{PK}),N_{64}2{\mathbb{F}}_p(p.v),p.\tau ,p.\text{SH},p.\text{UD},p.b)$$

Inputs and Outputs

Clear Input

Define the clear input attributes $$\begin{array}{rl}\text{MoneyClearInput}.v& \in N_{64}\\ \text{MoneyClearInput}.T& \in P_p\\ \text{MoneyClearInput}.v_{\text{blind}}& \in {\mathbb{F}}_q\\ \text{MoneyClearInput}.t_{\text{blind}}& \in {\mathbb{F}}_p\\ \text{MoneyClearInput}.Z& \in P_p\end{array}$$

/// A contract call's clear input
pub struct ClearInput {
    /// Input's value (amount)
    pub value: u64,
    /// Input's token ID
    pub token_id: TokenId,
    /// Blinding factor for `value`
    pub value_blind: ScalarBlind,
    /// Blinding factor for `token_id`
    pub token_blind: BaseBlind,
    /// Public key for the signature
    pub signature_public: PublicKey,
}

Input

Define the input attributes $$\begin{array}{rl}\text{MoneyInput}.V& \in P_p\\ \text{MoneyInput}.T& \in {\mathbb{F}}_p\\ \text{MoneyInput}.N& \in {\mathbb{F}}_p\\ \text{MoneyInput}.R& \in {\mathbb{F}}_p\\ \text{MoneyInput}.h& \in {\mathbb{F}}_p\\ \text{MoneyInput}.U& \in {\mathbb{F}}_p\\ \text{MoneyInput}.Z& \in P_p\end{array}$$

/// A contract call's anonymous input
pub struct Input {
    /// Pedersen commitment for the input's value
    pub value_commit: pallas::Point,
    /// Commitment for the input's token ID
    pub token_commit: pallas::Base,
    /// Revealed nullifier
    pub nullifier: Nullifier,
    /// Revealed Merkle root
    pub merkle_root: MerkleNode,
    /// Encrypted user data field. An encrypted commitment to arbitrary data.
    /// When spend hook is nonzero, then this field may be used to pass data
    /// to the invoked contract.
    pub user_data_enc: pallas::Base,
    /// Public key for the signature
    pub signature_public: PublicKey,
}

Output

Let $\text{AeadEncNote}$ be defined as in In-band Secret Distribution.

Define the output attributes $$\begin{array}{rl}\text{MoneyOutput}.V& \in P_p\\ \text{MoneyOutput}.T& \in {\mathbb{F}}_p\\ \text{MoneyOutput}.C& \in {\mathbb{F}}_p\\ \text{MoneyOutput}.\text{note}& \in \text{AeadEncNote}\end{array}$$

/// A contract call's anonymous output
pub struct Output {
    /// Pedersen commitment for the output's value
    pub value_commit: pallas::Point,
    /// Commitment for the output's token ID
    pub token_commit: pallas::Base,
    /// Minted coin
    pub coin: Coin,
    /// AEAD encrypted note
    pub note: AeadEncryptedNote,
}