Proposal

$X = (s n, e p, p k_{x}, p k_{y}, roo t, c m_{x}^{v a l u e}, c m_{y}^{v a l u e}, re w a r d, c m_{x}^{v a l u e^{o u t}}, c m_{y}^{v a l u e^{o u t}}, C, μ_{y}, y, μ_{ρ}, ρ, σ_{1}, σ_{2}, h e a d s t a r t)$ $W = (s k, n o n ce, v a l u e, e p, re w a r d, v a l u e_{b l in d}, τ, p a t h, v a l u e_{b l in d}^{o u t}, μ_{y}, μ_{ρ}, σ 1, σ 2, h e a d s t a r t)$ $L = {X : W \in R}$

Public Input	Description
sn¹	nullifier is hash of nonce nonce, and sk
ep	epoch index
$p k_{x}$	coin public key pk affine x coordinate
$p k_{y}$	coin public key pk affine y coordinate
root	root of coins commitments tree
$c m_{x}^{v a l u e}$	value commitment affine x coordinate
$c m_{y}^{v a l u e}$	value commitment affine y coordinate
reward	lottery reward value $\in Z$ of type u64
$c m_{x}^{v a l u e^{o u t}}$	value commitment affine x coordinate
$c m_{y}^{v a l u e^{o u t}}$	value commitment affine y coordinate
$C^{o u t}$	coin commitment
$μ_{y}$	random, deterministic PRF output
$μ_{ρ}$	random, deterministic PRF output
$ρ$	on-chain entropy as hash of nonce, and $μ_{ρ}$
$σ_{1}$	target function approximation first term coefficient
$σ_{2}$	target function approximation second term coefficient

Witnesses	Description
sk	coin secret key derived from previous coin sk
nonce²	random nonce derived from previous coin
value	coin value $\in Z$ or u64
ep	epoch index
reward	lottery reward value $\in Z$ of type u64
$v a l u e_{b l in d}$	blinding scalar for value commitment
$τ$	C position rooted by root
path	path of C at position $τ$
$v a l u e_{b l in d}^{o u t}$	blinding scalar for value commitment of newly minted coin
$μ_{y}$	random, deterministic PRF output
$μ_{ρ}$	random, deterministic PRF output
$σ_{1}$	target function approximation first term coefficient
$σ_{2}$	target function approximation second term coefficient
headstart	competitive advantage added to target T

Table: if you read this after zerocash which crypsinous is based off, both papers calls nullifiers serial numbers. and serial number is nonce, sn in the table below can be called nullifier in our contract, similarly nonce can be called input/output serial using zcash sapling terminology which is used in our money contract (sapling contract).

Functions	Description
$v a l u e^{o u t}$	value + reward
$n o n c e^{o u t}$	$ha s h (s k ∣∣ n o n ce)$
$s k^{o u t}$	$ha s h (s k)$
$p k^{o u t}$	commitment to $s k^{o u t}$
$C^{o u t}$	$ha s h (p k_{x}^{o u t} ∣∣ p k_{y}^{o u t} ∣∣ v a l u e^{o u t} ∣∣ e p ∣ n o n c e^{o u t})$
$c m^{v a l u e}$	commitment to $v a l u e^{o u t}$

The DarkFi Book

Proposal