Tornado Cash

1pragma solidity ^0.5.8;
2
3
4
5contract IVerifier {
6  function verifyProof(bytes memory _proof, uint256[6] memory _input) public returns(bool);
7}
8
9contract Tornado is MerkleTreeWithHistory, ReentrancyGuard {
10  uint256 public denomination;
11  mapping(bytes32 => bool) public nullifierHashes;
12  // we store all commitments just to prevent accidental deposits with the same commitment
13  mapping(bytes32 => bool) public commitments;
14  IVerifier public verifier;
15
16  // operator can update snark verification key
17  // after the final trusted setup ceremony operator rights are supposed to be transferred to zero address
18  address public operator;
19  modifier onlyOperator {
20    require(msg.sender == operator, "Only operator can call this function.");
21    _;
22  }
23
24  event Deposit(bytes32 indexed commitment, uint32 leafIndex, uint256 timestamp);
25  event Withdrawal(address to, bytes32 nullifierHash, address indexed relayer, uint256 fee);
26
27  /**
28    @dev The constructor
29    @param _verifier the address of SNARK verifier for this contract
30    @param _denomination transfer amount for each deposit
31    @param _merkleTreeHeight the height of deposits' Merkle Tree
32    @param _operator operator address (see operator comment above)
33  */
34  constructor(
35    IVerifier _verifier,
36    uint256 _denomination,
37    uint32 _merkleTreeHeight,
38    address _operator
39  ) MerkleTreeWithHistory(_merkleTreeHeight) public {
40    require(_denomination > 0, "denomination should be greater than 0");
41    verifier = _verifier;
42    operator = _operator;
43    denomination = _denomination;
44  }
45
46  /**
47    @dev Deposit funds into the contract. The caller must send (for ETH) or approve (for ERC20) value equal to or `denomination` of this instance.
48    @param _commitment the note commitment, which is PedersenHash(nullifier + secret)
49  */
50  function deposit(bytes32 _commitment) external payable nonReentrant {
51    require(!commitments[_commitment], "The commitment has been submitted");
52
53    uint32 insertedIndex = _insert(_commitment);
54    commitments[_commitment] = true;
55    _processDeposit();
56
57    emit Deposit(_commitment, insertedIndex, block.timestamp);
58  }
59
60  /** @dev this function is defined in a child contract */
61  function _processDeposit() internal;
62
63  /**
64    @dev Withdraw a deposit from the contract. `proof` is a zkSNARK proof data, and input is an array of circuit public inputs
65    `input` array consists of:
66      - merkle root of all deposits in the contract
67      - hash of unique deposit nullifier to prevent double spends
68      - the recipient of funds
69      - optional fee that goes to the transaction sender (usually a relay)
70  */
71  function withdraw(bytes calldata _proof, bytes32 _root, bytes32 _nullifierHash, address payable _recipient, address payable _relayer, uint256 _fee, uint256 _refund) external payable nonReentrant {
72    require(_fee <= denomination, "Fee exceeds transfer value");
73    require(!nullifierHashes[_nullifierHash], "The note has been already spent");
74    require(isKnownRoot(_root), "Cannot find your merkle root"); // Make sure to use a recent one
75    require(verifier.verifyProof(_proof, [uint256(_root), uint256(_nullifierHash), uint256(_recipient), uint256(_relayer), _fee, _refund]), "Invalid withdraw proof");
76
77    nullifierHashes[_nullifierHash] = true;
78    _processWithdraw(_recipient, _relayer, _fee, _refund);
79    emit Withdrawal(_recipient, _nullifierHash, _relayer, _fee);
80  }
81
82  /** @dev this function is defined in a child contract */
83  function _processWithdraw(address payable _recipient, address payable _relayer, uint256 _fee, uint256 _refund) internal;
84
85  /** @dev whether a note is already spent */
86  function isSpent(bytes32 _nullifierHash) public view returns(bool) {
87    return nullifierHashes[_nullifierHash];
88  }
89
90  /** @dev whether an array of notes is already spent */
91  function isSpentArray(bytes32[] calldata _nullifierHashes) external view returns(bool[] memory spent) {
92    spent = new bool[](_nullifierHashes.length);
93    for(uint i = 0; i < _nullifierHashes.length; i++) {
94      if (isSpent(_nullifierHashes[i])) {
95        spent[i] = true;
96      }
97    }
98  }
99
100  /**
101    @dev allow operator to update SNARK verification keys. This is needed to update keys after the final trusted setup ceremony is held.
102    After that operator rights are supposed to be transferred to zero address
103  */
104  function updateVerifier(address _newVerifier) external onlyOperator {
105    verifier = IVerifier(_newVerifier);
106  }
107
108  /** @dev operator can change his address */
109  function changeOperator(address _newOperator) external onlyOperator {
110    operator = _newOperator;
111  }
112}
113
114// File: contracts/ETHTornado.sol
115
116// https://tornado.cash
117/*
118* d888888P                                           dP              a88888b.                   dP
119*    88                                              88             d8'   `88                   88
120*    88    .d8888b. 88d888b. 88d888b. .d8888b. .d888b88 .d8888b.    88        .d8888b. .d8888b. 88d888b.
121*    88    88'  `88 88'  `88 88'  `88 88'  `88 88'  `88 88'  `88    88        88'  `88 Y8ooooo. 88'  `88
122*    88    88.  .88 88       88    88 88.  .88 88.  .88 88.  .88 dP Y8.   .88 88.  .88       88 88    88
123*    dP    `88888P' dP       dP    dP `88888P8 `88888P8 `88888P' 88  Y88888P' `88888P8 `88888P' dP    dP
124* ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
125*/
126
127pragma solidity ^0.5.8;
128
129
130contract TornadoCash_eth is Tornado {
131  constructor(
132    IVerifier _verifier,
133    uint256 _denomination,
134    uint32 _merkleTreeHeight,
135    address _operator
136  ) Tornado(_verifier, _denomination, _merkleTreeHeight, _operator) public {
137  }
138
139  function _processDeposit() internal {
140    require(msg.value == denomination, "Please send `mixDenomination` ETH along with transaction");
141  }
142
143  function _processWithdraw(address payable _recipient, address payable _relayer, uint256 _fee, uint256 _refund) internal {
144    // sanity checks
145    require(msg.value == 0, "Message value is supposed to be zero for ETH instance");
146    require(_refund == 0, "Refund value is supposed to be zero for ETH instance");
147
148    (bool success, ) = _recipient.call.value(denomination - _fee)("");
149    require(success, "payment to _recipient did not go thru");
150    if (_fee > 0) {
151      (success, ) = _relayer.call.value(_fee)("");
152      require(success, "payment to _relayer did not go thru");
153    }

JavaScript Tests