Merge pull request #180 from semaphore-protocol/refactor/group-id

No SNARK restrictions for Group IDs

Former-commit-id: 27320f1723

.env.example

@@ -1,5 +1,6 @@
 DEFAULT_NETWORK=hardhat
 TREE_DEPTH=20
+ALL_SNARK_ARTIFACTS=true
 REPORT_GAS=false
 BACKEND_PRIVATE_KEY=
 INFURA_API_KEY=

.eslintignore

@@ -20,6 +20,7 @@ circuits
 # production
 dist
 build
+docs
 
 # misc
 .DS_Store

.eslintrc.json

@@ -1,11 +1,24 @@
 {
+    "root": true,
     "env": {
         "es6": true
     },
-    "extends": ["eslint:recommended", "plugin:@typescript-eslint/recommended", "prettier"],
+    "extends": ["airbnb-base", "airbnb-typescript/base", "plugin:jest/recommended", "plugin:jest/style", "prettier"],
     "parser": "@typescript-eslint/parser",
     "parserOptions": {
-        "project": "tsconfig.json"
+        "ecmaVersion": 6,
+        "sourceType": "module",
+        "project": ["./tsconfig.json", "./packages/**/tsconfig.json"]
     },
-    "plugins": ["@typescript-eslint"]
+    "plugins": ["@typescript-eslint", "jest"],
+    "rules": {
+        "no-underscore-dangle": "off",
+        "import/no-extraneous-dependencies": "off",
+        "no-bitwise": "off",
+        "no-await-in-loop": "off",
+        "no-restricted-syntax": "off",
+        "no-console": ["warn", { "allow": ["info", "warn", "error"] }],
+        "@typescript-eslint/lines-between-class-members": "off",
+        "no-param-reassign": "off"
+    }
 }

.github/ISSUE_TEMPLATE/---package.md

@@ -0,0 +1,14 @@
+---
+name: "\U0001F4E6 Package"
+about: Propose a new Semaphore package
+title: ''
+labels: 'feature :rocket:'
+assignees: ''
+
+---
+
+**Describe the package you'd like**
+A clear and concise description of the type of package you have in mind.
+
+**Additional context**
+Add any other context about the package here.

.github/workflows/coverall.yml

@@ -1,50 +0,0 @@
-name: coverall
-
-on:
-    push:
-        branches:
-            - main
-
-env:
-    TREE_DEPTH: 20
-
-jobs:
-    coverall:
-        runs-on: ubuntu-latest
-
-        steps:
-            - uses: actions/checkout@v2
-
-            - name: Install Node.js
-              uses: actions/setup-node@v1
-              with:
-                  node-version: 16.x
-
-            - name: Get yarn cache directory path
-              id: yarn-cache-dir-path
-              run: echo "::set-output name=dir::$(yarn config get cacheFolder)"
-
-            - name: Restore yarn cache
-              uses: actions/cache@v3
-              id: yarn-cache
-              with:
-                  path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
-                  key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-                  restore-keys: |
-                      ${{ runner.os }}-yarn-
-
-            - name: Install dependencies
-              run: YARN_CHECKSUM_BEHAVIOR=ignore yarn
-
-            - name: Download Snark artifacts
-              run: yarn download:snark-artifacts
-
-            - name: Compile contracts
-              run: yarn compile
-
-            - name: Test contracts with coverage
-              run: yarn test:coverage
-
-            - uses: coverallsapp/github-action@master
-              with:
-                  github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/docs.yml

@@ -1,13 +1,12 @@
-name: style
+name: docs
 
 on:
-    pull_request:
     push:
         branches:
             - main
 
 jobs:
-    style:
+    gh-pages:
         runs-on: ubuntu-latest
 
         steps:
@@ -32,13 +31,15 @@ jobs:
                       ${{ runner.os }}-yarn-
 
             - name: Install dependencies
-              run: YARN_CHECKSUM_BEHAVIOR=ignore yarn
+              run: yarn
 
-            - name: Run Prettier
-              run: yarn prettier
+            - name: Generate doc website
+              run: yarn docs
 
-            - name: Run Eslint
-              run: yarn lint
-
-            - name: Compile contracts
-              run: yarn compile
+            - name: Publish on Github Pages
+              uses: crazy-max/ghaction-github-pages@v2.5.0
+              with:
+                  build_dir: docs
+                  jekyll: false
+              env:
+                  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/production.yml

@@ -0,0 +1,107 @@
+name: production
+
+on:
+    push:
+        branches:
+            - main
+
+env:
+    TREE_DEPTH: 20
+    ALL_SNARK_ARTIFACTS: false
+
+jobs:
+    style:
+        runs-on: ubuntu-latest
+
+        steps:
+            - uses: actions/checkout@v2
+
+            - name: Install Node.js
+              uses: actions/setup-node@v1
+              with:
+                  node-version: 16.x
+
+            - name: Get yarn cache directory path
+              id: yarn-cache-dir-path
+              run: echo "::set-output name=dir::$(yarn config get cacheFolder)"
+
+            - name: Restore yarn cache
+              uses: actions/cache@v3
+              id: yarn-cache
+              with:
+                  path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+                  key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+                  restore-keys: |
+                      ${{ runner.os }}-yarn-
+
+            - name: Install dependencies
+              run: yarn
+
+            - name: Compile contracts
+              run: yarn compile:contracts
+
+            - name: Build libraries
+              run: yarn build:libraries
+
+            - name: Run Prettier
+              run: yarn prettier
+
+            - name: Run Eslint
+              run: yarn lint
+
+    test:
+        runs-on: ubuntu-latest
+        strategy:
+            matrix:
+                type:
+                    - libraries
+                    - contracts
+
+        steps:
+            - uses: actions/checkout@v2
+
+            - name: Install Node.js
+              uses: actions/setup-node@v1
+              with:
+                  node-version: 16.x
+
+            - name: Get yarn cache directory path
+              id: yarn-cache-dir-path
+              run: echo "::set-output name=dir::$(yarn config get cacheFolder)"
+
+            - name: Restore yarn cache
+              uses: actions/cache@v3
+              id: yarn-cache
+              with:
+                  path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+                  key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+                  restore-keys: |
+                      ${{ runner.os }}-yarn-
+
+            - name: Install dependencies
+              run: yarn
+
+            - name: Build libraries
+              run: yarn build:libraries
+
+            - name: Test contracts and libraries
+              run: yarn test:${{ matrix.type }}
+
+            - name: Coveralls
+              uses: coverallsapp/github-action@master
+              with:
+                  github-token: ${{ secrets.GITHUB_TOKEN }}
+                  flag-name: run-${{ matrix.type }}
+                  path-to-lcov: ./coverage/${{ matrix.type }}/lcov.info
+                  parallel: true
+
+    coverage:
+        runs-on: ubuntu-latest
+        needs: test
+
+        steps:
+            - name: Coveralls Finished
+              uses: coverallsapp/github-action@master
+              with:
+                  github-token: ${{ secrets.GITHUB_TOKEN }}
+                  parallel-finished: true

.github/workflows/pull-requests.yml

@@ -0,0 +1,81 @@
+name: pull-requests
+
+on:
+    pull_request:
+
+env:
+    TREE_DEPTH: 20
+    ALL_SNARK_ARTIFACTS: false
+
+jobs:
+    style:
+        runs-on: ubuntu-latest
+
+        steps:
+            - uses: actions/checkout@v2
+
+            - name: Install Node.js
+              uses: actions/setup-node@v1
+              with:
+                  node-version: 16.x
+
+            - name: Get yarn cache directory path
+              id: yarn-cache-dir-path
+              run: echo "::set-output name=dir::$(yarn config get cacheFolder)"
+
+            - name: Restore yarn cache
+              uses: actions/cache@v3
+              id: yarn-cache
+              with:
+                  path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+                  key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+                  restore-keys: |
+                      ${{ runner.os }}-yarn-
+
+            - name: Install dependencies
+              run: yarn
+
+            - name: Compile contracts
+              run: yarn compile:contracts
+
+            - name: Build libraries
+              run: yarn build:libraries
+
+            - name: Run Prettier
+              run: yarn prettier
+
+            - name: Run Eslint
+              run: yarn lint
+
+    test:
+        runs-on: ubuntu-latest
+
+        steps:
+            - uses: actions/checkout@v2
+
+            - name: Install Node.js
+              uses: actions/setup-node@v1
+              with:
+                  node-version: 16.x
+
+            - name: Get yarn cache directory path
+              id: yarn-cache-dir-path
+              run: echo "::set-output name=dir::$(yarn config get cacheFolder)"
+
+            - name: Restore yarn cache
+              uses: actions/cache@v3
+              id: yarn-cache
+              with:
+                  path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+                  key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+                  restore-keys: |
+                      ${{ runner.os }}-yarn-
+
+            - name: Install dependencies
+              run: yarn
+
+            - name: Build libraries
+              run: yarn build:libraries
+
+            - name: Test contracts and libraries
+              run: yarn test

.github/workflows/test.yml

@@ -1,47 +0,0 @@
-name: test
-
-on:
-    pull_request:
-    push:
-        branches:
-            - main
-
-env:
-    TREE_DEPTH: 20
-
-jobs:
-    test:
-        runs-on: ubuntu-latest
-
-        steps:
-            - uses: actions/checkout@v2
-
-            - name: Install Node.js
-              uses: actions/setup-node@v1
-              with:
-                  node-version: 16.x
-
-            - name: Get yarn cache directory path
-              id: yarn-cache-dir-path
-              run: echo "::set-output name=dir::$(yarn config get cacheFolder)"
-
-            - name: Restore yarn cache
-              uses: actions/cache@v3
-              id: yarn-cache
-              with:
-                  path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
-                  key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-                  restore-keys: |
-                      ${{ runner.os }}-yarn-
-
-            - name: Install dependencies
-              run: YARN_CHECKSUM_BEHAVIOR=ignore yarn
-
-            - name: Download Snark artifacts
-              run: yarn download:snark-artifacts
-
-            - name: Compile contracts
-              run: yarn compile
-
-            - name: Test contracts with coverage
-              run: yarn test:coverage

.gitignore

@@ -16,9 +16,14 @@ pids
 *.seed
 *.pid.lock
 
+# IDE
+.vscode
+.idea
+
 # Testing
 coverage
 coverage.json
+*.lcov
 
 # Dependency directories
 node_modules/
@@ -28,6 +33,10 @@ node_modules/
 
 # Optional npm cache directory
 .npm
+.DS_Store
+
+# Output of 'npm pack'
+*.tgz
 
 # Optional eslint cache
 .eslintcache
@@ -54,12 +63,16 @@ node_modules/
 # Production
 build
 dist
-deployed-contracts/undefined.json
-deployed-contracts/localhost.json
+docs/*
+!docs/CNAME
+!docs/index.html
 
 # Hardhat
 artifacts
 cache
+packages/contracts/deployed-contracts/undefined.json
+packages/contracts/deployed-contracts/hardhat.json
+packages/contracts/deployed-contracts/localhost.json
 
 # Stores VSCode versions used for testing VSCode extensions
 .vscode-test
@@ -72,3 +85,6 @@ cache
 !.yarn/releases
 !.yarn/sdks
 !.yarn/versions
+
+# Other
+snark-artifacts

.prettierignore

@@ -10,6 +10,9 @@ coverage.json
 
 # hardhat
 cache
+packages/contracts/deployed-contracts/undefined.json
+packages/contracts/deployed-contracts/hardhat.json
+packages/contracts/deployed-contracts/localhost.json
 
 # types
 types
@@ -18,11 +21,12 @@ types
 circuits
 
 # contracts
-contracts/verifiers
+Verifier*.sol
 
 # production
 dist
 build
+docs
 
 # github
 .github/ISSUE_TEMPLATE
@@ -35,3 +39,6 @@ build
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
+
+# other
+snark-artifacts

.solcover.js

@@ -1,21 +0,0 @@
-module.exports = {
-    skipFiles: [
-        "verifiers/Verifier16.sol",
-        "verifiers/Verifier17.sol",
-        "verifiers/Verifier18.sol",
-        "verifiers/Verifier19.sol",
-        "verifiers/Verifier20.sol",
-        "verifiers/Verifier21.sol",
-        "verifiers/Verifier22.sol",
-        "verifiers/Verifier23.sol",
-        "verifiers/Verifier24.sol",
-        "verifiers/Verifier25.sol",
-        "verifiers/Verifier26.sol",
-        "verifiers/Verifier27.sol",
-        "verifiers/Verifier28.sol",
-        "verifiers/Verifier29.sol",
-        "verifiers/Verifier30.sol",
-        "verifiers/Verifier31.sol",
-        "verifiers/Verifier32.sol"
-    ]
-}

.solhintignore

@@ -1 +0,0 @@
-contracts/verifiers

.yarnrc.yml

@@ -1,4 +1,8 @@
 nodeLinker: node-modules
 checksumBehavior: update
 
+plugins:
+    - path: .yarn/plugins/@yarnpkg/plugin-workspace-tools.cjs
+      spec: "@yarnpkg/plugin-workspace-tools"
+
 yarnPath: .yarn/releases/yarn-3.2.1.cjs

CONTRIBUTING.md

@@ -56,7 +56,7 @@ Each commit message consists of a **header**, a **body** and a **footer**. The *
     <BLANK LINE>
     <footer>
 
-The **header** is mandatory and the **scope** of the header is optional.
+The **header** is mandatory and the **scope** of the header must contain the name of the package you are working on.
 
 #### Type
 

README.md

@@ -13,18 +13,18 @@
     <a href="https://github.com/semaphore-protocol" target="_blank">
         <img src="https://img.shields.io/badge/project-Semaphore-blue.svg?style=flat-square">
     </a>
-    <a href="https://github.com/semaphore-protocol/semaphore/blob/main/LICENSE">
+    <a href="/LICENSE">
         <img alt="Github license" src="https://img.shields.io/github/license/semaphore-protocol/semaphore.svg?style=flat-square">
     </a>
-    <a href="https://github.com/semaphore-protocol/semaphore/actions?query=workflow%3Atest">
-        <img alt="GitHub Workflow test" src="https://img.shields.io/github/workflow/status/semaphore-protocol/semaphore/test?label=test&style=flat-square&logo=github">
-    </a>
-    <a href="https://github.com/semaphore-protocol/semaphore/actions?query=workflow%3Astyle">
-        <img alt="GitHub Workflow style" src="https://img.shields.io/github/workflow/status/semaphore-protocol/semaphore/style?label=style&style=flat-square&logo=github">
+    <a href="https://github.com/semaphore-protocol/semaphore/actions?query=workflow%3Aproduction">
+        <img alt="GitHub Workflow test" src="https://img.shields.io/github/workflow/status/semaphore-protocol/semaphore/production?label=test&style=flat-square&logo=github">
     </a>
     <a href="https://coveralls.io/github/semaphore-protocol/semaphore">
         <img alt="Coveralls" src="https://img.shields.io/coveralls/github/semaphore-protocol/semaphore?style=flat-square&logo=coveralls">
     </a>
+    <a href="https://deepscan.io/dashboard#view=project&tid=16502&pid=22324&bid=657461">
+        <img src="https://deepscan.io/api/teams/16502/projects/22324/branches/657461/badge/grade.svg" alt="DeepScan grade">
+    </a>
     <a href="https://eslint.org/">
         <img alt="Linter eslint" src="https://img.shields.io/badge/linter-eslint-8080f2?style=flat-square&logo=eslint">
     </a>
@@ -48,7 +48,7 @@
             🔎 Issues
         </a>
         <span>&nbsp;&nbsp;|&nbsp;&nbsp;</span>
-        <a href="https://t.me/joinchat/B-PQx1U3GtAh--Z4Fwo56A">
+        <a href="https://discord.gg/6mSdGHnstH">
             🗣️ Chat &amp; Support
         </a>
     </h4>
@@ -57,12 +57,149 @@
 | Semaphore is a protocol, designed to be a simple and generic privacy layer for Ethereum DApps. Using zero knowledge, Ethereum users can prove their membership of a group and send signals such as votes or endorsements without revealing their original identity. |
 | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 
-The core of the Semaphore protocol is in the [circuit logic](/circuits/scheme.png). However Semaphore also provides [Solidity contracts](/contracts) (NPM: `@semaphore-protocol/contracts`) and [JavaScript libraries](https://github.com/semaphore-protocol/semaphore.js) to make the steps for offchain proof creation and onchain verification easier. To learn more about Semaphore visit [semaphore.appliedzkp.org](https://semaphore.appliedzkp.org).
+The core of the Semaphore protocol is in the [circuit logic](/packages/circuits/scheme.png). However Semaphore also provides [Solidity contracts](/packages/contracts) (NPM: `@semaphore-protocol/contracts`) and JavaScript libraries to make the steps for offchain proof creation and onchain verification easier. To learn more about Semaphore visit [semaphore.appliedzkp.org](https://semaphore.appliedzkp.org).
 
 You can find Semaphore V1 on [`version/1.0.0`](https://github.com/semaphore-protocol/semaphore/tree/version/1.0.0).
 
 ---
 
+## 📦 Packages
+
+<table>
+    <th>Package</th>
+    <th>Version</th>
+    <th>Downloads</th>
+    <tbody>
+        <tr>
+            <td>
+                <a href="/packages/contracts">
+                    @semaphore-protocol/contracts
+                </a>
+            </td>
+            <td>
+                <!-- NPM version -->
+                <a href="https://npmjs.org/package/@semaphore-protocol/contracts">
+                    <img src="https://img.shields.io/npm/v/@semaphore-protocol/contracts.svg?style=flat-square" alt="NPM version" />
+                </a>
+            </td>
+            <td>
+                <!-- Downloads -->
+                <a href="https://npmjs.org/package/@semaphore-protocol/contracts">
+                    <img src="https://img.shields.io/npm/dm/@semaphore-protocol/contracts.svg?style=flat-square" alt="Downloads" />
+                </a>
+            </td>
+        </tr>
+        <tr>
+            <td>
+                <a href="/packages/identity">
+                    @semaphore-protocol/identity
+                </a>
+                <a href="https://semaphore-protocol.github.io/semaphore/identity">
+                    (docs)
+                </a>
+            </td>
+            <td>
+                <!-- NPM version -->
+                <a href="https://npmjs.org/package/@semaphore-protocol/identity">
+                    <img src="https://img.shields.io/npm/v/@semaphore-protocol/identity.svg?style=flat-square" alt="NPM version" />
+                </a>
+            </td>
+            <td>
+                <!-- Downloads -->
+                <a href="https://npmjs.org/package/@semaphore-protocol/identity">
+                    <img src="https://img.shields.io/npm/dm/@semaphore-protocol/identity.svg?style=flat-square" alt="Downloads" />
+                </a>
+            </td>
+        </tr>
+        <tr>
+            <td>
+                <a href="/packages/group">
+                    @semaphore-protocol/group
+                </a>
+                <a href="https://semaphore-protocol.github.io/semaphore/group">
+                    (docs)
+                </a>
+            </td>
+            <td>
+                <!-- NPM version -->
+                <a href="https://npmjs.org/package/@semaphore-protocol/group">
+                    <img src="https://img.shields.io/npm/v/@semaphore-protocol/group.svg?style=flat-square" alt="NPM version" />
+                </a>
+            </td>
+            <td>
+                <!-- Downloads -->
+                <a href="https://npmjs.org/package/@semaphore-protocol/group">
+                    <img src="https://img.shields.io/npm/dm/@semaphore-protocol/group.svg?style=flat-square" alt="Downloads" />
+                </a>
+            </td>
+        </tr>
+        <tr>
+            <td>
+                <a href="/packages/proof">
+                    @semaphore-protocol/proof
+                </a>
+                <a href="https://semaphore-protocol.github.io/semaphore/proof">
+                    (docs)
+                </a>
+            </td>
+            <td>
+                <!-- NPM version -->
+                <a href="https://npmjs.org/package/@semaphore-protocol/proof">
+                    <img src="https://img.shields.io/npm/v/@semaphore-protocol/proof.svg?style=flat-square" alt="NPM version" />
+                </a>
+            </td>
+            <td>
+                <!-- Downloads -->
+                <a href="https://npmjs.org/package/@semaphore-protocol/proof">
+                    <img src="https://img.shields.io/npm/dm/@semaphore-protocol/proof.svg?style=flat-square" alt="Downloads" />
+                </a>
+            </td>
+        </tr>
+        <tr>
+            <td>
+                <a href="/packages/subgraph">
+                    @semaphore-protocol/subgraph
+                </a>
+                <a href="https://semaphore-protocol.github.io/semaphore/subgraph">
+                    (docs)
+                </a>
+            </td>
+            <td>
+                <!-- NPM version -->
+                <a href="https://npmjs.org/package/@semaphore-protocol/subgraph">
+                    <img src="https://img.shields.io/npm/v/@semaphore-protocol/subgraph.svg?style=flat-square" alt="NPM version" />
+                </a>
+            </td>
+            <td>
+                <!-- Downloads -->
+                <a href="https://npmjs.org/package/@semaphore-protocol/subgraph">
+                    <img src="https://img.shields.io/npm/dm/@semaphore-protocol/subgraph.svg?style=flat-square" alt="Downloads" />
+                </a>
+            </td>
+        </tr>
+        <tr>
+            <td>
+                <a href="/packages/hardhat">
+                    @semaphore-protocol/hardhat
+                </a>
+            </td>
+            <td>
+                <!-- NPM version -->
+                <a href="https://npmjs.org/package/@semaphore-protocol/hardhat">
+                    <img src="https://img.shields.io/npm/v/@semaphore-protocol/hardhat.svg?style=flat-square" alt="NPM version" />
+                </a>
+            </td>
+            <td>
+                <!-- Downloads -->
+                <a href="https://npmjs.org/package/@semaphore-protocol/hardhat">
+                    <img src="https://img.shields.io/npm/dm/@semaphore-protocol/hardhat.svg?style=flat-square" alt="Downloads" />
+                </a>
+            </td>
+        </tr>
+    <tbody>
+
+</table>
+
 ## 🛠 Install
 
 Clone this repository:
@@ -71,7 +208,7 @@ Clone this repository:
 git clone https://github.com/semaphore-protocol/semaphore.git
 ```
 
-and install the dependencies:
+And install the dependencies:
 
 ```bash
 cd semaphore && yarn
@@ -85,7 +222,7 @@ Copy the `.env.example` file as `.env`:
 cp .env.example .env
 ```
 
-and add your environment variables.
+And add your environment variables.
 
 ### Code quality and formatting
 
@@ -101,7 +238,7 @@ Run [Prettier](https://prettier.io/) to check formatting rules:
 yarn prettier
 ```
 
-or to automatically format the code:
+Or to automatically format the code:
 
 ```bash
 yarn prettier:write
@@ -125,59 +262,46 @@ Download the Semaphore snark artifacts needed to generate and verify proofs:
 yarn download:snark-artifacts
 ```
 
-### Compile contracts
-
-Compile the smart contracts with [Hardhat](https://hardhat.org/):
-
-```bash
-yarn compile
-```
-
 ### Testing
 
+Run [Jest](https://jestjs.io/) to test the JS libraries:
+
+```bash
+yarn test:libraries
+```
+
 Run [Mocha](https://mochajs.org/) to test the contracts:
 
+```bash
+yarn test:contracts
+```
+
+Or test everything with:
+
 ```bash
 yarn test
 ```
 
-You can also generate a test coverage report:
+### Build libraries & compile contracts
+
+Run [Rollup](https://www.rollupjs.org) to build all the packages:
 
 ```bash
-yarn test:coverage
+yarn build:libraries
 ```
 
-or a test gas report:
+Compile the smart contracts with [Hardhat](https://hardhat.org/):
 
 ```bash
-yarn test:report-gas
+yarn compile:contracts
 ```
 
-### Deploy contracts
+### Documentation (JS libraries)
 
-Deploy a verifier contract with depth = 20:
+Run [TypeDoc](https://typedoc.org/) to generate a documentation website for each package:
 
 ```bash
-yarn deploy:verifier --depth 20
+yarn docs
 ```
 
-Deploy the `Semaphore.sol` contract with one verifier:
-
-```bash
-yarn deploy:semaphore --verifiers '[{"merkleTreeDepth": 20, "contractAddress": "0x06bcD633988c1CE7Bd134DbE2C12119b6f3E4bD1"}]'
-```
-
-Deploy all verifiers and Semaphore contract:
-
-```bash
-yarn deploy:all
-```
-
-If you want to deploy contracts in a specific network you can set up the `DEFAULT_NETWORK` variable in your `.env` file with the name of one of our supported networks (hardhat, localhost, goerli, arbitrum). Or you can specify it as option:
-
-```bash
-yarn deploy:all --network goerli
-yarn deploy:all --network localhost
-```
-
-If you want to deploy contracts on Goerli or Arbitrum, remember to provide a valid private key and an Infura API in your `.env` file.
+The output will be placed on the `docs` folder.

babel.config.json

@@ -0,0 +1,3 @@
+{
+    "presets": [["@babel/preset-env", { "targets": { "node": "current" } }], "@babel/preset-typescript"]
+}

contracts/base/SemaphoreConstants.sol

@@ -1,4 +0,0 @@
-//SPDX-License-Identifier: MIT
-pragma solidity 0.8.4;
-
-uint256 constant SNARK_SCALAR_FIELD = 21888242871839275222246405745257275088548364400416034343698204186575808495617;

contracts/base/SemaphoreCore.sol

@@ -1,61 +0,0 @@
-//SPDX-License-Identifier: MIT
-pragma solidity 0.8.4;
-
-import "../interfaces/ISemaphoreCore.sol";
-import "../interfaces/IVerifier.sol";
-
-/// @title Semaphore core contract.
-/// @notice Minimal code to allow users to signal their endorsement of an arbitrary string.
-/// @dev The following code verifies that the proof is correct and saves the hash of the
-/// nullifier to prevent double-signaling. External nullifier and Merkle trees (i.e. groups) must be
-/// managed externally.
-contract SemaphoreCore is ISemaphoreCore {
-    /// @dev Gets a nullifier hash and returns true or false.
-    /// It is used to prevent double-signaling.
-    mapping(uint256 => bool) internal nullifierHashes;
-
-    /// @dev Asserts that no nullifier already exists and if the zero-knowledge proof is valid.
-    /// Otherwise it reverts.
-    /// @param signal: Semaphore signal.
-    /// @param root: Root of the Merkle tree.
-    /// @param nullifierHash: Nullifier hash.
-    /// @param externalNullifier: External nullifier.
-    /// @param proof: Zero-knowledge proof.
-    /// @param verifier: Verifier address.
-    function _verifyProof(
-        bytes32 signal,
-        uint256 root,
-        uint256 nullifierHash,
-        uint256 externalNullifier,
-        uint256[8] calldata proof,
-        IVerifier verifier
-    ) internal view {
-        if (nullifierHashes[nullifierHash]) {
-            revert Semaphore__YouAreUsingTheSameNillifierTwice();
-        }
-
-        uint256 signalHash = _hashSignal(signal);
-
-        verifier.verifyProof(
-            [proof[0], proof[1]],
-            [[proof[2], proof[3]], [proof[4], proof[5]]],
-            [proof[6], proof[7]],
-            [root, nullifierHash, signalHash, externalNullifier]
-        );
-    }
-
-    /// @dev Stores the nullifier hash to prevent double-signaling.
-    /// Attention! Remember to call it when you verify a proof if you
-    /// need to prevent double-signaling.
-    /// @param nullifierHash: Semaphore nullifier hash.
-    function _saveNullifierHash(uint256 nullifierHash) internal {
-        nullifierHashes[nullifierHash] = true;
-    }
-
-    /// @dev Creates a keccak256 hash of the signal.
-    /// @param signal: Semaphore signal.
-    /// @return Hash of the signal.
-    function _hashSignal(bytes32 signal) private pure returns (uint256) {
-        return uint256(keccak256(abi.encodePacked(signal))) >> 8;
-    }
-}

contracts/interfaces/ISemaphoreCore.sol

@@ -1,12 +0,0 @@
-//SPDX-License-Identifier: MIT
-pragma solidity 0.8.4;
-
-/// @title SemaphoreCore interface.
-/// @dev Interface of SemaphoreCore contract.
-interface ISemaphoreCore {
-    error Semaphore__YouAreUsingTheSameNillifierTwice();
-
-    /// @notice Emitted when a proof is verified correctly and a new nullifier hash is added.
-    /// @param nullifierHash: Hash of external and identity nullifiers.
-    event NullifierHashAdded(uint256 nullifierHash);
-}

contracts/interfaces/ISemaphoreNullifiers.sol

@@ -1,14 +0,0 @@
-//SPDX-License-Identifier: MIT
-pragma solidity 0.8.4;
-
-/// @title SemaphoreNullifiers interface.
-/// @dev Interface of SemaphoreNullifiers contract.
-interface ISemaphoreNullifiers {
-    /// @dev Emitted when a external nullifier is added.
-    /// @param externalNullifier: External Semaphore nullifier.
-    event ExternalNullifierAdded(uint256 externalNullifier);
-
-    /// @dev Emitted when a external nullifier is removed.
-    /// @param externalNullifier: External Semaphore nullifier.
-    event ExternalNullifierRemoved(uint256 externalNullifier);
-}

contracts/interfaces/IVerifier.sol

@@ -1,13 +0,0 @@
-//SPDX-License-Identifier: MIT
-pragma solidity 0.8.4;
-
-/// @title Verifier interface.
-/// @dev Interface of Verifier contract.
-interface IVerifier {
-    function verifyProof(
-        uint256[2] memory a,
-        uint256[2][2] memory b,
-        uint256[2] memory c,
-        uint256[4] memory input
-    ) external view;
-}

contracts/verifiers/Verifier16.sol

@@ -1,237 +0,0 @@
-//
-// Copyright 2017 Christian Reitwiessner
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// 2019 OKIMS
-//      ported to solidity 0.6
-//      fixed linter warnings
-//      added requiere error messages
-//
-// 2021 Remco Bloemen
-//       cleaned up code
-//       added InvalidProve() error
-//       always revert with InvalidProof() on invalid proof
-//       make Pairing strict
-//
-// SPDX-License-Identifier: GPL-3.0
-pragma solidity ^0.8.4;
-
-library Pairing {
-  error InvalidProof();
-
-  // The prime q in the base field F_q for G1
-  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-
-  // The prime moludus of the scalar field of G1.
-  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-
-  struct G1Point {
-    uint256 X;
-    uint256 Y;
-  }
-
-  // Encoding of field elements is: X[0] * z + X[1]
-  struct G2Point {
-    uint256[2] X;
-    uint256[2] Y;
-  }
-
-  /// @return the generator of G1
-  function P1() internal pure returns (G1Point memory) {
-    return G1Point(1, 2);
-  }
-
-  /// @return the generator of G2
-  function P2() internal pure returns (G2Point memory) {
-    return
-      G2Point(
-        [
-          11559732032986387107991004021392285783925812861821192530917403151452391805634,
-          10857046999023057135944570762232829481370756359578518086990519993285655852781
-        ],
-        [
-          4082367875863433681332203403145435568316851327593401208105741076214120093531,
-          8495653923123431417604973247489272438418190587263600148770280649306958101930
-        ]
-      );
-  }
-
-  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
-  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
-    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
-    // Validate input or revert
-    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
-    // We know p.Y > 0 and p.Y < BASE_MODULUS.
-    return G1Point(p.X, BASE_MODULUS - p.Y);
-  }
-
-  /// @return r the sum of two points of G1
-  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
-    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
-    // on the curve.
-    uint256[4] memory input;
-    input[0] = p1.X;
-    input[1] = p1.Y;
-    input[2] = p2.X;
-    input[3] = p2.Y;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// @return r the product of a point on G1 and a scalar, i.e.
-  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
-  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
-    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
-    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
-    if (s >= SCALAR_MODULUS) revert InvalidProof();
-    uint256[3] memory input;
-    input[0] = p.X;
-    input[1] = p.Y;
-    input[2] = s;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// Asserts the pairing check
-  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
-  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
-  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
-    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
-    // respective groups of the right order.
-    if (p1.length != p2.length) revert InvalidProof();
-    uint256 elements = p1.length;
-    uint256 inputSize = elements * 6;
-    uint256[] memory input = new uint256[](inputSize);
-    for (uint256 i = 0; i < elements; i++) {
-      input[i * 6 + 0] = p1[i].X;
-      input[i * 6 + 1] = p1[i].Y;
-      input[i * 6 + 2] = p2[i].X[0];
-      input[i * 6 + 3] = p2[i].X[1];
-      input[i * 6 + 4] = p2[i].Y[0];
-      input[i * 6 + 5] = p2[i].Y[1];
-    }
-    uint256[1] memory out;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
-    }
-    if (!success || out[0] != 1) revert InvalidProof();
-  }
-}
-
-contract Verifier16 {
-  using Pairing for *;
-
-  struct VerifyingKey {
-    Pairing.G1Point alfa1;
-    Pairing.G2Point beta2;
-    Pairing.G2Point gamma2;
-    Pairing.G2Point delta2;
-    Pairing.G1Point[] IC;
-  }
-
-  struct Proof {
-    Pairing.G1Point A;
-    Pairing.G2Point B;
-    Pairing.G1Point C;
-  }
-
-  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
-    vk.alfa1 = Pairing.G1Point(
-      20491192805390485299153009773594534940189261866228447918068658471970481763042,
-      9383485363053290200918347156157836566562967994039712273449902621266178545958
-    );
-
-    vk.beta2 = Pairing.G2Point(
-      [4252822878758300859123897981450591353533073413197771768651442665752259397132, 6375614351688725206403948262868962793625744043794305715222011528459656738731],
-      [21847035105528745403288232691147584728191162732299865338377159692350059136679, 10505242626370262277552901082094356697409835680220590971873171140371331206856]
-    );
-
-    vk.gamma2 = Pairing.G2Point(
-      [11559732032986387107991004021392285783925812861821192530917403151452391805634, 10857046999023057135944570762232829481370756359578518086990519993285655852781],
-      [4082367875863433681332203403145435568316851327593401208105741076214120093531, 8495653923123431417604973247489272438418190587263600148770280649306958101930]
-    );
-
-    vk.delta2 = Pairing.G2Point(
-      [13406811599156507528361773763681356312643537981039994686313383243831956396116, 16243966861079634958125511652590761846958471358623040426599000904006426210032],
-      [11781596534582143578120404722739278517564025497573071755253972265891888117374, 15688083679237922164673518758181461582601853873216319711156397437601833996222]
-    );
-
-    vk.IC = new Pairing.G1Point[](5);
-
-    
-      vk.IC[0] = Pairing.G1Point(
-        1964404930528116823793003656764176108669615750422202377358993070935069307720,
-        2137714996673694828207437580381836490878070731768805974506391024595988817424
-      );
-    
-      vk.IC[1] = Pairing.G1Point(
-        19568893707760843340848992184233194433177372925415116053368211122719346671126,
-        11639469568629189918046964192305250472192697612201524135560178632824282818614
-      );
-    
-      vk.IC[2] = Pairing.G1Point(
-        5317268879687484957437879782519918549127939892210247573193613900261494313825,
-        528174394975085006443543773707702838726735933116136102590448357278717993744
-      );
-    
-      vk.IC[3] = Pairing.G1Point(
-        14865918005176722116473730206622066845866539143554731094374354951675249722731,
-        3197770568483953664363740385883457803041685902965668289308665954510373380344
-      );
-    
-      vk.IC[4] = Pairing.G1Point(
-        6863358721495494421022713667808247652425178970453300712435830652679038918987,
-        15025816433373311798308762709072064417001390853103872064614174594927359131281
-      );
-    
-  }
-
-  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
-  function verifyProof(
-    uint[2] memory a,
-    uint[2][2] memory b,
-    uint[2] memory c,
-    uint[4] memory input
-  ) public view {
-    // If the values are not in the correct range, the Pairing contract will revert.
-    Proof memory proof;
-    proof.A = Pairing.G1Point(a[0], a[1]);
-    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
-    proof.C = Pairing.G1Point(c[0], c[1]);
-
-    VerifyingKey memory vk = verifyingKey();
-
-    // Compute the linear combination vk_x of inputs times IC
-    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
-    Pairing.G1Point memory vk_x = vk.IC[0];
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
-
-    // Check pairing
-    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
-    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
-    p1[0] = Pairing.negate(proof.A);
-    p2[0] = proof.B;
-    p1[1] = vk.alfa1;
-    p2[1] = vk.beta2;
-    p1[2] = vk_x;
-    p2[2] = vk.gamma2;
-    p1[3] = proof.C;
-    p2[3] = vk.delta2;
-    Pairing.pairingCheck(p1, p2);
-  }
-}

contracts/verifiers/Verifier17.sol

@@ -1,237 +0,0 @@
-//
-// Copyright 2017 Christian Reitwiessner
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// 2019 OKIMS
-//      ported to solidity 0.6
-//      fixed linter warnings
-//      added requiere error messages
-//
-// 2021 Remco Bloemen
-//       cleaned up code
-//       added InvalidProve() error
-//       always revert with InvalidProof() on invalid proof
-//       make Pairing strict
-//
-// SPDX-License-Identifier: GPL-3.0
-pragma solidity ^0.8.4;
-
-library Pairing {
-  error InvalidProof();
-
-  // The prime q in the base field F_q for G1
-  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-
-  // The prime moludus of the scalar field of G1.
-  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-
-  struct G1Point {
-    uint256 X;
-    uint256 Y;
-  }
-
-  // Encoding of field elements is: X[0] * z + X[1]
-  struct G2Point {
-    uint256[2] X;
-    uint256[2] Y;
-  }
-
-  /// @return the generator of G1
-  function P1() internal pure returns (G1Point memory) {
-    return G1Point(1, 2);
-  }
-
-  /// @return the generator of G2
-  function P2() internal pure returns (G2Point memory) {
-    return
-      G2Point(
-        [
-          11559732032986387107991004021392285783925812861821192530917403151452391805634,
-          10857046999023057135944570762232829481370756359578518086990519993285655852781
-        ],
-        [
-          4082367875863433681332203403145435568316851327593401208105741076214120093531,
-          8495653923123431417604973247489272438418190587263600148770280649306958101930
-        ]
-      );
-  }
-
-  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
-  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
-    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
-    // Validate input or revert
-    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
-    // We know p.Y > 0 and p.Y < BASE_MODULUS.
-    return G1Point(p.X, BASE_MODULUS - p.Y);
-  }
-
-  /// @return r the sum of two points of G1
-  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
-    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
-    // on the curve.
-    uint256[4] memory input;
-    input[0] = p1.X;
-    input[1] = p1.Y;
-    input[2] = p2.X;
-    input[3] = p2.Y;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// @return r the product of a point on G1 and a scalar, i.e.
-  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
-  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
-    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
-    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
-    if (s >= SCALAR_MODULUS) revert InvalidProof();
-    uint256[3] memory input;
-    input[0] = p.X;
-    input[1] = p.Y;
-    input[2] = s;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// Asserts the pairing check
-  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
-  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
-  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
-    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
-    // respective groups of the right order.
-    if (p1.length != p2.length) revert InvalidProof();
-    uint256 elements = p1.length;
-    uint256 inputSize = elements * 6;
-    uint256[] memory input = new uint256[](inputSize);
-    for (uint256 i = 0; i < elements; i++) {
-      input[i * 6 + 0] = p1[i].X;
-      input[i * 6 + 1] = p1[i].Y;
-      input[i * 6 + 2] = p2[i].X[0];
-      input[i * 6 + 3] = p2[i].X[1];
-      input[i * 6 + 4] = p2[i].Y[0];
-      input[i * 6 + 5] = p2[i].Y[1];
-    }
-    uint256[1] memory out;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
-    }
-    if (!success || out[0] != 1) revert InvalidProof();
-  }
-}
-
-contract Verifier17 {
-  using Pairing for *;
-
-  struct VerifyingKey {
-    Pairing.G1Point alfa1;
-    Pairing.G2Point beta2;
-    Pairing.G2Point gamma2;
-    Pairing.G2Point delta2;
-    Pairing.G1Point[] IC;
-  }
-
-  struct Proof {
-    Pairing.G1Point A;
-    Pairing.G2Point B;
-    Pairing.G1Point C;
-  }
-
-  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
-    vk.alfa1 = Pairing.G1Point(
-      20491192805390485299153009773594534940189261866228447918068658471970481763042,
-      9383485363053290200918347156157836566562967994039712273449902621266178545958
-    );
-
-    vk.beta2 = Pairing.G2Point(
-      [4252822878758300859123897981450591353533073413197771768651442665752259397132, 6375614351688725206403948262868962793625744043794305715222011528459656738731],
-      [21847035105528745403288232691147584728191162732299865338377159692350059136679, 10505242626370262277552901082094356697409835680220590971873171140371331206856]
-    );
-
-    vk.gamma2 = Pairing.G2Point(
-      [11559732032986387107991004021392285783925812861821192530917403151452391805634, 10857046999023057135944570762232829481370756359578518086990519993285655852781],
-      [4082367875863433681332203403145435568316851327593401208105741076214120093531, 8495653923123431417604973247489272438418190587263600148770280649306958101930]
-    );
-
-    vk.delta2 = Pairing.G2Point(
-      [15629200772768268814959330350023920183087521275477047626405113853190187031523, 13589689305661231568162336263197960570915890299814486885851912452076929115480],
-      [11464919285924930973853174493551975632739604254498590354200272115844983493029, 16004221700357242255845535848024178544616388017965468694776181247983831995562]
-    );
-
-    vk.IC = new Pairing.G1Point[](5);
-
-    
-      vk.IC[0] = Pairing.G1Point(
-        17789438292552571310739605737896030466581277887660997531707911256058650850910,
-        4112657509505371631825493224748310061184972897405589115208158208294581472016
-      );
-    
-      vk.IC[1] = Pairing.G1Point(
-        3322052920119834475842380240689494113984887785733316517680891208549118967155,
-        381029395779795399840019487059126246243641886087320875571067736504031557148
-      );
-    
-      vk.IC[2] = Pairing.G1Point(
-        8777645223617381095463415690983421308854368583891690388850387317049320450400,
-        11923582117369144413749726090967341613266070909169947059497952692052020331958
-      );
-    
-      vk.IC[3] = Pairing.G1Point(
-        15493263571528401950994933073246603557158047091963487223668240334879173885581,
-        6315532173951617115856055775098532808695228294437279844344466163873167020700
-      );
-    
-      vk.IC[4] = Pairing.G1Point(
-        3481637421055377106140197938175958155334313900824697193932986771017625492245,
-        20088416136090515091300914661950097694450984520235647990572441134215240947932
-      );
-    
-  }
-
-  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
-  function verifyProof(
-    uint[2] memory a,
-    uint[2][2] memory b,
-    uint[2] memory c,
-    uint[4] memory input
-  ) public view {
-    // If the values are not in the correct range, the Pairing contract will revert.
-    Proof memory proof;
-    proof.A = Pairing.G1Point(a[0], a[1]);
-    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
-    proof.C = Pairing.G1Point(c[0], c[1]);
-
-    VerifyingKey memory vk = verifyingKey();
-
-    // Compute the linear combination vk_x of inputs times IC
-    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
-    Pairing.G1Point memory vk_x = vk.IC[0];
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
-
-    // Check pairing
-    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
-    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
-    p1[0] = Pairing.negate(proof.A);
-    p2[0] = proof.B;
-    p1[1] = vk.alfa1;
-    p2[1] = vk.beta2;
-    p1[2] = vk_x;
-    p2[2] = vk.gamma2;
-    p1[3] = proof.C;
-    p2[3] = vk.delta2;
-    Pairing.pairingCheck(p1, p2);
-  }
-}

contracts/verifiers/Verifier18.sol

@@ -1,237 +0,0 @@
-//
-// Copyright 2017 Christian Reitwiessner
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// 2019 OKIMS
-//      ported to solidity 0.6
-//      fixed linter warnings
-//      added requiere error messages
-//
-// 2021 Remco Bloemen
-//       cleaned up code
-//       added InvalidProve() error
-//       always revert with InvalidProof() on invalid proof
-//       make Pairing strict
-//
-// SPDX-License-Identifier: GPL-3.0
-pragma solidity ^0.8.4;
-
-library Pairing {
-  error InvalidProof();
-
-  // The prime q in the base field F_q for G1
-  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-
-  // The prime moludus of the scalar field of G1.
-  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-
-  struct G1Point {
-    uint256 X;
-    uint256 Y;
-  }
-
-  // Encoding of field elements is: X[0] * z + X[1]
-  struct G2Point {
-    uint256[2] X;
-    uint256[2] Y;
-  }
-
-  /// @return the generator of G1
-  function P1() internal pure returns (G1Point memory) {
-    return G1Point(1, 2);
-  }
-
-  /// @return the generator of G2
-  function P2() internal pure returns (G2Point memory) {
-    return
-      G2Point(
-        [
-          11559732032986387107991004021392285783925812861821192530917403151452391805634,
-          10857046999023057135944570762232829481370756359578518086990519993285655852781
-        ],
-        [
-          4082367875863433681332203403145435568316851327593401208105741076214120093531,
-          8495653923123431417604973247489272438418190587263600148770280649306958101930
-        ]
-      );
-  }
-
-  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
-  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
-    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
-    // Validate input or revert
-    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
-    // We know p.Y > 0 and p.Y < BASE_MODULUS.
-    return G1Point(p.X, BASE_MODULUS - p.Y);
-  }
-
-  /// @return r the sum of two points of G1
-  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
-    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
-    // on the curve.
-    uint256[4] memory input;
-    input[0] = p1.X;
-    input[1] = p1.Y;
-    input[2] = p2.X;
-    input[3] = p2.Y;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// @return r the product of a point on G1 and a scalar, i.e.
-  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
-  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
-    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
-    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
-    if (s >= SCALAR_MODULUS) revert InvalidProof();
-    uint256[3] memory input;
-    input[0] = p.X;
-    input[1] = p.Y;
-    input[2] = s;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// Asserts the pairing check
-  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
-  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
-  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
-    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
-    // respective groups of the right order.
-    if (p1.length != p2.length) revert InvalidProof();
-    uint256 elements = p1.length;
-    uint256 inputSize = elements * 6;
-    uint256[] memory input = new uint256[](inputSize);
-    for (uint256 i = 0; i < elements; i++) {
-      input[i * 6 + 0] = p1[i].X;
-      input[i * 6 + 1] = p1[i].Y;
-      input[i * 6 + 2] = p2[i].X[0];
-      input[i * 6 + 3] = p2[i].X[1];
-      input[i * 6 + 4] = p2[i].Y[0];
-      input[i * 6 + 5] = p2[i].Y[1];
-    }
-    uint256[1] memory out;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
-    }
-    if (!success || out[0] != 1) revert InvalidProof();
-  }
-}
-
-contract Verifier18 {
-  using Pairing for *;
-
-  struct VerifyingKey {
-    Pairing.G1Point alfa1;
-    Pairing.G2Point beta2;
-    Pairing.G2Point gamma2;
-    Pairing.G2Point delta2;
-    Pairing.G1Point[] IC;
-  }
-
-  struct Proof {
-    Pairing.G1Point A;
-    Pairing.G2Point B;
-    Pairing.G1Point C;
-  }
-
-  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
-    vk.alfa1 = Pairing.G1Point(
-      20491192805390485299153009773594534940189261866228447918068658471970481763042,
-      9383485363053290200918347156157836566562967994039712273449902621266178545958
-    );
-
-    vk.beta2 = Pairing.G2Point(
-      [4252822878758300859123897981450591353533073413197771768651442665752259397132, 6375614351688725206403948262868962793625744043794305715222011528459656738731],
-      [21847035105528745403288232691147584728191162732299865338377159692350059136679, 10505242626370262277552901082094356697409835680220590971873171140371331206856]
-    );
-
-    vk.gamma2 = Pairing.G2Point(
-      [11559732032986387107991004021392285783925812861821192530917403151452391805634, 10857046999023057135944570762232829481370756359578518086990519993285655852781],
-      [4082367875863433681332203403145435568316851327593401208105741076214120093531, 8495653923123431417604973247489272438418190587263600148770280649306958101930]
-    );
-
-    vk.delta2 = Pairing.G2Point(
-      [9218320951536642499143228327011901814587826948504871816273184688188019956292, 19717684456458906358368865507225121991585492363133107109865920739019288468011],
-      [16717590750910963405756115910371408378114896008824240863060392362901176601412, 18221695645112467945186983098720611586049108689347006136423489099202471884089]
-    );
-
-    vk.IC = new Pairing.G1Point[](5);
-
-    
-      vk.IC[0] = Pairing.G1Point(
-        4691595252082380256698158158199364410440273386659834000993210659508747323919,
-        9205801980459323513061837717352821162780471027241700646145937351740096374660
-      );
-    
-      vk.IC[1] = Pairing.G1Point(
-        16150531426263112884093068164597994126623437929929609532055221646496813246000,
-        20245743178241899668170758952526381872637304119026868520579207157118516761827
-      );
-    
-      vk.IC[2] = Pairing.G1Point(
-        6063536446992770713985314309889717594240410784717230886576072989709763902848,
-        18258781411255795973918859665416013869184055573057512603788635470145328981347
-      );
-    
-      vk.IC[3] = Pairing.G1Point(
-        10109932964756104512054045207253535333686585863745296080906925765480296575285,
-        4174640428253153601540284363759502713687021920150940723252842152556151210349
-      );
-    
-      vk.IC[4] = Pairing.G1Point(
-        18049428534741480832385046397049175120355008065781483226058177421025493210952,
-        591730261265040164434889324846001338201068482543108348317417391345612814922
-      );
-    
-  }
-
-  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
-  function verifyProof(
-    uint[2] memory a,
-    uint[2][2] memory b,
-    uint[2] memory c,
-    uint[4] memory input
-  ) public view {
-    // If the values are not in the correct range, the Pairing contract will revert.
-    Proof memory proof;
-    proof.A = Pairing.G1Point(a[0], a[1]);
-    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
-    proof.C = Pairing.G1Point(c[0], c[1]);
-
-    VerifyingKey memory vk = verifyingKey();
-
-    // Compute the linear combination vk_x of inputs times IC
-    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
-    Pairing.G1Point memory vk_x = vk.IC[0];
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
-
-    // Check pairing
-    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
-    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
-    p1[0] = Pairing.negate(proof.A);
-    p2[0] = proof.B;
-    p1[1] = vk.alfa1;
-    p2[1] = vk.beta2;
-    p1[2] = vk_x;
-    p2[2] = vk.gamma2;
-    p1[3] = proof.C;
-    p2[3] = vk.delta2;
-    Pairing.pairingCheck(p1, p2);
-  }
-}

contracts/verifiers/Verifier19.sol

@@ -1,237 +0,0 @@
-//
-// Copyright 2017 Christian Reitwiessner
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// 2019 OKIMS
-//      ported to solidity 0.6
-//      fixed linter warnings
-//      added requiere error messages
-//
-// 2021 Remco Bloemen
-//       cleaned up code
-//       added InvalidProve() error
-//       always revert with InvalidProof() on invalid proof
-//       make Pairing strict
-//
-// SPDX-License-Identifier: GPL-3.0
-pragma solidity ^0.8.4;
-
-library Pairing {
-  error InvalidProof();
-
-  // The prime q in the base field F_q for G1
-  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-
-  // The prime moludus of the scalar field of G1.
-  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-
-  struct G1Point {
-    uint256 X;
-    uint256 Y;
-  }
-
-  // Encoding of field elements is: X[0] * z + X[1]
-  struct G2Point {
-    uint256[2] X;
-    uint256[2] Y;
-  }
-
-  /// @return the generator of G1
-  function P1() internal pure returns (G1Point memory) {
-    return G1Point(1, 2);
-  }
-
-  /// @return the generator of G2
-  function P2() internal pure returns (G2Point memory) {
-    return
-      G2Point(
-        [
-          11559732032986387107991004021392285783925812861821192530917403151452391805634,
-          10857046999023057135944570762232829481370756359578518086990519993285655852781
-        ],
-        [
-          4082367875863433681332203403145435568316851327593401208105741076214120093531,
-          8495653923123431417604973247489272438418190587263600148770280649306958101930
-        ]
-      );
-  }
-
-  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
-  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
-    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
-    // Validate input or revert
-    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
-    // We know p.Y > 0 and p.Y < BASE_MODULUS.
-    return G1Point(p.X, BASE_MODULUS - p.Y);
-  }
-
-  /// @return r the sum of two points of G1
-  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
-    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
-    // on the curve.
-    uint256[4] memory input;
-    input[0] = p1.X;
-    input[1] = p1.Y;
-    input[2] = p2.X;
-    input[3] = p2.Y;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// @return r the product of a point on G1 and a scalar, i.e.
-  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
-  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
-    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
-    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
-    if (s >= SCALAR_MODULUS) revert InvalidProof();
-    uint256[3] memory input;
-    input[0] = p.X;
-    input[1] = p.Y;
-    input[2] = s;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// Asserts the pairing check
-  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
-  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
-  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
-    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
-    // respective groups of the right order.
-    if (p1.length != p2.length) revert InvalidProof();
-    uint256 elements = p1.length;
-    uint256 inputSize = elements * 6;
-    uint256[] memory input = new uint256[](inputSize);
-    for (uint256 i = 0; i < elements; i++) {
-      input[i * 6 + 0] = p1[i].X;
-      input[i * 6 + 1] = p1[i].Y;
-      input[i * 6 + 2] = p2[i].X[0];
-      input[i * 6 + 3] = p2[i].X[1];
-      input[i * 6 + 4] = p2[i].Y[0];
-      input[i * 6 + 5] = p2[i].Y[1];
-    }
-    uint256[1] memory out;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
-    }
-    if (!success || out[0] != 1) revert InvalidProof();
-  }
-}
-
-contract Verifier19 {
-  using Pairing for *;
-
-  struct VerifyingKey {
-    Pairing.G1Point alfa1;
-    Pairing.G2Point beta2;
-    Pairing.G2Point gamma2;
-    Pairing.G2Point delta2;
-    Pairing.G1Point[] IC;
-  }
-
-  struct Proof {
-    Pairing.G1Point A;
-    Pairing.G2Point B;
-    Pairing.G1Point C;
-  }
-
-  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
-    vk.alfa1 = Pairing.G1Point(
-      20491192805390485299153009773594534940189261866228447918068658471970481763042,
-      9383485363053290200918347156157836566562967994039712273449902621266178545958
-    );
-
-    vk.beta2 = Pairing.G2Point(
-      [4252822878758300859123897981450591353533073413197771768651442665752259397132, 6375614351688725206403948262868962793625744043794305715222011528459656738731],
-      [21847035105528745403288232691147584728191162732299865338377159692350059136679, 10505242626370262277552901082094356697409835680220590971873171140371331206856]
-    );
-
-    vk.gamma2 = Pairing.G2Point(
-      [11559732032986387107991004021392285783925812861821192530917403151452391805634, 10857046999023057135944570762232829481370756359578518086990519993285655852781],
-      [4082367875863433681332203403145435568316851327593401208105741076214120093531, 8495653923123431417604973247489272438418190587263600148770280649306958101930]
-    );
-
-    vk.delta2 = Pairing.G2Point(
-      [3995128789564535587814512245259203300137618476815456454931286633947953135662, 15953239752392927777442331623182226063776310198012173504208557434319753428770],
-      [20957319343912866335583737646657534123362052690050674068142580221965936605075, 2523786679709693946058523307330825034772478122295850507521258983130425334580]
-    );
-
-    vk.IC = new Pairing.G1Point[](5);
-
-    
-      vk.IC[0] = Pairing.G1Point(
-        9877211178693075145402462781884120278654771727348087433632224794894486095150,
-        19972682062587174829535281061580296764150591339640180868104711395548066529340
-      );
-    
-      vk.IC[1] = Pairing.G1Point(
-        6324578424031095537345184040149690238371517387586958921377481904541316423724,
-        15513931720576048544404512239839508014664224085062729779520992909505663748296
-      );
-    
-      vk.IC[2] = Pairing.G1Point(
-        11371337652479737143800707796204655130812036287859296372695832558127430723628,
-        11757275188600040111649009832378343123994225623498773406233261322165903848967
-      );
-    
-      vk.IC[3] = Pairing.G1Point(
-        13282496583564708104981015168203451877588903263486398132954741568835583461335,
-        1746144324840370907926720490289700342734912534857331743685374514401176014195
-      );
-    
-      vk.IC[4] = Pairing.G1Point(
-        7993952462467372951144011615584426050192046712674662254138390197508963352374,
-        5156942148925224345709309361345680948125600198010285179548841917923439945819
-      );
-    
-  }
-
-  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
-  function verifyProof(
-    uint[2] memory a,
-    uint[2][2] memory b,
-    uint[2] memory c,
-    uint[4] memory input
-  ) public view {
-    // If the values are not in the correct range, the Pairing contract will revert.
-    Proof memory proof;
-    proof.A = Pairing.G1Point(a[0], a[1]);
-    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
-    proof.C = Pairing.G1Point(c[0], c[1]);
-
-    VerifyingKey memory vk = verifyingKey();
-
-    // Compute the linear combination vk_x of inputs times IC
-    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
-    Pairing.G1Point memory vk_x = vk.IC[0];
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
-
-    // Check pairing
-    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
-    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
-    p1[0] = Pairing.negate(proof.A);
-    p2[0] = proof.B;
-    p1[1] = vk.alfa1;
-    p2[1] = vk.beta2;
-    p1[2] = vk_x;
-    p2[2] = vk.gamma2;
-    p1[3] = proof.C;
-    p2[3] = vk.delta2;
-    Pairing.pairingCheck(p1, p2);
-  }
-}

contracts/verifiers/Verifier20.sol

@@ -1,237 +0,0 @@
-//
-// Copyright 2017 Christian Reitwiessner
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// 2019 OKIMS
-//      ported to solidity 0.6
-//      fixed linter warnings
-//      added requiere error messages
-//
-// 2021 Remco Bloemen
-//       cleaned up code
-//       added InvalidProve() error
-//       always revert with InvalidProof() on invalid proof
-//       make Pairing strict
-//
-// SPDX-License-Identifier: GPL-3.0
-pragma solidity ^0.8.4;
-
-library Pairing {
-  error InvalidProof();
-
-  // The prime q in the base field F_q for G1
-  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-
-  // The prime moludus of the scalar field of G1.
-  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-
-  struct G1Point {
-    uint256 X;
-    uint256 Y;
-  }
-
-  // Encoding of field elements is: X[0] * z + X[1]
-  struct G2Point {
-    uint256[2] X;
-    uint256[2] Y;
-  }
-
-  /// @return the generator of G1
-  function P1() internal pure returns (G1Point memory) {
-    return G1Point(1, 2);
-  }
-
-  /// @return the generator of G2
-  function P2() internal pure returns (G2Point memory) {
-    return
-      G2Point(
-        [
-          11559732032986387107991004021392285783925812861821192530917403151452391805634,
-          10857046999023057135944570762232829481370756359578518086990519993285655852781
-        ],
-        [
-          4082367875863433681332203403145435568316851327593401208105741076214120093531,
-          8495653923123431417604973247489272438418190587263600148770280649306958101930
-        ]
-      );
-  }
-
-  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
-  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
-    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
-    // Validate input or revert
-    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
-    // We know p.Y > 0 and p.Y < BASE_MODULUS.
-    return G1Point(p.X, BASE_MODULUS - p.Y);
-  }
-
-  /// @return r the sum of two points of G1
-  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
-    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
-    // on the curve.
-    uint256[4] memory input;
-    input[0] = p1.X;
-    input[1] = p1.Y;
-    input[2] = p2.X;
-    input[3] = p2.Y;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// @return r the product of a point on G1 and a scalar, i.e.
-  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
-  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
-    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
-    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
-    if (s >= SCALAR_MODULUS) revert InvalidProof();
-    uint256[3] memory input;
-    input[0] = p.X;
-    input[1] = p.Y;
-    input[2] = s;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// Asserts the pairing check
-  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
-  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
-  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
-    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
-    // respective groups of the right order.
-    if (p1.length != p2.length) revert InvalidProof();
-    uint256 elements = p1.length;
-    uint256 inputSize = elements * 6;
-    uint256[] memory input = new uint256[](inputSize);
-    for (uint256 i = 0; i < elements; i++) {
-      input[i * 6 + 0] = p1[i].X;
-      input[i * 6 + 1] = p1[i].Y;
-      input[i * 6 + 2] = p2[i].X[0];
-      input[i * 6 + 3] = p2[i].X[1];
-      input[i * 6 + 4] = p2[i].Y[0];
-      input[i * 6 + 5] = p2[i].Y[1];
-    }
-    uint256[1] memory out;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
-    }
-    if (!success || out[0] != 1) revert InvalidProof();
-  }
-}
-
-contract Verifier20 {
-  using Pairing for *;
-
-  struct VerifyingKey {
-    Pairing.G1Point alfa1;
-    Pairing.G2Point beta2;
-    Pairing.G2Point gamma2;
-    Pairing.G2Point delta2;
-    Pairing.G1Point[] IC;
-  }
-
-  struct Proof {
-    Pairing.G1Point A;
-    Pairing.G2Point B;
-    Pairing.G1Point C;
-  }
-
-  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
-    vk.alfa1 = Pairing.G1Point(
-      20491192805390485299153009773594534940189261866228447918068658471970481763042,
-      9383485363053290200918347156157836566562967994039712273449902621266178545958
-    );
-
-    vk.beta2 = Pairing.G2Point(
-      [4252822878758300859123897981450591353533073413197771768651442665752259397132, 6375614351688725206403948262868962793625744043794305715222011528459656738731],
-      [21847035105528745403288232691147584728191162732299865338377159692350059136679, 10505242626370262277552901082094356697409835680220590971873171140371331206856]
-    );
-
-    vk.gamma2 = Pairing.G2Point(
-      [11559732032986387107991004021392285783925812861821192530917403151452391805634, 10857046999023057135944570762232829481370756359578518086990519993285655852781],
-      [4082367875863433681332203403145435568316851327593401208105741076214120093531, 8495653923123431417604973247489272438418190587263600148770280649306958101930]
-    );
-
-    vk.delta2 = Pairing.G2Point(
-      [18976133691706015337908381757202123182841901611067930614519324084182946094218, 1382518990777992893805140303684642328066746531257780279226677247567004248173],
-      [6627710380771660558660627878547223719795356903257079198333641681330388499309, 21806956747910197517744499423107239699428979652113081469385876768212706694581]
-    );
-
-    vk.IC = new Pairing.G1Point[](5);
-
-    
-      vk.IC[0] = Pairing.G1Point(
-        19918517214839406678907482305035208173510172567546071380302965459737278553528,
-        7151186077716310064777520690144511885696297127165278362082219441732663131220
-      );
-    
-      vk.IC[1] = Pairing.G1Point(
-        690581125971423619528508316402701520070153774868732534279095503611995849608,
-        21271996888576045810415843612869789314680408477068973024786458305950370465558
-      );
-    
-      vk.IC[2] = Pairing.G1Point(
-        16461282535702132833442937829027913110152135149151199860671943445720775371319,
-        2814052162479976678403678512565563275428791320557060777323643795017729081887
-      );
-    
-      vk.IC[3] = Pairing.G1Point(
-        4319780315499060392574138782191013129592543766464046592208884866569377437627,
-        13920930439395002698339449999482247728129484070642079851312682993555105218086
-      );
-    
-      vk.IC[4] = Pairing.G1Point(
-        3554830803181375418665292545416227334138838284686406179598687755626325482686,
-        5951609174746846070367113593675211691311013364421437923470787371738135276998
-      );
-    
-  }
-
-  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
-  function verifyProof(
-    uint[2] memory a,
-    uint[2][2] memory b,
-    uint[2] memory c,
-    uint[4] memory input
-  ) public view {
-    // If the values are not in the correct range, the Pairing contract will revert.
-    Proof memory proof;
-    proof.A = Pairing.G1Point(a[0], a[1]);
-    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
-    proof.C = Pairing.G1Point(c[0], c[1]);
-
-    VerifyingKey memory vk = verifyingKey();
-
-    // Compute the linear combination vk_x of inputs times IC
-    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
-    Pairing.G1Point memory vk_x = vk.IC[0];
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
-
-    // Check pairing
-    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
-    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
-    p1[0] = Pairing.negate(proof.A);
-    p2[0] = proof.B;
-    p1[1] = vk.alfa1;
-    p2[1] = vk.beta2;
-    p1[2] = vk_x;
-    p2[2] = vk.gamma2;
-    p1[3] = proof.C;
-    p2[3] = vk.delta2;
-    Pairing.pairingCheck(p1, p2);
-  }
-}

contracts/verifiers/Verifier21.sol

@@ -1,237 +0,0 @@
-//
-// Copyright 2017 Christian Reitwiessner
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// 2019 OKIMS
-//      ported to solidity 0.6
-//      fixed linter warnings
-//      added requiere error messages
-//
-// 2021 Remco Bloemen
-//       cleaned up code
-//       added InvalidProve() error
-//       always revert with InvalidProof() on invalid proof
-//       make Pairing strict
-//
-// SPDX-License-Identifier: GPL-3.0
-pragma solidity ^0.8.4;
-
-library Pairing {
-  error InvalidProof();
-
-  // The prime q in the base field F_q for G1
-  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-
-  // The prime moludus of the scalar field of G1.
-  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-
-  struct G1Point {
-    uint256 X;
-    uint256 Y;
-  }
-
-  // Encoding of field elements is: X[0] * z + X[1]
-  struct G2Point {
-    uint256[2] X;
-    uint256[2] Y;
-  }
-
-  /// @return the generator of G1
-  function P1() internal pure returns (G1Point memory) {
-    return G1Point(1, 2);
-  }
-
-  /// @return the generator of G2
-  function P2() internal pure returns (G2Point memory) {
-    return
-      G2Point(
-        [
-          11559732032986387107991004021392285783925812861821192530917403151452391805634,
-          10857046999023057135944570762232829481370756359578518086990519993285655852781
-        ],
-        [
-          4082367875863433681332203403145435568316851327593401208105741076214120093531,
-          8495653923123431417604973247489272438418190587263600148770280649306958101930
-        ]
-      );
-  }
-
-  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
-  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
-    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
-    // Validate input or revert
-    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
-    // We know p.Y > 0 and p.Y < BASE_MODULUS.
-    return G1Point(p.X, BASE_MODULUS - p.Y);
-  }
-
-  /// @return r the sum of two points of G1
-  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
-    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
-    // on the curve.
-    uint256[4] memory input;
-    input[0] = p1.X;
-    input[1] = p1.Y;
-    input[2] = p2.X;
-    input[3] = p2.Y;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// @return r the product of a point on G1 and a scalar, i.e.
-  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
-  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
-    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
-    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
-    if (s >= SCALAR_MODULUS) revert InvalidProof();
-    uint256[3] memory input;
-    input[0] = p.X;
-    input[1] = p.Y;
-    input[2] = s;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// Asserts the pairing check
-  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
-  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
-  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
-    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
-    // respective groups of the right order.
-    if (p1.length != p2.length) revert InvalidProof();
-    uint256 elements = p1.length;
-    uint256 inputSize = elements * 6;
-    uint256[] memory input = new uint256[](inputSize);
-    for (uint256 i = 0; i < elements; i++) {
-      input[i * 6 + 0] = p1[i].X;
-      input[i * 6 + 1] = p1[i].Y;
-      input[i * 6 + 2] = p2[i].X[0];
-      input[i * 6 + 3] = p2[i].X[1];
-      input[i * 6 + 4] = p2[i].Y[0];
-      input[i * 6 + 5] = p2[i].Y[1];
-    }
-    uint256[1] memory out;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
-    }
-    if (!success || out[0] != 1) revert InvalidProof();
-  }
-}
-
-contract Verifier21 {
-  using Pairing for *;
-
-  struct VerifyingKey {
-    Pairing.G1Point alfa1;
-    Pairing.G2Point beta2;
-    Pairing.G2Point gamma2;
-    Pairing.G2Point delta2;
-    Pairing.G1Point[] IC;
-  }
-
-  struct Proof {
-    Pairing.G1Point A;
-    Pairing.G2Point B;
-    Pairing.G1Point C;
-  }
-
-  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
-    vk.alfa1 = Pairing.G1Point(
-      20491192805390485299153009773594534940189261866228447918068658471970481763042,
-      9383485363053290200918347156157836566562967994039712273449902621266178545958
-    );
-
-    vk.beta2 = Pairing.G2Point(
-      [4252822878758300859123897981450591353533073413197771768651442665752259397132, 6375614351688725206403948262868962793625744043794305715222011528459656738731],
-      [21847035105528745403288232691147584728191162732299865338377159692350059136679, 10505242626370262277552901082094356697409835680220590971873171140371331206856]
-    );
-
-    vk.gamma2 = Pairing.G2Point(
-      [11559732032986387107991004021392285783925812861821192530917403151452391805634, 10857046999023057135944570762232829481370756359578518086990519993285655852781],
-      [4082367875863433681332203403145435568316851327593401208105741076214120093531, 8495653923123431417604973247489272438418190587263600148770280649306958101930]
-    );
-
-    vk.delta2 = Pairing.G2Point(
-      [3811592683283527904145155808200366192489850711742363953668998371801696238057, 9032545080831535702239063467087720597970266046938395860207839433937324718536],
-      [16308433125974933290258540904373317426123214107276055539769464205982500660715, 12429982191499850873612518410809641163252887523090441166572590809691267943605]
-    );
-
-    vk.IC = new Pairing.G1Point[](5);
-
-    
-      vk.IC[0] = Pairing.G1Point(
-        9494885690931955877467315318223108618392113101843890678090902614660136056680,
-        11783514256715757384821021009301806722951917744219075907912683963173706887379
-      );
-    
-      vk.IC[1] = Pairing.G1Point(
-        7562082660623781416745328104576133910743071878837764423695105915778139873834,
-        17954307004260053757579194018551114133664721761483240877658498973152950708099
-      );
-    
-      vk.IC[2] = Pairing.G1Point(
-        19338184851116432029108109461622579541195083625346674255186169347975445785058,
-        38361206266360048012365562393026952048730052530888439195454086987795985927
-      );
-    
-      vk.IC[3] = Pairing.G1Point(
-        21178537742782571863590222710872928190886000600239072595684369348717288330049,
-        9786438258541172244884631831247223050494423968411444302812755467521949734320
-      );
-    
-      vk.IC[4] = Pairing.G1Point(
-        11330504221972341797183339350494223413034293674225690456356444509688810101433,
-        1490009915387901405464437253469086864085891770312035292355706249426866485365
-      );
-    
-  }
-
-  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
-  function verifyProof(
-    uint[2] memory a,
-    uint[2][2] memory b,
-    uint[2] memory c,
-    uint[4] memory input
-  ) public view {
-    // If the values are not in the correct range, the Pairing contract will revert.
-    Proof memory proof;
-    proof.A = Pairing.G1Point(a[0], a[1]);
-    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
-    proof.C = Pairing.G1Point(c[0], c[1]);
-
-    VerifyingKey memory vk = verifyingKey();
-
-    // Compute the linear combination vk_x of inputs times IC
-    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
-    Pairing.G1Point memory vk_x = vk.IC[0];
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
-
-    // Check pairing
-    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
-    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
-    p1[0] = Pairing.negate(proof.A);
-    p2[0] = proof.B;
-    p1[1] = vk.alfa1;
-    p2[1] = vk.beta2;
-    p1[2] = vk_x;
-    p2[2] = vk.gamma2;
-    p1[3] = proof.C;
-    p2[3] = vk.delta2;
-    Pairing.pairingCheck(p1, p2);
-  }
-}

contracts/verifiers/Verifier22.sol

@@ -1,237 +0,0 @@
-//
-// Copyright 2017 Christian Reitwiessner
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// 2019 OKIMS
-//      ported to solidity 0.6
-//      fixed linter warnings
-//      added requiere error messages
-//
-// 2021 Remco Bloemen
-//       cleaned up code
-//       added InvalidProve() error
-//       always revert with InvalidProof() on invalid proof
-//       make Pairing strict
-//
-// SPDX-License-Identifier: GPL-3.0
-pragma solidity ^0.8.4;
-
-library Pairing {
-  error InvalidProof();
-
-  // The prime q in the base field F_q for G1
-  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-
-  // The prime moludus of the scalar field of G1.
-  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-
-  struct G1Point {
-    uint256 X;
-    uint256 Y;
-  }
-
-  // Encoding of field elements is: X[0] * z + X[1]
-  struct G2Point {
-    uint256[2] X;
-    uint256[2] Y;
-  }
-
-  /// @return the generator of G1
-  function P1() internal pure returns (G1Point memory) {
-    return G1Point(1, 2);
-  }
-
-  /// @return the generator of G2
-  function P2() internal pure returns (G2Point memory) {
-    return
-      G2Point(
-        [
-          11559732032986387107991004021392285783925812861821192530917403151452391805634,
-          10857046999023057135944570762232829481370756359578518086990519993285655852781
-        ],
-        [
-          4082367875863433681332203403145435568316851327593401208105741076214120093531,
-          8495653923123431417604973247489272438418190587263600148770280649306958101930
-        ]
-      );
-  }
-
-  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
-  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
-    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
-    // Validate input or revert
-    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
-    // We know p.Y > 0 and p.Y < BASE_MODULUS.
-    return G1Point(p.X, BASE_MODULUS - p.Y);
-  }
-
-  /// @return r the sum of two points of G1
-  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
-    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
-    // on the curve.
-    uint256[4] memory input;
-    input[0] = p1.X;
-    input[1] = p1.Y;
-    input[2] = p2.X;
-    input[3] = p2.Y;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// @return r the product of a point on G1 and a scalar, i.e.
-  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
-  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
-    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
-    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
-    if (s >= SCALAR_MODULUS) revert InvalidProof();
-    uint256[3] memory input;
-    input[0] = p.X;
-    input[1] = p.Y;
-    input[2] = s;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// Asserts the pairing check
-  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
-  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
-  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
-    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
-    // respective groups of the right order.
-    if (p1.length != p2.length) revert InvalidProof();
-    uint256 elements = p1.length;
-    uint256 inputSize = elements * 6;
-    uint256[] memory input = new uint256[](inputSize);
-    for (uint256 i = 0; i < elements; i++) {
-      input[i * 6 + 0] = p1[i].X;
-      input[i * 6 + 1] = p1[i].Y;
-      input[i * 6 + 2] = p2[i].X[0];
-      input[i * 6 + 3] = p2[i].X[1];
-      input[i * 6 + 4] = p2[i].Y[0];
-      input[i * 6 + 5] = p2[i].Y[1];
-    }
-    uint256[1] memory out;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
-    }
-    if (!success || out[0] != 1) revert InvalidProof();
-  }
-}
-
-contract Verifier22 {
-  using Pairing for *;
-
-  struct VerifyingKey {
-    Pairing.G1Point alfa1;
-    Pairing.G2Point beta2;
-    Pairing.G2Point gamma2;
-    Pairing.G2Point delta2;
-    Pairing.G1Point[] IC;
-  }
-
-  struct Proof {
-    Pairing.G1Point A;
-    Pairing.G2Point B;
-    Pairing.G1Point C;
-  }
-
-  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
-    vk.alfa1 = Pairing.G1Point(
-      20491192805390485299153009773594534940189261866228447918068658471970481763042,
-      9383485363053290200918347156157836566562967994039712273449902621266178545958
-    );
-
-    vk.beta2 = Pairing.G2Point(
-      [4252822878758300859123897981450591353533073413197771768651442665752259397132, 6375614351688725206403948262868962793625744043794305715222011528459656738731],
-      [21847035105528745403288232691147584728191162732299865338377159692350059136679, 10505242626370262277552901082094356697409835680220590971873171140371331206856]
-    );
-
-    vk.gamma2 = Pairing.G2Point(
-      [11559732032986387107991004021392285783925812861821192530917403151452391805634, 10857046999023057135944570762232829481370756359578518086990519993285655852781],
-      [4082367875863433681332203403145435568316851327593401208105741076214120093531, 8495653923123431417604973247489272438418190587263600148770280649306958101930]
-    );
-
-    vk.delta2 = Pairing.G2Point(
-      [9485639152672984144988597737758037391807993615552051606205480347442429414340, 17626503110323089701269363177710295379967225765713250625279671011873619640598],
-      [12391874700409435648975069978280047983726144854114915177376036190441913967689, 18953587685067712486092665232725058638563458484886448540567142557894080640927]
-    );
-
-    vk.IC = new Pairing.G1Point[](5);
-
-    
-      vk.IC[0] = Pairing.G1Point(
-        21791720972262589799021600767292883644106575897307484548888696814333235336885,
-        11092962469758788187888592619035811117815082357439060720677582048880121542623
-      );
-    
-      vk.IC[1] = Pairing.G1Point(
-        9418924955930663972575130074928583215922927562059194231976193350658171304436,
-        16113558481826020406162261319744796072664750077095575593106901121115073101408
-      );
-    
-      vk.IC[2] = Pairing.G1Point(
-        20054934960262983176880675919444457578562219675808407582143519621873973120773,
-        14877415271301547911435683263206245199959943680225555496786470669330176961657
-      );
-    
-      vk.IC[3] = Pairing.G1Point(
-        4215199263810110748751715719957184804379752373072771007598572158043965517488,
-        5225943468606602818132879686778547605180105897615251160509064537462109826521
-      );
-    
-      vk.IC[4] = Pairing.G1Point(
-        6250242626034734280813142093008675407723196706248829741247204621913994561803,
-        1472231555266678689888727724824566171966416459791722465278225775922487343641
-      );
-    
-  }
-
-  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
-  function verifyProof(
-    uint[2] memory a,
-    uint[2][2] memory b,
-    uint[2] memory c,
-    uint[4] memory input
-  ) public view {
-    // If the values are not in the correct range, the Pairing contract will revert.
-    Proof memory proof;
-    proof.A = Pairing.G1Point(a[0], a[1]);
-    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
-    proof.C = Pairing.G1Point(c[0], c[1]);
-
-    VerifyingKey memory vk = verifyingKey();
-
-    // Compute the linear combination vk_x of inputs times IC
-    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
-    Pairing.G1Point memory vk_x = vk.IC[0];
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
-
-    // Check pairing
-    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
-    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
-    p1[0] = Pairing.negate(proof.A);
-    p2[0] = proof.B;
-    p1[1] = vk.alfa1;
-    p2[1] = vk.beta2;
-    p1[2] = vk_x;
-    p2[2] = vk.gamma2;
-    p1[3] = proof.C;
-    p2[3] = vk.delta2;
-    Pairing.pairingCheck(p1, p2);
-  }
-}

contracts/verifiers/Verifier23.sol

@@ -1,237 +0,0 @@
-//
-// Copyright 2017 Christian Reitwiessner
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// 2019 OKIMS
-//      ported to solidity 0.6
-//      fixed linter warnings
-//      added requiere error messages
-//
-// 2021 Remco Bloemen
-//       cleaned up code
-//       added InvalidProve() error
-//       always revert with InvalidProof() on invalid proof
-//       make Pairing strict
-//
-// SPDX-License-Identifier: GPL-3.0
-pragma solidity ^0.8.4;
-
-library Pairing {
-  error InvalidProof();
-
-  // The prime q in the base field F_q for G1
-  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-
-  // The prime moludus of the scalar field of G1.
-  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-
-  struct G1Point {
-    uint256 X;
-    uint256 Y;
-  }
-
-  // Encoding of field elements is: X[0] * z + X[1]
-  struct G2Point {
-    uint256[2] X;
-    uint256[2] Y;
-  }
-
-  /// @return the generator of G1
-  function P1() internal pure returns (G1Point memory) {
-    return G1Point(1, 2);
-  }
-
-  /// @return the generator of G2
-  function P2() internal pure returns (G2Point memory) {
-    return
-      G2Point(
-        [
-          11559732032986387107991004021392285783925812861821192530917403151452391805634,
-          10857046999023057135944570762232829481370756359578518086990519993285655852781
-        ],
-        [
-          4082367875863433681332203403145435568316851327593401208105741076214120093531,
-          8495653923123431417604973247489272438418190587263600148770280649306958101930
-        ]
-      );
-  }
-
-  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
-  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
-    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
-    // Validate input or revert
-    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
-    // We know p.Y > 0 and p.Y < BASE_MODULUS.
-    return G1Point(p.X, BASE_MODULUS - p.Y);
-  }
-
-  /// @return r the sum of two points of G1
-  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
-    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
-    // on the curve.
-    uint256[4] memory input;
-    input[0] = p1.X;
-    input[1] = p1.Y;
-    input[2] = p2.X;
-    input[3] = p2.Y;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// @return r the product of a point on G1 and a scalar, i.e.
-  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
-  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
-    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
-    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
-    if (s >= SCALAR_MODULUS) revert InvalidProof();
-    uint256[3] memory input;
-    input[0] = p.X;
-    input[1] = p.Y;
-    input[2] = s;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// Asserts the pairing check
-  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
-  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
-  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
-    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
-    // respective groups of the right order.
-    if (p1.length != p2.length) revert InvalidProof();
-    uint256 elements = p1.length;
-    uint256 inputSize = elements * 6;
-    uint256[] memory input = new uint256[](inputSize);
-    for (uint256 i = 0; i < elements; i++) {
-      input[i * 6 + 0] = p1[i].X;
-      input[i * 6 + 1] = p1[i].Y;
-      input[i * 6 + 2] = p2[i].X[0];
-      input[i * 6 + 3] = p2[i].X[1];
-      input[i * 6 + 4] = p2[i].Y[0];
-      input[i * 6 + 5] = p2[i].Y[1];
-    }
-    uint256[1] memory out;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
-    }
-    if (!success || out[0] != 1) revert InvalidProof();
-  }
-}
-
-contract Verifier23 {
-  using Pairing for *;
-
-  struct VerifyingKey {
-    Pairing.G1Point alfa1;
-    Pairing.G2Point beta2;
-    Pairing.G2Point gamma2;
-    Pairing.G2Point delta2;
-    Pairing.G1Point[] IC;
-  }
-
-  struct Proof {
-    Pairing.G1Point A;
-    Pairing.G2Point B;
-    Pairing.G1Point C;
-  }
-
-  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
-    vk.alfa1 = Pairing.G1Point(
-      20491192805390485299153009773594534940189261866228447918068658471970481763042,
-      9383485363053290200918347156157836566562967994039712273449902621266178545958
-    );
-
-    vk.beta2 = Pairing.G2Point(
-      [4252822878758300859123897981450591353533073413197771768651442665752259397132, 6375614351688725206403948262868962793625744043794305715222011528459656738731],
-      [21847035105528745403288232691147584728191162732299865338377159692350059136679, 10505242626370262277552901082094356697409835680220590971873171140371331206856]
-    );
-
-    vk.gamma2 = Pairing.G2Point(
-      [11559732032986387107991004021392285783925812861821192530917403151452391805634, 10857046999023057135944570762232829481370756359578518086990519993285655852781],
-      [4082367875863433681332203403145435568316851327593401208105741076214120093531, 8495653923123431417604973247489272438418190587263600148770280649306958101930]
-    );
-
-    vk.delta2 = Pairing.G2Point(
-      [9830856103389248449121962275587399130605902703453384856543071762984116567573, 11408965575174993375815840422438995549652812400401163392501956884932167624437],
-      [11814906841949499037550820576929552248172160643991870665022770052632331265834, 19969543376625663966419118899515353499678204573709836615846115182224340858492]
-    );
-
-    vk.IC = new Pairing.G1Point[](5);
-
-    
-      vk.IC[0] = Pairing.G1Point(
-        3047486363455933831148688762823238723024952519326207356549121929667745957778,
-        20241836359289449005887237560564358543646542598344362915541027571505243817211
-      );
-    
-      vk.IC[1] = Pairing.G1Point(
-        5965631918800530319167124148627450454569264331058008407732200168631989208657,
-        20463557477532480934514091877628554948892025887087712764683631108388998871350
-      );
-    
-      vk.IC[2] = Pairing.G1Point(
-        16605042322692983282732511249912403956057999815658038166796858627082222971215,
-        12219061498275616585164456833410962809536084885494309093787669879221959361956
-      );
-    
-      vk.IC[3] = Pairing.G1Point(
-        1548998572074037722622224303222294716243074837074272552644853986075252666508,
-        10393312002885367652301897874262367916506364670364584602554176742602334134772
-      );
-    
-      vk.IC[4] = Pairing.G1Point(
-        16180907689593358346406392015123900260925622357393826746385511046141256905390,
-        12267326749885120640972074479210537480053065569337817484467225562817467244765
-      );
-    
-  }
-
-  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
-  function verifyProof(
-    uint[2] memory a,
-    uint[2][2] memory b,
-    uint[2] memory c,
-    uint[4] memory input
-  ) public view {
-    // If the values are not in the correct range, the Pairing contract will revert.
-    Proof memory proof;
-    proof.A = Pairing.G1Point(a[0], a[1]);
-    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
-    proof.C = Pairing.G1Point(c[0], c[1]);
-
-    VerifyingKey memory vk = verifyingKey();
-
-    // Compute the linear combination vk_x of inputs times IC
-    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
-    Pairing.G1Point memory vk_x = vk.IC[0];
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
-
-    // Check pairing
-    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
-    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
-    p1[0] = Pairing.negate(proof.A);
-    p2[0] = proof.B;
-    p1[1] = vk.alfa1;
-    p2[1] = vk.beta2;
-    p1[2] = vk_x;
-    p2[2] = vk.gamma2;
-    p1[3] = proof.C;
-    p2[3] = vk.delta2;
-    Pairing.pairingCheck(p1, p2);
-  }
-}

contracts/verifiers/Verifier24.sol

@@ -1,237 +0,0 @@
-//
-// Copyright 2017 Christian Reitwiessner
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// 2019 OKIMS
-//      ported to solidity 0.6
-//      fixed linter warnings
-//      added requiere error messages
-//
-// 2021 Remco Bloemen
-//       cleaned up code
-//       added InvalidProve() error
-//       always revert with InvalidProof() on invalid proof
-//       make Pairing strict
-//
-// SPDX-License-Identifier: GPL-3.0
-pragma solidity ^0.8.4;
-
-library Pairing {
-  error InvalidProof();
-
-  // The prime q in the base field F_q for G1
-  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-
-  // The prime moludus of the scalar field of G1.
-  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-
-  struct G1Point {
-    uint256 X;
-    uint256 Y;
-  }
-
-  // Encoding of field elements is: X[0] * z + X[1]
-  struct G2Point {
-    uint256[2] X;
-    uint256[2] Y;
-  }
-
-  /// @return the generator of G1
-  function P1() internal pure returns (G1Point memory) {
-    return G1Point(1, 2);
-  }
-
-  /// @return the generator of G2
-  function P2() internal pure returns (G2Point memory) {
-    return
-      G2Point(
-        [
-          11559732032986387107991004021392285783925812861821192530917403151452391805634,
-          10857046999023057135944570762232829481370756359578518086990519993285655852781
-        ],
-        [
-          4082367875863433681332203403145435568316851327593401208105741076214120093531,
-          8495653923123431417604973247489272438418190587263600148770280649306958101930
-        ]
-      );
-  }
-
-  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
-  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
-    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
-    // Validate input or revert
-    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
-    // We know p.Y > 0 and p.Y < BASE_MODULUS.
-    return G1Point(p.X, BASE_MODULUS - p.Y);
-  }
-
-  /// @return r the sum of two points of G1
-  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
-    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
-    // on the curve.
-    uint256[4] memory input;
-    input[0] = p1.X;
-    input[1] = p1.Y;
-    input[2] = p2.X;
-    input[3] = p2.Y;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// @return r the product of a point on G1 and a scalar, i.e.
-  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
-  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
-    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
-    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
-    if (s >= SCALAR_MODULUS) revert InvalidProof();
-    uint256[3] memory input;
-    input[0] = p.X;
-    input[1] = p.Y;
-    input[2] = s;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// Asserts the pairing check
-  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
-  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
-  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
-    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
-    // respective groups of the right order.
-    if (p1.length != p2.length) revert InvalidProof();
-    uint256 elements = p1.length;
-    uint256 inputSize = elements * 6;
-    uint256[] memory input = new uint256[](inputSize);
-    for (uint256 i = 0; i < elements; i++) {
-      input[i * 6 + 0] = p1[i].X;
-      input[i * 6 + 1] = p1[i].Y;
-      input[i * 6 + 2] = p2[i].X[0];
-      input[i * 6 + 3] = p2[i].X[1];
-      input[i * 6 + 4] = p2[i].Y[0];
-      input[i * 6 + 5] = p2[i].Y[1];
-    }
-    uint256[1] memory out;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
-    }
-    if (!success || out[0] != 1) revert InvalidProof();
-  }
-}
-
-contract Verifier24 {
-  using Pairing for *;
-
-  struct VerifyingKey {
-    Pairing.G1Point alfa1;
-    Pairing.G2Point beta2;
-    Pairing.G2Point gamma2;
-    Pairing.G2Point delta2;
-    Pairing.G1Point[] IC;
-  }
-
-  struct Proof {
-    Pairing.G1Point A;
-    Pairing.G2Point B;
-    Pairing.G1Point C;
-  }
-
-  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
-    vk.alfa1 = Pairing.G1Point(
-      20491192805390485299153009773594534940189261866228447918068658471970481763042,
-      9383485363053290200918347156157836566562967994039712273449902621266178545958
-    );
-
-    vk.beta2 = Pairing.G2Point(
-      [4252822878758300859123897981450591353533073413197771768651442665752259397132, 6375614351688725206403948262868962793625744043794305715222011528459656738731],
-      [21847035105528745403288232691147584728191162732299865338377159692350059136679, 10505242626370262277552901082094356697409835680220590971873171140371331206856]
-    );
-
-    vk.gamma2 = Pairing.G2Point(
-      [11559732032986387107991004021392285783925812861821192530917403151452391805634, 10857046999023057135944570762232829481370756359578518086990519993285655852781],
-      [4082367875863433681332203403145435568316851327593401208105741076214120093531, 8495653923123431417604973247489272438418190587263600148770280649306958101930]
-    );
-
-    vk.delta2 = Pairing.G2Point(
-      [15035335306919942325459417688135340085377315274625768597233474641923619728582, 10090041889587324002759549286390619541526396451963494627957072069124011137562],
-      [21342049717074059749518233491526445388158772701642182532370641230478027030319, 10507786999799841055999967456762679569286329319056926475375760604262707147294]
-    );
-
-    vk.IC = new Pairing.G1Point[](5);
-
-    
-      vk.IC[0] = Pairing.G1Point(
-        19590996174696909242575628014943555633938195923520472786993379268302478708283,
-        2673753072556442230312995111304911178679525806396134504594492458566941824354
-      );
-    
-      vk.IC[1] = Pairing.G1Point(
-        13411253172375451489380472831999887223592471057462692619008484995624281735092,
-        17181767455563581254432161119660408482332423481128600038352147258951772423229
-      );
-    
-      vk.IC[2] = Pairing.G1Point(
-        19138864631164378176055647711995352935065134904103255748190268290992108588628,
-        14282526277736365863821375748687709839392307698935143595732632710176778519757
-      );
-    
-      vk.IC[3] = Pairing.G1Point(
-        20183773658676161990469276414858234178608794783112866811307579993999118293429,
-        5223464433544489066271184294750886227362580875255044558831927430970236355539
-      );
-    
-      vk.IC[4] = Pairing.G1Point(
-        12333466991139269670298178539679773509487545471126920233507132846828588847444,
-        3787586478923104354547687861486563468235879611952775292288436085429794222238
-      );
-    
-  }
-
-  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
-  function verifyProof(
-    uint[2] memory a,
-    uint[2][2] memory b,
-    uint[2] memory c,
-    uint[4] memory input
-  ) public view {
-    // If the values are not in the correct range, the Pairing contract will revert.
-    Proof memory proof;
-    proof.A = Pairing.G1Point(a[0], a[1]);
-    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
-    proof.C = Pairing.G1Point(c[0], c[1]);
-
-    VerifyingKey memory vk = verifyingKey();
-
-    // Compute the linear combination vk_x of inputs times IC
-    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
-    Pairing.G1Point memory vk_x = vk.IC[0];
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
-
-    // Check pairing
-    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
-    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
-    p1[0] = Pairing.negate(proof.A);
-    p2[0] = proof.B;
-    p1[1] = vk.alfa1;
-    p2[1] = vk.beta2;
-    p1[2] = vk_x;
-    p2[2] = vk.gamma2;
-    p1[3] = proof.C;
-    p2[3] = vk.delta2;
-    Pairing.pairingCheck(p1, p2);
-  }
-}

contracts/verifiers/Verifier25.sol

@@ -1,237 +0,0 @@
-//
-// Copyright 2017 Christian Reitwiessner
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// 2019 OKIMS
-//      ported to solidity 0.6
-//      fixed linter warnings
-//      added requiere error messages
-//
-// 2021 Remco Bloemen
-//       cleaned up code
-//       added InvalidProve() error
-//       always revert with InvalidProof() on invalid proof
-//       make Pairing strict
-//
-// SPDX-License-Identifier: GPL-3.0
-pragma solidity ^0.8.4;
-
-library Pairing {
-  error InvalidProof();
-
-  // The prime q in the base field F_q for G1
-  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-
-  // The prime moludus of the scalar field of G1.
-  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-
-  struct G1Point {
-    uint256 X;
-    uint256 Y;
-  }
-
-  // Encoding of field elements is: X[0] * z + X[1]
-  struct G2Point {
-    uint256[2] X;
-    uint256[2] Y;
-  }
-
-  /// @return the generator of G1
-  function P1() internal pure returns (G1Point memory) {
-    return G1Point(1, 2);
-  }
-
-  /// @return the generator of G2
-  function P2() internal pure returns (G2Point memory) {
-    return
-      G2Point(
-        [
-          11559732032986387107991004021392285783925812861821192530917403151452391805634,
-          10857046999023057135944570762232829481370756359578518086990519993285655852781
-        ],
-        [
-          4082367875863433681332203403145435568316851327593401208105741076214120093531,
-          8495653923123431417604973247489272438418190587263600148770280649306958101930
-        ]
-      );
-  }
-
-  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
-  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
-    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
-    // Validate input or revert
-    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
-    // We know p.Y > 0 and p.Y < BASE_MODULUS.
-    return G1Point(p.X, BASE_MODULUS - p.Y);
-  }
-
-  /// @return r the sum of two points of G1
-  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
-    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
-    // on the curve.
-    uint256[4] memory input;
-    input[0] = p1.X;
-    input[1] = p1.Y;
-    input[2] = p2.X;
-    input[3] = p2.Y;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// @return r the product of a point on G1 and a scalar, i.e.
-  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
-  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
-    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
-    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
-    if (s >= SCALAR_MODULUS) revert InvalidProof();
-    uint256[3] memory input;
-    input[0] = p.X;
-    input[1] = p.Y;
-    input[2] = s;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// Asserts the pairing check
-  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
-  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
-  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
-    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
-    // respective groups of the right order.
-    if (p1.length != p2.length) revert InvalidProof();
-    uint256 elements = p1.length;
-    uint256 inputSize = elements * 6;
-    uint256[] memory input = new uint256[](inputSize);
-    for (uint256 i = 0; i < elements; i++) {
-      input[i * 6 + 0] = p1[i].X;
-      input[i * 6 + 1] = p1[i].Y;
-      input[i * 6 + 2] = p2[i].X[0];
-      input[i * 6 + 3] = p2[i].X[1];
-      input[i * 6 + 4] = p2[i].Y[0];
-      input[i * 6 + 5] = p2[i].Y[1];
-    }
-    uint256[1] memory out;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
-    }
-    if (!success || out[0] != 1) revert InvalidProof();
-  }
-}
-
-contract Verifier25 {
-  using Pairing for *;
-
-  struct VerifyingKey {
-    Pairing.G1Point alfa1;
-    Pairing.G2Point beta2;
-    Pairing.G2Point gamma2;
-    Pairing.G2Point delta2;
-    Pairing.G1Point[] IC;
-  }
-
-  struct Proof {
-    Pairing.G1Point A;
-    Pairing.G2Point B;
-    Pairing.G1Point C;
-  }
-
-  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
-    vk.alfa1 = Pairing.G1Point(
-      20491192805390485299153009773594534940189261866228447918068658471970481763042,
-      9383485363053290200918347156157836566562967994039712273449902621266178545958
-    );
-
-    vk.beta2 = Pairing.G2Point(
-      [4252822878758300859123897981450591353533073413197771768651442665752259397132, 6375614351688725206403948262868962793625744043794305715222011528459656738731],
-      [21847035105528745403288232691147584728191162732299865338377159692350059136679, 10505242626370262277552901082094356697409835680220590971873171140371331206856]
-    );
-
-    vk.gamma2 = Pairing.G2Point(
-      [11559732032986387107991004021392285783925812861821192530917403151452391805634, 10857046999023057135944570762232829481370756359578518086990519993285655852781],
-      [4082367875863433681332203403145435568316851327593401208105741076214120093531, 8495653923123431417604973247489272438418190587263600148770280649306958101930]
-    );
-
-    vk.delta2 = Pairing.G2Point(
-      [15718373132479769904443326381037437528372212185108294117696143473979328398658, 43456740675249348549891878341522275183186932745162972528932808393415299552],
-      [11236864934894600819960883124570686936554376109344998527334431594565774237827, 4289247401578837038775845192875793775418122783738936298355403103074020081838]
-    );
-
-    vk.IC = new Pairing.G1Point[](5);
-
-    
-      vk.IC[0] = Pairing.G1Point(
-        18580370382199518848261939652153768394883698461842792002922164533882262019935,
-        20516185953882700254387267244708111605796661864845495645678049276372075842359
-      );
-    
-      vk.IC[1] = Pairing.G1Point(
-        20041291712709610738573661974551517833120775539593003477018637287434210072702,
-        6326630253906616820412999166182553773360987412889775567442543181359104720511
-      );
-    
-      vk.IC[2] = Pairing.G1Point(
-        13268971611130152315428629919012388924225656285593904211561391821918930327614,
-        9247437189452353488017802041158840512956111558640958728149597697508914590433
-      );
-    
-      vk.IC[3] = Pairing.G1Point(
-        6267384495557139339708615182113725421733376438932580472141549274050146739549,
-        1832264154031452148715318442722960696977572389206897240030908464579133134237
-      );
-    
-      vk.IC[4] = Pairing.G1Point(
-        16650684165487873559901140599157559153018449083939294496255590830891994564285,
-        14140282729498011406186082176268025578697081678243955538935501306868500498994
-      );
-    
-  }
-
-  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
-  function verifyProof(
-    uint[2] memory a,
-    uint[2][2] memory b,
-    uint[2] memory c,
-    uint[4] memory input
-  ) public view {
-    // If the values are not in the correct range, the Pairing contract will revert.
-    Proof memory proof;
-    proof.A = Pairing.G1Point(a[0], a[1]);
-    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
-    proof.C = Pairing.G1Point(c[0], c[1]);
-
-    VerifyingKey memory vk = verifyingKey();
-
-    // Compute the linear combination vk_x of inputs times IC
-    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
-    Pairing.G1Point memory vk_x = vk.IC[0];
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
-
-    // Check pairing
-    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
-    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
-    p1[0] = Pairing.negate(proof.A);
-    p2[0] = proof.B;
-    p1[1] = vk.alfa1;
-    p2[1] = vk.beta2;
-    p1[2] = vk_x;
-    p2[2] = vk.gamma2;
-    p1[3] = proof.C;
-    p2[3] = vk.delta2;
-    Pairing.pairingCheck(p1, p2);
-  }
-}

contracts/verifiers/Verifier26.sol

@@ -1,237 +0,0 @@
-//
-// Copyright 2017 Christian Reitwiessner
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// 2019 OKIMS
-//      ported to solidity 0.6
-//      fixed linter warnings
-//      added requiere error messages
-//
-// 2021 Remco Bloemen
-//       cleaned up code
-//       added InvalidProve() error
-//       always revert with InvalidProof() on invalid proof
-//       make Pairing strict
-//
-// SPDX-License-Identifier: GPL-3.0
-pragma solidity ^0.8.4;
-
-library Pairing {
-  error InvalidProof();
-
-  // The prime q in the base field F_q for G1
-  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-
-  // The prime moludus of the scalar field of G1.
-  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-
-  struct G1Point {
-    uint256 X;
-    uint256 Y;
-  }
-
-  // Encoding of field elements is: X[0] * z + X[1]
-  struct G2Point {
-    uint256[2] X;
-    uint256[2] Y;
-  }
-
-  /// @return the generator of G1
-  function P1() internal pure returns (G1Point memory) {
-    return G1Point(1, 2);
-  }
-
-  /// @return the generator of G2
-  function P2() internal pure returns (G2Point memory) {
-    return
-      G2Point(
-        [
-          11559732032986387107991004021392285783925812861821192530917403151452391805634,
-          10857046999023057135944570762232829481370756359578518086990519993285655852781
-        ],
-        [
-          4082367875863433681332203403145435568316851327593401208105741076214120093531,
-          8495653923123431417604973247489272438418190587263600148770280649306958101930
-        ]
-      );
-  }
-
-  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
-  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
-    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
-    // Validate input or revert
-    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
-    // We know p.Y > 0 and p.Y < BASE_MODULUS.
-    return G1Point(p.X, BASE_MODULUS - p.Y);
-  }
-
-  /// @return r the sum of two points of G1
-  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
-    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
-    // on the curve.
-    uint256[4] memory input;
-    input[0] = p1.X;
-    input[1] = p1.Y;
-    input[2] = p2.X;
-    input[3] = p2.Y;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// @return r the product of a point on G1 and a scalar, i.e.
-  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
-  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
-    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
-    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
-    if (s >= SCALAR_MODULUS) revert InvalidProof();
-    uint256[3] memory input;
-    input[0] = p.X;
-    input[1] = p.Y;
-    input[2] = s;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// Asserts the pairing check
-  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
-  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
-  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
-    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
-    // respective groups of the right order.
-    if (p1.length != p2.length) revert InvalidProof();
-    uint256 elements = p1.length;
-    uint256 inputSize = elements * 6;
-    uint256[] memory input = new uint256[](inputSize);
-    for (uint256 i = 0; i < elements; i++) {
-      input[i * 6 + 0] = p1[i].X;
-      input[i * 6 + 1] = p1[i].Y;
-      input[i * 6 + 2] = p2[i].X[0];
-      input[i * 6 + 3] = p2[i].X[1];
-      input[i * 6 + 4] = p2[i].Y[0];
-      input[i * 6 + 5] = p2[i].Y[1];
-    }
-    uint256[1] memory out;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
-    }
-    if (!success || out[0] != 1) revert InvalidProof();
-  }
-}
-
-contract Verifier26 {
-  using Pairing for *;
-
-  struct VerifyingKey {
-    Pairing.G1Point alfa1;
-    Pairing.G2Point beta2;
-    Pairing.G2Point gamma2;
-    Pairing.G2Point delta2;
-    Pairing.G1Point[] IC;
-  }
-
-  struct Proof {
-    Pairing.G1Point A;
-    Pairing.G2Point B;
-    Pairing.G1Point C;
-  }
-
-  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
-    vk.alfa1 = Pairing.G1Point(
-      20491192805390485299153009773594534940189261866228447918068658471970481763042,
-      9383485363053290200918347156157836566562967994039712273449902621266178545958
-    );
-
-    vk.beta2 = Pairing.G2Point(
-      [4252822878758300859123897981450591353533073413197771768651442665752259397132, 6375614351688725206403948262868962793625744043794305715222011528459656738731],
-      [21847035105528745403288232691147584728191162732299865338377159692350059136679, 10505242626370262277552901082094356697409835680220590971873171140371331206856]
-    );
-
-    vk.gamma2 = Pairing.G2Point(
-      [11559732032986387107991004021392285783925812861821192530917403151452391805634, 10857046999023057135944570762232829481370756359578518086990519993285655852781],
-      [4082367875863433681332203403145435568316851327593401208105741076214120093531, 8495653923123431417604973247489272438418190587263600148770280649306958101930]
-    );
-
-    vk.delta2 = Pairing.G2Point(
-      [1723458149089715907994189658689343304709709060535625667210252753337752162173, 4023016874169005249382064394379671330447496454371261692205411970999350949293],
-      [7651670126664625790835334090273463062538865895183205964669372719235003083565, 17710652158212212080502343565075513548898593397103675832636832371532093744857]
-    );
-
-    vk.IC = new Pairing.G1Point[](5);
-
-    
-      vk.IC[0] = Pairing.G1Point(
-        4247947150009812467217672970806328247513830308400387953244764907353849211641,
-        14500381439127180474801393438175928191199696177607750163263715436006533630877
-      );
-    
-      vk.IC[1] = Pairing.G1Point(
-        21213779524495874664157797605662894019112036728653622806607467354233012380232,
-        1429370857470083395421401524518861545167550347090873730934256398864585069083
-      );
-    
-      vk.IC[2] = Pairing.G1Point(
-        12465277751642747637430517396067173985821959773399832969105187923427872239200,
-        4377704428607835904642653580543541241155601291484645500691968624389522190030
-      );
-    
-      vk.IC[3] = Pairing.G1Point(
-        11283027832501128633761619552392013253304972822086786857121687098087331014745,
-        21463394238922953607096052056881931791797740737164052798044623278557203313720
-      );
-    
-      vk.IC[4] = Pairing.G1Point(
-        19687293493101130967741578773742597470558958652351513582962108464055656171331,
-        4445165696525061401582979300506082669540223774145877762689724631935313716632
-      );
-    
-  }
-
-  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
-  function verifyProof(
-    uint[2] memory a,
-    uint[2][2] memory b,
-    uint[2] memory c,
-    uint[4] memory input
-  ) public view {
-    // If the values are not in the correct range, the Pairing contract will revert.
-    Proof memory proof;
-    proof.A = Pairing.G1Point(a[0], a[1]);
-    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
-    proof.C = Pairing.G1Point(c[0], c[1]);
-
-    VerifyingKey memory vk = verifyingKey();
-
-    // Compute the linear combination vk_x of inputs times IC
-    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
-    Pairing.G1Point memory vk_x = vk.IC[0];
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
-
-    // Check pairing
-    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
-    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
-    p1[0] = Pairing.negate(proof.A);
-    p2[0] = proof.B;
-    p1[1] = vk.alfa1;
-    p2[1] = vk.beta2;
-    p1[2] = vk_x;
-    p2[2] = vk.gamma2;
-    p1[3] = proof.C;
-    p2[3] = vk.delta2;
-    Pairing.pairingCheck(p1, p2);
-  }
-}

contracts/verifiers/Verifier27.sol

@@ -1,237 +0,0 @@
-//
-// Copyright 2017 Christian Reitwiessner
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// 2019 OKIMS
-//      ported to solidity 0.6
-//      fixed linter warnings
-//      added requiere error messages
-//
-// 2021 Remco Bloemen
-//       cleaned up code
-//       added InvalidProve() error
-//       always revert with InvalidProof() on invalid proof
-//       make Pairing strict
-//
-// SPDX-License-Identifier: GPL-3.0
-pragma solidity ^0.8.4;
-
-library Pairing {
-  error InvalidProof();
-
-  // The prime q in the base field F_q for G1
-  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-
-  // The prime moludus of the scalar field of G1.
-  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-
-  struct G1Point {
-    uint256 X;
-    uint256 Y;
-  }
-
-  // Encoding of field elements is: X[0] * z + X[1]
-  struct G2Point {
-    uint256[2] X;
-    uint256[2] Y;
-  }
-
-  /// @return the generator of G1
-  function P1() internal pure returns (G1Point memory) {
-    return G1Point(1, 2);
-  }
-
-  /// @return the generator of G2
-  function P2() internal pure returns (G2Point memory) {
-    return
-      G2Point(
-        [
-          11559732032986387107991004021392285783925812861821192530917403151452391805634,
-          10857046999023057135944570762232829481370756359578518086990519993285655852781
-        ],
-        [
-          4082367875863433681332203403145435568316851327593401208105741076214120093531,
-          8495653923123431417604973247489272438418190587263600148770280649306958101930
-        ]
-      );
-  }
-
-  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
-  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
-    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
-    // Validate input or revert
-    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
-    // We know p.Y > 0 and p.Y < BASE_MODULUS.
-    return G1Point(p.X, BASE_MODULUS - p.Y);
-  }
-
-  /// @return r the sum of two points of G1
-  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
-    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
-    // on the curve.
-    uint256[4] memory input;
-    input[0] = p1.X;
-    input[1] = p1.Y;
-    input[2] = p2.X;
-    input[3] = p2.Y;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// @return r the product of a point on G1 and a scalar, i.e.
-  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
-  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
-    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
-    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
-    if (s >= SCALAR_MODULUS) revert InvalidProof();
-    uint256[3] memory input;
-    input[0] = p.X;
-    input[1] = p.Y;
-    input[2] = s;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// Asserts the pairing check
-  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
-  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
-  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
-    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
-    // respective groups of the right order.
-    if (p1.length != p2.length) revert InvalidProof();
-    uint256 elements = p1.length;
-    uint256 inputSize = elements * 6;
-    uint256[] memory input = new uint256[](inputSize);
-    for (uint256 i = 0; i < elements; i++) {
-      input[i * 6 + 0] = p1[i].X;
-      input[i * 6 + 1] = p1[i].Y;
-      input[i * 6 + 2] = p2[i].X[0];
-      input[i * 6 + 3] = p2[i].X[1];
-      input[i * 6 + 4] = p2[i].Y[0];
-      input[i * 6 + 5] = p2[i].Y[1];
-    }
-    uint256[1] memory out;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
-    }
-    if (!success || out[0] != 1) revert InvalidProof();
-  }
-}
-
-contract Verifier27 {
-  using Pairing for *;
-
-  struct VerifyingKey {
-    Pairing.G1Point alfa1;
-    Pairing.G2Point beta2;
-    Pairing.G2Point gamma2;
-    Pairing.G2Point delta2;
-    Pairing.G1Point[] IC;
-  }
-
-  struct Proof {
-    Pairing.G1Point A;
-    Pairing.G2Point B;
-    Pairing.G1Point C;
-  }
-
-  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
-    vk.alfa1 = Pairing.G1Point(
-      20491192805390485299153009773594534940189261866228447918068658471970481763042,
-      9383485363053290200918347156157836566562967994039712273449902621266178545958
-    );
-
-    vk.beta2 = Pairing.G2Point(
-      [4252822878758300859123897981450591353533073413197771768651442665752259397132, 6375614351688725206403948262868962793625744043794305715222011528459656738731],
-      [21847035105528745403288232691147584728191162732299865338377159692350059136679, 10505242626370262277552901082094356697409835680220590971873171140371331206856]
-    );
-
-    vk.gamma2 = Pairing.G2Point(
-      [11559732032986387107991004021392285783925812861821192530917403151452391805634, 10857046999023057135944570762232829481370756359578518086990519993285655852781],
-      [4082367875863433681332203403145435568316851327593401208105741076214120093531, 8495653923123431417604973247489272438418190587263600148770280649306958101930]
-    );
-
-    vk.delta2 = Pairing.G2Point(
-      [745924679191739894055143748466112994378439645681039136007774787076115375124, 13132169670125192016391258838554965176628317453468870968867717287446623320643],
-      [2126777833939378028304266129616145667925849332481755567268747182629795296580, 20909608709868730010029182074820840312550443752829480953667886902663547957991]
-    );
-
-    vk.IC = new Pairing.G1Point[](5);
-
-    
-      vk.IC[0] = Pairing.G1Point(
-        3388767735894417381503201756905214431625081913405504580464345986403824999889,
-        21014112837214011009096825602791072748195337199912773858499588477762724153070
-      );
-    
-      vk.IC[1] = Pairing.G1Point(
-        10521317016331497094903116740581271122844131442882845700567581775404872949272,
-        13201921794561774338466680421903602920184688290946713194187958007088351657367
-      );
-    
-      vk.IC[2] = Pairing.G1Point(
-        16170260722059932609965743383032703380650557609693540121262881902248073364496,
-        6004983491336500911294872035126141746032033211872472427212274143945425740617
-      );
-    
-      vk.IC[3] = Pairing.G1Point(
-        10275615677574391293596971122111363003313434841806630200532546038183081960924,
-        5955568702561336410725734958627459212680756023420452791680213386065159525989
-      );
-    
-      vk.IC[4] = Pairing.G1Point(
-        19059081014385850734732058652137664919364805650872154944590269874395511868415,
-        19202365837673729366500417038229950532560250566916189579621883380623278182155
-      );
-    
-  }
-
-  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
-  function verifyProof(
-    uint[2] memory a,
-    uint[2][2] memory b,
-    uint[2] memory c,
-    uint[4] memory input
-  ) public view {
-    // If the values are not in the correct range, the Pairing contract will revert.
-    Proof memory proof;
-    proof.A = Pairing.G1Point(a[0], a[1]);
-    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
-    proof.C = Pairing.G1Point(c[0], c[1]);
-
-    VerifyingKey memory vk = verifyingKey();
-
-    // Compute the linear combination vk_x of inputs times IC
-    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
-    Pairing.G1Point memory vk_x = vk.IC[0];
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
-
-    // Check pairing
-    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
-    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
-    p1[0] = Pairing.negate(proof.A);
-    p2[0] = proof.B;
-    p1[1] = vk.alfa1;
-    p2[1] = vk.beta2;
-    p1[2] = vk_x;
-    p2[2] = vk.gamma2;
-    p1[3] = proof.C;
-    p2[3] = vk.delta2;
-    Pairing.pairingCheck(p1, p2);
-  }
-}

contracts/verifiers/Verifier28.sol

@@ -1,237 +0,0 @@
-//
-// Copyright 2017 Christian Reitwiessner
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// 2019 OKIMS
-//      ported to solidity 0.6
-//      fixed linter warnings
-//      added requiere error messages
-//
-// 2021 Remco Bloemen
-//       cleaned up code
-//       added InvalidProve() error
-//       always revert with InvalidProof() on invalid proof
-//       make Pairing strict
-//
-// SPDX-License-Identifier: GPL-3.0
-pragma solidity ^0.8.4;
-
-library Pairing {
-  error InvalidProof();
-
-  // The prime q in the base field F_q for G1
-  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-
-  // The prime moludus of the scalar field of G1.
-  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-
-  struct G1Point {
-    uint256 X;
-    uint256 Y;
-  }
-
-  // Encoding of field elements is: X[0] * z + X[1]
-  struct G2Point {
-    uint256[2] X;
-    uint256[2] Y;
-  }
-
-  /// @return the generator of G1
-  function P1() internal pure returns (G1Point memory) {
-    return G1Point(1, 2);
-  }
-
-  /// @return the generator of G2
-  function P2() internal pure returns (G2Point memory) {
-    return
-      G2Point(
-        [
-          11559732032986387107991004021392285783925812861821192530917403151452391805634,
-          10857046999023057135944570762232829481370756359578518086990519993285655852781
-        ],
-        [
-          4082367875863433681332203403145435568316851327593401208105741076214120093531,
-          8495653923123431417604973247489272438418190587263600148770280649306958101930
-        ]
-      );
-  }
-
-  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
-  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
-    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
-    // Validate input or revert
-    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
-    // We know p.Y > 0 and p.Y < BASE_MODULUS.
-    return G1Point(p.X, BASE_MODULUS - p.Y);
-  }
-
-  /// @return r the sum of two points of G1
-  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
-    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
-    // on the curve.
-    uint256[4] memory input;
-    input[0] = p1.X;
-    input[1] = p1.Y;
-    input[2] = p2.X;
-    input[3] = p2.Y;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// @return r the product of a point on G1 and a scalar, i.e.
-  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
-  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
-    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
-    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
-    if (s >= SCALAR_MODULUS) revert InvalidProof();
-    uint256[3] memory input;
-    input[0] = p.X;
-    input[1] = p.Y;
-    input[2] = s;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// Asserts the pairing check
-  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
-  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
-  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
-    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
-    // respective groups of the right order.
-    if (p1.length != p2.length) revert InvalidProof();
-    uint256 elements = p1.length;
-    uint256 inputSize = elements * 6;
-    uint256[] memory input = new uint256[](inputSize);
-    for (uint256 i = 0; i < elements; i++) {
-      input[i * 6 + 0] = p1[i].X;
-      input[i * 6 + 1] = p1[i].Y;
-      input[i * 6 + 2] = p2[i].X[0];
-      input[i * 6 + 3] = p2[i].X[1];
-      input[i * 6 + 4] = p2[i].Y[0];
-      input[i * 6 + 5] = p2[i].Y[1];
-    }
-    uint256[1] memory out;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
-    }
-    if (!success || out[0] != 1) revert InvalidProof();
-  }
-}
-
-contract Verifier28 {
-  using Pairing for *;
-
-  struct VerifyingKey {
-    Pairing.G1Point alfa1;
-    Pairing.G2Point beta2;
-    Pairing.G2Point gamma2;
-    Pairing.G2Point delta2;
-    Pairing.G1Point[] IC;
-  }
-
-  struct Proof {
-    Pairing.G1Point A;
-    Pairing.G2Point B;
-    Pairing.G1Point C;
-  }
-
-  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
-    vk.alfa1 = Pairing.G1Point(
-      20491192805390485299153009773594534940189261866228447918068658471970481763042,
-      9383485363053290200918347156157836566562967994039712273449902621266178545958
-    );
-
-    vk.beta2 = Pairing.G2Point(
-      [4252822878758300859123897981450591353533073413197771768651442665752259397132, 6375614351688725206403948262868962793625744043794305715222011528459656738731],
-      [21847035105528745403288232691147584728191162732299865338377159692350059136679, 10505242626370262277552901082094356697409835680220590971873171140371331206856]
-    );
-
-    vk.gamma2 = Pairing.G2Point(
-      [11559732032986387107991004021392285783925812861821192530917403151452391805634, 10857046999023057135944570762232829481370756359578518086990519993285655852781],
-      [4082367875863433681332203403145435568316851327593401208105741076214120093531, 8495653923123431417604973247489272438418190587263600148770280649306958101930]
-    );
-
-    vk.delta2 = Pairing.G2Point(
-      [4553625243522856553165922942982108474187282402890756796515747778282922584601, 16835654219229187428071649241190746119082269636345872682107941472241044260584],
-      [3272293478534046729728233267765357195255129499603632413158978822084188871854, 873742823867191038535544062852920538566418819521732785500614249239215175476]
-    );
-
-    vk.IC = new Pairing.G1Point[](5);
-
-    
-      vk.IC[0] = Pairing.G1Point(
-        7856986171681248404396064225772749784181602218562773063185003409958949630985,
-        11707218736744382138692483591389641607570557654489363179025201039696228471230
-      );
-    
-      vk.IC[1] = Pairing.G1Point(
-        2902255937308264958973169948617099471543255757887963647238093192858290079050,
-        4092153880227661899721872164083575597602963673456107552146583620177664115673
-      );
-    
-      vk.IC[2] = Pairing.G1Point(
-        18380478859138320895837407377103009470968863533040661874531861881638854174636,
-        14502773952184441371657781525836310753176308880224816843041318743809785835984
-      );
-    
-      vk.IC[3] = Pairing.G1Point(
-        2781117248053224106149213822307598926495461873135153638774638501111353469325,
-        3500056595279027698683405880585654897391289317486204483344715855049598477604
-      );
-    
-      vk.IC[4] = Pairing.G1Point(
-        8880120765926282932795149634761705738498809569874317407549203808931092257005,
-        19080036326648068547894941015038877788526324720587349784852594495705578761000
-      );
-    
-  }
-
-  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
-  function verifyProof(
-    uint[2] memory a,
-    uint[2][2] memory b,
-    uint[2] memory c,
-    uint[4] memory input
-  ) public view {
-    // If the values are not in the correct range, the Pairing contract will revert.
-    Proof memory proof;
-    proof.A = Pairing.G1Point(a[0], a[1]);
-    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
-    proof.C = Pairing.G1Point(c[0], c[1]);
-
-    VerifyingKey memory vk = verifyingKey();
-
-    // Compute the linear combination vk_x of inputs times IC
-    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
-    Pairing.G1Point memory vk_x = vk.IC[0];
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
-
-    // Check pairing
-    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
-    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
-    p1[0] = Pairing.negate(proof.A);
-    p2[0] = proof.B;
-    p1[1] = vk.alfa1;
-    p2[1] = vk.beta2;
-    p1[2] = vk_x;
-    p2[2] = vk.gamma2;
-    p1[3] = proof.C;
-    p2[3] = vk.delta2;
-    Pairing.pairingCheck(p1, p2);
-  }
-}

contracts/verifiers/Verifier29.sol

@@ -1,237 +0,0 @@
-//
-// Copyright 2017 Christian Reitwiessner
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// 2019 OKIMS
-//      ported to solidity 0.6
-//      fixed linter warnings
-//      added requiere error messages
-//
-// 2021 Remco Bloemen
-//       cleaned up code
-//       added InvalidProve() error
-//       always revert with InvalidProof() on invalid proof
-//       make Pairing strict
-//
-// SPDX-License-Identifier: GPL-3.0
-pragma solidity ^0.8.4;
-
-library Pairing {
-  error InvalidProof();
-
-  // The prime q in the base field F_q for G1
-  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-
-  // The prime moludus of the scalar field of G1.
-  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-
-  struct G1Point {
-    uint256 X;
-    uint256 Y;
-  }
-
-  // Encoding of field elements is: X[0] * z + X[1]
-  struct G2Point {
-    uint256[2] X;
-    uint256[2] Y;
-  }
-
-  /// @return the generator of G1
-  function P1() internal pure returns (G1Point memory) {
-    return G1Point(1, 2);
-  }
-
-  /// @return the generator of G2
-  function P2() internal pure returns (G2Point memory) {
-    return
-      G2Point(
-        [
-          11559732032986387107991004021392285783925812861821192530917403151452391805634,
-          10857046999023057135944570762232829481370756359578518086990519993285655852781
-        ],
-        [
-          4082367875863433681332203403145435568316851327593401208105741076214120093531,
-          8495653923123431417604973247489272438418190587263600148770280649306958101930
-        ]
-      );
-  }
-
-  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
-  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
-    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
-    // Validate input or revert
-    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
-    // We know p.Y > 0 and p.Y < BASE_MODULUS.
-    return G1Point(p.X, BASE_MODULUS - p.Y);
-  }
-
-  /// @return r the sum of two points of G1
-  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
-    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
-    // on the curve.
-    uint256[4] memory input;
-    input[0] = p1.X;
-    input[1] = p1.Y;
-    input[2] = p2.X;
-    input[3] = p2.Y;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// @return r the product of a point on G1 and a scalar, i.e.
-  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
-  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
-    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
-    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
-    if (s >= SCALAR_MODULUS) revert InvalidProof();
-    uint256[3] memory input;
-    input[0] = p.X;
-    input[1] = p.Y;
-    input[2] = s;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// Asserts the pairing check
-  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
-  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
-  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
-    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
-    // respective groups of the right order.
-    if (p1.length != p2.length) revert InvalidProof();
-    uint256 elements = p1.length;
-    uint256 inputSize = elements * 6;
-    uint256[] memory input = new uint256[](inputSize);
-    for (uint256 i = 0; i < elements; i++) {
-      input[i * 6 + 0] = p1[i].X;
-      input[i * 6 + 1] = p1[i].Y;
-      input[i * 6 + 2] = p2[i].X[0];
-      input[i * 6 + 3] = p2[i].X[1];
-      input[i * 6 + 4] = p2[i].Y[0];
-      input[i * 6 + 5] = p2[i].Y[1];
-    }
-    uint256[1] memory out;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
-    }
-    if (!success || out[0] != 1) revert InvalidProof();
-  }
-}
-
-contract Verifier29 {
-  using Pairing for *;
-
-  struct VerifyingKey {
-    Pairing.G1Point alfa1;
-    Pairing.G2Point beta2;
-    Pairing.G2Point gamma2;
-    Pairing.G2Point delta2;
-    Pairing.G1Point[] IC;
-  }
-
-  struct Proof {
-    Pairing.G1Point A;
-    Pairing.G2Point B;
-    Pairing.G1Point C;
-  }
-
-  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
-    vk.alfa1 = Pairing.G1Point(
-      20491192805390485299153009773594534940189261866228447918068658471970481763042,
-      9383485363053290200918347156157836566562967994039712273449902621266178545958
-    );
-
-    vk.beta2 = Pairing.G2Point(
-      [4252822878758300859123897981450591353533073413197771768651442665752259397132, 6375614351688725206403948262868962793625744043794305715222011528459656738731],
-      [21847035105528745403288232691147584728191162732299865338377159692350059136679, 10505242626370262277552901082094356697409835680220590971873171140371331206856]
-    );
-
-    vk.gamma2 = Pairing.G2Point(
-      [11559732032986387107991004021392285783925812861821192530917403151452391805634, 10857046999023057135944570762232829481370756359578518086990519993285655852781],
-      [4082367875863433681332203403145435568316851327593401208105741076214120093531, 8495653923123431417604973247489272438418190587263600148770280649306958101930]
-    );
-
-    vk.delta2 = Pairing.G2Point(
-      [7252337675475138150830402909353772156046809729627064992143762325769537840623, 7601443214415704135008588588192028557655441716696726549510699770097979655628],
-      [436607343827794507835462908831699962173244647704538949914686722631806931932, 18500126298578278987997086114400065402270866280547473913420536595663876273004]
-    );
-
-    vk.IC = new Pairing.G1Point[](5);
-
-    
-      vk.IC[0] = Pairing.G1Point(
-        18427701611614193839908361166447988195308352665132182219164437649866377475111,
-        5299493942596042045861137432338955179078182570752746487573709678936617478454
-      );
-    
-      vk.IC[1] = Pairing.G1Point(
-        4188155714164125069834512529839479682516489319499446390214266838952761728656,
-        2720966082507704094346897998659841489771837229143573083003847010258396944787
-      );
-    
-      vk.IC[2] = Pairing.G1Point(
-        13256461570028177373135283778770729308216900804505379897951455548375840027026,
-        10722074030307391322177899534114921764931623271723882054692012663305322382747
-      );
-    
-      vk.IC[3] = Pairing.G1Point(
-        9824147497244652955949696442395586567974424828238608972020527958186701134273,
-        15755269950882650791869946186461432242513999576056199368058858215068920022191
-      );
-    
-      vk.IC[4] = Pairing.G1Point(
-        21172488506061181949536573476893375313339715931330476837156243346077173297265,
-        13892434487977776248366965108031841947713544939953824768291380177301871559945
-      );
-    
-  }
-
-  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
-  function verifyProof(
-    uint[2] memory a,
-    uint[2][2] memory b,
-    uint[2] memory c,
-    uint[4] memory input
-  ) public view {
-    // If the values are not in the correct range, the Pairing contract will revert.
-    Proof memory proof;
-    proof.A = Pairing.G1Point(a[0], a[1]);
-    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
-    proof.C = Pairing.G1Point(c[0], c[1]);
-
-    VerifyingKey memory vk = verifyingKey();
-
-    // Compute the linear combination vk_x of inputs times IC
-    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
-    Pairing.G1Point memory vk_x = vk.IC[0];
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
-
-    // Check pairing
-    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
-    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
-    p1[0] = Pairing.negate(proof.A);
-    p2[0] = proof.B;
-    p1[1] = vk.alfa1;
-    p2[1] = vk.beta2;
-    p1[2] = vk_x;
-    p2[2] = vk.gamma2;
-    p1[3] = proof.C;
-    p2[3] = vk.delta2;
-    Pairing.pairingCheck(p1, p2);
-  }
-}

contracts/verifiers/Verifier30.sol

@@ -1,237 +0,0 @@
-//
-// Copyright 2017 Christian Reitwiessner
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// 2019 OKIMS
-//      ported to solidity 0.6
-//      fixed linter warnings
-//      added requiere error messages
-//
-// 2021 Remco Bloemen
-//       cleaned up code
-//       added InvalidProve() error
-//       always revert with InvalidProof() on invalid proof
-//       make Pairing strict
-//
-// SPDX-License-Identifier: GPL-3.0
-pragma solidity ^0.8.4;
-
-library Pairing {
-  error InvalidProof();
-
-  // The prime q in the base field F_q for G1
-  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-
-  // The prime moludus of the scalar field of G1.
-  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-
-  struct G1Point {
-    uint256 X;
-    uint256 Y;
-  }
-
-  // Encoding of field elements is: X[0] * z + X[1]
-  struct G2Point {
-    uint256[2] X;
-    uint256[2] Y;
-  }
-
-  /// @return the generator of G1
-  function P1() internal pure returns (G1Point memory) {
-    return G1Point(1, 2);
-  }
-
-  /// @return the generator of G2
-  function P2() internal pure returns (G2Point memory) {
-    return
-      G2Point(
-        [
-          11559732032986387107991004021392285783925812861821192530917403151452391805634,
-          10857046999023057135944570762232829481370756359578518086990519993285655852781
-        ],
-        [
-          4082367875863433681332203403145435568316851327593401208105741076214120093531,
-          8495653923123431417604973247489272438418190587263600148770280649306958101930
-        ]
-      );
-  }
-
-  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
-  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
-    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
-    // Validate input or revert
-    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
-    // We know p.Y > 0 and p.Y < BASE_MODULUS.
-    return G1Point(p.X, BASE_MODULUS - p.Y);
-  }
-
-  /// @return r the sum of two points of G1
-  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
-    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
-    // on the curve.
-    uint256[4] memory input;
-    input[0] = p1.X;
-    input[1] = p1.Y;
-    input[2] = p2.X;
-    input[3] = p2.Y;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// @return r the product of a point on G1 and a scalar, i.e.
-  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
-  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
-    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
-    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
-    if (s >= SCALAR_MODULUS) revert InvalidProof();
-    uint256[3] memory input;
-    input[0] = p.X;
-    input[1] = p.Y;
-    input[2] = s;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// Asserts the pairing check
-  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
-  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
-  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
-    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
-    // respective groups of the right order.
-    if (p1.length != p2.length) revert InvalidProof();
-    uint256 elements = p1.length;
-    uint256 inputSize = elements * 6;
-    uint256[] memory input = new uint256[](inputSize);
-    for (uint256 i = 0; i < elements; i++) {
-      input[i * 6 + 0] = p1[i].X;
-      input[i * 6 + 1] = p1[i].Y;
-      input[i * 6 + 2] = p2[i].X[0];
-      input[i * 6 + 3] = p2[i].X[1];
-      input[i * 6 + 4] = p2[i].Y[0];
-      input[i * 6 + 5] = p2[i].Y[1];
-    }
-    uint256[1] memory out;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
-    }
-    if (!success || out[0] != 1) revert InvalidProof();
-  }
-}
-
-contract Verifier30 {
-  using Pairing for *;
-
-  struct VerifyingKey {
-    Pairing.G1Point alfa1;
-    Pairing.G2Point beta2;
-    Pairing.G2Point gamma2;
-    Pairing.G2Point delta2;
-    Pairing.G1Point[] IC;
-  }
-
-  struct Proof {
-    Pairing.G1Point A;
-    Pairing.G2Point B;
-    Pairing.G1Point C;
-  }
-
-  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
-    vk.alfa1 = Pairing.G1Point(
-      20491192805390485299153009773594534940189261866228447918068658471970481763042,
-      9383485363053290200918347156157836566562967994039712273449902621266178545958
-    );
-
-    vk.beta2 = Pairing.G2Point(
-      [4252822878758300859123897981450591353533073413197771768651442665752259397132, 6375614351688725206403948262868962793625744043794305715222011528459656738731],
-      [21847035105528745403288232691147584728191162732299865338377159692350059136679, 10505242626370262277552901082094356697409835680220590971873171140371331206856]
-    );
-
-    vk.gamma2 = Pairing.G2Point(
-      [11559732032986387107991004021392285783925812861821192530917403151452391805634, 10857046999023057135944570762232829481370756359578518086990519993285655852781],
-      [4082367875863433681332203403145435568316851327593401208105741076214120093531, 8495653923123431417604973247489272438418190587263600148770280649306958101930]
-    );
-
-    vk.delta2 = Pairing.G2Point(
-      [10202326166286888893675634318107715186834588694714750762952081034135561546271, 15028154694713144242204861571552635520290993855826554325002991692907421516918],
-      [18486039841380105976272577521609866666900576498507352937328726490052296469859, 12766289885372833812620582632847872978085960777075662988932200910695848591357]
-    );
-
-    vk.IC = new Pairing.G1Point[](5);
-
-    
-      vk.IC[0] = Pairing.G1Point(
-        1452272927738590248356371174422184656932731110936062990115610832462181634644,
-        3608050114233210789542189629343107890943266759827387991788718454179833288695
-      );
-    
-      vk.IC[1] = Pairing.G1Point(
-        14798240452388909327945424685903532333765637883272751382037716636327236955001,
-        10773894897711848209682368488916121016695006898681985691467605219098835500201
-      );
-    
-      vk.IC[2] = Pairing.G1Point(
-        17204267933132009093604099819536245144503489322639121825381131096467570698650,
-        7704298975420304156332734115679983371345754866278811368869074990486717531131
-      );
-    
-      vk.IC[3] = Pairing.G1Point(
-        8060465662017324080560848316478407038163145149983639907596180500095598669247,
-        20475082166427284188002500222093571716651248980245637602667562336751029856573
-      );
-    
-      vk.IC[4] = Pairing.G1Point(
-        7457566682692308112726332096733260585025339741083447785327706250123165087868,
-        11904519443874922292602150685069370036383697877657723976244907400392778002614
-      );
-    
-  }
-
-  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
-  function verifyProof(
-    uint[2] memory a,
-    uint[2][2] memory b,
-    uint[2] memory c,
-    uint[4] memory input
-  ) public view {
-    // If the values are not in the correct range, the Pairing contract will revert.
-    Proof memory proof;
-    proof.A = Pairing.G1Point(a[0], a[1]);
-    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
-    proof.C = Pairing.G1Point(c[0], c[1]);
-
-    VerifyingKey memory vk = verifyingKey();
-
-    // Compute the linear combination vk_x of inputs times IC
-    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
-    Pairing.G1Point memory vk_x = vk.IC[0];
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
-
-    // Check pairing
-    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
-    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
-    p1[0] = Pairing.negate(proof.A);
-    p2[0] = proof.B;
-    p1[1] = vk.alfa1;
-    p2[1] = vk.beta2;
-    p1[2] = vk_x;
-    p2[2] = vk.gamma2;
-    p1[3] = proof.C;
-    p2[3] = vk.delta2;
-    Pairing.pairingCheck(p1, p2);
-  }
-}

contracts/verifiers/Verifier31.sol

@@ -1,237 +0,0 @@
-//
-// Copyright 2017 Christian Reitwiessner
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// 2019 OKIMS
-//      ported to solidity 0.6
-//      fixed linter warnings
-//      added requiere error messages
-//
-// 2021 Remco Bloemen
-//       cleaned up code
-//       added InvalidProve() error
-//       always revert with InvalidProof() on invalid proof
-//       make Pairing strict
-//
-// SPDX-License-Identifier: GPL-3.0
-pragma solidity ^0.8.4;
-
-library Pairing {
-  error InvalidProof();
-
-  // The prime q in the base field F_q for G1
-  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-
-  // The prime moludus of the scalar field of G1.
-  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-
-  struct G1Point {
-    uint256 X;
-    uint256 Y;
-  }
-
-  // Encoding of field elements is: X[0] * z + X[1]
-  struct G2Point {
-    uint256[2] X;
-    uint256[2] Y;
-  }
-
-  /// @return the generator of G1
-  function P1() internal pure returns (G1Point memory) {
-    return G1Point(1, 2);
-  }
-
-  /// @return the generator of G2
-  function P2() internal pure returns (G2Point memory) {
-    return
-      G2Point(
-        [
-          11559732032986387107991004021392285783925812861821192530917403151452391805634,
-          10857046999023057135944570762232829481370756359578518086990519993285655852781
-        ],
-        [
-          4082367875863433681332203403145435568316851327593401208105741076214120093531,
-          8495653923123431417604973247489272438418190587263600148770280649306958101930
-        ]
-      );
-  }
-
-  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
-  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
-    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
-    // Validate input or revert
-    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
-    // We know p.Y > 0 and p.Y < BASE_MODULUS.
-    return G1Point(p.X, BASE_MODULUS - p.Y);
-  }
-
-  /// @return r the sum of two points of G1
-  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
-    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
-    // on the curve.
-    uint256[4] memory input;
-    input[0] = p1.X;
-    input[1] = p1.Y;
-    input[2] = p2.X;
-    input[3] = p2.Y;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// @return r the product of a point on G1 and a scalar, i.e.
-  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
-  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
-    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
-    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
-    if (s >= SCALAR_MODULUS) revert InvalidProof();
-    uint256[3] memory input;
-    input[0] = p.X;
-    input[1] = p.Y;
-    input[2] = s;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// Asserts the pairing check
-  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
-  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
-  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
-    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
-    // respective groups of the right order.
-    if (p1.length != p2.length) revert InvalidProof();
-    uint256 elements = p1.length;
-    uint256 inputSize = elements * 6;
-    uint256[] memory input = new uint256[](inputSize);
-    for (uint256 i = 0; i < elements; i++) {
-      input[i * 6 + 0] = p1[i].X;
-      input[i * 6 + 1] = p1[i].Y;
-      input[i * 6 + 2] = p2[i].X[0];
-      input[i * 6 + 3] = p2[i].X[1];
-      input[i * 6 + 4] = p2[i].Y[0];
-      input[i * 6 + 5] = p2[i].Y[1];
-    }
-    uint256[1] memory out;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
-    }
-    if (!success || out[0] != 1) revert InvalidProof();
-  }
-}
-
-contract Verifier31 {
-  using Pairing for *;
-
-  struct VerifyingKey {
-    Pairing.G1Point alfa1;
-    Pairing.G2Point beta2;
-    Pairing.G2Point gamma2;
-    Pairing.G2Point delta2;
-    Pairing.G1Point[] IC;
-  }
-
-  struct Proof {
-    Pairing.G1Point A;
-    Pairing.G2Point B;
-    Pairing.G1Point C;
-  }
-
-  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
-    vk.alfa1 = Pairing.G1Point(
-      20491192805390485299153009773594534940189261866228447918068658471970481763042,
-      9383485363053290200918347156157836566562967994039712273449902621266178545958
-    );
-
-    vk.beta2 = Pairing.G2Point(
-      [4252822878758300859123897981450591353533073413197771768651442665752259397132, 6375614351688725206403948262868962793625744043794305715222011528459656738731],
-      [21847035105528745403288232691147584728191162732299865338377159692350059136679, 10505242626370262277552901082094356697409835680220590971873171140371331206856]
-    );
-
-    vk.gamma2 = Pairing.G2Point(
-      [11559732032986387107991004021392285783925812861821192530917403151452391805634, 10857046999023057135944570762232829481370756359578518086990519993285655852781],
-      [4082367875863433681332203403145435568316851327593401208105741076214120093531, 8495653923123431417604973247489272438418190587263600148770280649306958101930]
-    );
-
-    vk.delta2 = Pairing.G2Point(
-      [14930624777162656776068112402283260602512252179767747308433194885322661150422, 13682963731073238132274278610660469286329368216526659590944079211949686450402],
-      [18705481657148807016785305378773304476425591636333098330324049960258682574070, 21315724107376627085778492378001676935454590984229146391746301404292016287653]
-    );
-
-    vk.IC = new Pairing.G1Point[](5);
-
-    
-      vk.IC[0] = Pairing.G1Point(
-        12628427235010608529869146871556870477182704310235373946877240509680742038961,
-        15093298104438768585559335868663959710321348106117735180051519837845319121254
-      );
-    
-      vk.IC[1] = Pairing.G1Point(
-        6593907467779318957599440584793099005109789224774644007604434924706249001015,
-        18549596630007199540674697114946251030815675677713256327810772799104711621483
-      );
-    
-      vk.IC[2] = Pairing.G1Point(
-        6271101737045248834759003849256661059806617144229427987717476992610974162336,
-        355748132218964841305454070022507122319085542484477110563322753565651576458
-      );
-    
-      vk.IC[3] = Pairing.G1Point(
-        2116139772133141967317791473319540620104888687412078412336248003979594158546,
-        4004400204967325849492155713520296687406035356901102254880522534085890616486
-      );
-    
-      vk.IC[4] = Pairing.G1Point(
-        4206647028595764233995379982714022410660284578620723510907006350595207905228,
-        19380634286337609988098517090003334645113675227742745065381519159322795845003
-      );
-    
-  }
-
-  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
-  function verifyProof(
-    uint[2] memory a,
-    uint[2][2] memory b,
-    uint[2] memory c,
-    uint[4] memory input
-  ) public view {
-    // If the values are not in the correct range, the Pairing contract will revert.
-    Proof memory proof;
-    proof.A = Pairing.G1Point(a[0], a[1]);
-    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
-    proof.C = Pairing.G1Point(c[0], c[1]);
-
-    VerifyingKey memory vk = verifyingKey();
-
-    // Compute the linear combination vk_x of inputs times IC
-    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
-    Pairing.G1Point memory vk_x = vk.IC[0];
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
-
-    // Check pairing
-    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
-    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
-    p1[0] = Pairing.negate(proof.A);
-    p2[0] = proof.B;
-    p1[1] = vk.alfa1;
-    p2[1] = vk.beta2;
-    p1[2] = vk_x;
-    p2[2] = vk.gamma2;
-    p1[3] = proof.C;
-    p2[3] = vk.delta2;
-    Pairing.pairingCheck(p1, p2);
-  }
-}

contracts/verifiers/Verifier32.sol

@@ -1,237 +0,0 @@
-//
-// Copyright 2017 Christian Reitwiessner
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-//
-// 2019 OKIMS
-//      ported to solidity 0.6
-//      fixed linter warnings
-//      added requiere error messages
-//
-// 2021 Remco Bloemen
-//       cleaned up code
-//       added InvalidProve() error
-//       always revert with InvalidProof() on invalid proof
-//       make Pairing strict
-//
-// SPDX-License-Identifier: GPL-3.0
-pragma solidity ^0.8.4;
-
-library Pairing {
-  error InvalidProof();
-
-  // The prime q in the base field F_q for G1
-  uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
-
-  // The prime moludus of the scalar field of G1.
-  uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
-
-  struct G1Point {
-    uint256 X;
-    uint256 Y;
-  }
-
-  // Encoding of field elements is: X[0] * z + X[1]
-  struct G2Point {
-    uint256[2] X;
-    uint256[2] Y;
-  }
-
-  /// @return the generator of G1
-  function P1() internal pure returns (G1Point memory) {
-    return G1Point(1, 2);
-  }
-
-  /// @return the generator of G2
-  function P2() internal pure returns (G2Point memory) {
-    return
-      G2Point(
-        [
-          11559732032986387107991004021392285783925812861821192530917403151452391805634,
-          10857046999023057135944570762232829481370756359578518086990519993285655852781
-        ],
-        [
-          4082367875863433681332203403145435568316851327593401208105741076214120093531,
-          8495653923123431417604973247489272438418190587263600148770280649306958101930
-        ]
-      );
-  }
-
-  /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
-  function negate(G1Point memory p) internal pure returns (G1Point memory r) {
-    if (p.X == 0 && p.Y == 0) return G1Point(0, 0);
-    // Validate input or revert
-    if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) revert InvalidProof();
-    // We know p.Y > 0 and p.Y < BASE_MODULUS.
-    return G1Point(p.X, BASE_MODULUS - p.Y);
-  }
-
-  /// @return r the sum of two points of G1
-  function addition(G1Point memory p1, G1Point memory p2) internal view returns (G1Point memory r) {
-    // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
-    // on the curve.
-    uint256[4] memory input;
-    input[0] = p1.X;
-    input[1] = p1.Y;
-    input[2] = p2.X;
-    input[3] = p2.Y;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// @return r the product of a point on G1 and a scalar, i.e.
-  /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
-  function scalar_mul(G1Point memory p, uint256 s) internal view returns (G1Point memory r) {
-    // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
-    // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
-    if (s >= SCALAR_MODULUS) revert InvalidProof();
-    uint256[3] memory input;
-    input[0] = p.X;
-    input[1] = p.Y;
-    input[2] = s;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
-    }
-    if (!success) revert InvalidProof();
-  }
-
-  /// Asserts the pairing check
-  /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
-  /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
-  function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) internal view {
-    // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
-    // respective groups of the right order.
-    if (p1.length != p2.length) revert InvalidProof();
-    uint256 elements = p1.length;
-    uint256 inputSize = elements * 6;
-    uint256[] memory input = new uint256[](inputSize);
-    for (uint256 i = 0; i < elements; i++) {
-      input[i * 6 + 0] = p1[i].X;
-      input[i * 6 + 1] = p1[i].Y;
-      input[i * 6 + 2] = p2[i].X[0];
-      input[i * 6 + 3] = p2[i].X[1];
-      input[i * 6 + 4] = p2[i].Y[0];
-      input[i * 6 + 5] = p2[i].Y[1];
-    }
-    uint256[1] memory out;
-    bool success;
-    // solium-disable-next-line security/no-inline-assembly
-    assembly {
-      success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
-    }
-    if (!success || out[0] != 1) revert InvalidProof();
-  }
-}
-
-contract Verifier32 {
-  using Pairing for *;
-
-  struct VerifyingKey {
-    Pairing.G1Point alfa1;
-    Pairing.G2Point beta2;
-    Pairing.G2Point gamma2;
-    Pairing.G2Point delta2;
-    Pairing.G1Point[] IC;
-  }
-
-  struct Proof {
-    Pairing.G1Point A;
-    Pairing.G2Point B;
-    Pairing.G1Point C;
-  }
-
-  function verifyingKey() internal pure returns (VerifyingKey memory vk) {
-    vk.alfa1 = Pairing.G1Point(
-      20491192805390485299153009773594534940189261866228447918068658471970481763042,
-      9383485363053290200918347156157836566562967994039712273449902621266178545958
-    );
-
-    vk.beta2 = Pairing.G2Point(
-      [4252822878758300859123897981450591353533073413197771768651442665752259397132, 6375614351688725206403948262868962793625744043794305715222011528459656738731],
-      [21847035105528745403288232691147584728191162732299865338377159692350059136679, 10505242626370262277552901082094356697409835680220590971873171140371331206856]
-    );
-
-    vk.gamma2 = Pairing.G2Point(
-      [11559732032986387107991004021392285783925812861821192530917403151452391805634, 10857046999023057135944570762232829481370756359578518086990519993285655852781],
-      [4082367875863433681332203403145435568316851327593401208105741076214120093531, 8495653923123431417604973247489272438418190587263600148770280649306958101930]
-    );
-
-    vk.delta2 = Pairing.G2Point(
-      [12315240965742683516581565369496371929586281338862761742109651525191835544242, 18994803742708336446369128568423705404354655742604689352630273180469431952708],
-      [18019403342409608922812569436317484250134945386869657285229378095251425778096, 12707009780301102830224094192984906206920666691015255692741008594808694787917]
-    );
-
-    vk.IC = new Pairing.G1Point[](5);
-
-    
-      vk.IC[0] = Pairing.G1Point(
-        2592407181901686208061988776764501828311271519595797153264758207470081204331,
-        11847594161160074962679125411562687287595382335410213641115001866587988494499
-      );
-    
-      vk.IC[1] = Pairing.G1Point(
-        3346927026869562921166545684451290646273836362895645367665514203662899621366,
-        15758185693543979820528128025093553492246135914029575732836221618882836493143
-      );
-    
-      vk.IC[2] = Pairing.G1Point(
-        20528686657810499188368147206002308531447185877994439397529705707372170337045,
-        18025396678079701612906003769476076600196287001844168390936182972248852818155
-      );
-    
-      vk.IC[3] = Pairing.G1Point(
-        9799815250059685769827017947834627563597884023490186073806184882963949644596,
-        4998495094322372762314630336611134866447406022687118703953312157819349892603
-      );
-    
-      vk.IC[4] = Pairing.G1Point(
-        16176535527670849161173306151058200762642157343823553073439957507563856439772,
-        21877331533292960470552563236986670222564955589137303622102707801351340670855
-      );
-    
-  }
-
-  /// @dev Verifies a Semaphore proof. Reverts with InvalidProof if the proof is invalid.
-  function verifyProof(
-    uint[2] memory a,
-    uint[2][2] memory b,
-    uint[2] memory c,
-    uint[4] memory input
-  ) public view {
-    // If the values are not in the correct range, the Pairing contract will revert.
-    Proof memory proof;
-    proof.A = Pairing.G1Point(a[0], a[1]);
-    proof.B = Pairing.G2Point([b[0][0], b[0][1]], [b[1][0], b[1][1]]);
-    proof.C = Pairing.G1Point(c[0], c[1]);
-
-    VerifyingKey memory vk = verifyingKey();
-
-    // Compute the linear combination vk_x of inputs times IC
-    if (input.length + 1 != vk.IC.length) revert Pairing.InvalidProof();
-    Pairing.G1Point memory vk_x = vk.IC[0];
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[1], input[0]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[2], input[1]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[3], input[2]));
-    vk_x = Pairing.addition(vk_x, Pairing.scalar_mul(vk.IC[4], input[3]));
-
-    // Check pairing
-    Pairing.G1Point[] memory p1 = new Pairing.G1Point[](4);
-    Pairing.G2Point[] memory p2 = new Pairing.G2Point[](4);
-    p1[0] = Pairing.negate(proof.A);
-    p2[0] = proof.B;
-    p1[1] = vk.alfa1;
-    p2[1] = vk.beta2;
-    p1[2] = vk_x;
-    p2[2] = vk.gamma2;
-    p1[3] = proof.C;
-    p2[3] = vk.delta2;
-    Pairing.pairingCheck(p1, p2);
-  }
-}

deployed-contracts/arbitrum.json

@@ -1,74 +0,0 @@
-[
-    {
-        "name": "Verifier16",
-        "address": "0x6143ECd9Fd1A00EDe1046d456f8aab53a7D71609"
-    },
-    {
-        "name": "Verifier17",
-        "address": "0xAc12fFFE354D6446eb50dd33E683B78FED73Fb02"
-    },
-    {
-        "name": "Verifier18",
-        "address": "0x610aeF0F2da3CD1C8bDefe4BDB434Ee146E0C701"
-    },
-    {
-        "name": "Verifier19",
-        "address": "0x5477725177035bbC9d70443eb921D29749D6FCb4"
-    },
-    {
-        "name": "Verifier20",
-        "address": "0x3fB2C0988a37b76e760c44e6516aF720935f3136"
-    },
-    {
-        "name": "Verifier21",
-        "address": "0xDc8f6B8A42836d4566256f4c6C53131DFD127DF8"
-    },
-    {
-        "name": "Verifier22",
-        "address": "0x6962b5e706be5278eeCb01c286b50A48484632f2"
-    },
-    {
-        "name": "Verifier23",
-        "address": "0x41e4796Bd89B4BF04013b559c93fC32E9a2BdF6B"
-    },
-    {
-        "name": "Verifier24",
-        "address": "0xD528B1D1408ab3583af4694F92b0aFEbE33d5b60"
-    },
-    {
-        "name": "Verifier25",
-        "address": "0x1683a27EF9c10c5286dB56412E1272cD0Ca733e7"
-    },
-    {
-        "name": "Verifier26",
-        "address": "0x78194bB665d1E33b97eE45B1A755c15717E94C00"
-    },
-    {
-        "name": "Verifier27",
-        "address": "0x997Dac00E6701Ef7F3518280E5a9922801126E42"
-    },
-    {
-        "name": "Verifier28",
-        "address": "0xDd3C7f4cBA2467aE41c0F614A3c3E24bC80268c6"
-    },
-    {
-        "name": "Verifier29",
-        "address": "0xe53eF12093933D5df5691EAbA3821bD1c1EB60Cd"
-    },
-    {
-        "name": "Verifier30",
-        "address": "0x7FeA07c536ABBB0E7FB3c833376EE4EaDc21340e"
-    },
-    {
-        "name": "Verifier31",
-        "address": "0xe4539a592df18936202480FBe77E47DE012F2178"
-    },
-    {
-        "name": "Verifier32",
-        "address": "0x98c90845A7870e215cBd7265DDC653E6c07032F4"
-    },
-    {
-        "name": "Semaphore",
-        "address": "0x49281E30F17A30808a6ce538f979d539747e6707"
-    }
-]

deployed-contracts/goerli.json

@@ -1,74 +0,0 @@
-[
-    {
-        "name": "Verifier16",
-        "address": "0xA5253ba39381Aa99c4C2C5A4D5C2deC036d06629"
-    },
-    {
-        "name": "Verifier17",
-        "address": "0xe0418A5f8fBF051D6cbc41Ff29855Dd2a02201Ab"
-    },
-    {
-        "name": "Verifier18",
-        "address": "0x7CdB3336d7d7c55Bce0FB1508594C54521656797"
-    },
-    {
-        "name": "Verifier19",
-        "address": "0xbd870921d8A5398a3314C950d1fc63b8C3AB190B"
-    },
-    {
-        "name": "Verifier20",
-        "address": "0x2a96c5696F85e3d2aa918496806B5c5a4D93E099"
-    },
-    {
-        "name": "Verifier21",
-        "address": "0x5Ec7d851a52A2a25CEc528F42a7ACA8EcF4667Cd"
-    },
-    {
-        "name": "Verifier22",
-        "address": "0x919d3d9c05FA7411e334deA5a763354fC7B6aA5b"
-    },
-    {
-        "name": "Verifier23",
-        "address": "0x63917b00a6dA7865bEfdd107AfC83CC2e6BDE552"
-    },
-    {
-        "name": "Verifier24",
-        "address": "0xd05CAd7d940114c1419098EE3cEA0776ab510E7D"
-    },
-    {
-        "name": "Verifier25",
-        "address": "0x6D9862e6140D94E932d94c8BcE74a0BDD0ea5ACb"
-    },
-    {
-        "name": "Verifier26",
-        "address": "0x8c29e0b77e32f704F03eeCE01c041192A5EB6c77"
-    },
-    {
-        "name": "Verifier27",
-        "address": "0x066cC22f8CA2A8D90D7Ff77D8a10A27e629c9c4C"
-    },
-    {
-        "name": "Verifier28",
-        "address": "0x698F9507f504E2BD238be7da56E8D9fee60C6D15"
-    },
-    {
-        "name": "Verifier29",
-        "address": "0xbBfC2E201C3c3c6F50063c3Edb4746c6Fcb36346"
-    },
-    {
-        "name": "Verifier30",
-        "address": "0x06bcD633988c1CE7Bd134DbE2C12119b6f3E4bD1"
-    },
-    {
-        "name": "Verifier31",
-        "address": "0x133b69Ce47BF20C49368354914DF47519Ca6cCFE"
-    },
-    {
-        "name": "Verifier32",
-        "address": "0xe2978F79cb4AF62e5C990EE5c7E12fb22ee22e2D"
-    },
-    {
-        "name": "Semaphore",
-        "address": "0xd688189016277e1a6aE5228ef6894C14585A42D3"
-    }
-]

docs/index.html

@@ -0,0 +1,123 @@
+<!DOCTYPE html>
+
+<html style="height: 100%">
+    <head>
+        <meta charset="utf-8" />
+        <meta http-equiv="x-ua-compatible" content="IE=edge" />
+        <title>Semaphore packages</title>
+        <meta
+            name="description"
+            content="A monorepo of Semaphore packages."
+        />
+        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <link
+            rel="stylesheet"
+            href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css"
+        />
+    </head>
+    <body
+        style="
+            margin: 0;
+            background-color: #EAF0F4;
+            color: #000;
+            height: 100%;
+            font-family: 'Courier New', monospace;
+            display: flex;
+            flex-direction: column;
+            justify-content: space-between;
+        "
+    >
+        <div
+            style="
+                display: flex;
+                flex-direction: column;
+                align-items: center;
+                justify-content: center;
+                flex: 1;
+                padding: 0 20px;
+                text-align: center;
+            "
+        >
+            <div style="display: flex">
+                <span style="margin-right: 5px">
+                    <img width="40" src="https://raw.githubusercontent.com/semaphore-protocol/website/main/static/img/semaphore-icon.svg">
+                </span>
+                <h1 style="margin: 0; font-size: 40px">Semaphore packages</h1>
+            </div>
+            <p style="max-width: 500px">
+                A monorepo of Semaphore packages.
+            </p>
+            <ul style="list-style-type: none; padding: 0; margin: 0; margin-top: 10px"></ul>
+        </div>
+        <footer
+            style="
+                display: flex;
+                justify-content: center;
+                padding: 15px 20px;
+                background-color: #EAF0F4;
+            "
+        >
+            <div
+                style="
+                    display: flex;
+                    justify-content: space-between;
+                    align-items: center;
+                    width: 900px;
+                "
+            >
+                <p style="margin: 0; font-size: 16px">
+                    Copyright © 2022 Ethereum Foundation
+                </p>
+                <div>
+                    <a
+                        style="margin-right: 15px; text-decoration: none"
+                        target="_blank"
+                        href="https://github.com/semaphore-protocol/semaphore"
+                    >
+                        <i
+                            class="fa fa-github"
+                            style="font-size: 24px; color: #000"
+                        ></i>
+                    </a>
+                </div>
+            </div>
+        </footer>
+    </body>
+    <script>
+        const url =
+            "https://api.github.com/repos/semaphore-protocol/semaphore/contents?ref=gh-pages"
+
+        function insertLinks(packages) {
+            const [element] = window.document.getElementsByTagName("ul")
+            let html = ""
+
+            for (const package of packages) {
+                html += `<li style="display: flex; align-items: center; margin-bottom: 8px">
+            <a style="margin-right: 15px" target="_blank" href="https://github.com/semaphore-protocol/semaphore/tree/main/packages/${package}">
+              <i class="fa fa-github" style="font-size: 24px; color: #000"></i>
+            </a>
+            <a style="color: #000; text-decoration: none; font-size: 16px"
+              onmouseover="this.style.color='#404A4E';"
+              onmouseout="this.style.color='#000';"
+              target="_blank" href="https://semaphore-protocol.github.io/semaphore/${package}">
+                @semaphore-protocol/${package} >
+            </a></li>`
+            }
+
+            element.innerHTML = html
+        }
+
+        fetch(url)
+            .then((response) => response.json())
+            .then((data) => {
+                const ignore = [".nojekyll", "index.html", "CNAME"]
+                const packages = data
+                    .map((c) => c.name)
+                    .filter((name) => !ignore.includes(name))
+
+                localStorage.setItem("packages", JSON.stringify(packages))
+
+                insertLinks(packages)
+            })
+    </script>
+</html>

jest.config.ts

@@ -0,0 +1,29 @@
+import fs from "fs"
+import type { Config } from "@jest/types"
+
+const projects: any = fs
+    .readdirSync("./packages", { withFileTypes: true })
+    .filter((directory) => directory.isDirectory())
+    .map(({ name }) => ({
+        rootDir: `packages/${name}`,
+        displayName: name,
+        setupFiles: ["dotenv/config"],
+        moduleNameMapper: {
+            "@semaphore-protocol/(.*)": "<rootDir>/../$1/src/index.ts" // Interdependency packages.
+        }
+    }))
+
+export default async (): Promise<Config.InitialOptions> => ({
+    projects,
+    verbose: true,
+    coverageDirectory: "./coverage/libraries",
+    collectCoverageFrom: ["<rootDir>/src/**/*.ts", "!<rootDir>/src/**/index.ts", "!<rootDir>/src/**/*.d.ts"],
+    coverageThreshold: {
+        global: {
+            branches: 90,
+            functions: 95,
+            lines: 95,
+            statements: 95
+        }
+    }
+})

package.json

@@ -1,104 +1,80 @@
 {
-    "name": "semaphore",
+    "name": "semaphore-protocol",
     "description": "A zero-knowledge protocol for anonymous signalling on Ethereum.",
     "license": "MIT",
-    "homepage": "https://github.com/semaphore-protocol/semaphore.git#readme",
-    "repository": {
-        "type": "git",
-        "url": "git+https://github.com/semaphore-protocol/semaphore.git.git"
-    },
-    "bugs": {
-        "url": "https://github.com/semaphore-protocol/semaphore.git/issues"
-    },
+    "repository": "git@github.com:semaphore-protocol/semaphore.git",
+    "homepage": "https://github.com/semaphore-protocol/semaphore",
+    "bugs": "https://github.com/semaphore-protocol/semaphore/issues",
     "private": true,
     "scripts": {
-        "start": "hardhat node",
-        "compile": "hardhat compile",
-        "download:snark-artifacts": "hardhat run scripts/download-snark-artifacts.ts",
-        "deploy:all": "hardhat run scripts/deploy-all.ts",
-        "deploy:verifier": "hardhat deploy:verifier",
-        "deploy:semaphore": "hardhat deploy:semaphore",
-        "deploy:semaphore-voting": "hardhat deploy:semaphore-voting",
-        "deploy:semaphore-whistleblowing": "hardhat deploy:semaphore-whistleblowing",
-        "test": "hardhat test",
-        "test:report-gas": "REPORT_GAS=true hardhat test",
-        "test:coverage": "hardhat coverage",
-        "typechain": "hardhat typechain",
-        "lint": "yarn lint:sol && yarn lint:ts",
-        "lint:ts": "eslint . --ext .js,.ts",
-        "lint:sol": "solhint 'contracts/**/*.sol'",
+        "build:libraries": "yarn workspaces foreach run build",
+        "compile:contracts": "yarn workspace contracts compile",
+        "download:snark-artifacts": "rimraf snark-artifacts && ts-node scripts/download-snark-artifacts.ts",
+        "test": "yarn test:libraries && yarn test:contracts",
+        "test:libraries": "jest --coverage",
+        "test:contracts": "yarn workspace contracts test:coverage",
+        "lint": "eslint . --ext .js,.ts && yarn workspace contracts lint",
         "prettier": "prettier -c .",
         "prettier:write": "prettier -w .",
+        "docs": "yarn workspaces foreach run docs",
         "commit": "cz",
-        "precommit": "lint-staged"
+        "precommit": "lint-staged",
+        "postinstall": "yarn download:snark-artifacts"
     },
+    "keywords": [
+        "ethereum",
+        "semaphore",
+        "solidity",
+        "circom",
+        "javascript",
+        "typescript",
+        "zero-knowledge",
+        "zk-snarks",
+        "zero-knowledge-proofs",
+        "proof-of-membership",
+        "monorepo"
+    ],
+    "workspaces": [
+        "packages/*"
+    ],
     "packageManager": "yarn@3.2.1",
     "devDependencies": {
-        "@commitlint/cli": "^16.1.0",
+        "@babel/core": "^7.16.7",
+        "@babel/preset-env": "^7.16.8",
+        "@babel/preset-typescript": "^7.17.12",
+        "@commitlint/cli": "^16.0.2",
         "@commitlint/config-conventional": "^16.0.0",
-        "@nomiclabs/hardhat-ethers": "^2.0.6",
-        "@nomiclabs/hardhat-etherscan": "^3.1.0",
-        "@nomiclabs/hardhat-waffle": "^2.0.3",
-        "@semaphore-protocol/group": "2.2.0",
-        "@semaphore-protocol/identity": "2.0.0",
-        "@semaphore-protocol/proof": "2.3.1",
-        "@typechain/ethers-v5": "^10.0.0",
-        "@typechain/hardhat": "^6.0.0",
-        "@types/chai": "^4.3.0",
+        "@rollup/plugin-typescript": "^8.3.0",
         "@types/download": "^8.0.1",
-        "@types/mocha": "^9.1.0",
-        "@types/node": "^17.0.12",
+        "@types/glob": "^7.2.0",
+        "@types/jest": "^27.4.0",
+        "@types/node": "^17.0.9",
         "@types/rimraf": "^3.0.2",
-        "@typescript-eslint/eslint-plugin": "^5.10.1",
-        "@typescript-eslint/parser": "^5.10.1",
-        "chai": "^4.3.5",
-        "circomlib": "^2.0.2",
-        "circomlibjs": "^0.0.8",
+        "@typescript-eslint/eslint-plugin": "^5.9.1",
+        "@typescript-eslint/parser": "^5.9.1",
+        "babel-jest": "^27.4.6",
         "commitizen": "^4.2.4",
         "cz-conventional-changelog": "^3.3.0",
-        "dotenv": "^14.3.2",
-        "download": "^8.0.0",
-        "eslint": "^8.7.0",
+        "dotenv": "^16.0.2",
+        "eslint": "^8.2.0",
+        "eslint-config-airbnb-base": "15.0.0",
+        "eslint-config-airbnb-typescript": "^16.1.0",
         "eslint-config-prettier": "^8.3.0",
-        "ethereum-waffle": "^3.4.4",
-        "ethers": "^5.6.8",
-        "hardhat": "^2.9.7",
-        "hardhat-gas-reporter": "^1.0.8",
-        "js-logger": "^1.6.1",
-        "lint-staged": "^12.3.2",
+        "eslint-plugin-import": "^2.25.2",
+        "eslint-plugin-jest": "^25.7.0",
+        "jest": "^27.4.1",
+        "jest-config": "^27.4.7",
+        "lint-staged": "^12.1.7",
         "prettier": "^2.5.1",
-        "prettier-plugin-solidity": "^1.0.0-beta.19",
         "rimraf": "^3.0.2",
-        "snarkjs": "^0.4.13",
-        "solhint": "^3.3.6",
-        "solhint-plugin-prettier": "^0.0.5",
-        "solidity-coverage": "^0.7.21",
+        "rollup": "^2.64.0",
         "ts-node": "^10.4.0",
-        "typechain": "^8.0.0",
-        "typescript": "^4.5.5"
+        "tslib": "^2.3.1",
+        "typescript": "^4.5.4"
     },
     "config": {
-        "solidity": {
-            "version": "0.8.4"
-        },
-        "paths": {
-            "contracts": "./contracts",
-            "circuit": "./circuit",
-            "tests": "./test",
-            "cache": "./cache",
-            "snarkjs-templates": "./snarkjs-templates",
-            "build": {
-                "snark-artifacts": "./build/snark-artifacts",
-                "contracts": "./build/contracts",
-                "typechain": "./build/typechain"
-            }
-        },
         "commitizen": {
             "path": "./node_modules/cz-conventional-changelog"
         }
-    },
-    "dependencies": {
-        "@openzeppelin/contracts": "4.4.2",
-        "@zk-kit/incremental-merkle-tree.sol": "1.3.0"
     }
 }

packages/circuits/README.md

@@ -0,0 +1,37 @@
+<p align="center">
+    <h1 align="center">
+        Semaphore circuits
+    </h1>
+    <p align="center">Semaphore circuits to create and verify zero-knowledge proofs.</p>
+</p>
+
+<p align="center">
+    <a href="https://github.com/semaphore-protocol">
+        <img src="https://img.shields.io/badge/project-Semaphore-blue.svg?style=flat-square">
+    </a>
+    <a href="https://github.com/semaphore-protocol/semaphore/blob/main/LICENSE">
+        <img alt="Github license" src="https://img.shields.io/github/license/semaphore-protocol/semaphore.svg?style=flat-square">
+    </a>
+</p>
+
+<div align="center">
+    <h4>
+        <a href="https://github.com/semaphore-protocol/semaphore/blob/main/CONTRIBUTING.md">
+            👥 Contributing
+        </a>
+        <span>&nbsp;&nbsp;|&nbsp;&nbsp;</span>
+        <a href="https://github.com/semaphore-protocol/semaphore/blob/main/CODE_OF_CONDUCT.md">
+            🤝 Code of conduct
+        </a>
+        <span>&nbsp;&nbsp;|&nbsp;&nbsp;</span>
+        <a href="https://github.com/semaphore-protocol/semaphore/contribute">
+            🔎 Issues
+        </a>
+        <span>&nbsp;&nbsp;|&nbsp;&nbsp;</span>
+        <a href="https://discord.gg/6mSdGHnstH">
+            🗣️ Chat &amp; Support
+        </a>
+    </h4>
+</div>
+
+To learn more about circuits visit [semaphore.appliedzkp.org](https://semaphore.appliedzkp.org/docs/technical-reference/circuits).

packages/circuits/package.json

@@ -0,0 +1,7 @@
+{
+    "name": "circuits",
+    "private": true,
+    "dependencies": {
+        "circomlib": "^2.0.2"
+    }
+}

packages/contracts/.solcover.js

@@ -0,0 +1,4 @@
+module.exports = {
+    istanbulFolder: "../../coverage/contracts",
+    skipFiles: ["base/Pairing.sol"]
+}

packages/contracts/.solhint.json

@@ -4,6 +4,7 @@
     "rules": {
         "code-complexity": ["error", 7],
         "compiler-version": ["error", ">=0.8.0"],
+        "var-name-mixedcase": "off",
         "const-name-snakecase": "off",
         "no-empty-blocks": "off",
         "constructor-syntax": "error",

packages/contracts/.solhintignore

@@ -0,0 +1 @@
+contracts/base/Pairing.sol

packages/contracts/README.md

@@ -0,0 +1 @@
+contracts/README.md

packages/contracts/contracts/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 Ethereum Foundation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

packages/contracts/contracts/README.md

@@ -7,7 +7,7 @@
 
 <p align="center">
     <a href="https://github.com/semaphore-protocol">
-        <img src="https://img.shields.io/badge/project-semaphore-blue.svg?style=flat-square">
+        <img src="https://img.shields.io/badge/project-Semaphore-blue.svg?style=flat-square">
     </a>
     <a href="https://github.com/semaphore-protocol/semaphore/blob/main/LICENSE">
         <img alt="Github license" src="https://img.shields.io/github/license/semaphore-protocol/semaphore.svg?style=flat-square">
@@ -34,7 +34,7 @@
             🔎 Issues
         </a>
         <span>&nbsp;&nbsp;|&nbsp;&nbsp;</span>
-        <a href="https://t.me/joinchat/B-PQx1U3GtAh--Z4Fwo56A">
+        <a href="https://discord.gg/6mSdGHnstH">
             🗣️ Chat &amp; Support
         </a>
     </h4>
@@ -59,3 +59,62 @@ or yarn:
 ```bash
 yarn add @semaphore-protocol/contracts
 ```
+
+## 📜 Usage
+
+### Compile contracts
+
+Compile the smart contracts with [Hardhat](https://hardhat.org/):
+
+```bash
+yarn compile
+```
+
+### Testing
+
+Run [Mocha](https://mochajs.org/) to test the contracts:
+
+```bash
+yarn test
+```
+
+You can also generate a test coverage report:
+
+```bash
+yarn test:coverage
+```
+
+Or a test gas report:
+
+```bash
+yarn test:report-gas
+```
+
+### Deploy contracts
+
+Deploy a verifier contract with depth = 20:
+
+```bash
+yarn deploy:verifier --depth 20
+```
+
+Deploy the `Semaphore.sol` contract with one verifier:
+
+```bash
+yarn deploy:semaphore --verifiers '[{"merkleTreeDepth": 20, "contractAddress": "0x06bcD633988c1CE7Bd134DbE2C12119b6f3E4bD1"}]'
+```
+
+Deploy all verifiers and Semaphore contract:
+
+```bash
+yarn deploy:all
+```
+
+If you want to deploy contracts in a specific network you can set up the `DEFAULT_NETWORK` variable in your `.env` file with the name of one of our supported networks (hardhat, localhost, goerli, arbitrum). Or you can specify it as option:
+
+```bash
+yarn deploy:all --network goerli
+yarn deploy:all --network localhost
+```
+
+If you want to deploy contracts on Goerli or Arbitrum, remember to provide a valid private key and an Infura API in your `.env` file.

packages/contracts/contracts/Semaphore.sol

@@ -2,25 +2,20 @@
 pragma solidity 0.8.4;
 
 import "./interfaces/ISemaphore.sol";
-import "./interfaces/IVerifier.sol";
-import "./base/SemaphoreCore.sol";
+import "./interfaces/ISemaphoreVerifier.sol";
 import "./base/SemaphoreGroups.sol";
 
 /// @title Semaphore
-contract Semaphore is ISemaphore, SemaphoreCore, SemaphoreGroups {
-    /// @dev Gets a tree depth and returns its verifier address.
-    mapping(uint256 => IVerifier) public verifiers;
+contract Semaphore is ISemaphore, SemaphoreGroups {
+    ISemaphoreVerifier public verifier;
 
-    /// @dev Gets a group id and returns the group admin address.
-    mapping(uint256 => address) public groupAdmins;
-
-    /// @dev Gets a group id and returns data to check if a Merkle root is expired.
-    mapping(uint256 => MerkleTreeExpiry) public merkleTreeExpiries;
+    /// @dev Gets a group id and returns the group parameters.
+    mapping(uint256 => Group) public groups;
 
     /// @dev Checks if the group admin is the transaction sender.
     /// @param groupId: Id of the group.
     modifier onlyGroupAdmin(uint256 groupId) {
-        if (groupAdmins[groupId] != _msgSender()) {
+        if (groups[groupId].admin != _msgSender()) {
             revert Semaphore__CallerIsNotTheGroupAdmin();
         }
         _;
@@ -29,22 +24,16 @@ contract Semaphore is ISemaphore, SemaphoreCore, SemaphoreGroups {
     /// @dev Checks if there is a verifier for the given tree depth.
     /// @param merkleTreeDepth: Depth of the tree.
     modifier onlySupportedMerkleTreeDepth(uint256 merkleTreeDepth) {
-        if (address(verifiers[merkleTreeDepth]) == address(0)) {
+        if (merkleTreeDepth < 16 || merkleTreeDepth > 32) {
             revert Semaphore__MerkleTreeDepthIsNotSupported();
         }
         _;
     }
 
-    /// @dev Initializes the Semaphore verifiers used to verify the user's ZK proofs.
-    /// @param _verifiers: List of Semaphore verifiers (address and related Merkle tree depth).
-    constructor(Verifier[] memory _verifiers) {
-        for (uint8 i = 0; i < _verifiers.length; ) {
-            verifiers[_verifiers[i].merkleTreeDepth] = IVerifier(_verifiers[i].contractAddress);
-
-            unchecked {
-                ++i;
-            }
-        }
+    /// @dev Initializes the Semaphore verifier used to verify the user's ZK proofs.
+    /// @param _verifier: Semaphore verifier address.
+    constructor(ISemaphoreVerifier _verifier) {
+        verifier = _verifier;
     }
 
     /// @dev See {ISemaphore-createGroup}.
@@ -56,8 +45,8 @@ contract Semaphore is ISemaphore, SemaphoreCore, SemaphoreGroups {
     ) external override onlySupportedMerkleTreeDepth(merkleTreeDepth) {
         _createGroup(groupId, merkleTreeDepth, zeroValue);
 
-        groupAdmins[groupId] = admin;
-        merkleTreeExpiries[groupId].rootDuration = 1 hours;
+        groups[groupId].admin = admin;
+        groups[groupId].merkleRootDuration = 1 hours;
 
         emit GroupAdminUpdated(groupId, address(0), admin);
     }
@@ -72,15 +61,15 @@ contract Semaphore is ISemaphore, SemaphoreCore, SemaphoreGroups {
     ) external override onlySupportedMerkleTreeDepth(merkleTreeDepth) {
         _createGroup(groupId, merkleTreeDepth, zeroValue);
 
-        groupAdmins[groupId] = admin;
-        merkleTreeExpiries[groupId].rootDuration = merkleTreeRootDuration;
+        groups[groupId].admin = admin;
+        groups[groupId].merkleRootDuration = merkleTreeRootDuration;
 
         emit GroupAdminUpdated(groupId, address(0), admin);
     }
 
     /// @dev See {ISemaphore-updateGroupAdmin}.
     function updateGroupAdmin(uint256 groupId, address newAdmin) external override onlyGroupAdmin(groupId) {
-        groupAdmins[groupId] = newAdmin;
+        groups[groupId].admin = newAdmin;
 
         emit GroupAdminUpdated(groupId, _msgSender(), newAdmin);
     }
@@ -91,7 +80,7 @@ contract Semaphore is ISemaphore, SemaphoreCore, SemaphoreGroups {
 
         uint256 merkleTreeRoot = getMerkleTreeRoot(groupId);
 
-        merkleTreeExpiries[groupId].rootCreationDates[merkleTreeRoot] = block.timestamp;
+        groups[groupId].merkleRootCreationDates[merkleTreeRoot] = block.timestamp;
     }
 
     /// @dev See {ISemaphore-addMembers}.
@@ -110,7 +99,7 @@ contract Semaphore is ISemaphore, SemaphoreCore, SemaphoreGroups {
 
         uint256 merkleTreeRoot = getMerkleTreeRoot(groupId);
 
-        merkleTreeExpiries[groupId].rootCreationDates[merkleTreeRoot] = block.timestamp;
+        groups[groupId].merkleRootCreationDates[merkleTreeRoot] = block.timestamp;
     }
 
     /// @dev See {ISemaphore-updateMember}.
@@ -122,6 +111,10 @@ contract Semaphore is ISemaphore, SemaphoreCore, SemaphoreGroups {
         uint8[] calldata proofPathIndices
     ) external override onlyGroupAdmin(groupId) {
         _updateMember(groupId, identityCommitment, newIdentityCommitment, proofSiblings, proofPathIndices);
+
+        uint256 merkleTreeRoot = getMerkleTreeRoot(groupId);
+
+        groups[groupId].merkleRootCreationDates[merkleTreeRoot] = block.timestamp;
     }
 
     /// @dev See {ISemaphore-removeMember}.
@@ -132,13 +125,17 @@ contract Semaphore is ISemaphore, SemaphoreCore, SemaphoreGroups {
         uint8[] calldata proofPathIndices
     ) external override onlyGroupAdmin(groupId) {
         _removeMember(groupId, identityCommitment, proofSiblings, proofPathIndices);
+
+        uint256 merkleTreeRoot = getMerkleTreeRoot(groupId);
+
+        groups[groupId].merkleRootCreationDates[merkleTreeRoot] = block.timestamp;
     }
 
     /// @dev See {ISemaphore-verifyProof}.
     function verifyProof(
         uint256 groupId,
         uint256 merkleTreeRoot,
-        bytes32 signal,
+        uint256 signal,
         uint256 nullifierHash,
         uint256 externalNullifier,
         uint256[8] calldata proof
@@ -150,26 +147,28 @@ contract Semaphore is ISemaphore, SemaphoreCore, SemaphoreGroups {
         }
 
         if (merkleTreeRoot != currentMerkleTreeRoot) {
-            uint256 rootCreationDate = merkleTreeExpiries[groupId].rootCreationDates[merkleTreeRoot];
-            uint256 rootDuration = merkleTreeExpiries[groupId].rootDuration;
+            uint256 merkleRootCreationDate = groups[groupId].merkleRootCreationDates[merkleTreeRoot];
+            uint256 merkleRootDuration = groups[groupId].merkleRootDuration;
 
-            if (rootCreationDate == 0) {
+            if (merkleRootCreationDate == 0) {
                 revert Semaphore__MerkleTreeRootIsNotPartOfTheGroup();
             }
 
-            if (block.timestamp > rootCreationDate + rootDuration) {
+            if (block.timestamp > merkleRootCreationDate + merkleRootDuration) {
                 revert Semaphore__MerkleTreeRootIsExpired();
             }
         }
 
+        if (groups[groupId].nullifierHashes[nullifierHash]) {
+            revert Semaphore__YouAreUsingTheSameNillifierTwice();
+        }
+
         uint256 merkleTreeDepth = getMerkleTreeDepth(groupId);
 
-        IVerifier verifier = verifiers[merkleTreeDepth];
+        verifier.verifyProof(merkleTreeRoot, nullifierHash, signal, externalNullifier, proof, merkleTreeDepth);
 
-        _verifyProof(signal, merkleTreeRoot, nullifierHash, externalNullifier, proof, verifier);
+        groups[groupId].nullifierHashes[nullifierHash] = true;
 
-        _saveNullifierHash(nullifierHash);
-
-        emit ProofVerified(groupId, signal);
+        emit ProofVerified(groupId, merkleTreeRoot, nullifierHash, externalNullifier, signal);
     }
 }

packages/contracts/contracts/base/Pairing.sol

@@ -0,0 +1,151 @@
+// Copyright 2017 Christian Reitwiessner
+// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+// The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+//
+// The following Pairing library is a modified version adapted to Semaphore.
+//
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.4;
+
+library Pairing {
+    error Semaphore__InvalidProof();
+
+    // The prime q in the base field F_q for G1
+    uint256 constant BASE_MODULUS = 21888242871839275222246405745257275088696311157297823662689037894645226208583;
+
+    // The prime moludus of the scalar field of G1.
+    uint256 constant SCALAR_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
+
+    struct G1Point {
+        uint256 X;
+        uint256 Y;
+    }
+
+    // Encoding of field elements is: X[0] * z + X[1]
+    struct G2Point {
+        uint256[2] X;
+        uint256[2] Y;
+    }
+
+    /// @return the generator of G1
+    function P1() public pure returns (G1Point memory) {
+        return G1Point(1, 2);
+    }
+
+    /// @return the generator of G2
+    function P2() public pure returns (G2Point memory) {
+        return
+            G2Point(
+                [
+                    11559732032986387107991004021392285783925812861821192530917403151452391805634,
+                    10857046999023057135944570762232829481370756359578518086990519993285655852781
+                ],
+                [
+                    4082367875863433681332203403145435568316851327593401208105741076214120093531,
+                    8495653923123431417604973247489272438418190587263600148770280649306958101930
+                ]
+            );
+    }
+
+    /// @return r the negation of p, i.e. p.addition(p.negate()) should be zero.
+    function negate(G1Point memory p) public pure returns (G1Point memory r) {
+        if (p.X == 0 && p.Y == 0) {
+            return G1Point(0, 0);
+        }
+
+        // Validate input or revert
+        if (p.X >= BASE_MODULUS || p.Y >= BASE_MODULUS) {
+            revert Semaphore__InvalidProof();
+        }
+
+        // We know p.Y > 0 and p.Y < BASE_MODULUS.
+        return G1Point(p.X, BASE_MODULUS - p.Y);
+    }
+
+    /// @return r the sum of two points of G1
+    function addition(G1Point memory p1, G1Point memory p2) public view returns (G1Point memory r) {
+        // By EIP-196 all input is validated to be less than the BASE_MODULUS and form points
+        // on the curve.
+        uint256[4] memory input;
+
+        input[0] = p1.X;
+        input[1] = p1.Y;
+        input[2] = p2.X;
+        input[3] = p2.Y;
+
+        bool success;
+
+        // solium-disable-next-line security/no-inline-assembly
+        assembly {
+            success := staticcall(sub(gas(), 2000), 6, input, 0xc0, r, 0x60)
+        }
+
+        if (!success) {
+            revert Semaphore__InvalidProof();
+        }
+    }
+
+    /// @return r the product of a point on G1 and a scalar, i.e.
+    /// p == p.scalar_mul(1) and p.addition(p) == p.scalar_mul(2) for all points p.
+    function scalar_mul(G1Point memory p, uint256 s) public view returns (G1Point memory r) {
+        // By EIP-196 the values p.X and p.Y are verified to less than the BASE_MODULUS and
+        // form a valid point on the curve. But the scalar is not verified, so we do that explicitelly.
+        if (s >= SCALAR_MODULUS) {
+            revert Semaphore__InvalidProof();
+        }
+
+        uint256[3] memory input;
+
+        input[0] = p.X;
+        input[1] = p.Y;
+        input[2] = s;
+
+        bool success;
+
+        // solium-disable-next-line security/no-inline-assembly
+        assembly {
+            success := staticcall(sub(gas(), 2000), 7, input, 0x80, r, 0x60)
+        }
+
+        if (!success) {
+            revert Semaphore__InvalidProof();
+        }
+    }
+
+    /// Asserts the pairing check
+    /// e(p1[0], p2[0]) *  .... * e(p1[n], p2[n]) == 1
+    /// For example pairing([P1(), P1().negate()], [P2(), P2()]) should succeed
+    function pairingCheck(G1Point[] memory p1, G2Point[] memory p2) public view {
+        // By EIP-197 all input is verified to be less than the BASE_MODULUS and form elements in their
+        // respective groups of the right order.
+        if (p1.length != p2.length) {
+            revert Semaphore__InvalidProof();
+        }
+
+        uint256 elements = p1.length;
+        uint256 inputSize = elements * 6;
+        uint256[] memory input = new uint256[](inputSize);
+
+        for (uint256 i = 0; i < elements; i++) {
+            input[i * 6 + 0] = p1[i].X;
+            input[i * 6 + 1] = p1[i].Y;
+            input[i * 6 + 2] = p2[i].X[0];
+            input[i * 6 + 3] = p2[i].X[1];
+            input[i * 6 + 4] = p2[i].Y[0];
+            input[i * 6 + 5] = p2[i].Y[1];
+        }
+
+        uint256[1] memory out;
+        bool success;
+
+        // solium-disable-next-line security/no-inline-assembly
+        assembly {
+            success := staticcall(sub(gas(), 2000), 8, add(input, 0x20), mul(inputSize, 0x20), out, 0x20)
+        }
+
+        if (!success || out[0] != 1) {
+            revert Semaphore__InvalidProof();
+        }
+    }
+}

packages/contracts/contracts/base/SemaphoreGroups.sol

@@ -1,7 +1,6 @@
 //SPDX-License-Identifier: MIT
 pragma solidity 0.8.4;
 
-import {SNARK_SCALAR_FIELD} from "./SemaphoreConstants.sol";
 import "../interfaces/ISemaphoreGroups.sol";
 import "@zk-kit/incremental-merkle-tree.sol/IncrementalBinaryTree.sol";
 import "@openzeppelin/contracts/utils/Context.sol";
@@ -12,8 +11,8 @@ import "@openzeppelin/contracts/utils/Context.sol";
 abstract contract SemaphoreGroups is Context, ISemaphoreGroups {
     using IncrementalBinaryTree for IncrementalTreeData;
 
-    /// @dev Gets a group id and returns the group/tree data.
-    mapping(uint256 => IncrementalTreeData) internal groups;
+    /// @dev Gets a group id and returns the tree data.
+    mapping(uint256 => IncrementalTreeData) internal merkleTree;
 
     /// @dev Creates a new group by initializing the associated tree.
     /// @param groupId: Id of the group.
@@ -24,15 +23,11 @@ abstract contract SemaphoreGroups is Context, ISemaphoreGroups {
         uint256 merkleTreeDepth,
         uint256 zeroValue
     ) internal virtual {
-        if (groupId >= SNARK_SCALAR_FIELD) {
-            revert Semaphore__GroupIdIsNotLessThanSnarkScalarField();
-        }
-
         if (getMerkleTreeDepth(groupId) != 0) {
             revert Semaphore__GroupAlreadyExists();
         }
 
-        groups[groupId].init(merkleTreeDepth, zeroValue);
+        merkleTree[groupId].init(merkleTreeDepth, zeroValue);
 
         emit GroupCreated(groupId, merkleTreeDepth, zeroValue);
     }
@@ -45,11 +40,12 @@ abstract contract SemaphoreGroups is Context, ISemaphoreGroups {
             revert Semaphore__GroupDoesNotExist();
         }
 
-        groups[groupId].insert(identityCommitment);
+        merkleTree[groupId].insert(identityCommitment);
 
         uint256 merkleTreeRoot = getMerkleTreeRoot(groupId);
+        uint256 index = getNumberOfMerkleTreeLeaves(groupId) - 1;
 
-        emit MemberAdded(groupId, identityCommitment, merkleTreeRoot);
+        emit MemberAdded(groupId, index, identityCommitment, merkleTreeRoot);
     }
 
     /// @dev Updates an identity commitment of an existing group. A proof of membership is
@@ -70,11 +66,12 @@ abstract contract SemaphoreGroups is Context, ISemaphoreGroups {
             revert Semaphore__GroupDoesNotExist();
         }
 
-        groups[groupId].update(identityCommitment, newIdentityCommitment, proofSiblings, proofPathIndices);
+        merkleTree[groupId].update(identityCommitment, newIdentityCommitment, proofSiblings, proofPathIndices);
 
         uint256 merkleTreeRoot = getMerkleTreeRoot(groupId);
+        uint256 index = proofPathIndicesToMemberIndex(proofPathIndices);
 
-        emit MemberUpdated(groupId, identityCommitment, newIdentityCommitment, merkleTreeRoot);
+        emit MemberUpdated(groupId, index, identityCommitment, newIdentityCommitment, merkleTreeRoot);
     }
 
     /// @dev Removes an identity commitment from an existing group. A proof of membership is
@@ -93,25 +90,49 @@ abstract contract SemaphoreGroups is Context, ISemaphoreGroups {
             revert Semaphore__GroupDoesNotExist();
         }
 
-        groups[groupId].remove(identityCommitment, proofSiblings, proofPathIndices);
+        merkleTree[groupId].remove(identityCommitment, proofSiblings, proofPathIndices);
 
         uint256 merkleTreeRoot = getMerkleTreeRoot(groupId);
+        uint256 index = proofPathIndicesToMemberIndex(proofPathIndices);
 
-        emit MemberRemoved(groupId, identityCommitment, merkleTreeRoot);
+        emit MemberRemoved(groupId, index, identityCommitment, merkleTreeRoot);
     }
 
     /// @dev See {ISemaphoreGroups-getMerkleTreeRoot}.
     function getMerkleTreeRoot(uint256 groupId) public view virtual override returns (uint256) {
-        return groups[groupId].root;
+        return merkleTree[groupId].root;
     }
 
     /// @dev See {ISemaphoreGroups-getMerkleTreeDepth}.
     function getMerkleTreeDepth(uint256 groupId) public view virtual override returns (uint256) {
-        return groups[groupId].depth;
+        return merkleTree[groupId].depth;
     }
 
     /// @dev See {ISemaphoreGroups-getNumberOfMerkleTreeLeaves}.
     function getNumberOfMerkleTreeLeaves(uint256 groupId) public view virtual override returns (uint256) {
-        return groups[groupId].numberOfLeaves;
+        return merkleTree[groupId].numberOfLeaves;
+    }
+
+    /// @dev Converts the path indices of a Merkle proof to the identity commitment index in the tree.
+    /// @param proofPathIndices: Path of the proof of membership.
+    /// @return Index of a group member.
+    function proofPathIndicesToMemberIndex(uint8[] calldata proofPathIndices) private pure returns (uint256) {
+        uint256 memberIndex = 0;
+
+        for (uint8 i = uint8(proofPathIndices.length); i > 0; ) {
+            if (memberIndex > 0 || proofPathIndices[i - 1] != 0) {
+                memberIndex *= 2;
+
+                if (proofPathIndices[i - 1] == 1) {
+                    memberIndex += 1;
+                }
+            }
+
+            unchecked {
+                --i;
+            }
+        }
+
+        return memberIndex;
     }
 }

packages/contracts/contracts/extensions/SemaphoreVoting.sol

@@ -2,29 +2,20 @@
 pragma solidity 0.8.4;
 
 import "../interfaces/ISemaphoreVoting.sol";
-import "../base/SemaphoreCore.sol";
+import "../interfaces/ISemaphoreVerifier.sol";
 import "../base/SemaphoreGroups.sol";
 
 /// @title Semaphore voting contract.
 /// @dev The following code allows you to create polls, add voters and allow them to vote anonymously.
-contract SemaphoreVoting is ISemaphoreVoting, SemaphoreCore, SemaphoreGroups {
-    /// @dev Gets a tree depth and returns its verifier address.
-    mapping(uint256 => IVerifier) internal verifiers;
+contract SemaphoreVoting is ISemaphoreVoting, SemaphoreGroups {
+    ISemaphoreVerifier public verifier;
 
     /// @dev Gets a poll id and returns the poll data.
     mapping(uint256 => Poll) internal polls;
 
-    /// @dev Initializes the Semaphore verifiers used to verify the user's ZK proofs.
-    /// @param _verifiers: List of Semaphore verifiers (address and related Merkle tree depth).
-    constructor(Verifier[] memory _verifiers) {
-        for (uint8 i = 0; i < _verifiers.length; ) {
-            verifiers[_verifiers[i].merkleTreeDepth] = IVerifier(_verifiers[i].contractAddress);
-
-            unchecked {
-                ++i;
-            }
-        }
-    }
+    /// @dev Gets a nullifier hash and returns true or false.
+    /// It is used to prevent double-voting.
+    mapping(uint256 => bool) internal nullifierHashes;
 
     /// @dev Checks if the poll coordinator is the transaction sender.
     /// @param pollId: Id of the poll.
@@ -36,13 +27,19 @@ contract SemaphoreVoting is ISemaphoreVoting, SemaphoreCore, SemaphoreGroups {
         _;
     }
 
+    /// @dev Initializes the Semaphore verifier used to verify the user's ZK proofs.
+    /// @param _verifier: Semaphore verifier address.
+    constructor(ISemaphoreVerifier _verifier) {
+        verifier = _verifier;
+    }
+
     /// @dev See {ISemaphoreVoting-createPoll}.
     function createPoll(
         uint256 pollId,
         address coordinator,
         uint256 merkleTreeDepth
     ) public override {
-        if (address(verifiers[merkleTreeDepth]) == address(0)) {
+        if (merkleTreeDepth < 16 || merkleTreeDepth > 32) {
             revert Semaphore__MerkleTreeDepthIsNotSupported();
         }
 
@@ -79,26 +76,27 @@ contract SemaphoreVoting is ISemaphoreVoting, SemaphoreCore, SemaphoreGroups {
 
     /// @dev See {ISemaphoreVoting-castVote}.
     function castVote(
-        bytes32 vote,
+        uint256 vote,
         uint256 nullifierHash,
         uint256 pollId,
         uint256[8] calldata proof
-    ) public override onlyCoordinator(pollId) {
+    ) public override {
         Poll memory poll = polls[pollId];
 
         if (poll.state != PollState.Ongoing) {
             revert Semaphore__PollIsNotOngoing();
         }
 
+        if (nullifierHashes[nullifierHash]) {
+            revert Semaphore__YouAreUsingTheSameNillifierTwice();
+        }
+
         uint256 merkleTreeDepth = getMerkleTreeDepth(pollId);
         uint256 merkleTreeRoot = getMerkleTreeRoot(pollId);
 
-        IVerifier verifier = verifiers[merkleTreeDepth];
+        verifier.verifyProof(merkleTreeRoot, nullifierHash, vote, pollId, proof, merkleTreeDepth);
 
-        _verifyProof(vote, merkleTreeRoot, nullifierHash, pollId, proof, verifier);
-
-        // Prevent double-voting (nullifierHash = hash(pollId + identityNullifier)).
-        _saveNullifierHash(nullifierHash);
+        nullifierHashes[nullifierHash] = true;
 
         emit VoteAdded(pollId, vote);
     }

packages/contracts/contracts/extensions/SemaphoreWhistleblowing.sol

@@ -2,32 +2,19 @@
 pragma solidity 0.8.4;
 
 import "../interfaces/ISemaphoreWhistleblowing.sol";
-import "../base/SemaphoreCore.sol";
+import "../interfaces/ISemaphoreVerifier.sol";
 import "../base/SemaphoreGroups.sol";
 
 /// @title Semaphore whistleblowing contract.
 /// @dev The following code allows you to create entities for whistleblowers (e.g. non-profit
 /// organization, newspaper) and to allow them to publish news leaks anonymously.
 /// Leaks can be IPFS hashes, permanent links or other kinds of reference.
-contract SemaphoreWhistleblowing is ISemaphoreWhistleblowing, SemaphoreCore, SemaphoreGroups {
-    /// @dev Gets a tree depth and returns its verifier address.
-    mapping(uint256 => IVerifier) internal verifiers;
+contract SemaphoreWhistleblowing is ISemaphoreWhistleblowing, SemaphoreGroups {
+    ISemaphoreVerifier public verifier;
 
     /// @dev Gets an editor address and return their entity.
     mapping(address => uint256) private entities;
 
-    /// @dev Initializes the Semaphore verifiers used to verify the user's ZK proofs.
-    /// @param _verifiers: List of Semaphore verifiers (address and related Merkle tree depth).
-    constructor(Verifier[] memory _verifiers) {
-        for (uint8 i = 0; i < _verifiers.length; ) {
-            verifiers[_verifiers[i].merkleTreeDepth] = IVerifier(_verifiers[i].contractAddress);
-
-            unchecked {
-                ++i;
-            }
-        }
-    }
-
     /// @dev Checks if the editor is the transaction sender.
     /// @param entityId: Id of the entity.
     modifier onlyEditor(uint256 entityId) {
@@ -38,13 +25,19 @@ contract SemaphoreWhistleblowing is ISemaphoreWhistleblowing, SemaphoreCore, Sem
         _;
     }
 
+    /// @dev Initializes the Semaphore verifier used to verify the user's ZK proofs.
+    /// @param _verifier: Semaphore verifier address.
+    constructor(ISemaphoreVerifier _verifier) {
+        verifier = _verifier;
+    }
+
     /// @dev See {ISemaphoreWhistleblowing-createEntity}.
     function createEntity(
         uint256 entityId,
         address editor,
         uint256 merkleTreeDepth
     ) public override {
-        if (address(verifiers[merkleTreeDepth]) == address(0)) {
+        if (merkleTreeDepth < 16 || merkleTreeDepth > 32) {
             revert Semaphore__MerkleTreeDepthIsNotSupported();
         }
 
@@ -72,17 +65,15 @@ contract SemaphoreWhistleblowing is ISemaphoreWhistleblowing, SemaphoreCore, Sem
 
     /// @dev See {ISemaphoreWhistleblowing-publishLeak}.
     function publishLeak(
-        bytes32 leak,
+        uint256 leak,
         uint256 nullifierHash,
         uint256 entityId,
         uint256[8] calldata proof
-    ) public override onlyEditor(entityId) {
+    ) public override {
         uint256 merkleTreeDepth = getMerkleTreeDepth(entityId);
         uint256 merkleTreeRoot = getMerkleTreeRoot(entityId);
 
-        IVerifier verifier = verifiers[merkleTreeDepth];
-
-        _verifyProof(leak, merkleTreeRoot, nullifierHash, entityId, proof, verifier);
+        verifier.verifyProof(merkleTreeRoot, nullifierHash, leak, entityId, proof, merkleTreeDepth);
 
         emit LeakPublished(entityId, leak);
     }

packages/contracts/contracts/interfaces/ISemaphore.sol

@@ -8,17 +8,19 @@ interface ISemaphore {
     error Semaphore__MerkleTreeDepthIsNotSupported();
     error Semaphore__MerkleTreeRootIsExpired();
     error Semaphore__MerkleTreeRootIsNotPartOfTheGroup();
+    error Semaphore__YouAreUsingTheSameNillifierTwice();
 
     struct Verifier {
         address contractAddress;
         uint256 merkleTreeDepth;
     }
 
-    /// It defines all the parameters needed to check whether a
-    /// zero-knowledge proof generated with a certain Merkle tree is still valid.
-    struct MerkleTreeExpiry {
-        uint256 rootDuration;
-        mapping(uint256 => uint256) rootCreationDates;
+    /// It defines all the group parameters, in addition to those in the Merkle tree.
+    struct Group {
+        address admin;
+        uint256 merkleRootDuration;
+        mapping(uint256 => uint256) merkleRootCreationDates;
+        mapping(uint256 => bool) nullifierHashes;
     }
 
     /// @dev Emitted when an admin is assigned to a group.
@@ -29,8 +31,17 @@ interface ISemaphore {
 
     /// @dev Emitted when a Semaphore proof is verified.
     /// @param groupId: Id of the group.
+    /// @param merkleTreeRoot: Root of the Merkle tree.
+    /// @param externalNullifier: External nullifier.
+    /// @param nullifierHash: Nullifier hash.
     /// @param signal: Semaphore signal.
-    event ProofVerified(uint256 indexed groupId, bytes32 signal);
+    event ProofVerified(
+        uint256 indexed groupId,
+        uint256 merkleTreeRoot,
+        uint256 externalNullifier,
+        uint256 nullifierHash,
+        uint256 signal
+    );
 
     /// @dev Saves the nullifier hash to avoid double signaling and emits an event
     /// if the zero-knowledge proof is valid.
@@ -43,7 +54,7 @@ interface ISemaphore {
     function verifyProof(
         uint256 groupId,
         uint256 merkleTreeRoot,
-        bytes32 signal,
+        uint256 signal,
         uint256 nullifierHash,
         uint256 externalNullifier,
         uint256[8] calldata proof

packages/contracts/contracts/interfaces/ISemaphoreGroups.sol

@@ -16,17 +16,20 @@ interface ISemaphoreGroups {
 
     /// @dev Emitted when a new identity commitment is added.
     /// @param groupId: Group id of the group.
+    /// @param index: Identity commitment index.
     /// @param identityCommitment: New identity commitment.
     /// @param merkleTreeRoot: New root hash of the tree.
-    event MemberAdded(uint256 indexed groupId, uint256 identityCommitment, uint256 merkleTreeRoot);
+    event MemberAdded(uint256 indexed groupId, uint256 index, uint256 identityCommitment, uint256 merkleTreeRoot);
 
     /// @dev Emitted when an identity commitment is updated.
     /// @param groupId: Group id of the group.
-    /// @param identityCommitment: New identity commitment.
+    /// @param index: Identity commitment index.
+    /// @param identityCommitment: Existing identity commitment to be updated.
     /// @param newIdentityCommitment: New identity commitment.
     /// @param merkleTreeRoot: New root hash of the tree.
     event MemberUpdated(
         uint256 indexed groupId,
+        uint256 index,
         uint256 identityCommitment,
         uint256 newIdentityCommitment,
         uint256 merkleTreeRoot
@@ -34,9 +37,10 @@ interface ISemaphoreGroups {
 
     /// @dev Emitted when a new identity commitment is removed.
     /// @param groupId: Group id of the group.
+    /// @param index: Identity commitment index.
     /// @param identityCommitment: Existing identity commitment to be removed.
     /// @param merkleTreeRoot: New root hash of the tree.
-    event MemberRemoved(uint256 indexed groupId, uint256 identityCommitment, uint256 merkleTreeRoot);
+    event MemberRemoved(uint256 indexed groupId, uint256 index, uint256 identityCommitment, uint256 merkleTreeRoot);
 
     /// @dev Returns the last root hash of a group.
     /// @param groupId: Id of the group.

packages/contracts/contracts/interfaces/ISemaphoreVerifier.sol

@@ -0,0 +1,38 @@
+//SPDX-License-Identifier: MIT
+pragma solidity 0.8.4;
+
+import "../base/Pairing.sol";
+
+/// @title SemaphoreVerifier interface.
+/// @dev Interface of SemaphoreVerifier contract.
+interface ISemaphoreVerifier {
+    struct VerificationKey {
+        Pairing.G1Point alfa1;
+        Pairing.G2Point beta2;
+        Pairing.G2Point gamma2;
+        Pairing.G2Point delta2;
+        Pairing.G1Point[] IC;
+    }
+
+    struct Proof {
+        Pairing.G1Point A;
+        Pairing.G2Point B;
+        Pairing.G1Point C;
+    }
+
+    /// @dev Verifies that the zero-knowledge proof is valid.
+    /// @param merkleTreeRoot: Root of the Merkle tree.
+    /// @param nullifierHash: Nullifier hash.
+    /// @param signal: Semaphore signal.
+    /// @param externalNullifier: External nullifier.
+    /// @param proof: Zero-knowledge proof.
+    /// @param merkleTreeDepth: Depth of the tree.
+    function verifyProof(
+        uint256 merkleTreeRoot,
+        uint256 nullifierHash,
+        uint256 signal,
+        uint256 externalNullifier,
+        uint256[8] calldata proof,
+        uint256 merkleTreeDepth
+    ) external view;
+}

packages/contracts/contracts/interfaces/ISemaphoreVoting.sol

@@ -8,6 +8,7 @@ interface ISemaphoreVoting {
     error Semaphore__MerkleTreeDepthIsNotSupported();
     error Semaphore__PollHasAlreadyBeenStarted();
     error Semaphore__PollIsNotOngoing();
+    error Semaphore__YouAreUsingTheSameNillifierTwice();
 
     enum PollState {
         Created,
@@ -39,7 +40,7 @@ interface ISemaphoreVoting {
     /// @dev Emitted when a user votes on a poll.
     /// @param pollId: Id of the poll.
     /// @param vote: User encrypted vote.
-    event VoteAdded(uint256 indexed pollId, bytes32 vote);
+    event VoteAdded(uint256 indexed pollId, uint256 vote);
 
     /// @dev Emitted when a poll is ended.
     /// @param pollId: Id of the poll.
@@ -73,7 +74,7 @@ interface ISemaphoreVoting {
     /// @param pollId: Id of the poll.
     /// @param proof: Private zk-proof parameters.
     function castVote(
-        bytes32 vote,
+        uint256 vote,
         uint256 nullifierHash,
         uint256 pollId,
         uint256[8] calldata proof

packages/contracts/contracts/interfaces/ISemaphoreWhistleblowing.sol

@@ -20,7 +20,7 @@ interface ISemaphoreWhistleblowing {
     /// @dev Emitted when a whistleblower publish a new leak.
     /// @param entityId: Id of the entity.
     /// @param leak: News leak.
-    event LeakPublished(uint256 indexed entityId, bytes32 leak);
+    event LeakPublished(uint256 indexed entityId, uint256 leak);
 
     /// @dev Creates an entity and the associated Merkle tree/group.
     /// @param entityId: Id of the entity.
@@ -55,7 +55,7 @@ interface ISemaphoreWhistleblowing {
     /// @param entityId: Id of the entity.
     /// @param proof: Private zk-proof parameters.
     function publishLeak(
-        bytes32 leak,
+        uint256 leak,
         uint256 nullifierHash,
         uint256 entityId,
         uint256[8] calldata proof

packages/contracts/contracts/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@semaphore-protocol/contracts",
-    "version": "2.1.0",
+    "version": "2.6.1",
     "description": "Semaphore contracts to manage groups and broadcast anonymous signals.",
     "license": "MIT",
     "files": [
@@ -20,11 +20,8 @@
         "circom",
         "proof-of-membership"
     ],
-    "homepage": "https://github.com/semaphore-protocol/semaphore.git#readme",
-    "repository": {
-        "type": "git",
-        "url": "git+https://github.com/semaphore-protocol/semaphore.git.git"
-    },
+    "repository": "https://github.com/semaphore-protocol/semaphore",
+    "homepage": "https://github.com/semaphore-protocol/semaphore/tree/main/packages/contracts",
     "bugs": {
         "url": "https://github.com/semaphore-protocol/semaphore.git/issues"
     },
@@ -32,7 +29,7 @@
         "access": "public"
     },
     "dependencies": {
-        "@openzeppelin/contracts": "4.4.2",
-        "@zk-kit/incremental-merkle-tree.sol": "1.3.0"
+        "@openzeppelin/contracts": "4.7.3",
+        "@zk-kit/incremental-merkle-tree.sol": "1.3.1"
     }
 }

packages/contracts/deployed-contracts/arbitrum.json

@@ -0,0 +1,24 @@
+{
+    "verifiers": {
+        "Verifier16": "0x6143ECd9Fd1A00EDe1046d456f8aab53a7D71609",
+        "Verifier17": "0xAc12fFFE354D6446eb50dd33E683B78FED73Fb02",
+        "Verifier18": "0x610aeF0F2da3CD1C8bDefe4BDB434Ee146E0C701",
+        "Verifier19": "0x5477725177035bbC9d70443eb921D29749D6FCb4",
+        "Verifier20": "0x3fB2C0988a37b76e760c44e6516aF720935f3136",
+        "Verifier21": "0xDc8f6B8A42836d4566256f4c6C53131DFD127DF8",
+        "Verifier22": "0x6962b5e706be5278eeCb01c286b50A48484632f2",
+        "Verifier23": "0x41e4796Bd89B4BF04013b559c93fC32E9a2BdF6B",
+        "Verifier24": "0xD528B1D1408ab3583af4694F92b0aFEbE33d5b60",
+        "Verifier25": "0x1683a27EF9c10c5286dB56412E1272cD0Ca733e7",
+        "Verifier26": "0x78194bB665d1E33b97eE45B1A755c15717E94C00",
+        "Verifier27": "0x997Dac00E6701Ef7F3518280E5a9922801126E42",
+        "Verifier28": "0xDd3C7f4cBA2467aE41c0F614A3c3E24bC80268c6",
+        "Verifier29": "0xe53eF12093933D5df5691EAbA3821bD1c1EB60Cd",
+        "Verifier30": "0x7FeA07c536ABBB0E7FB3c833376EE4EaDc21340e",
+        "Verifier31": "0xe4539a592df18936202480FBe77E47DE012F2178",
+        "Verifier32": "0x98c90845A7870e215cBd7265DDC653E6c07032F4"
+    },
+    "Semaphore": "0x86337c87A56117f8264bbaBA70e5a522C6E8A604",
+    "PoseidonT3": "0xe0c8d1e53D9Bfc9071F6564755FCFf6cC0dB61d0",
+    "IncrementalBinaryTree": "0x91cD2B8573629d00BeC72EA1188d446897BD3948"
+}

packages/contracts/deployed-contracts/goerli.json

@@ -0,0 +1,24 @@
+{
+    "verifiers": {
+        "Verifier16": "0xA5253ba39381Aa99c4C2C5A4D5C2deC036d06629",
+        "Verifier17": "0xe0418A5f8fBF051D6cbc41Ff29855Dd2a02201Ab",
+        "Verifier18": "0x7CdB3336d7d7c55Bce0FB1508594C54521656797",
+        "Verifier19": "0xbd870921d8A5398a3314C950d1fc63b8C3AB190B",
+        "Verifier20": "0x2a96c5696F85e3d2aa918496806B5c5a4D93E099",
+        "Verifier21": "0x5Ec7d851a52A2a25CEc528F42a7ACA8EcF4667Cd",
+        "Verifier22": "0x919d3d9c05FA7411e334deA5a763354fC7B6aA5b",
+        "Verifier23": "0x63917b00a6dA7865bEfdd107AfC83CC2e6BDE552",
+        "Verifier24": "0xd05CAd7d940114c1419098EE3cEA0776ab510E7D",
+        "Verifier25": "0x6D9862e6140D94E932d94c8BcE74a0BDD0ea5ACb",
+        "Verifier26": "0x8c29e0b77e32f704F03eeCE01c041192A5EB6c77",
+        "Verifier27": "0x066cC22f8CA2A8D90D7Ff77D8a10A27e629c9c4C",
+        "Verifier28": "0x698F9507f504E2BD238be7da56E8D9fee60C6D15",
+        "Verifier29": "0xbBfC2E201C3c3c6F50063c3Edb4746c6Fcb36346",
+        "Verifier30": "0x06bcD633988c1CE7Bd134DbE2C12119b6f3E4bD1",
+        "Verifier31": "0x133b69Ce47BF20C49368354914DF47519Ca6cCFE",
+        "Verifier32": "0xe2978F79cb4AF62e5C990EE5c7E12fb22ee22e2D"
+    },
+    "Semaphore": "0x5259d32659F1806ccAfcE593ED5a89eBAb85262f",
+    "PoseidonT3": "0xe0A452533853310C371b50Bd91BB9DCC8961350F",
+    "IncrementalBinaryTree": "0x61AE89E372492e53D941DECaaC9821649fa9B236"
+}

packages/contracts/hardhat.config.ts

@@ -13,26 +13,27 @@ import "./tasks/accounts"
 import "./tasks/deploy-semaphore"
 import "./tasks/deploy-semaphore-voting"
 import "./tasks/deploy-semaphore-whistleblowing"
-import "./tasks/deploy-verifier"
 
-dotenvConfig({ path: resolve(__dirname, "./.env") })
+dotenvConfig({ path: resolve(__dirname, "../../.env") })
 
-function getNetworks(): NetworksUserConfig | undefined {
-    if (process.env.INFURA_API_KEY && process.env.BACKEND_PRIVATE_KEY) {
-        const infuraApiKey = process.env.INFURA_API_KEY
-        const accounts = [`0x${process.env.BACKEND_PRIVATE_KEY}`]
+function getNetworks(): NetworksUserConfig {
+    if (!process.env.INFURA_API_KEY || !process.env.BACKEND_PRIVATE_KEY) {
+        return {}
+    }
 
-        return {
-            goerli: {
-                url: `https://goerli.infura.io/v3/${infuraApiKey}`,
-                chainId: 5,
-                accounts
-            },
-            arbitrum: {
-                url: "https://arb1.arbitrum.io/rpc",
-                chainId: 42161,
-                accounts
-            }
+    const infuraApiKey = process.env.INFURA_API_KEY
+    const accounts = [`0x${process.env.BACKEND_PRIVATE_KEY}`]
+
+    return {
+        goerli: {
+            url: `https://goerli.infura.io/v3/${infuraApiKey}`,
+            chainId: 5,
+            accounts
+        },
+        arbitrum: {
+            url: "https://arb1.arbitrum.io/rpc",
+            chainId: 42161,
+            accounts
         }
     }
 }

packages/contracts/package.json

@@ -0,0 +1,69 @@
+{
+    "name": "contracts",
+    "private": true,
+    "scripts": {
+        "start": "hardhat node",
+        "compile": "hardhat compile",
+        "deploy:semaphore": "hardhat deploy:semaphore",
+        "deploy:semaphore-voting": "hardhat deploy:semaphore-voting",
+        "deploy:semaphore-whistleblowing": "hardhat deploy:semaphore-whistleblowing",
+        "verify:contracts": "hardhat run scripts/verify-contracts.ts",
+        "test": "hardhat test",
+        "test:report-gas": "REPORT_GAS=true hardhat test",
+        "test:coverage": "hardhat coverage",
+        "typechain": "hardhat typechain",
+        "lint": "solhint 'contracts/**/*.sol'"
+    },
+    "devDependencies": {
+        "@nomiclabs/hardhat-ethers": "^2.0.6",
+        "@nomiclabs/hardhat-etherscan": "^3.1.0",
+        "@nomiclabs/hardhat-waffle": "^2.0.3",
+        "@semaphore-protocol/group": "workspace:packages/group",
+        "@semaphore-protocol/identity": "workspace:packages/identity",
+        "@semaphore-protocol/proof": "workspace:packages/proof",
+        "@typechain/ethers-v5": "^10.0.0",
+        "@typechain/hardhat": "^6.0.0",
+        "@types/chai": "^4.3.0",
+        "@types/download": "^8.0.1",
+        "@types/mocha": "^9.1.0",
+        "@types/node": "^17.0.12",
+        "@types/rimraf": "^3.0.2",
+        "chai": "^4.3.5",
+        "circomlib": "^2.0.2",
+        "circomlibjs": "^0.0.8",
+        "download": "^8.0.0",
+        "ethereum-waffle": "^3.4.4",
+        "ethers": "^5.6.8",
+        "hardhat": "^2.9.7",
+        "hardhat-gas-reporter": "^1.0.8",
+        "js-logger": "^1.6.1",
+        "prettier-plugin-solidity": "^1.0.0-beta.19",
+        "rimraf": "^3.0.2",
+        "snarkjs": "^0.4.13",
+        "solhint": "^3.3.6",
+        "solhint-plugin-prettier": "^0.0.5",
+        "solidity-coverage": "^0.7.21",
+        "ts-node": "^10.4.0",
+        "typechain": "^8.0.0"
+    },
+    "config": {
+        "solidity": {
+            "version": "0.8.4"
+        },
+        "paths": {
+            "contracts": "./contracts",
+            "circuit": "./circuit",
+            "tests": "./test",
+            "cache": "./cache",
+            "snarkjs-templates": "./snarkjs-templates",
+            "build": {
+                "contracts": "./build/contracts",
+                "typechain": "./build/typechain"
+            }
+        }
+    },
+    "dependencies": {
+        "@openzeppelin/contracts": "4.7.3",
+        "@zk-kit/incremental-merkle-tree.sol": "1.3.1"
+    }
+}

packages/contracts/scripts/utils.ts

@@ -0,0 +1,33 @@
+import { readFileSync, writeFileSync } from "fs"
+
+type DeployedContracts = {
+    Pairing?: string
+    SemaphoreVerifier?: string
+    Poseidon?: string
+    IncrementalBinaryTree?: string
+    Semaphore?: string
+}
+
+export function getDeployedContracts(network: string | undefined): DeployedContracts | null {
+    try {
+        return JSON.parse(readFileSync(`./deployed-contracts/${network}.json`, "utf8"))
+    } catch (error) {
+        return {}
+    }
+}
+
+export function saveDeployedContracts(network: string | undefined, newDeployedContracts: DeployedContracts) {
+    const deployedContracts = getDeployedContracts(network)
+
+    writeFileSync(
+        `./deployed-contracts/${network}.json`,
+        JSON.stringify(
+            {
+                ...deployedContracts,
+                ...newDeployedContracts
+            },
+            null,
+            4
+        )
+    )
+}

packages/contracts/scripts/verify-contracts.ts

@@ -0,0 +1,29 @@
+import { hardhatArguments, run } from "hardhat"
+import { getDeployedContracts } from "./utils"
+
+async function main() {
+    const deployedContracts = getDeployedContracts(hardhatArguments.network)
+
+    await run("verify:verify", {
+        address: deployedContracts.IncrementalBinaryTree
+    })
+
+    await run("verify:verify", {
+        address: deployedContracts.Semaphore
+    })
+
+    await run("verify:verify", {
+        address: deployedContracts.Pairing
+    })
+
+    await run("verify:verify", {
+        address: deployedContracts.SemaphoreVerifier
+    })
+}
+
+main()
+    .then(() => process.exit(0))
+    .catch((error) => {
+        console.error(error)
+        process.exit(1)
+    })

packages/contracts/tasks/accounts.ts

@@ -8,7 +8,7 @@ task("accounts", "Prints the list of accounts")
 
         if (logs) {
             for (const account of accounts) {
-                console.log(await account.getAddress())
+                console.info(await account.getAddress())
             }
         }
 

packages/contracts/tasks/deploy-semaphore-voting.ts

@@ -0,0 +1,73 @@
+import { poseidon_gencontract as poseidonContract } from "circomlibjs"
+import { Contract } from "ethers"
+import { task, types } from "hardhat/config"
+
+task("deploy:semaphore-voting", "Deploy a SemaphoreVoting contract")
+    .addOptionalParam<boolean>("logs", "Print the logs", true, types.boolean)
+    .setAction(async ({ logs }, { ethers }): Promise<Contract> => {
+        const PairingFactory = await ethers.getContractFactory("Pairing")
+        const pairing = await PairingFactory.deploy()
+
+        await pairing.deployed()
+
+        if (logs) {
+            console.info(`Pairing library has been deployed to: ${pairing.address}`)
+        }
+
+        const SemaphoreVerifierFactory = await ethers.getContractFactory("SemaphoreVerifier", {
+            libraries: {
+                Pairing: pairing.address
+            }
+        })
+
+        const semaphoreVerifier = await SemaphoreVerifierFactory.deploy()
+
+        await semaphoreVerifier.deployed()
+
+        if (logs) {
+            console.info(`SemaphoreVerifier contract has been deployed to: ${semaphoreVerifier.address}`)
+        }
+
+        const poseidonABI = poseidonContract.generateABI(2)
+        const poseidonBytecode = poseidonContract.createCode(2)
+
+        const [signer] = await ethers.getSigners()
+
+        const PoseidonFactory = new ethers.ContractFactory(poseidonABI, poseidonBytecode, signer)
+        const poseidon = await PoseidonFactory.deploy()
+
+        await poseidon.deployed()
+
+        if (logs) {
+            console.info(`Poseidon library has been deployed to: ${poseidon.address}`)
+        }
+
+        const IncrementalBinaryTreeFactory = await ethers.getContractFactory("IncrementalBinaryTree", {
+            libraries: {
+                PoseidonT3: poseidon.address
+            }
+        })
+        const incrementalBinaryTree = await IncrementalBinaryTreeFactory.deploy()
+
+        await incrementalBinaryTree.deployed()
+
+        if (logs) {
+            console.info(`IncrementalBinaryTree library has been deployed to: ${incrementalBinaryTree.address}`)
+        }
+
+        const SemaphoreVotingFactory = await ethers.getContractFactory("SemaphoreVoting", {
+            libraries: {
+                IncrementalBinaryTree: incrementalBinaryTree.address
+            }
+        })
+
+        const semaphoreVoting = await SemaphoreVotingFactory.deploy(semaphoreVerifier.address)
+
+        await semaphoreVoting.deployed()
+
+        if (logs) {
+            console.info(`SemaphoreVoting contract has been deployed to: ${semaphoreVoting.address}`)
+        }
+
+        return semaphoreVoting
+    })

packages/contracts/tasks/deploy-semaphore-whistleblowing.ts

@@ -0,0 +1,73 @@
+import { poseidon_gencontract as poseidonContract } from "circomlibjs"
+import { Contract } from "ethers"
+import { task, types } from "hardhat/config"
+
+task("deploy:semaphore-whistleblowing", "Deploy a SemaphoreWhistleblowing contract")
+    .addOptionalParam<boolean>("logs", "Print the logs", true, types.boolean)
+    .setAction(async ({ logs }, { ethers }): Promise<Contract> => {
+        const PairingFactory = await ethers.getContractFactory("Pairing")
+        const pairing = await PairingFactory.deploy()
+
+        await pairing.deployed()
+
+        if (logs) {
+            console.info(`Pairing library has been deployed to: ${pairing.address}`)
+        }
+
+        const SemaphoreVerifierFactory = await ethers.getContractFactory("SemaphoreVerifier", {
+            libraries: {
+                Pairing: pairing.address
+            }
+        })
+
+        const semaphoreVerifier = await SemaphoreVerifierFactory.deploy()
+
+        await semaphoreVerifier.deployed()
+
+        if (logs) {
+            console.info(`SemaphoreVerifier contract has been deployed to: ${semaphoreVerifier.address}`)
+        }
+
+        const poseidonABI = poseidonContract.generateABI(2)
+        const poseidonBytecode = poseidonContract.createCode(2)
+
+        const [signer] = await ethers.getSigners()
+
+        const PoseidonFactory = new ethers.ContractFactory(poseidonABI, poseidonBytecode, signer)
+        const poseidon = await PoseidonFactory.deploy()
+
+        await poseidon.deployed()
+
+        if (logs) {
+            console.info(`Poseidon library has been deployed to: ${poseidon.address}`)
+        }
+
+        const IncrementalBinaryTreeFactory = await ethers.getContractFactory("IncrementalBinaryTree", {
+            libraries: {
+                PoseidonT3: poseidon.address
+            }
+        })
+        const incrementalBinaryTree = await IncrementalBinaryTreeFactory.deploy()
+
+        await incrementalBinaryTree.deployed()
+
+        if (logs) {
+            console.info(`IncrementalBinaryTree library has been deployed to: ${incrementalBinaryTree.address}`)
+        }
+
+        const SemaphoreWhistleblowingFactory = await ethers.getContractFactory("SemaphoreWhistleblowing", {
+            libraries: {
+                IncrementalBinaryTree: incrementalBinaryTree.address
+            }
+        })
+
+        const semaphoreWhistleblowing = await SemaphoreWhistleblowingFactory.deploy(semaphoreVerifier.address)
+
+        await semaphoreWhistleblowing.deployed()
+
+        if (logs) {
+            console.info(`SemaphoreWhistleblowing contract has been deployed to: ${semaphoreWhistleblowing.address}`)
+        }
+
+        return semaphoreWhistleblowing
+    })

packages/contracts/tasks/deploy-semaphore.ts

@@ -0,0 +1,118 @@
+import { poseidon_gencontract as poseidonContract } from "circomlibjs"
+import { Contract } from "ethers"
+import { task, types } from "hardhat/config"
+import { saveDeployedContracts } from "../scripts/utils"
+
+task("deploy:semaphore", "Deploy a Semaphore contract")
+    .addOptionalParam<boolean>("pairing", "Pairing library address", undefined, types.string)
+    .addOptionalParam<boolean>("semaphoreVerifier", "SemaphoreVerifier contract address", undefined, types.string)
+    .addOptionalParam<boolean>("poseidon", "Poseidon library address", undefined, types.string)
+    .addOptionalParam<boolean>(
+        "incrementalBinaryTree",
+        "IncrementalBinaryTree library address",
+        undefined,
+        types.string
+    )
+    .addOptionalParam<boolean>("logs", "Print the logs", true, types.boolean)
+    .setAction(
+        async (
+            {
+                logs,
+                pairing: pairingAddress,
+                semaphoreVerifier: semaphoreVerifierAddress,
+                poseidon: poseidonAddress,
+                incrementalBinaryTree: incrementalBinaryTreeAddress
+            },
+            { ethers, hardhatArguments }
+        ): Promise<Contract> => {
+            if (!semaphoreVerifierAddress) {
+                if (!pairingAddress) {
+                    const PairingFactory = await ethers.getContractFactory("Pairing")
+                    const pairing = await PairingFactory.deploy()
+
+                    await pairing.deployed()
+
+                    if (logs) {
+                        console.info(`Pairing library has been deployed to: ${pairing.address}`)
+                    }
+
+                    pairingAddress = pairing.address
+                }
+
+                const SemaphoreVerifierFactory = await ethers.getContractFactory("SemaphoreVerifier", {
+                    libraries: {
+                        Pairing: pairingAddress
+                    }
+                })
+
+                const semaphoreVerifier = await SemaphoreVerifierFactory.deploy()
+
+                await semaphoreVerifier.deployed()
+
+                if (logs) {
+                    console.info(`SemaphoreVerifier contract has been deployed to: ${semaphoreVerifier.address}`)
+                }
+
+                semaphoreVerifierAddress = semaphoreVerifier.address
+            }
+
+            if (!incrementalBinaryTreeAddress) {
+                if (!poseidonAddress) {
+                    const poseidonABI = poseidonContract.generateABI(2)
+                    const poseidonBytecode = poseidonContract.createCode(2)
+
+                    const [signer] = await ethers.getSigners()
+
+                    const PoseidonFactory = new ethers.ContractFactory(poseidonABI, poseidonBytecode, signer)
+                    const poseidon = await PoseidonFactory.deploy()
+
+                    await poseidon.deployed()
+
+                    if (logs) {
+                        console.info(`Poseidon library has been deployed to: ${poseidon.address}`)
+                    }
+
+                    poseidonAddress = poseidon.address
+                }
+
+                const IncrementalBinaryTreeFactory = await ethers.getContractFactory("IncrementalBinaryTree", {
+                    libraries: {
+                        PoseidonT3: poseidonAddress
+                    }
+                })
+                const incrementalBinaryTree = await IncrementalBinaryTreeFactory.deploy()
+
+                await incrementalBinaryTree.deployed()
+
+                if (logs) {
+                    console.info(`IncrementalBinaryTree library has been deployed to: ${incrementalBinaryTree.address}`)
+                }
+
+                incrementalBinaryTreeAddress = incrementalBinaryTree.address
+            }
+
+            const SemaphoreFactory = await ethers.getContractFactory("Semaphore", {
+                libraries: {
+                    IncrementalBinaryTree: incrementalBinaryTreeAddress
+                }
+            })
+
+            const semaphore = await SemaphoreFactory.deploy(semaphoreVerifierAddress)
+
+            await semaphore.deployed()
+
+            if (logs) {
+                console.info(`Semaphore contract has been deployed to: ${semaphore.address}`)
+            }
+
+            saveDeployedContracts(hardhatArguments.network, {
+                Pairing: pairingAddress,
+                SemaphoreVerifier: semaphoreVerifierAddress,
+                Poseidon: poseidonAddress,
+                IncrementalBinaryTree: incrementalBinaryTreeAddress,
+                Semaphore: semaphore.address
+            })
+
+            return semaphore
+        }
+    )

packages/contracts/test/Semaphore.ts

@@ -1,11 +1,12 @@
+/* eslint-disable @typescript-eslint/no-shadow */
+/* eslint-disable jest/valid-expect */
 import { Group } from "@semaphore-protocol/group"
 import { Identity } from "@semaphore-protocol/identity"
 import { FullProof, generateProof, packToSolidityProof, SolidityProof } from "@semaphore-protocol/proof"
 import { expect } from "chai"
-import { constants, Signer, utils } from "ethers"
+import { constants, Signer } from "ethers"
 import { run } from "hardhat"
 import { Semaphore } from "../build/typechain"
-import { config } from "../package.json"
 import { createIdentityCommitments } from "./utils"
 
 describe("Semaphore", () => {
@@ -13,18 +14,16 @@ describe("Semaphore", () => {
     let signers: Signer[]
     let accounts: string[]
 
-    const treeDepth = Number(process.env.TREE_DEPTH)
+    const treeDepth = Number(process.env.TREE_DEPTH) || 20
     const groupId = 1
     const members = createIdentityCommitments(3)
 
-    const wasmFilePath = `${config.paths.build["snark-artifacts"]}/semaphore.wasm`
-    const zkeyFilePath = `${config.paths.build["snark-artifacts"]}/semaphore.zkey`
+    const wasmFilePath = `../../snark-artifacts/${treeDepth}/semaphore.wasm`
+    const zkeyFilePath = `../../snark-artifacts/${treeDepth}/semaphore.zkey`
 
     before(async () => {
-        const { address: verifierAddress } = await run("deploy:verifier", { logs: false, depth: treeDepth })
         contract = await run("deploy:semaphore", {
-            logs: false,
-            verifiers: [{ merkleTreeDepth: treeDepth, contractAddress: verifierAddress }]
+            logs: false
         })
 
         signers = await run("accounts", { logs: false })
@@ -95,25 +94,17 @@ describe("Semaphore", () => {
         })
 
         it("Should add a new member in an existing group", async () => {
+            const group = new Group(treeDepth)
+
+            group.addMember(members[0])
+
             const transaction = contract.addMember(groupId, members[0])
 
-            await expect(transaction)
-                .to.emit(contract, "MemberAdded")
-                .withArgs(
-                    groupId,
-                    members[0],
-                    "18951329906296061785889394467312334959162736293275411745101070722914184798221"
-                )
+            await expect(transaction).to.emit(contract, "MemberAdded").withArgs(groupId, 0, members[0], group.root)
         })
     })
 
     describe("# addMembers", () => {
-        it("Should not add members if the caller is not the group admin", async () => {
-            const transaction = contract.connect(signers[1]).addMembers(groupId, [1, 2, 3])
-
-            await expect(transaction).to.be.revertedWith("Semaphore__CallerIsNotTheGroupAdmin()")
-        })
-
         it("Should add new members to an existing group", async () => {
             const groupId = 3
             const members = [BigInt(1), BigInt(2), BigInt(3)]
@@ -125,13 +116,15 @@ describe("Semaphore", () => {
 
             const transaction = contract.addMembers(groupId, members)
 
-            await expect(transaction).to.emit(contract, "MemberAdded").withArgs(groupId, BigInt(3), group.root)
+            await expect(transaction).to.emit(contract, "MemberAdded").withArgs(groupId, 2, BigInt(3), group.root)
         })
     })
 
     describe("# updateMember", () => {
         it("Should not update a member if the caller is not the group admin", async () => {
-            const transaction = contract.connect(signers[1]).updateMember(groupId, members[0], 1, [0, 1], [0, 1])
+            const member = BigInt(2)
+
+            const transaction = contract.connect(signers[1]).updateMember(groupId, member, 1, [0, 1], [0, 1])
 
             await expect(transaction).to.be.revertedWith("Semaphore__CallerIsNotTheGroupAdmin()")
         })
@@ -148,17 +141,21 @@ describe("Semaphore", () => {
             await contract["createGroup(uint256,uint256,uint256,address)"](groupId, treeDepth, 0, accounts[0])
             await contract.addMembers(groupId, members)
 
-            const { siblings, pathIndices, root } = group.generateProofOfMembership(0)
+            const { siblings, pathIndices, root } = group.generateMerkleProof(0)
 
             const transaction = contract.updateMember(groupId, BigInt(1), BigInt(4), siblings, pathIndices)
 
-            await expect(transaction).to.emit(contract, "MemberUpdated").withArgs(groupId, BigInt(1), BigInt(4), root)
+            await expect(transaction)
+                .to.emit(contract, "MemberUpdated")
+                .withArgs(groupId, 0, BigInt(1), BigInt(4), root)
         })
     })
 
     describe("# removeMember", () => {
         it("Should not remove a member if the caller is not the group admin", async () => {
-            const transaction = contract.connect(signers[1]).removeMember(groupId, members[0], [0, 1], [0, 1])
+            const member = BigInt(2)
+
+            const transaction = contract.connect(signers[1]).removeMember(groupId, member, [0, 1], [0, 1])
 
             await expect(transaction).to.be.revertedWith("Semaphore__CallerIsNotTheGroupAdmin()")
         })
@@ -170,21 +167,21 @@ describe("Semaphore", () => {
 
             group.addMembers(members)
 
-            group.removeMember(0)
+            group.removeMember(2)
 
             await contract["createGroup(uint256,uint256,uint256,address)"](groupId, treeDepth, 0, accounts[0])
             await contract.addMembers(groupId, members)
 
-            const { siblings, pathIndices, root } = group.generateProofOfMembership(0)
+            const { siblings, pathIndices, root } = group.generateMerkleProof(2)
 
-            const transaction = contract.removeMember(groupId, BigInt(1), siblings, pathIndices)
+            const transaction = contract.removeMember(groupId, BigInt(3), siblings, pathIndices)
 
-            await expect(transaction).to.emit(contract, "MemberRemoved").withArgs(groupId, BigInt(1), root)
+            await expect(transaction).to.emit(contract, "MemberRemoved").withArgs(groupId, 2, BigInt(3), root)
         })
     })
 
     describe("# verifyProof", () => {
-        const signal = utils.formatBytes32String("Hello world")
+        const signal = 2
         const identity = new Identity("0")
 
         const group = new Group(treeDepth)
@@ -226,7 +223,7 @@ describe("Semaphore", () => {
                 solidityProof
             )
 
-            await expect(transaction).to.be.revertedWith("InvalidProof()")
+            await expect(transaction).to.be.revertedWith("Semaphore__InvalidProof()")
         })
 
         it("Should verify a proof for an onchain group correctly", async () => {
@@ -235,11 +232,32 @@ describe("Semaphore", () => {
                 group.root,
                 signal,
                 fullProof.publicSignals.nullifierHash,
-                fullProof.publicSignals.merkleRoot,
+                fullProof.publicSignals.merkleTreeRoot,
                 solidityProof
             )
 
-            await expect(transaction).to.emit(contract, "ProofVerified").withArgs(groupId, signal)
+            await expect(transaction)
+                .to.emit(contract, "ProofVerified")
+                .withArgs(
+                    groupId,
+                    group.root,
+                    fullProof.publicSignals.nullifierHash,
+                    fullProof.publicSignals.merkleTreeRoot,
+                    signal
+                )
+        })
+
+        it("Should not verify the same proof for an onchain group twice", async () => {
+            const transaction = contract.verifyProof(
+                groupId,
+                group.root,
+                signal,
+                fullProof.publicSignals.nullifierHash,
+                fullProof.publicSignals.merkleTreeRoot,
+                solidityProof
+            )
+
+            await expect(transaction).to.be.revertedWith("Semaphore__YouAreUsingTheSameNillifierTwice()")
         })
 
         it("Should not verify a proof if the Merkle tree root is expired", async () => {

packages/contracts/test/SemaphoreVoting.ts

@@ -1,36 +1,28 @@
-import { Identity } from "@semaphore-protocol/identity"
+/* eslint-disable jest/valid-expect */
 import { Group } from "@semaphore-protocol/group"
-import {
-    generateNullifierHash,
-    generateProof,
-    packToSolidityProof,
-    PublicSignals,
-    SolidityProof
-} from "@semaphore-protocol/proof"
+import { Identity } from "@semaphore-protocol/identity"
+import { generateProof, packToSolidityProof, PublicSignals, SolidityProof } from "@semaphore-protocol/proof"
 import { expect } from "chai"
-import { Signer, utils } from "ethers"
+import { Signer } from "ethers"
 import { ethers, run } from "hardhat"
 import { SemaphoreVoting } from "../build/typechain"
-import { config } from "../package.json"
 
 describe("SemaphoreVoting", () => {
     let contract: SemaphoreVoting
     let accounts: Signer[]
     let coordinator: string
 
-    const treeDepth = Number(process.env.TREE_DEPTH)
-    const pollIds = [BigInt(1), BigInt(2), BigInt(3)]
+    const treeDepth = Number(process.env.TREE_DEPTH) || 20
+    const pollIds = [1, 2, 3]
     const encryptionKey = BigInt(0)
     const decryptionKey = BigInt(0)
 
-    const wasmFilePath = `${config.paths.build["snark-artifacts"]}/semaphore.wasm`
-    const zkeyFilePath = `${config.paths.build["snark-artifacts"]}/semaphore.zkey`
+    const wasmFilePath = `../../snark-artifacts/${treeDepth}/semaphore.wasm`
+    const zkeyFilePath = `../../snark-artifacts/${treeDepth}/semaphore.zkey`
 
     before(async () => {
-        const { address: verifierAddress } = await run("deploy:verifier", { logs: false, depth: treeDepth })
         contract = await run("deploy:semaphore-voting", {
-            logs: false,
-            verifiers: [{ merkleTreeDepth: treeDepth, contractAddress: verifierAddress }]
+            logs: false
         })
 
         accounts = await ethers.getSigners()
@@ -44,16 +36,6 @@ describe("SemaphoreVoting", () => {
             await expect(transaction).to.be.revertedWith("Semaphore__MerkleTreeDepthIsNotSupported()")
         })
 
-        it("Should not create a poll greater than the snark scalar field", async () => {
-            const transaction = contract.createPoll(
-                BigInt("21888242871839275222246405745257275088548364400416034343698204186575808495618"),
-                coordinator,
-                treeDepth
-            )
-
-            await expect(transaction).to.be.revertedWith("Semaphore__GroupIdIsNotLessThanSnarkScalarField()")
-        })
-
         it("Should create a poll", async () => {
             const transaction = contract.createPoll(pollIds[0], coordinator, treeDepth)
 
@@ -93,36 +75,30 @@ describe("SemaphoreVoting", () => {
         })
 
         it("Should not add a voter if the caller is not the coordinator", async () => {
-            const identity = new Identity()
-            const identityCommitment = identity.generateCommitment()
+            const { commitment } = new Identity()
 
-            const transaction = contract.addVoter(pollIds[0], identityCommitment)
+            const transaction = contract.addVoter(pollIds[0], commitment)
 
             await expect(transaction).to.be.revertedWith("Semaphore__CallerIsNotThePollCoordinator()")
         })
 
         it("Should not add a voter if the poll has already been started", async () => {
-            const identity = new Identity()
-            const identityCommitment = identity.generateCommitment()
+            const { commitment } = new Identity()
 
-            const transaction = contract.connect(accounts[1]).addVoter(pollIds[0], identityCommitment)
+            const transaction = contract.connect(accounts[1]).addVoter(pollIds[0], commitment)
 
             await expect(transaction).to.be.revertedWith("Semaphore__PollHasAlreadyBeenStarted()")
         })
 
         it("Should add a voter to an existing poll", async () => {
-            const identity = new Identity("test")
-            const identityCommitment = identity.generateCommitment()
+            const { commitment } = new Identity("test")
+            const group = new Group(treeDepth)
 
-            const transaction = contract.connect(accounts[1]).addVoter(pollIds[1], identityCommitment)
+            group.addMember(commitment)
 
-            await expect(transaction)
-                .to.emit(contract, "MemberAdded")
-                .withArgs(
-                    pollIds[1],
-                    identityCommitment,
-                    "14787813191318312920980352979830075893203307366494541177071234930769373297362"
-                )
+            const transaction = contract.connect(accounts[1]).addVoter(pollIds[1], commitment)
+
+            await expect(transaction).to.emit(contract, "MemberAdded").withArgs(pollIds[1], 0, commitment, group.root)
         })
 
         it("Should return the correct number of poll voters", async () => {
@@ -134,13 +110,11 @@ describe("SemaphoreVoting", () => {
 
     describe("# castVote", () => {
         const identity = new Identity("test")
-        const identityCommitment = identity.generateCommitment()
-        const vote = "1"
-        const bytes32Vote = utils.formatBytes32String(vote)
+        const vote = 1
 
         const group = new Group(treeDepth)
 
-        group.addMembers([identityCommitment, BigInt(1)])
+        group.addMembers([identity.commitment, BigInt(1)])
 
         let solidityProof: SolidityProof
         let publicSignals: PublicSignals
@@ -159,42 +133,32 @@ describe("SemaphoreVoting", () => {
             solidityProof = packToSolidityProof(fullProof.proof)
         })
 
-        it("Should not cast a vote if the caller is not the coordinator", async () => {
-            const transaction = contract.castVote(bytes32Vote, publicSignals.nullifierHash, pollIds[0], solidityProof)
-
-            await expect(transaction).to.be.revertedWith("Semaphore__CallerIsNotThePollCoordinator()")
-        })
-
         it("Should not cast a vote if the poll is not ongoing", async () => {
             const transaction = contract
                 .connect(accounts[1])
-                .castVote(bytes32Vote, publicSignals.nullifierHash, pollIds[2], solidityProof)
+                .castVote(vote, publicSignals.nullifierHash, pollIds[2], solidityProof)
 
             await expect(transaction).to.be.revertedWith("Semaphore__PollIsNotOngoing()")
         })
 
         it("Should not cast a vote if the proof is not valid", async () => {
-            const nullifierHash = generateNullifierHash(pollIds[0], identity.getNullifier())
+            const transaction = contract.connect(accounts[1]).castVote(vote, 0, pollIds[1], solidityProof)
 
-            const transaction = contract
-                .connect(accounts[1])
-                .castVote(bytes32Vote, nullifierHash, pollIds[1], solidityProof)
-
-            await expect(transaction).to.be.revertedWith("InvalidProof()")
+            await expect(transaction).to.be.revertedWith("Semaphore__InvalidProof()")
         })
 
         it("Should cast a vote", async () => {
             const transaction = contract
                 .connect(accounts[1])
-                .castVote(bytes32Vote, publicSignals.nullifierHash, pollIds[1], solidityProof)
+                .castVote(vote, publicSignals.nullifierHash, pollIds[1], solidityProof)
 
-            await expect(transaction).to.emit(contract, "VoteAdded").withArgs(pollIds[1], bytes32Vote)
+            await expect(transaction).to.emit(contract, "VoteAdded").withArgs(pollIds[1], vote)
         })
 
         it("Should not cast a vote twice", async () => {
             const transaction = contract
                 .connect(accounts[1])
-                .castVote(bytes32Vote, publicSignals.nullifierHash, pollIds[1], solidityProof)
+                .castVote(vote, publicSignals.nullifierHash, pollIds[1], solidityProof)
 
             await expect(transaction).to.be.revertedWith("Semaphore__YouAreUsingTheSameNillifierTwice()")
         })

packages/contracts/test/SemaphoreWhistleblowing.ts

@@ -1,34 +1,26 @@
+/* eslint-disable jest/valid-expect */
 import { Group } from "@semaphore-protocol/group"
 import { Identity } from "@semaphore-protocol/identity"
-import {
-    generateNullifierHash,
-    generateProof,
-    packToSolidityProof,
-    PublicSignals,
-    SolidityProof
-} from "@semaphore-protocol/proof"
+import { generateProof, packToSolidityProof, PublicSignals, SolidityProof } from "@semaphore-protocol/proof"
 import { expect } from "chai"
 import { Signer, utils } from "ethers"
 import { ethers, run } from "hardhat"
 import { SemaphoreWhistleblowing } from "../build/typechain"
-import { config } from "../package.json"
 
 describe("SemaphoreWhistleblowing", () => {
     let contract: SemaphoreWhistleblowing
     let accounts: Signer[]
     let editor: string
 
-    const treeDepth = Number(process.env.TREE_DEPTH)
-    const entityIds = [BigInt(1), BigInt(2)]
+    const treeDepth = Number(process.env.TREE_DEPTH) || 20
+    const entityIds = [1, 2]
 
-    const wasmFilePath = `${config.paths.build["snark-artifacts"]}/semaphore.wasm`
-    const zkeyFilePath = `${config.paths.build["snark-artifacts"]}/semaphore.zkey`
+    const wasmFilePath = `../../snark-artifacts/${treeDepth}/semaphore.wasm`
+    const zkeyFilePath = `../../snark-artifacts/${treeDepth}/semaphore.zkey`
 
     before(async () => {
-        const { address: verifierAddress } = await run("deploy:verifier", { logs: false, depth: treeDepth })
         contract = await run("deploy:semaphore-whistleblowing", {
-            logs: false,
-            verifiers: [{ merkleTreeDepth: treeDepth, contractAddress: verifierAddress }]
+            logs: false
         })
 
         accounts = await ethers.getSigners()
@@ -42,16 +34,6 @@ describe("SemaphoreWhistleblowing", () => {
             await expect(transaction).to.be.revertedWith("Semaphore__MerkleTreeDepthIsNotSupported()")
         })
 
-        it("Should not create an entity greater than the snark scalar field", async () => {
-            const transaction = contract.createEntity(
-                BigInt("21888242871839275222246405745257275088548364400416034343698204186575808495618"),
-                editor,
-                treeDepth
-            )
-
-            await expect(transaction).to.be.revertedWith("Semaphore__GroupIdIsNotLessThanSnarkScalarField()")
-        })
-
         it("Should create an entity", async () => {
             const transaction = contract.createEntity(entityIds[0], editor, treeDepth)
 
@@ -67,27 +49,22 @@ describe("SemaphoreWhistleblowing", () => {
 
     describe("# addWhistleblower", () => {
         it("Should not add a whistleblower if the caller is not the editor", async () => {
-            const identity = new Identity()
-            const identityCommitment = identity.generateCommitment()
+            const { commitment } = new Identity()
 
-            const transaction = contract.addWhistleblower(entityIds[0], identityCommitment)
+            const transaction = contract.addWhistleblower(entityIds[0], commitment)
 
             await expect(transaction).to.be.revertedWith("Semaphore__CallerIsNotTheEditor()")
         })
 
         it("Should add a whistleblower to an existing entity", async () => {
-            const identity = new Identity("test")
-            const identityCommitment = identity.generateCommitment()
+            const { commitment } = new Identity("test")
+            const group = new Group(treeDepth)
 
-            const transaction = contract.connect(accounts[1]).addWhistleblower(entityIds[0], identityCommitment)
+            group.addMember(commitment)
 
-            await expect(transaction)
-                .to.emit(contract, "MemberAdded")
-                .withArgs(
-                    entityIds[0],
-                    identityCommitment,
-                    "14787813191318312920980352979830075893203307366494541177071234930769373297362"
-                )
+            const transaction = contract.connect(accounts[1]).addWhistleblower(entityIds[0], commitment)
+
+            await expect(transaction).to.emit(contract, "MemberAdded").withArgs(entityIds[0], 0, commitment, group.root)
         })
 
         it("Should return the correct number of whistleblowers of an entity", async () => {
@@ -99,58 +76,52 @@ describe("SemaphoreWhistleblowing", () => {
 
     describe("# removeWhistleblower", () => {
         it("Should not remove a whistleblower if the caller is not the editor", async () => {
-            const identity = new Identity()
-            const identityCommitment = identity.generateCommitment()
+            const { commitment } = new Identity()
             const group = new Group(treeDepth)
 
-            group.addMember(identityCommitment)
+            group.addMember(commitment)
 
-            const { siblings, pathIndices } = group.generateProofOfMembership(0)
+            const { siblings, pathIndices } = group.generateMerkleProof(0)
 
-            const transaction = contract.removeWhistleblower(entityIds[0], identityCommitment, siblings, pathIndices)
+            const transaction = contract.removeWhistleblower(entityIds[0], commitment, siblings, pathIndices)
 
             await expect(transaction).to.be.revertedWith("Semaphore__CallerIsNotTheEditor()")
         })
 
         it("Should remove a whistleblower from an existing entity", async () => {
-            const identity = new Identity("test")
-            const identityCommitment = identity.generateCommitment()
+            const { commitment } = new Identity("test")
             const group = new Group(treeDepth)
 
-            group.addMember(identityCommitment)
+            group.addMember(commitment)
 
-            const { siblings, pathIndices } = group.generateProofOfMembership(0)
+            const { siblings, pathIndices } = group.generateMerkleProof(0)
+
+            group.removeMember(0)
 
             const transaction = contract
                 .connect(accounts[1])
-                .removeWhistleblower(entityIds[0], identityCommitment, siblings, pathIndices)
+                .removeWhistleblower(entityIds[0], commitment, siblings, pathIndices)
 
             await expect(transaction)
                 .to.emit(contract, "MemberRemoved")
-                .withArgs(
-                    entityIds[0],
-                    identityCommitment,
-                    "15019797232609675441998260052101280400536945603062888308240081994073687793470"
-                )
+                .withArgs(entityIds[0], 0, commitment, group.root)
         })
     })
 
     describe("# publishLeak", () => {
         const identity = new Identity("test")
-        const identityCommitment = identity.generateCommitment()
-        const leak = "leak"
-        const bytes32Leak = utils.formatBytes32String(leak)
+        const leak = utils.formatBytes32String("This is a leak")
 
         const group = new Group(treeDepth)
 
-        group.addMembers([identityCommitment, BigInt(1)])
+        group.addMembers([identity.commitment, BigInt(1)])
 
         let solidityProof: SolidityProof
         let publicSignals: PublicSignals
 
         before(async () => {
             await contract.createEntity(entityIds[1], editor, treeDepth)
-            await contract.connect(accounts[1]).addWhistleblower(entityIds[1], identityCommitment)
+            await contract.connect(accounts[1]).addWhistleblower(entityIds[1], identity.commitment)
             await contract.connect(accounts[1]).addWhistleblower(entityIds[1], BigInt(1))
 
             const fullProof = await generateProof(identity, group, entityIds[1], leak, {
@@ -162,33 +133,18 @@ describe("SemaphoreWhistleblowing", () => {
             solidityProof = packToSolidityProof(fullProof.proof)
         })
 
-        it("Should not publish a leak if the caller is not the editor", async () => {
-            const transaction = contract.publishLeak(
-                bytes32Leak,
-                publicSignals.nullifierHash,
-                entityIds[0],
-                solidityProof
-            )
-
-            await expect(transaction).to.be.revertedWith("Semaphore__CallerIsNotTheEditor()")
-        })
-
         it("Should not publish a leak if the proof is not valid", async () => {
-            const nullifierHash = generateNullifierHash(entityIds[0], identity.getNullifier())
+            const transaction = contract.connect(accounts[1]).publishLeak(leak, 0, entityIds[1], solidityProof)
 
-            const transaction = contract
-                .connect(accounts[1])
-                .publishLeak(bytes32Leak, nullifierHash, entityIds[1], solidityProof)
-
-            await expect(transaction).to.be.revertedWith("InvalidProof()")
+            await expect(transaction).to.be.revertedWith("Semaphore__InvalidProof()")
         })
 
         it("Should publish a leak", async () => {
             const transaction = contract
                 .connect(accounts[1])
-                .publishLeak(bytes32Leak, publicSignals.nullifierHash, entityIds[1], solidityProof)
+                .publishLeak(leak, publicSignals.nullifierHash, entityIds[1], solidityProof)
 
-            await expect(transaction).to.emit(contract, "LeakPublished").withArgs(entityIds[1], bytes32Leak)
+            await expect(transaction).to.emit(contract, "LeakPublished").withArgs(entityIds[1], leak)
         })
     })
 })

packages/contracts/test/utils.ts

@@ -1,13 +1,13 @@
 import { Identity } from "@semaphore-protocol/identity"
 
+// eslint-disable-next-line import/prefer-default-export
 export function createIdentityCommitments(n: number): bigint[] {
     const identityCommitments: bigint[] = []
 
-    for (let i = 0; i < n; i++) {
-        const identity = new Identity(i.toString())
-        const identityCommitment = identity.generateCommitment()
+    for (let i = 0; i < n; i += 1) {
+        const { commitment } = new Identity(i.toString())
 
-        identityCommitments.push(identityCommitment)
+        identityCommitments.push(commitment)
     }
 
     return identityCommitments

packages/contracts/tsconfig.json

@@ -0,0 +1,10 @@
+{
+    "extends": "../../tsconfig.json",
+    "compilerOptions": {
+        "target": "ES2018",
+        "module": "CommonJS",
+        "outDir": "dist"
+    },
+    "include": ["scripts/**/*", "tasks/**/*", "test/**/*", "build/typechain/**/*", "types/**/*"],
+    "files": ["hardhat.config.ts"]
+}

packages/group/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 Ethereum Foundation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

packages/group/README.md

@@ -0,0 +1,127 @@
+<p align="center">
+    <h1 align="center">
+        Semaphore group
+    </h1>
+    <p align="center">A library to create and manage Semaphore groups.</p>
+</p>
+
+<p align="center">
+    <a href="https://github.com/semaphore-protocol">
+        <img src="https://img.shields.io/badge/project-Semaphore-blue.svg?style=flat-square">
+    </a>
+    <a href="https://github.com/semaphore-protocol/semaphore/blob/main/LICENSE">
+        <img alt="Github license" src="https://img.shields.io/github/license/semaphore-protocol/semaphore.svg?style=flat-square">
+    </a>
+    <a href="https://www.npmjs.com/package/@semaphore-protocol/group">
+        <img alt="NPM version" src="https://img.shields.io/npm/v/@semaphore-protocol/group?style=flat-square" />
+    </a>
+    <a href="https://npmjs.org/package/@semaphore-protocol/group">
+        <img alt="Downloads" src="https://img.shields.io/npm/dm/@semaphore-protocol/group.svg?style=flat-square" />
+    </a>
+    <a href="https://eslint.org/">
+        <img alt="Linter eslint" src="https://img.shields.io/badge/linter-eslint-8080f2?style=flat-square&logo=eslint" />
+    </a>
+    <a href="https://prettier.io/">
+        <img alt="Code style prettier" src="https://img.shields.io/badge/code%20style-prettier-f8bc45?style=flat-square&logo=prettier" />
+    </a>
+</p>
+
+<div align="center">
+    <h4>
+        <a href="https://github.com/semaphore-protocol/semaphore/blob/main/CONTRIBUTING.md">
+            👥 Contributing
+        </a>
+        <span>&nbsp;&nbsp;|&nbsp;&nbsp;</span>
+        <a href="https://github.com/semaphore-protocol/semaphore/blob/main/CODE_OF_CONDUCT.md">
+            🤝 Code of conduct
+        </a>
+        <span>&nbsp;&nbsp;|&nbsp;&nbsp;</span>
+        <a href="https://github.com/semaphore-protocol/semaphore/contribute">
+            🔎 Issues
+        </a>
+        <span>&nbsp;&nbsp;|&nbsp;&nbsp;</span>
+        <a href="https://discord.gg/6mSdGHnstH">
+            🗣️ Chat &amp; Support
+        </a>
+    </h4>
+</div>
+
+| This library is an abstraction of [`@zk-kit/incremental-merkle-tree`](https://github.com/privacy-scaling-explorations/zk-kit/tree/main/packages/incremental-merkle-tree). The main goal is to make it easier to create offchain groups, which are also used to generate Semaphore proofs. Semaphore groups are actually incremental Merkle trees, and the group members are tree leaves. Since the Merkle tree implementation we are using is a binary tree, the maximum number of members of a group is equal to `2^treeDepth`. |
+| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+
+## 🛠 Install
+
+### npm or yarn
+
+Install the `@semaphore-protocol/group` package with npm:
+
+```bash
+npm i @semaphore-protocol/group
+```
+
+or yarn:
+
+```bash
+yarn add @semaphore-protocol/group
+```
+
+## 📜 Usage
+
+\# **new Group**(treeDepth = 20, zeroValue = BigInt(0)): _Group_
+
+```typescript
+import { Group } from "@semaphore-protocol/group"
+
+// Group with max 1048576 members (20^²).
+const group1 = new Group()
+
+// Group with max 65536 members (16^²).
+const group2 = new Group(16)
+
+// Group with max 16777216 members (24^²).
+const group3 = new Group(24)
+```
+
+\# **addMember**(identityCommitment: _Member_)
+
+```typescript
+import { Identity } from "@semaphore-protocol/identity"
+
+const identity = new Identity()
+const commitment = identity.generateCommitment()
+
+group.addMember(commitment)
+```
+
+\# **addMembers**(identityCommitments: _Member\[]_)
+
+```typescript
+let identityCommitments: bigint[]
+
+for (let i = 0; i < 10; i++) {
+    const identity = new Identity()
+    const commitment = identity.generateCommitment()
+
+    identityCommitments.push(commitment)
+}
+
+group.addMember(identityCommitments)
+```
+
+\# **removeMember**(index: _number_)
+
+```typescript
+group.removeMember(0)
+```
+
+\# **indexOf**(member: _Member_): _number_
+
+```typescript
+group.indexOf(commitment) // 0
+```
+
+\# **generateMerkleProof**(index: _number_): _MerkleProof_
+
+```typescript
+const proof = group.generateMerkleProof(0)
+```

packages/group/build.tsconfig.json

@@ -0,0 +1,8 @@
+{
+    "extends": "../../tsconfig.json",
+    "compilerOptions": {
+        "baseUrl": ".",
+        "declarationDir": "dist/types"
+    },
+    "include": ["src"]
+}

packages/group/package.json

@@ -0,0 +1,41 @@
+{
+    "name": "@semaphore-protocol/group",
+    "version": "2.6.1",
+    "description": "A library to create and manage Semaphore groups.",
+    "license": "MIT",
+    "main": "dist/index.node.js",
+    "exports": {
+        "import": "./dist/index.mjs",
+        "require": "./dist/index.node.js"
+    },
+    "types": "dist/types/index.d.ts",
+    "files": [
+        "dist/",
+        "src/",
+        "LICENSE",
+        "README.md"
+    ],
+    "repository": "https://github.com/semaphore-protocol/semaphore",
+    "homepage": "https://github.com/semaphore-protocol/semaphore/tree/main/packages/group",
+    "bugs": {
+        "url": "https://github.com/semaphore-protocol/semaphore.git/issues"
+    },
+    "scripts": {
+        "build:watch": "rollup -c rollup.config.ts -w --configPlugin typescript",
+        "build": "rimraf dist && rollup -c rollup.config.ts --configPlugin typescript",
+        "prepublishOnly": "yarn build",
+        "docs": "typedoc src/index.ts --out ../../docs/group"
+    },
+    "publishConfig": {
+        "access": "public"
+    },
+    "devDependencies": {
+        "rollup-plugin-cleanup": "^3.2.1",
+        "rollup-plugin-typescript2": "^0.31.2",
+        "typedoc": "^0.22.11"
+    },
+    "dependencies": {
+        "@zk-kit/incremental-merkle-tree": "1.0.0",
+        "poseidon-lite": "^0.0.2"
+    }
+}

packages/group/rollup.config.ts

@@ -0,0 +1,29 @@
+import typescript from "rollup-plugin-typescript2"
+import * as fs from "fs"
+import cleanup from "rollup-plugin-cleanup"
+
+const pkg = JSON.parse(fs.readFileSync("./package.json", "utf-8"))
+const banner = `/**
+ * @module ${pkg.name}
+ * @version ${pkg.version}
+ * @file ${pkg.description}
+ * @copyright Ethereum Foundation 2022
+ * @license ${pkg.license}
+ * @see [Github]{@link ${pkg.homepage}}
+*/`
+
+export default {
+    input: "src/index.ts",
+    output: [
+        { file: pkg.exports.require, format: "cjs", banner, exports: "auto" },
+        { file: pkg.exports.import, format: "es", banner }
+    ],
+    external: Object.keys(pkg.dependencies),
+    plugins: [
+        typescript({
+            tsconfig: "./build.tsconfig.json",
+            useTsconfigDeclarationDir: true
+        }),
+        cleanup({ comments: "jsdoc" })
+    ]
+}

packages/group/src/group.test.ts

@@ -0,0 +1,95 @@
+import Group from "./group"
+
+describe("Group", () => {
+    describe("# Group", () => {
+        it("Should create a group", () => {
+            const group = new Group()
+
+            expect(group.root.toString()).toContain("150197")
+            expect(group.depth).toBe(20)
+            expect(group.zeroValue).toBe(BigInt(0))
+            expect(group.members).toHaveLength(0)
+        })
+
+        it("Should not create a group with a wrong tree depth", () => {
+            const fun = () => new Group(33)
+
+            expect(fun).toThrow("The tree depth must be between 16 and 32")
+        })
+
+        it("Should create a group with different parameters", () => {
+            const group = new Group(32, BigInt(1))
+
+            expect(group.root.toString()).toContain("640470")
+            expect(group.depth).toBe(32)
+            expect(group.zeroValue).toBe(BigInt(1))
+            expect(group.members).toHaveLength(0)
+        })
+    })
+
+    describe("# addMember", () => {
+        it("Should add a member to a group", () => {
+            const group = new Group()
+
+            group.addMember(BigInt(3))
+
+            expect(group.members).toHaveLength(1)
+        })
+    })
+
+    describe("# addMembers", () => {
+        it("Should add many members to a group", () => {
+            const group = new Group()
+
+            group.addMembers([BigInt(1), BigInt(3)])
+
+            expect(group.members).toHaveLength(2)
+        })
+    })
+
+    describe("# indexOf", () => {
+        it("Should return the index of a member in a group", () => {
+            const group = new Group()
+            group.addMembers([BigInt(1), BigInt(3)])
+
+            const index = group.indexOf(BigInt(3))
+
+            expect(index).toBe(1)
+        })
+    })
+
+    describe("# updateMember", () => {
+        it("Should update a member in a group", () => {
+            const group = new Group()
+            group.addMembers([BigInt(1), BigInt(3)])
+
+            group.updateMember(0, BigInt(1))
+
+            expect(group.members).toHaveLength(2)
+            expect(group.members[0]).toBe(BigInt(1))
+        })
+    })
+
+    describe("# removeMember", () => {
+        it("Should remove a member from a group", () => {
+            const group = new Group()
+            group.addMembers([BigInt(1), BigInt(3)])
+
+            group.removeMember(0)
+
+            expect(group.members).toHaveLength(2)
+            expect(group.members[0]).toBe(group.zeroValue)
+        })
+    })
+
+    describe("# generateMerkleProof", () => {
+        it("Should generate a proof of membership", () => {
+            const group = new Group()
+            group.addMembers([BigInt(1), BigInt(3)])
+
+            const proof = group.generateMerkleProof(0)
+
+            expect(proof.leaf).toBe(BigInt(1))
+        })
+    })
+})

packages/group/src/group.ts

@@ -0,0 +1,109 @@
+import { IncrementalMerkleTree, MerkleProof } from "@zk-kit/incremental-merkle-tree"
+import poseidon from "poseidon-lite"
+import { Member } from "./types"
+
+export default class Group {
+    merkleTree: IncrementalMerkleTree
+
+    /**
+     * Initializes the group with the tree depth and the zero value.
+     * @param treeDepth Tree depth.
+     * @param zeroValue Zero values for zeroes.
+     */
+    constructor(treeDepth = 20, zeroValue: Member = BigInt(0)) {
+        if (treeDepth < 16 || treeDepth > 32) {
+            throw new Error("The tree depth must be between 16 and 32")
+        }
+
+        this.merkleTree = new IncrementalMerkleTree(poseidon, treeDepth, zeroValue, 2)
+    }
+
+    /**
+     * Returns the root hash of the tree.
+     * @returns Root hash.
+     */
+    get root(): Member {
+        return this.merkleTree.root
+    }
+
+    /**
+     * Returns the depth of the tree.
+     * @returns Tree depth.
+     */
+    get depth(): number {
+        return this.merkleTree.depth
+    }
+
+    /**
+     * Returns the zero value of the tree.
+     * @returns Tree zero value.
+     */
+    get zeroValue(): Member {
+        return this.merkleTree.zeroes[0]
+    }
+
+    /**
+     * Returns the members (i.e. identity commitments) of the group.
+     * @returns List of members.
+     */
+    get members(): Member[] {
+        return this.merkleTree.leaves
+    }
+
+    /**
+     * Returns the index of a member. If the member does not exist it returns -1.
+     * @param member Group member.
+     * @returns Index of the member.
+     */
+    indexOf(member: Member): number {
+        return this.merkleTree.indexOf(member)
+    }
+
+    /**
+     * Adds a new member to the group.
+     * @param member New member.
+     */
+    addMember(member: Member) {
+        this.merkleTree.insert(BigInt(member))
+    }
+
+    /**
+     * Adds new members to the group.
+     * @param members New members.
+     */
+    addMembers(members: Member[]) {
+        for (const member of members) {
+            this.addMember(member)
+        }
+    }
+
+    /**
+     * Updates a member in the group.
+     * @param index Index of the member to be updated.
+     * @param member New member value.
+     */
+    updateMember(index: number, member: Member) {
+        this.merkleTree.update(index, member)
+    }
+
+    /**
+     * Removes a member from the group.
+     * @param index Index of the member to be removed.
+     */
+    removeMember(index: number) {
+        this.merkleTree.delete(index)
+    }
+
+    /**
+     * Creates a proof of membership.
+     * @param index Index of the proof's member.
+     * @returns Proof object.
+     */
+    generateMerkleProof(index: number): MerkleProof {
+        const merkleProof = this.merkleTree.createProof(index)
+
+        merkleProof.siblings = merkleProof.siblings.map((s) => s[0])
+
+        return merkleProof
+    }
+}

packages/group/src/index.ts

@@ -0,0 +1,4 @@
+import Group from "./group"
+
+export { Group }
+export * from "./types"

packages/group/src/types/index.ts

@@ -0,0 +1 @@
+export type Member = string | bigint

packages/group/tsconfig.json

@@ -0,0 +1,4 @@
+{
+    "extends": "../../tsconfig.json",
+    "include": ["src", "rollup.config.ts"]
+}

packages/hardhat/README.md

@@ -0,0 +1,115 @@
+<p align="center">
+    <h1 align="center">
+        Semaphore Hardhat plugin
+    </h1>
+    <p align="center">A Semaphore Hardhat plugin to deploy verifiers and Semaphore contracts.</p>
+</p>
+
+<p align="center">
+    <a href="https://github.com/semaphore-protocol">
+        <img src="https://img.shields.io/badge/project-Semaphore-blue.svg?style=flat-square">
+    </a>
+    <a href="https://github.com/semaphore-protocol/semaphore/blob/main/LICENSE">
+        <img alt="Github license" src="https://img.shields.io/github/license/semaphore-protocol/semaphore.svg?style=flat-square">
+    </a>
+    <a href="https://www.npmjs.com/package/@semaphore-protocol/hardhat">
+        <img alt="NPM version" src="https://img.shields.io/npm/v/@semaphore-protocol/hardhat?style=flat-square" />
+    </a>
+    <a href="https://npmjs.org/package/@semaphore-protocol/hardhat">
+        <img alt="Downloads" src="https://img.shields.io/npm/dm/@semaphore-protocol/hardhat.svg?style=flat-square" />
+    </a>
+    <a href="https://eslint.org/">
+        <img alt="Linter eslint" src="https://img.shields.io/badge/linter-eslint-8080f2?style=flat-square&logo=eslint" />
+    </a>
+    <a href="https://prettier.io/">
+        <img alt="Code style prettier" src="https://img.shields.io/badge/code%20style-prettier-f8bc45?style=flat-square&logo=prettier" />
+    </a>
+</p>
+
+<div align="center">
+    <h4>
+        <a href="https://github.com/semaphore-protocol/semaphore/blob/main/CONTRIBUTING.md">
+            👥 Contributing
+        </a>
+        <span>&nbsp;&nbsp;|&nbsp;&nbsp;</span>
+        <a href="https://github.com/semaphore-protocol/semaphore/blob/main/CODE_OF_CONDUCT.md">
+            🤝 Code of conduct
+        </a>
+        <span>&nbsp;&nbsp;|&nbsp;&nbsp;</span>
+        <a href="https://github.com/semaphore-protocol/semaphore/contribute">
+            🔎 Issues
+        </a>
+        <span>&nbsp;&nbsp;|&nbsp;&nbsp;</span>
+        <a href="https://discord.gg/6mSdGHnstH">
+            🗣️ Chat &amp; Support
+        </a>
+    </h4>
+</div>
+
+| This Hardhat plugin provides two simple tasks that can be used to deploy verifiers and Semaphore contracts without any additional configuration. |
+| ------------------------------------------------------------------------------------------------------------------------------------------------ |
+
+## 🛠 Install
+
+### npm or yarn
+
+Install the `@semaphore-protocol/hardhat` package with npm:
+
+```bash
+npm i @semaphore-protocol/hardhat
+```
+
+or yarn:
+
+```bash
+yarn add @semaphore-protocol/hardhat
+```
+
+## 📜 Usage
+
+Import the plugin in your `hardhat.config.ts` file:
+
+```typescript
+import "@semaphore-protocol/hardhat"
+import "./tasks/deploy"
+
+const hardhatConfig: HardhatUserConfig = {
+    solidity: "0.8.4"
+}
+
+export default hardhatConfig
+```
+
+And use its tasks to create your own `deploy` task and deploy your contract with a Semaphore address.
+
+```typescript
+import { task, types } from "hardhat/config"
+
+task("deploy", "Deploy a Greeter contract")
+    .addOptionalParam("logs", "Print the logs", true, types.boolean)
+    .setAction(async ({ logs }, { ethers, run }) => {
+        const { address: verifierAddress } = await run("deploy:verifier", { logs, merkleTreeDepth: 20 })
+
+        const { address: semaphoreAddress } = await run("deploy:semaphore", {
+            logs,
+            verifiers: [
+                {
+                    merkleTreeDepth: 20,
+                    contractAddress: verifierAddress
+                }
+            ]
+        })
+
+        const Greeter = await ethers.getContractFactory("Greeter")
+
+        const greeter = await Greeter.deploy(semaphoreAddress)
+
+        await greeter.deployed()
+
+        if (logs) {
+            console.log(`Greeter contract has been deployed to: ${greeter.address}`)
+        }
+
+        return greeter
+    })
+```

packages/hardhat/build.tsconfig.json

@@ -0,0 +1,8 @@
+{
+    "extends": "../../tsconfig.json",
+    "compilerOptions": {
+        "baseUrl": ".",
+        "declarationDir": "dist/types"
+    },
+    "include": ["src"]
+}

packages/hardhat/package.json

@@ -0,0 +1,46 @@
+{
+    "name": "@semaphore-protocol/hardhat",
+    "version": "0.1.0",
+    "description": "A Semaphore Hardhat plugin to deploy verifiers and Semaphore contract.",
+    "license": "MIT",
+    "main": "dist/index.node.js",
+    "exports": {
+        "import": "./dist/index.mjs",
+        "require": "./dist/index.node.js"
+    },
+    "types": "dist/types/index.d.ts",
+    "files": [
+        "dist/",
+        "src/",
+        "LICENSE",
+        "README.md"
+    ],
+    "repository": "https://github.com/semaphore-protocol/semaphore",
+    "homepage": "https://github.com/semaphore-protocol/semaphore/tree/main/packages/hardhat",
+    "bugs": {
+        "url": "https://github.com/semaphore-protocol/semaphore.git/issues"
+    },
+    "scripts": {
+        "build:watch": "rollup -c rollup.config.ts -w --configPlugin typescript",
+        "build": "rimraf dist && rollup -c rollup.config.ts --configPlugin typescript",
+        "prepublishOnly": "yarn build"
+    },
+    "publishConfig": {
+        "access": "public"
+    },
+    "devDependencies": {
+        "hardhat": "^2.0.0",
+        "rollup-plugin-cleanup": "^3.2.1",
+        "rollup-plugin-typescript2": "^0.31.2"
+    },
+    "peerDependencies": {
+        "hardhat": "^2.0.0"
+    },
+    "dependencies": {
+        "@nomiclabs/hardhat-ethers": "^2.1.1",
+        "@semaphore-protocol/contracts": "^2.5.0",
+        "circomlibjs": "^0.0.8",
+        "ethers": "^5.7.1",
+        "hardhat-dependency-compiler": "^1.1.3"
+    }
+}

packages/hardhat/rollup.config.ts

@@ -0,0 +1,29 @@
+import typescript from "rollup-plugin-typescript2"
+import * as fs from "fs"
+import cleanup from "rollup-plugin-cleanup"
+
+const pkg = JSON.parse(fs.readFileSync("./package.json", "utf-8"))
+const banner = `/**
+ * @module ${pkg.name}
+ * @version ${pkg.version}
+ * @file ${pkg.description}
+ * @copyright Ethereum Foundation 2022
+ * @license ${pkg.license}
+ * @see [Github]{@link ${pkg.homepage}}
+*/`
+
+export default {
+    input: "src/index.ts",
+    output: [
+        { file: pkg.exports.require, format: "cjs", banner, exports: "auto" },
+        { file: pkg.exports.import, format: "es", banner }
+    ],
+    external: Object.keys(pkg.dependencies),
+    plugins: [
+        typescript({
+            tsconfig: "./build.tsconfig.json",
+            useTsconfigDeclarationDir: true
+        }),
+        cleanup({ comments: "jsdoc" })
+    ]
+}

packages/hardhat/src/index.ts

@@ -0,0 +1,34 @@
+import { extendConfig } from "hardhat/config"
+import { HardhatConfig, HardhatUserConfig } from "hardhat/types"
+
+import "hardhat-dependency-compiler"
+import "@nomiclabs/hardhat-ethers"
+import "./tasks/deploy-semaphore"
+import "./tasks/deploy-verifier"
+
+extendConfig((config: HardhatConfig, userConfig: Readonly<HardhatUserConfig>) => {
+    config.dependencyCompiler.paths = [
+        "@semaphore-protocol/contracts/verifiers/Verifier16.sol",
+        "@semaphore-protocol/contracts/verifiers/Verifier17.sol",
+        "@semaphore-protocol/contracts/verifiers/Verifier18.sol",
+        "@semaphore-protocol/contracts/verifiers/Verifier19.sol",
+        "@semaphore-protocol/contracts/verifiers/Verifier20.sol",
+        "@semaphore-protocol/contracts/verifiers/Verifier21.sol",
+        "@semaphore-protocol/contracts/verifiers/Verifier22.sol",
+        "@semaphore-protocol/contracts/verifiers/Verifier23.sol",
+        "@semaphore-protocol/contracts/verifiers/Verifier24.sol",
+        "@semaphore-protocol/contracts/verifiers/Verifier25.sol",
+        "@semaphore-protocol/contracts/verifiers/Verifier26.sol",
+        "@semaphore-protocol/contracts/verifiers/Verifier27.sol",
+        "@semaphore-protocol/contracts/verifiers/Verifier28.sol",
+        "@semaphore-protocol/contracts/verifiers/Verifier29.sol",
+        "@semaphore-protocol/contracts/verifiers/Verifier30.sol",
+        "@semaphore-protocol/contracts/verifiers/Verifier31.sol",
+        "@semaphore-protocol/contracts/verifiers/Verifier32.sol",
+        "@semaphore-protocol/contracts/Semaphore.sol"
+    ]
+
+    if (userConfig.dependencyCompiler?.paths) {
+        config.dependencyCompiler.paths = [...config.dependencyCompiler.paths, ...userConfig.dependencyCompiler.paths]
+    }
+})

packages/hardhat/src/tasks/deploy-semaphore.ts

@@ -3,8 +3,8 @@ import { Contract } from "ethers"
 import { task, types } from "hardhat/config"
 
 task("deploy:semaphore", "Deploy a Semaphore contract")
+    .addParam("verifiers", "Tree depths and verifier addresses", [], types.json)
     .addOptionalParam<boolean>("logs", "Print the logs", true, types.boolean)
-    .addParam("verifiers", "Tree depths and verifier addresses", undefined, types.json)
     .setAction(async ({ logs, verifiers }, { ethers }): Promise<Contract> => {
         const poseidonABI = poseidonContract.generateABI(2)
         const poseidonBytecode = poseidonContract.createCode(2)
@@ -16,7 +16,9 @@ task("deploy:semaphore", "Deploy a Semaphore contract")
 
         await poseidonLib.deployed()
 
-        logs && console.log(`Poseidon library has been deployed to: ${poseidonLib.address}`)
+        if (logs) {
+            console.info(`Poseidon library has been deployed to: ${poseidonLib.address}`)
+        }
 
         const IncrementalBinaryTreeLibFactory = await ethers.getContractFactory("IncrementalBinaryTree", {
             libraries: {
@@ -27,19 +29,23 @@ task("deploy:semaphore", "Deploy a Semaphore contract")
 
         await incrementalBinaryTreeLib.deployed()
 
-        logs && console.log(`IncrementalBinaryTree library has been deployed to: ${incrementalBinaryTreeLib.address}`)
+        if (logs) {
+            console.info(`IncrementalBinaryTree library has been deployed to: ${incrementalBinaryTreeLib.address}`)
+        }
 
-        const ContractFactory = await ethers.getContractFactory("Semaphore", {
+        const SemaphoreContractFactory = await ethers.getContractFactory("Semaphore", {
             libraries: {
                 IncrementalBinaryTree: incrementalBinaryTreeLib.address
             }
         })
 
-        const contract = await ContractFactory.deploy(verifiers)
+        const semaphoreContract = await SemaphoreContractFactory.deploy(verifiers)
 
-        await contract.deployed()
+        await semaphoreContract.deployed()
 
-        logs && console.log(`Semaphore contract has been deployed to: ${contract.address}`)
+        if (logs) {
+            console.info(`Semaphore contract has been deployed to: ${semaphoreContract.address}`)
+        }
 
-        return contract
+        return semaphoreContract
     })