diff --git a/README.md b/README.md index 9f79b3a..c8ed24c 100644 --- a/README.md +++ b/README.md @@ -30,7 +30,7 @@ * Relayer is frontrunnable. When relayer submits a transaction someone can see it in tx pool and frontrun it with higher gas price to get the fee and drain relayer funds. * Workaround: we can set high gas price so that (almost) all fee is used on gas. The relayer will not receive profit this way, but this approach is acceptable until we develop more sophisticated system that prevents frontrunning * Bugs in contract. Even though we have an extensive experience in smart contract security audits, we can still make mistakes. An external audit is needed to reduce probablility of bugs -* Nullifier griefing - when you submit a withdraw transaction you reveal the nullifier for your note. If someone manages to +* Nullifier griefing. when you submit a withdraw transaction you reveal the nullifier for your note. If someone manages to make a deposit with the same nullifier and withdraw it while your transaction is still in tx pool, your note will be considered spent since it has the same nullifier and it will prevent you from withdrawing your funds * This attack doesnt't provide any profit for the attacker diff --git a/lib/MerkleTree.js b/lib/MerkleTree.js index 012f266..e5f952e 100644 --- a/lib/MerkleTree.js +++ b/lib/MerkleTree.js @@ -1,15 +1,17 @@ +const jsStorage = require("./Storage"); +const mimcHasher = require("./MiMC"); class MerkleTree { - constructor(prefix, storage, hasher, n_levels, zero_value, defaultElements) { + constructor(n_levels, zero_value, defaultElements, prefix, storage, hasher) { this.prefix = prefix; - this.storage = storage; - this.hasher = hasher; + this.storage = storage || new jsStorage(); + this.hasher = hasher || new mimcHasher(); this.n_levels = n_levels; this.zero_values = []; this.totalElements = 0; - let current_zero_value = zero_value; + let current_zero_value = zero_value || 0; this.zero_values.push(current_zero_value); for (let i = 0; i < n_levels; i++) { current_zero_value = this.hasher.hash(i, current_zero_value, current_zero_value); diff --git a/scripts/test_snark.js b/scripts/test_snark.js index c1b8ba8..5e0042b 100644 --- a/scripts/test_snark.js +++ b/scripts/test_snark.js @@ -26,7 +26,7 @@ function generateDeposit() { const dep2 = generateDeposit(); const dep3 = generateDeposit(); - const tree = new merkleTree("", new jsStorage(), new mimcHasher(), 16, 0); + const tree = new merkleTree(16); await tree.insert(dep1.commitment); await tree.insert(dep2.commitment); diff --git a/test/MerkleTreeWithHistory.test.js b/test/MerkleTreeWithHistory.test.js index 99df8a1..5f2f633 100644 --- a/test/MerkleTreeWithHistory.test.js +++ b/test/MerkleTreeWithHistory.test.js @@ -9,9 +9,8 @@ const { takeSnapshot, revertSnapshot, increaseTime } = require('../scripts/ganac const MerkleTreeWithHistory = artifacts.require('./MerkleTreeWithHistoryMock.sol') const MiMC = artifacts.require('./MiMC.sol') -const JsStorage = require('../lib/Storage') const MerkleTree = require('../lib/MerkleTree') -const MimcHacher = require('../lib/MiMC') +const MimcHasher = require('../lib/MiMC') function BNArrayToStringArray(array) { const arrayToPrint = [] @@ -34,14 +33,11 @@ contract('MerkleTreeWithHistory', async accounts => { let hasher before(async () => { - const storage = new JsStorage() - hasher = new MimcHacher() tree = new MerkleTree( - prefix, - storage, - hasher, levels, zeroValue, + null, + prefix, ) miMC = await MiMC.deployed() await MerkleTreeWithHistory.link(MiMC, miMC.address) @@ -73,14 +69,12 @@ contract('MerkleTreeWithHistory', async accounts => { }) it('tests insert', async () => { - const storage = new JsStorage() - hasher = new MimcHacher() + hasher = new MimcHasher() tree = new MerkleTree( - prefix, - storage, - hasher, 2, zeroValue, + null, + prefix, ) await tree.insert('5') let {root, path_elements, path_index} = await tree.path(0) @@ -97,15 +91,11 @@ contract('MerkleTreeWithHistory', async accounts => { await tree.insert(el) } - const storage = new JsStorage() - hasher = new MimcHacher() const batchTree = new MerkleTree( - prefix, - storage, - hasher, levels, zeroValue, - elements + elements, + prefix, ); for(const [i, el] of Object.entries(elements)) { const pathViaConstructor = await batchTree.path(i) @@ -120,15 +110,11 @@ contract('MerkleTreeWithHistory', async accounts => { await tree.insert(el) } - const storage = new JsStorage() - hasher = new MimcHacher() const batchTree = new MerkleTree( - prefix, - storage, - hasher, levels, zeroValue, - elements + elements, + prefix, ); for(const [i, el] of Object.entries(elements)) { const pathViaConstructor = await batchTree.path(i) @@ -142,16 +128,12 @@ contract('MerkleTreeWithHistory', async accounts => { for(let i = 1000; i < 31001; i++) { elements.push(i) } - const storage = new JsStorage() - hasher = new MimcHacher() console.time('MerkleTree'); tree = new MerkleTree( - prefix, - storage, - hasher, levels, zeroValue, - elements + elements, + prefix, ); console.timeEnd('MerkleTree'); // 2,7 GHz Intel Core i7 @@ -184,21 +166,21 @@ contract('MerkleTreeWithHistory', async accounts => { describe('#MIMC', async () => { it.skip('gas price', async () => { const gas = await merkleTreeWithHistory.hashLeftRight.estimateGas(1,2) - console.log('gas', gas) + // console.log('gas', gas) }) }) afterEach(async () => { await revertSnapshot(snapshotId.result) snapshotId = await takeSnapshot() - const storage = new JsStorage() - hasher = new MimcHacher() + hasher = new MimcHasher() tree = new MerkleTree( - prefix, - storage, - hasher, levels, zeroValue, + null, + prefix, + null, + hasher, ) }) }) diff --git a/test/Mixer.test.js b/test/Mixer.test.js index 8581662..e4ff18a 100644 --- a/test/Mixer.test.js +++ b/test/Mixer.test.js @@ -13,9 +13,7 @@ const utils = require("../scripts/utils") const stringifyBigInts = require("websnark/tools/stringifybigint").stringifyBigInts const snarkjs = require("snarkjs"); const bigInt = snarkjs.bigInt; -const JsStorage = require('../lib/Storage') const MerkleTree = require('../lib/MerkleTree') -const MimcHacher = require('../lib/MiMC') function generateDeposit() { let deposit = { @@ -29,7 +27,6 @@ function generateDeposit() { contract('Mixer', async accounts => { let mixer - let miMC const sender = accounts[0] const emptyAddress = '0x0000000000000000000000000000000000000000' const levels = 16 @@ -37,17 +34,13 @@ contract('Mixer', async accounts => { let snapshotId let prefix = 'test' let tree - let hasher before(async () => { - const storage = new JsStorage() - hasher = new MimcHacher() tree = new MerkleTree( - prefix, - storage, - hasher, levels, zeroValue, + null, + prefix, ) mixer = await Mixer.deployed() snapshotId = await takeSnapshot() @@ -78,8 +71,8 @@ contract('Mixer', async accounts => { it('should work', async () => { const deposit = generateDeposit() await tree.insert(deposit.commitment) - let gas = await mixer.deposit.estimateGas(toBN(deposit.commitment.toString()), { value: AMOUNT, from: sender }) - console.log('deposit gas', gas) + // let gas = await mixer.deposit.estimateGas(toBN(deposit.commitment.toString()), { value: AMOUNT, from: sender }) + // console.log('deposit gas', gas) await mixer.deposit(toBN(deposit.commitment.toString()), { value: AMOUNT, from: sender }) const {root, path_elements, path_index} = await tree.path(0); @@ -101,8 +94,8 @@ contract('Mixer', async accounts => { const { pi_a, pi_b, pi_c, publicSignals } = await utils.snarkProof(input) // console.log('proof', pi_a, pi_b, pi_c, publicSignals) - gas = await mixer.withdraw.estimateGas(pi_a, pi_b, pi_c, publicSignals, { from: sender }) - console.log('withdraw gas', gas) + // gas = await mixer.withdraw.estimateGas(pi_a, pi_b, pi_c, publicSignals, { from: sender }) + // console.log('withdraw gas', gas) const { logs } = await mixer.withdraw(pi_a, pi_b, pi_c, publicSignals, { from: sender }) logs[0].event.should.be.equal('Withdraw') // logs[0].args.nullifier.should.be.eq.BN(toBN(commitment))