// SPDX-License-Identifier: MIT // https://tornado.cash /* * d888888P dP a88888b. dP * 88 88 d8' `88 88 * 88 .d8888b. 88d888b. 88d888b. .d8888b. .d888b88 .d8888b. 88 .d8888b. .d8888b. 88d888b. * 88 88' `88 88' `88 88' `88 88' `88 88' `88 88' `88 88 88' `88 Y8ooooo. 88' `88 * 88 88. .88 88 88 88 88. .88 88. .88 88. .88 dP Y8. .88 88. .88 88 88 88 * dP `88888P' dP dP dP `88888P8 `88888P8 `88888P' 88 Y88888P' `88888P8 `88888P' dP dP * ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo */ pragma solidity ^0.7.0; pragma experimental ABIEncoderV2; import "@openzeppelin/contracts/contracts/token/ERC20/IERC20.sol"; import "@openzeppelin/contracts/contracts/cryptography/ECDSA.sol"; import "./MerkleTreeWithHistory.sol"; interface IERC6777 is IERC20 { function transferAndCall( address, uint256, bytes calldata ) external returns (bool); } interface IVerifier { function verifyProof(bytes memory _proof, uint256[7] memory _input) external view returns (bool); function verifyProof(bytes memory _proof, uint256[21] memory _input) external view returns (bool); } interface IERC20Receiver { function onTokenBridged( IERC6777 token, uint256 value, bytes calldata data ) external; } contract TornadoPool is MerkleTreeWithHistory, IERC20Receiver { int256 public constant MAX_EXT_AMOUNT = 2**248; uint256 public constant MAX_FEE = 2**248; bytes32 public constant ACCOUNT_TYPEHASH = keccak256("TornadoAccount(address owner,bytes publicKey)"); uint256 public immutable L1_CHAIN_ID; IVerifier public immutable verifier2; IVerifier public immutable verifier16; IERC6777 public immutable token; address public immutable omniBridge; address public immutable l1Unwrapper; uint256 public totalDeposited; mapping(bytes32 => bool) public nullifierHashes; struct ExtData { address recipient; int256 extAmount; address relayer; uint256 fee; bytes encryptedOutput1; bytes encryptedOutput2; bool isL1Withdrawal; } struct Proof { bytes proof; bytes32 root; bytes32[] inputNullifiers; bytes32[2] outputCommitments; uint256 publicAmount; bytes32 extDataHash; } struct Account { address owner; bytes publicKey; } event NewCommitment(bytes32 commitment, uint256 index, bytes encryptedOutput); event NewNullifier(bytes32 nullifier); event PublicKey(address indexed owner, bytes key); /** @dev The constructor @param _verifier2 the address of SNARK verifier for 2 inputs @param _verifier16 the address of SNARK verifier for 16 inputs */ constructor( IVerifier _verifier2, IVerifier _verifier16, uint32 _levels, address _hasher, IERC6777 _token, address _omniBridge, address _l1Unwrapper, uint256 _l1ChainId ) MerkleTreeWithHistory(_levels, _hasher) { verifier2 = _verifier2; verifier16 = _verifier16; token = _token; omniBridge = _omniBridge; l1Unwrapper = _l1Unwrapper; L1_CHAIN_ID = _l1ChainId; } function transact(Proof memory _args, ExtData memory _extData) public { if (_extData.extAmount > 0) { // for deposits from L2 token.transferFrom(msg.sender, address(this), uint256(_extData.extAmount)); totalDeposited += uint256(_extData.extAmount); } _transact(_args, _extData); } function _transact(Proof memory _args, ExtData memory _extData) internal { require(isKnownRoot(_args.root), "Invalid merkle root"); for (uint256 i = 0; i < _args.inputNullifiers.length; i++) { require(!isSpent(_args.inputNullifiers[i]), "Input is already spent"); } require(uint256(_args.extDataHash) == uint256(keccak256(abi.encode(_extData))) % FIELD_SIZE, "Incorrect external data hash"); require(_args.publicAmount == calculatePublicAmount(_extData.extAmount, _extData.fee), "Invalid public amount"); require(verifyProof(_args), "Invalid transaction proof"); for (uint256 i = 0; i < _args.inputNullifiers.length; i++) { nullifierHashes[_args.inputNullifiers[i]] = true; } if (_extData.extAmount < 0) { require(_extData.recipient != address(0), "Can't withdraw to zero address"); if (_extData.isL1Withdrawal) { token.transferAndCall(omniBridge, uint256(-_extData.extAmount), abi.encodePacked(l1Unwrapper, _extData.recipient)); } else { token.transfer(_extData.recipient, uint256(-_extData.extAmount)); } totalDeposited -= uint256(-_extData.extAmount); } if (_extData.fee > 0) { token.transfer(_extData.relayer, _extData.fee); } _insert(_args.outputCommitments[0], _args.outputCommitments[1]); emit NewCommitment(_args.outputCommitments[0], nextIndex - 2, _extData.encryptedOutput1); emit NewCommitment(_args.outputCommitments[1], nextIndex - 1, _extData.encryptedOutput2); for (uint256 i = 0; i < _args.inputNullifiers.length; i++) { emit NewNullifier(_args.inputNullifiers[i]); } } function calculatePublicAmount(int256 _extAmount, uint256 _fee) public pure returns (uint256) { require(_fee < MAX_FEE, "Invalid fee"); require(_extAmount > -MAX_EXT_AMOUNT && _extAmount < MAX_EXT_AMOUNT, "Invalid ext amount"); int256 publicAmount = _extAmount - int256(_fee); return (publicAmount >= 0) ? uint256(publicAmount) : FIELD_SIZE - uint256(-publicAmount); } /** @dev whether a note is already spent */ function isSpent(bytes32 _nullifierHash) public view returns (bool) { return nullifierHashes[_nullifierHash]; } function verifyProof(Proof memory _args) public view returns (bool) { if (_args.inputNullifiers.length == 2) { return verifier2.verifyProof( _args.proof, [ uint256(_args.root), _args.publicAmount, uint256(_args.extDataHash), uint256(_args.inputNullifiers[0]), uint256(_args.inputNullifiers[1]), uint256(_args.outputCommitments[0]), uint256(_args.outputCommitments[1]) ] ); } else if (_args.inputNullifiers.length == 16) { return verifier16.verifyProof( _args.proof, [ uint256(_args.root), _args.publicAmount, uint256(_args.extDataHash), uint256(_args.inputNullifiers[0]), uint256(_args.inputNullifiers[1]), uint256(_args.inputNullifiers[2]), uint256(_args.inputNullifiers[3]), uint256(_args.inputNullifiers[4]), uint256(_args.inputNullifiers[5]), uint256(_args.inputNullifiers[6]), uint256(_args.inputNullifiers[7]), uint256(_args.inputNullifiers[8]), uint256(_args.inputNullifiers[9]), uint256(_args.inputNullifiers[10]), uint256(_args.inputNullifiers[11]), uint256(_args.inputNullifiers[12]), uint256(_args.inputNullifiers[13]), uint256(_args.inputNullifiers[14]), uint256(_args.inputNullifiers[15]), uint256(_args.outputCommitments[0]), uint256(_args.outputCommitments[1]) ] ); } else { revert("unsupported input count"); } } function register(Account memory _account) public { require(_account.owner == msg.sender, "only owner can be registered"); _register(_account); } function _register(Account memory _account) internal { emit PublicKey(_account.owner, _account.publicKey); } function registerAndTransact( Account memory _account, Proof memory _proofArgs, ExtData memory _extData ) public { register(_account); transact(_proofArgs, _extData); } function onTokenBridged( IERC6777 _token, uint256 _amount, bytes calldata _data ) external override { (Account memory _account, Proof memory _args, ExtData memory _extData, bytes memory _signature) = abi.decode( _data, (Account, Proof, ExtData, bytes) ); require(isValidSignature(_account, _signature), "Invalid account signature"); require(_token == token, "provided token is not supported"); require(msg.sender == omniBridge, "only omni bridge"); require(_amount == uint256(_extData.extAmount), "amount from bridge is incorrect"); require(uint256(_extData.extAmount) + totalDeposited >= token.balanceOf(address(this)), "bridge did not send enough tokens"); totalDeposited += uint256(_extData.extAmount); if (_account.owner != address(0) && _account.publicKey.length > 0) { _register(_account); } _transact(_args, _extData); } function isValidSignature(Account memory _account, bytes memory _signature) public view returns (bool) { bytes32 hashStruct = keccak256(abi.encode(ACCOUNT_TYPEHASH, _account.owner, keccak256(_account.publicKey))); bytes32 hash = keccak256(abi.encodePacked(uint16(0x1901), domainSeparator(), hashStruct)); address signer = ECDSA.recover(hash, _signature); return signer == _account.owner; } function domainSeparator() public view returns (bytes32) { return keccak256( abi.encode( keccak256("EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)"), keccak256(bytes("TornadoPool")), keccak256(bytes("1")), // Version L1_CHAIN_ID, address(this) ) ); } }