def make_private_if_not_already(self, ast: Expression): if ast.annotated_type.is_private(): expected = AnnotatedTypeName(ast.annotated_type.type_name, Expression.me_expr()) if not ast.instanceof(expected): raise TypeMismatchException(expected, ast.annotated_type, ast) return ast else: return self.make_private(ast, Expression.me_expr())
def handle_cast(self, expr: Expression, t: TypeName) -> AnnotatedTypeName: # because of the fake solidity check we already know that the cast is possible -> don't have to check if cast possible if expr.annotated_type.is_private(): expected = AnnotatedTypeName(expr.annotated_type.type_name, Expression.me_expr()) if not expr.instanceof(expected): raise TypeMismatchException(expected, expr.annotated_type, expr) return AnnotatedTypeName(t.clone(), Expression.me_expr()) else: return AnnotatedTypeName(t.clone())
def _ensure_encryption(self, stmt: Statement, plain: HybridArgumentIdf, new_privacy: PrivacyLabelExpr, crypto_params: CryptoParams, cipher: HybridArgumentIdf, is_param: bool, is_dec: bool): """ Make sure that cipher = enc(plain, getPk(new_privacy), priv_user_provided_rnd). This automatically requests necessary keys and adds a circuit input for the randomness. Note: This function adds pre-statements to stmt :param stmt [SIDE EFFECT]: the statement which contains the expression which requires this encryption :param plain: circuit variable referencing the plaintext value :param new_privacy: privacy label corresponding to the destination key address :param cipher: circuit variable referencing the encrypted value :param is_param: whether cipher is a function parameter :param is_dec: whether this is a decryption operation (user supplied plain) as opposed to an encryption operation (user supplied cipher) """ if crypto_params.is_symmetric_cipher(): # Need a different set of keys for hybrid-encryption (ecdh-based) backends self._require_secret_key(crypto_params) my_pk = self._require_public_key_for_label_at( stmt, Expression.me_expr(), crypto_params) if is_dec: other_pk = self._get_public_key_in_sender_field( stmt, cipher, crypto_params) else: if new_privacy == Expression.me_expr(): other_pk = my_pk else: other_pk = self._require_public_key_for_label_at( stmt, new_privacy, crypto_params) self.phi.append( CircComment( f'{cipher.name} = enc({plain.name}, ecdh({other_pk.name}, my_sk))' )) self._phi.append( CircSymmEncConstraint(plain, other_pk, cipher, is_dec)) else: rnd = self._secret_input_name_factory.add_idf( f'{plain.name if is_param else cipher.name}_R', TypeName.rnd_type(crypto_params)) pk = self._require_public_key_for_label_at(stmt, new_privacy, crypto_params) if not is_dec: self.phi.append( CircComment( f'{cipher.name} = enc({plain.name}, {pk.name})')) self._phi.append(CircEncConstraint(plain, rnd, pk, cipher, is_dec))
def visitIfStatement(self, ast: IfStatement): b = ast.condition if not b.instanceof_data_type(TypeName.bool_type()): raise TypeMismatchException(TypeName.bool_type(), b.annotated_type.type_name, b) if ast.condition.annotated_type.is_private(): expected = AnnotatedTypeName(TypeName.bool_type(), Expression.me_expr()) if not b.instanceof(expected): raise TypeMismatchException(expected, b.annotated_type, b)
def ensure_parameter_encryption(self, insert_loc_stmt: Statement, param: Parameter): """ Make circuit prove that the encryption of the specified parameter is correct. """ assert param.annotated_type.is_cipher() plain_idf = self._secret_input_name_factory.add_idf( param.idf.name, param.annotated_type.zkay_type.type_name) name = f'{self._in_name_factory.get_new_name(param.annotated_type.type_name)}_{param.idf.name}' cipher_idf = self._in_name_factory.add_idf( name, param.annotated_type.type_name) self._ensure_encryption(insert_loc_stmt, plain_idf, Expression.me_expr(), param.annotated_type.type_name.crypto_params, cipher_idf, True, False)
def visitReclassifyExpr(self, ast: ReclassifyExpr): if self.inside_privif_stmt and not ast.statement.before_analysis.same_partition( ast.privacy.privacy_annotation_label(), Expression.me_expr()): raise TypeException( 'Revealing information to other parties is not allowed inside private if statements', ast) if ast.expr.annotated_type.is_public(): eval_in_public = False try: self.priv_setter.set_evaluation(ast, evaluate_privately=True) except TypeException: eval_in_public = True if eval_in_public or not self.should_evaluate_public_expr_in_circuit( ast.expr): self.priv_setter.set_evaluation(ast.expr, evaluate_privately=False) else: self.priv_setter.set_evaluation(ast, evaluate_privately=True) self.visit(ast.expr)
def visitIfStatement(self, ast: IfStatement): old_in_privif_stmt = self.inside_privif_stmt if ast.condition.annotated_type.is_private(): mod_vals = set(ast.then_branch.modified_values.keys()) if ast.else_branch is not None: mod_vals = mod_vals.union(ast.else_branch.modified_values) for val in mod_vals: if not val.target.annotated_type.zkay_type.type_name.is_primitive_type( ): raise TypeException( 'Writes to non-primitive type variables are not allowed inside private if statements', ast) if val.in_scope_at( ast) and not ast.before_analysis.same_partition( val.privacy, Expression.me_expr()): raise TypeException( 'If statement with private condition must not contain side effects to variables with owner != me', ast) self.inside_privif_stmt = True self.priv_setter.set_evaluation(ast, evaluate_privately=True) self.visitChildren(ast) self.inside_privif_stmt = old_in_privif_stmt
def add_to_circuit_inputs(self, expr: Expression) -> HybridArgumentIdf: """ Add the provided expression to the public circuit inputs. Roughly corresponds to in() from paper If expr is encrypted (privacy != @all), this function also automatically ensures that the circuit has access to the correctly decrypted expression value in the form of a new private circuit input. If expr is an IdentifierExpr, its value will be cached (i.e. when the same identifier is needed again as a circuit input, its value will be retrieved from cache rather \ than adding an expensive redundant input. The cache is invalidated as soon as the identifier is overwritten in public code) Note: This function has side effects on expr.statement (adds a pre_statement) :param expr: [SIDE EFFECT] expression which should be made available inside the circuit as an argument :return: HybridArgumentIdf which references the plaintext value of the newly added input """ privacy = expr.annotated_type.privacy_annotation.privacy_annotation_label( ) if expr.annotated_type.is_private() else Expression.all_expr() is_public = privacy == Expression.all_expr() expr_text = expr.code() input_expr = self._expr_trafo.visit(expr) t = input_expr.annotated_type.type_name locally_decrypted_idf = None # If expression has literal type -> evaluate it inside the circuit (constant folding will be used) # rather than introducing an unnecessary public circuit input (expensive) if isinstance(t, BooleanLiteralType): return self._evaluate_private_expression(input_expr, str(t.value)) elif isinstance(t, NumberLiteralType): return self._evaluate_private_expression(input_expr, str(t.value)) t_suffix = '' if isinstance(expr, IdentifierExpr): # Look in cache before doing expensive move-in if self._remapper.is_remapped(expr.target.idf): remapped_idf = self._remapper.get_current(expr.target.idf) return remapped_idf t_suffix = f'_{expr.idf.name}' # Generate circuit inputs if is_public: tname = f'{self._in_name_factory.get_new_name(expr.annotated_type.type_name)}{t_suffix}' return_idf = input_idf = self._in_name_factory.add_idf( tname, expr.annotated_type.type_name) self._phi.append(CircComment(f'{input_idf.name} = {expr_text}')) else: # Encrypted inputs need to be decrypted inside the circuit (i.e. add plain as private input and prove encryption) tname = f'{self._secret_input_name_factory.get_new_name(expr.annotated_type.type_name)}{t_suffix}' return_idf = locally_decrypted_idf = self._secret_input_name_factory.add_idf( tname, expr.annotated_type.type_name) cipher_t = TypeName.cipher_type(input_expr.annotated_type, expr.annotated_type.homomorphism) tname = f'{self._in_name_factory.get_new_name(cipher_t)}{t_suffix}' input_idf = self._in_name_factory.add_idf( tname, cipher_t, IdentifierExpr(locally_decrypted_idf)) # Add a CircuitInputStatement to the solidity code, which looks like a normal assignment statement, # but also signals the offchain simulator to perform decryption if necessary expr.statement.pre_statements.append( CircuitInputStatement(input_idf.get_loc_expr(), input_expr)) if not is_public: # Check if the secret plain input corresponds to the decrypted cipher value crypto_params = cfg.get_crypto_params( expr.annotated_type.homomorphism) self._phi.append( CircComment( f'{locally_decrypted_idf} = dec({expr_text}) [{input_idf.name}]' )) self._ensure_encryption(expr.statement, locally_decrypted_idf, Expression.me_expr(), crypto_params, input_idf, False, True) # Cache circuit input for later reuse if possible if cfg.opt_cache_circuit_inputs and isinstance(expr, IdentifierExpr): # TODO: What if a homomorphic variable gets used as both a plain variable and as a ciphertext? # This works for now because we never perform homomorphic operations on variables we can decrypt. self._remapper.remap(expr.target.idf, return_idf) return return_idf
def evaluate_stmt_in_circuit(self, ast: Statement) -> AssignmentStatement: """ Evaluate an entire statement privately. This works by turning the statement into an assignment statement where the * lhs is a tuple of all external locations (defined outside statement), which are modified inside the statement * rhs is the return value of an inlined function call expression to a virtual function where body = the statement + return statement \ which returns a tuple of the most recent SSA version of all modified locations Note: Modifying external locations which are not owned by @me inside the statement is illegal (would leak information). Note: At the moment, this is only used for if statements with a private condition. :param ast: the statement to evaluate inside the circuit :return: AssignmentStatement as described above """ astmt = ExpressionStatement(NumberLiteralExpr(0)) for var in ast.modified_values: if var.in_scope_at(ast): astmt = AssignmentStatement(None, None) break astmt.before_analysis = ast.before_analysis # External values written inside statement -> function return values ret_params = [] for var in ast.modified_values: if var.in_scope_at(ast): # side effect affects location outside statement and has privacy @me assert ast.before_analysis.same_partition( var.privacy, Expression.me_expr()) assert isinstance( var.target, (Parameter, VariableDeclaration, StateVariableDeclaration)) t = var.target.annotated_type.zkay_type if not t.type_name.is_primitive_type(): raise NotImplementedError( 'Reference types inside private if statements are not supported' ) ret_t = AnnotatedTypeName(t.type_name, Expression.me_expr(), t.homomorphism) # t, but @me ret_param = IdentifierExpr(var.target.idf.clone(), ret_t).override(target=var.target) ret_param.statement = astmt ret_params.append(ret_param) # Build the imaginary function fdef = ConstructorOrFunctionDefinition( Identifier('<stmt_fct>'), [], ['private'], [ Parameter([], ret.annotated_type, ret.target.idf) for ret in ret_params ], Block([ast, ReturnStatement(TupleExpr(ret_params))])) fdef.original_body = fdef.body fdef.body.parent = fdef fdef.parent = ast # inline "Call" to the imaginary function fcall = FunctionCallExpr( IdentifierExpr('<stmt_fct>').override(target=fdef), []) fcall.statement = astmt ret_args = self.inline_function_call_into_circuit(fcall) # Move all return values out of the circuit if not isinstance(ret_args, TupleExpr): ret_args = TupleExpr([ret_args]) for ret_arg in ret_args.elements: ret_arg.statement = astmt ret_arg_outs = [ self._get_circuit_output_for_private_expression( ret_arg, Expression.me_expr(), ret_param.annotated_type.homomorphism) for ret_param, ret_arg in zip(ret_params, ret_args.elements) ] # Create assignment statement if ret_params: astmt.lhs = TupleExpr( [ret_param.clone() for ret_param in ret_params]) astmt.rhs = TupleExpr(ret_arg_outs) return astmt else: assert isinstance(astmt, ExpressionStatement) return astmt
def visitPrimitiveCastExpr(self, ast: PrimitiveCastExpr): """Casts are handled either in public or inside the circuit depending on the privacy of the casted expression.""" if ast.evaluate_privately: return self.gen.evaluate_expr_in_circuit(ast, Expression.me_expr()) else: return self.visit_children(ast)
def visitFunctionCallExpr(self, ast: FunctionCallExpr): if isinstance(ast.func, BuiltinFunction): if ast.func.is_private: """ Modified Rule (12) builtin functions with private operands are evaluated inside the circuit. A private expression on its own (like an IdentifierExpr referring to a private variable) is not enough to trigger a boundary crossing (assignment of private variables is a public operation). """ return self.gen.evaluate_expr_in_circuit(ast, Expression.me_expr()) else: """ Rule (10) with additional short-circuit handling. Builtin operations on public operands are normally left untransformed, but if the builtin function has short-circuiting semantics, guard conditions must be added if any of the public operands contains nested private expressions. """ # handle short-circuiting if ast.func.has_shortcircuiting() and any(map(contains_private_expr, ast.args[1:])): op = ast.func.op guard_var = self.gen.add_to_circuit_inputs(ast.args[0]) ast.args[0] = guard_var.get_loc_expr(ast) if op == 'ite': ast.args[1] = self.visit_guarded_expression(guard_var, True, ast.args[1]) ast.args[2] = self.visit_guarded_expression(guard_var, False, ast.args[2]) elif op == '||': ast.args[1] = self.visit_guarded_expression(guard_var, False, ast.args[1]) elif op == '&&': ast.args[1] = self.visit_guarded_expression(guard_var, True, ast.args[1]) return ast return self.visit_children(ast) elif ast.is_cast: """Casts are handled either in public or inside the circuit depending on the privacy of the casted expression.""" assert isinstance(ast.func.target, EnumDefinition) if ast.args[0].evaluate_privately: return self.gen.evaluate_expr_in_circuit(ast, Expression.me_expr()) else: return self.visit_children(ast) else: """ Handle normal function calls (outside private expression case). The called functions are allowed to have side effects, if the function does not require verification it can even be recursive. """ assert isinstance(ast.func, LocationExpr) ast = self.visit_children(ast) if ast.func.target.requires_verification_when_external: # Reroute the function call to the corresponding internal function if the called function was split into external/internal. if not isinstance(ast.func, IdentifierExpr): raise NotImplementedError() ast.func.idf.name = cfg.get_internal_name(ast.func.target) if ast.func.target.requires_verification: # If the target function has an associated circuit, make this function's circuit aware of the call. self.gen.call_function(ast) elif ast.func.target.has_side_effects and self.gen is not None: # Invalidate modified state variables for the current circuit for val in ast.modified_values: if val.key is None and isinstance(val.target, StateVariableDeclaration): self.gen.invalidate_idf(val.target.idf) # The call will be present as a normal function call in the output solidity code. return ast
def create_external_wrapper_body(int_fct: ConstructorOrFunctionDefinition, ext_circuit: CircuitHelper, original_params: List[Parameter], requires_proof: bool) -> Block: """ Return Block with external wrapper function body. :param int_fct: corresponding internal function :param ext_circuit: [SIDE EFFECT] circuit helper of the external wrapper function :param original_params: list of transformed function parameters without additional parameters added due to transformation :return: body with wrapper code """ priv_args = [p for p in original_params if p.annotated_type.is_cipher()] args_backends = OrderedDict.fromkeys([p.annotated_type.type_name.crypto_params for p in priv_args]) stmts = [] for crypto_params in args_backends: assert crypto_params in int_fct.used_crypto_backends # If there are any private arguments with homomorphism 'hom', we need the public key for that crypto backend ext_circuit._require_public_key_for_label_at(None, Expression.me_expr(), crypto_params) for crypto_params in cfg.all_crypto_params(): if crypto_params.is_symmetric_cipher(): if (MeExpr(), crypto_params) in ext_circuit.requested_global_keys or crypto_params in args_backends: # Make sure msg.sender's key pair is available in the circuit stmts += ext_circuit.request_private_key(crypto_params) # Verify that out parameter has correct size stmts += [RequireStatement(IdentifierExpr(cfg.zk_out_name).dot('length').binop('==', NumberLiteralExpr(ext_circuit.out_size_trans)))] # IdentifierExpr for array var holding serialized public circuit inputs in_arr_var = IdentifierExpr(cfg.zk_in_name).as_type(Array(AnnotatedTypeName.uint_all())) # Request static public keys offset = 0 key_req_stmts = [] me_key_idx: Dict[CryptoParams, int] = {} if ext_circuit.requested_global_keys: # Ensure that me public key is stored starting at in[0] keys = [key for key in ext_circuit.requested_global_keys] tmp_keys = {} for crypto_params in int_fct.used_crypto_backends: tmp_key_var = Identifier(f'_tmp_key_{crypto_params.identifier_name}') key_req_stmts.append(tmp_key_var.decl_var(AnnotatedTypeName.key_type(crypto_params))) tmp_keys[crypto_params] = tmp_key_var for (key_owner, crypto_params) in keys: tmp_key_var = tmp_keys[crypto_params] idf, assignment = ext_circuit.request_public_key(crypto_params, key_owner, ext_circuit.get_glob_key_name(key_owner, crypto_params)) assignment.lhs = IdentifierExpr(tmp_key_var.clone()) key_req_stmts.append(assignment) # Remember me-keys for later use in symmetrically encrypted keys if key_owner == MeExpr(): assert crypto_params not in me_key_idx me_key_idx[crypto_params] = offset # Manually add to circuit inputs key_len = crypto_params.key_len key_req_stmts.append(in_arr_var.slice(offset, key_len).assign(IdentifierExpr(tmp_key_var.clone()).slice(0, key_len))) offset += key_len assert offset == ext_circuit.in_size # Check encrypted parameters param_stmts = [] for p in original_params: """ * of T_e rule 8 """ if p.annotated_type.is_cipher(): cipher_payload_len = p.annotated_type.type_name.crypto_params.cipher_payload_len assign_stmt = in_arr_var.slice(offset, cipher_payload_len).assign(IdentifierExpr(p.idf.clone()).slice(0, cipher_payload_len)) ext_circuit.ensure_parameter_encryption(assign_stmt, p) # Manually add to circuit inputs param_stmts.append(assign_stmt) offset += cipher_payload_len # Populate sender field of parameters encrypted with a symmetric cipher copy_stmts = [] for p in original_params: if p.annotated_type.is_cipher(): c = p.annotated_type.type_name assert isinstance(c, CipherText) if c.crypto_params.is_symmetric_cipher(): sender_key = in_arr_var.index(me_key_idx[c.crypto_params]) idf = IdentifierExpr(p.idf.clone()).as_type(p.annotated_type.clone()) cipher_payload_len = cfg.get_crypto_params(p.annotated_type.homomorphism).cipher_payload_len lit = ArrayLiteralExpr([idf.clone().index(i) for i in range(cipher_payload_len)] + [sender_key]) copy_stmts.append(VariableDeclarationStatement(VariableDeclaration([], p.annotated_type.clone(), p.idf.clone(), 'memory'), lit)) if copy_stmts: param_stmts += [Comment(), Comment('Copy from calldata to memory and set sender field')] + copy_stmts # Declare in array new_in_array_expr = NewExpr(AnnotatedTypeName(TypeName.dyn_uint_array()), [NumberLiteralExpr(ext_circuit.in_size_trans)]) in_var_decl = in_arr_var.idf.decl_var(TypeName.dyn_uint_array(), new_in_array_expr) stmts.append(in_var_decl) stmts.append(Comment()) stmts += Comment.comment_wrap_block('Request static public keys', key_req_stmts) stmts += Comment.comment_wrap_block('Backup private arguments for verification', param_stmts) # Call internal function args = [IdentifierExpr(param.idf.clone()) for param in original_params] internal_call = FunctionCallExpr(IdentifierExpr(int_fct.idf.clone()).override(target=int_fct), args) internal_call.sec_start_offset = ext_circuit.priv_in_size if int_fct.requires_verification: ext_circuit.call_function(internal_call) args += [in_arr_var.clone(), NumberLiteralExpr(ext_circuit.in_size), IdentifierExpr(cfg.zk_out_name), NumberLiteralExpr(ext_circuit.out_size)] if int_fct.return_parameters: stmts += Comment.comment_list("Declare return variables", [VariableDeclarationStatement(deep_copy(vd)) for vd in int_fct.return_var_decls]) in_call = TupleExpr([IdentifierExpr(vd.idf.clone()) for vd in int_fct.return_var_decls]).assign(internal_call) else: in_call = ExpressionStatement(internal_call) stmts.append(Comment("Call internal function")) stmts.append(in_call) stmts.append(Comment()) # Call verifier if requires_proof and not cfg.disable_verification: verifier = IdentifierExpr(cfg.get_contract_var_name(ext_circuit.verifier_contract_type.code())) verifier_args = [IdentifierExpr(cfg.proof_param_name), IdentifierExpr(cfg.zk_in_name), IdentifierExpr(cfg.zk_out_name)] verify = ExpressionStatement(verifier.call(cfg.verification_function_name, verifier_args)) stmts.append(StatementList([Comment('Verify zk proof of execution'), verify], excluded_from_simulation=True)) # Add return statement at the end if necessary if int_fct.return_parameters: stmts.append(ReturnStatement(TupleExpr([IdentifierExpr(vd.idf.clone()) for vd in int_fct.return_var_decls]))) return Block(stmts)
def transform_contract(self, su: SourceUnit, c: ContractDefinition) -> ContractDefinition: """ Transform an entire zkay contract into a public solidity contract. This: * transforms state variables, function bodies and signatures * import verification contracts * adds zk_data structs for each function with verification \ (to store circuit I/O, to bypass solidity stack limit and allow for easy assignment of array variables), * creates external wrapper functions for all public functions which require verification * adds circuit IO serialization/deserialization code from/to zk_data struct to all functions which require verification. :param su: [SIDE EFFECTS] Source unit of which this contract is part of :param c: [SIDE EFFECTS] The contract to transform :return: The contract itself """ all_fcts = c.constructor_definitions + c.function_definitions # Get list of static owner labels for this contract global_owners = [Expression.me_expr()] for var in c.state_variable_declarations: if var.annotated_type.is_address() and (var.is_final or var.is_constant): global_owners.append(var.idf) # Backup untransformed function bodies for fct in all_fcts: fct.original_body = deep_copy(fct.body, with_types=True, with_analysis=True) # Transform types of normal state variables c.state_variable_declarations = self.var_decl_trafo.visit_list(c.state_variable_declarations) # Split into functions which require verification and those which don't need a circuit helper req_ext_fcts = {} new_fcts, new_constr = [], [] for fct in all_fcts: assert isinstance(fct, ConstructorOrFunctionDefinition) if fct.requires_verification or fct.requires_verification_when_external: self.circuits[fct] = self.create_circuit_helper(fct, global_owners) if fct.requires_verification_when_external: req_ext_fcts[fct] = fct.parameters[:] elif fct.is_constructor: new_constr.append(fct) else: new_fcts.append(fct) # Add constant state variables for external contracts and field prime field_prime_decl = StateVariableDeclaration(AnnotatedTypeName.uint_all(), ['public', 'constant'], Identifier(cfg.field_prime_var_name), NumberLiteralExpr(bn128_scalar_field)) contract_var_decls = self.include_verification_contracts(su, c) c.state_variable_declarations = [field_prime_decl, Comment()]\ + Comment.comment_list('Helper Contracts', contract_var_decls)\ + [Comment('User state variables')]\ + c.state_variable_declarations # Transform signatures for f in all_fcts: f.parameters = self.var_decl_trafo.visit_list(f.parameters) for f in c.function_definitions: f.return_parameters = self.var_decl_trafo.visit_list(f.return_parameters) f.return_var_decls = self.var_decl_trafo.visit_list(f.return_var_decls) # Transform bodies for fct in all_fcts: gen = self.circuits.get(fct, None) fct.body = ZkayStatementTransformer(gen).visit(fct.body) # Transform (internal) functions which require verification (add the necessary additional parameters and boilerplate code) fcts_with_verification = [fct for fct in all_fcts if fct.requires_verification] compute_transitive_circuit_io_sizes(fcts_with_verification, self.circuits) transform_internal_calls(fcts_with_verification, self.circuits) for f in fcts_with_verification: circuit = self.circuits[f] assert circuit.requires_verification() if circuit.requires_zk_data_struct(): # Add zk data struct for f to contract zk_data_struct = StructDefinition(Identifier(circuit.zk_data_struct_name), [ VariableDeclaration([], AnnotatedTypeName(idf.t), idf.clone(), '') for idf in circuit.output_idfs + circuit.input_idfs ]) c.struct_definitions.append(zk_data_struct) self.create_internal_verification_wrapper(f) # Create external wrapper functions where necessary for f, params in req_ext_fcts.items(): ext_f, int_f = self.split_into_external_and_internal_fct(f, params, global_owners) if ext_f.is_function: new_fcts.append(ext_f) else: new_constr.append(ext_f) new_fcts.append(int_f) c.constructor_definitions = new_constr c.function_definitions = new_fcts return c
def create_external_wrapper_body(int_fct: ConstructorOrFunctionDefinition, ext_circuit: CircuitHelper, original_params: List[Parameter], requires_proof: bool) -> Block: """ Return Block with external wrapper function body. :param int_fct: corresponding internal function :param ext_circuit: [SIDE EFFECT] circuit helper of the external wrapper function :param original_params: list of transformed function parameters without additional parameters added due to transformation :return: body with wrapper code """ has_priv_args = any( [p.annotated_type.is_cipher() for p in original_params]) stmts = [] if has_priv_args: ext_circuit._require_public_key_for_label_at( None, Expression.me_expr()) if cfg.is_symmetric_cipher(): # Make sure msg.sender's key pair is available in the circuit assert any(isinstance(k, MeExpr) for k in ext_circuit.requested_global_keys) \ or has_priv_args, "requires verification => both sender keys required" stmts += ext_circuit.request_private_key() # Verify that out parameter has correct size stmts += [ RequireStatement( IdentifierExpr(cfg.zk_out_name).dot('length').binop( '==', NumberLiteralExpr(ext_circuit.out_size_trans))) ] # IdentifierExpr for array var holding serialized public circuit inputs in_arr_var = IdentifierExpr(cfg.zk_in_name).as_type( Array(AnnotatedTypeName.uint_all())) # Find index of me's public key in requested_global_keys glob_me_key_index = -1 for idx, e in enumerate(ext_circuit.requested_global_keys): if isinstance(e, MeExpr): glob_me_key_index = idx break # Request static public keys offset = 0 key_req_stmts = [] if ext_circuit.requested_global_keys: # Ensure that me public key is stored starting at in[0] keys = [key for key in ext_circuit.requested_global_keys] if glob_me_key_index != -1: (keys[0], keys[glob_me_key_index]) = (keys[glob_me_key_index], keys[0]) tmp_key_var = Identifier('_tmp_key') key_req_stmts.append( tmp_key_var.decl_var(AnnotatedTypeName.key_type())) for key_owner in keys: idf, assignment = ext_circuit.request_public_key( key_owner, ext_circuit.get_glob_key_name(key_owner)) assignment.lhs = IdentifierExpr(tmp_key_var.clone()) key_req_stmts.append(assignment) # Manually add to circuit inputs key_req_stmts.append( in_arr_var.slice(offset, cfg.key_len).assign( IdentifierExpr(tmp_key_var.clone()).slice( 0, cfg.key_len))) offset += cfg.key_len assert offset == ext_circuit.in_size # Check encrypted parameters param_stmts = [] for p in original_params: """ * of T_e rule 8 """ if p.annotated_type.is_cipher(): assign_stmt = in_arr_var.slice( offset, cfg.cipher_payload_len).assign( IdentifierExpr(p.idf.clone()).slice( 0, cfg.cipher_payload_len)) ext_circuit.ensure_parameter_encryption(assign_stmt, p) # Manually add to circuit inputs param_stmts.append(assign_stmt) offset += cfg.cipher_payload_len if cfg.is_symmetric_cipher(): # Populate sender field of encrypted parameters copy_stmts = [] for p in original_params: if p.annotated_type.is_cipher(): sender_key = in_arr_var.index(0) idf = IdentifierExpr(p.idf.clone()).as_type( p.annotated_type.clone()) lit = ArrayLiteralExpr([ idf.clone().index(i) for i in range(cfg.cipher_payload_len) ] + [sender_key]) copy_stmts.append( VariableDeclarationStatement( VariableDeclaration([], p.annotated_type.clone(), p.idf.clone(), 'memory'), lit)) if copy_stmts: param_stmts += [ Comment(), Comment( 'Copy from calldata to memory and set sender field') ] + copy_stmts assert glob_me_key_index != -1, "Symmetric cipher but did not request me key" # Declare in array new_in_array_expr = NewExpr( AnnotatedTypeName(TypeName.dyn_uint_array()), [NumberLiteralExpr(ext_circuit.in_size_trans)]) in_var_decl = in_arr_var.idf.decl_var(TypeName.dyn_uint_array(), new_in_array_expr) stmts.append(in_var_decl) stmts.append(Comment()) stmts += Comment.comment_wrap_block('Request static public keys', key_req_stmts) stmts += Comment.comment_wrap_block( 'Backup private arguments for verification', param_stmts) # Call internal function args = [IdentifierExpr(param.idf.clone()) for param in original_params] internal_call = FunctionCallExpr( IdentifierExpr(int_fct.idf.clone()).override(target=int_fct), args) internal_call.sec_start_offset = ext_circuit.priv_in_size if int_fct.requires_verification: ext_circuit.call_function(internal_call) args += [ in_arr_var.clone(), NumberLiteralExpr(ext_circuit.in_size), IdentifierExpr(cfg.zk_out_name), NumberLiteralExpr(ext_circuit.out_size) ] if int_fct.return_parameters: stmts += Comment.comment_list("Declare return variables", [ VariableDeclarationStatement(deep_copy(vd)) for vd in int_fct.return_var_decls ]) in_call = TupleExpr([ IdentifierExpr(vd.idf.clone()) for vd in int_fct.return_var_decls ]).assign(internal_call) else: in_call = ExpressionStatement(internal_call) stmts.append(Comment("Call internal function")) stmts.append(in_call) stmts.append(Comment()) # Call verifier if requires_proof: verifier = IdentifierExpr( cfg.get_contract_var_name( ext_circuit.verifier_contract_type.code())) verifier_args = [ IdentifierExpr(cfg.proof_param_name), IdentifierExpr(cfg.zk_in_name), IdentifierExpr(cfg.zk_out_name) ] verify = ExpressionStatement( verifier.call(cfg.verification_function_name, verifier_args)) stmts.append( StatementList( [Comment('Verify zk proof of execution'), verify], excluded_from_simulation=True)) # Add return statement at the end if necessary if int_fct.return_parameters: stmts.append( ReturnStatement( TupleExpr([ IdentifierExpr(vd.idf.clone()) for vd in int_fct.return_var_decls ]))) return Block(stmts)
def handle_builtin_function_call(self, ast: FunctionCallExpr, func: BuiltinFunction): # handle special cases if func.is_ite(): cond_t = ast.args[0].annotated_type # Ensure that condition is boolean if not cond_t.type_name.implicitly_convertible_to( TypeName.bool_type()): raise TypeMismatchException(TypeName.bool_type(), cond_t.type_name, ast.args[0]) res_t = ast.args[1].annotated_type.type_name.combined_type( ast.args[2].annotated_type.type_name, True) if cond_t.is_private(): # Everything is turned private func.is_private = True a = res_t.annotate(Expression.me_expr()) else: p = ast.args[1].annotated_type.combined_privacy( ast.analysis, ast.args[2].annotated_type) a = res_t.annotate(p) ast.args[1] = self.get_rhs(ast.args[1], a) ast.args[2] = self.get_rhs(ast.args[2], a) ast.annotated_type = a return elif func.is_parenthesis(): ast.annotated_type = ast.args[0].annotated_type return # Check that argument types conform to op signature parameter_types = func.input_types() if not func.is_eq(): for arg, t in zip(ast.args, parameter_types): if not arg.instanceof_data_type(t): raise TypeMismatchException(t, arg.annotated_type.type_name, arg) t1 = ast.args[0].annotated_type.type_name t2 = None if len( ast.args) == 1 else ast.args[1].annotated_type.type_name if len(ast.args) == 1: arg_t = 'lit' if ast.args[ 0].annotated_type.type_name.is_literal else t1 else: assert len(ast.args) == 2 is_eq_with_tuples = func.is_eq() and isinstance(t1, TupleType) arg_t = t1.combined_type(t2, convert_literals=is_eq_with_tuples) # Infer argument and output types if arg_t == 'lit': res = func.op_func( *[arg.annotated_type.type_name.value for arg in ast.args]) if isinstance(res, bool): assert func.output_type() == TypeName.bool_type() out_t = BooleanLiteralType(res) else: assert func.output_type() == TypeName.number_type() out_t = NumberLiteralType(res) if func.is_eq(): arg_t = t1.to_abstract_type().combined_type( t2.to_abstract_type(), True) elif func.output_type() == TypeName.bool_type(): out_t = TypeName.bool_type() else: out_t = arg_t assert arg_t is not None and (arg_t != 'lit' or not func.is_eq()) private_args = any(map(self.has_private_type, ast.args)) if private_args: assert arg_t != 'lit' if func.can_be_private(): if func.is_shiftop(): if not ast.args[1].annotated_type.type_name.is_literal: raise TypeException( 'Private shift expressions must use a constant (literal) shift amount', ast.args[1]) if ast.args[1].annotated_type.type_name.value < 0: raise TypeException('Cannot shift by negative amount', ast.args[1]) if func.is_bitop() or func.is_shiftop(): for arg in ast.args: if arg.annotated_type.type_name.elem_bitwidth == 256: raise TypeException( 'Private bitwise and shift operations are only supported for integer types < 256 bit, ' 'please use a smaller type', arg) if func.is_arithmetic(): for a in ast.args: if a.annotated_type.type_name.elem_bitwidth == 256: issue_compiler_warning( func, 'Possible field prime overflow', 'Private arithmetic 256bit operations overflow at FIELD_PRIME.\n' 'If you need correct overflow behavior, use a smaller integer type.' ) break elif func.is_comp(): for a in ast.args: if a.annotated_type.type_name.elem_bitwidth == 256: issue_compiler_warning( func, 'Possible private comparison failure', 'Private 256bit comparison operations will fail for values >= 2^252.\n' 'If you cannot guarantee that the value stays in range, you must use ' 'a smaller integer type to ensure correctness.' ) break func.is_private = True p = Expression.me_expr() else: raise TypeException( f'Operation \'{func.op}\' does not support private operands', ast) else: p = None if arg_t != 'lit': # Add implicit casts for arguments arg_pt = arg_t.annotate(p) if func.is_shiftop() and p is not None: ast.args[0] = self.get_rhs(ast.args[0], arg_pt) else: ast.args[:] = map( lambda argument: self.get_rhs(argument, arg_pt), ast.args) ast.annotated_type = out_t.annotate(p)