Amount privacy (privacy pool)

deposit:  pick nullifier, secret  ->  precommitment = Poseidon(nullifier, secret)
          deposit(precommitment){value}  ->  contract assigns label = Poseidon(scope, index),
          inserts commitment = Poseidon(value, label, precommitment) into the state tree
ASP:      provider reviews the deposit; if clean, adds `label` to the association set
withdraw: prove (commitment in state tree) and (label in association set) and nullifier and
          value-accounting, to a FRESH stealth address  ->  paid out, remainder re-inserted

import { buildPoolCrypto, generateDepositNote, buildDepositTx } from "@opaquecash/privacy-pool";
import { randomBytes } from "@noble/hashes/utils";

const crypto = await buildPoolCrypto();
const note = generateDepositNote(crypto, randomBytes); // { nullifier, secret, precommitment }

const tx = buildDepositTx(poolAddress, note, parseEther("1"));
await wallet.sendTransaction(tx); // value = 1 ETH

// PERSIST `note` (nullifier + secret) and the assigned `label` (from the Deposit event).
// They are required to withdraw and are never recoverable from the chain alone.

import {
  buildWithdrawalWitness,
  generateWithdrawalProof,
  buildWithdrawTx,
  reconstructAspSetFromDeposits,
  aspIndexOf,
} from "@opaquecash/privacy-pool";

// `deposits`: { label, leafIndex } for every Deposit event (the same scan builds the state tree).
const set = reconstructAspSetFromDeposits(crypto, deposits, currentAspRoot);
if (!set) throw new Error("no set matches the current aspRoot yet; wait for the next ASP update");

// The contract binds the payout into the proof via `context`; read it first.
const params = { recipient: freshStealthAddress, feeRecipient, fee };
const context = await publicClient.readContract({
  address: poolAddress, abi: opaquePrivacyPoolAbi, functionName: "context", args: [params],
});

const witness = buildWithdrawalWitness(crypto, {
  note: { value, label, nullifier, secret },
  withdrawnValue: parseEther("0.4"),
  newNullifier, newSecret,                          // fresh openings for the remainder
  stateLeaves, stateIndex,                          // from the pool's Deposit events
  aspLeaves: set.aspLeaves,                         // resolved + verified against aspRoot
  aspIndex: aspIndexOf(set.aspLeaves, label),
  context,
});

const { proof } = await generateWithdrawalProof(witness, {
  wasmPath: "withdrawal.wasm",
  zkeyPath: "withdrawal_final.zkey",
});

const tx = buildWithdrawTx(poolAddress, proof, witness.publics, params);
await wallet.sendTransaction(tx); // the recipient receives withdrawnValue - fee

import { createPublicClient, createWalletClient, http, parseEther, decodeEventLog, parseAbiItem } from "viem";
import { privateKeyToAccount } from "viem/accounts";
import { sepolia } from "viem/chains";
import { requireEvmDeployment } from "@opaquecash/deployments";
import {
  buildPoolCrypto, PoolMerkleTree,
  generateDepositNote, buildDepositTx,
  buildWithdrawalWitness, generateWithdrawalProof, buildWithdrawTx,
  reconstructAspSetFromDeposits, aspIndexOf,
  opaquePrivacyPoolAbi,
} from "@opaquecash/privacy-pool";
import { randomBytes } from "@noble/hashes/utils";

const pool = requireEvmDeployment(11155111).contracts.opaquePrivacyPool;
const account = privateKeyToAccount(process.env.FUNDER_KEY as `0x${string}`);
const wallet = createWalletClient({ account, chain: sepolia, transport: http(rpcUrl) });
const publicClient = createPublicClient({ chain: sepolia, transport: http(rpcUrl) });
const crypto = await buildPoolCrypto();

// The Deposit event carries the contract-assigned label + leaf index.
const depositEvent = parseAbiItem(
  "event Deposit(bytes32 indexed commitment, uint256 label, uint256 value, uint32 leafIndex)",
);

const value = parseEther("0.01");
const note = generateDepositNote(crypto, randomBytes); // { nullifier, secret, precommitment }

const depositTx = buildDepositTx(pool, note, value);
const depositHash = await wallet.sendTransaction(depositTx);
const receipt = await publicClient.waitForTransactionReceipt({ hash: depositHash });

// Decode the contract-assigned label + leaf index from the Deposit event.
const depositLog = receipt.logs.find((l) => l.address.toLowerCase() === pool.toLowerCase());
const { args } = decodeEventLog({ abi: [depositEvent], data: depositLog!.data, topics: depositLog!.topics });

// Persist this note record off-chain (encrypted):
const record = {
  value,
  label: args.label,
  leafIndex: Number(args.leafIndex),
  nullifier: note.nullifier,
  secret: note.secret,
};

const currentAspRoot = BigInt(
  await publicClient.readContract({ address: pool, abi: opaquePrivacyPoolAbi, functionName: "aspRoot" }),
);

// `commitments`: all Deposit event commitments, ordered by leafIndex (from logs or an indexer).
const stateTree = new PoolMerkleTree(crypto, commitments);
const stateProof = stateTree.proof(record.leafIndex);

// `deposits`: { label, leafIndex } from the same Deposit events. Under the default approve-all
// policy the association set is these labels ordered by leafIndex, so rebuild it from chain and
// pick the prefix matching the on-chain root. No dependency on the ASP server.
const set = reconstructAspSetFromDeposits(crypto, deposits, currentAspRoot);
if (!set) throw new Error("no association set matches the current aspRoot yet (deposit not yet approved/posted)");

const aspIndex = aspIndexOf(set.aspLeaves, record.label);
if (aspIndex < 0) throw new Error("your label is not in the current ASP set yet; wait for the next ASP update");

import { resolveAspSetViaEns, aspSetFromManifest } from "@opaquecash/privacy-pool";

const manifest = await resolveAspSetViaEns("evm-asp.opqtest.eth", {
  ensGetText: (name, key) => publicClient.getEnsText({ name, key }),
});
const set = aspSetFromManifest(crypto, manifest, currentAspRoot); // throws if it does not match the root
const aspIndex = aspIndexOf(set.aspLeaves, record.label);

const params = { recipient: freshStealthAddress, feeRecipient, fee: 0n };
const context = await publicClient.readContract({
  address: pool, abi: opaquePrivacyPoolAbi, functionName: "context", args: [params],
});

const withdrawnValue = parseEther("0.004");
const newNote = generateDepositNote(crypto, randomBytes); // remainder openings

const witness = buildWithdrawalWitness(crypto, {
  note: { value: record.value, label: record.label, nullifier: record.nullifier, secret: record.secret },
  withdrawnValue,
  newNullifier: newNote.nullifier,
  newSecret: newNote.secret,
  stateLeaves: commitments, stateIndex: record.leafIndex,
  aspLeaves: set.aspLeaves, aspIndex,
  context: BigInt(context),
});

const { proof } = await generateWithdrawalProof(witness, {
  wasmPath: "withdrawal.wasm",     // from circuits/v2/build (served statically in a browser)
  zkeyPath: "withdrawal_final.zkey",
});

const withdrawTx = buildWithdrawTx(pool, proof, witness.publics, params);
const wHash = await wallet.sendTransaction(withdrawTx);
await publicClient.waitForTransactionReceipt({ hash: wHash });
// freshStealthAddress now holds withdrawnValue - fee, unlinked from the deposit.