Circuit Specification

Overview

Lateo uses a single Circom circuit: policy_tx_2_2 (PolicyTransaction with 2 inputs and 2 outputs).

Transaction Types

The same circuit handles deposits, withdrawals, and transfers. The publicAmount (ext_amount) determines the type:

Public Inputs (11 total)

root                    — Pool Merkle tree root (validates input commitment existence)
publicAmount            — Net amount entering/leaving the pool (signed)
extDataHash             — Poseidon2 hash of external data (recipient, amount, encrypted outputs)
inputNullifiers[2]      — Nullifiers for spent inputs (prevents double-spend)
outputCommitments[2]    — Commitments for new outputs (inserted into Merkle tree)
membershipRoots[1][1]   — ASP membership tree root
nonMembershipRoots[1][1] — ASP non-membership tree root

Constraints

The circuit enforces:

1. Balance conservation: sum(input_amounts) + publicAmount = sum(output_amounts)
2. Commitment validity: commitment = Poseidon2(amount, pubKey, blinding, 0x01)
3. Nullifier correctness: nullifier = Poseidon2(commitment, pathIndices, privKey, 0x02)
4. Merkle inclusion: Each input commitment has a valid Merkle path to root
5. ASP membership: Prover’s leaf is in the membership tree
6. ASP non-membership: Prover is NOT in the exclusion tree
7. Signature: Prover knows the private key corresponding to the public key in the commitment
8. ExtData binding: extDataHash commits to the recipient and encrypted outputs (prevents front-running)

Domain Separators

All Poseidon2 hashes use domain separators to prevent cross-domain attacks:

Proof Format

Groth16 proof = 3 uncompressed BN254 points: