Each swap contains a SwapBody and a zk-SNARK swap proof.
The swap proof demonstrates the properties enumerated below for the private witnesses known by the prover:
- Swap plaintext which consists of:
- Trading pair, which consists of two asset IDs with asset-specific generators
- Fee value which consists of an amount interpreted as an and an asset ID with asset-specific generator
- Input amount of the first asset interpreted as an
- Input amount of the second asset interpreted as an
Rseed, interpreted as an
- Diversified basepoint corresponding to the claim address
- Transmission key corresponding to the claim address
- Clue key corresponding to the claim address
- Fee blinding factor used to blind the fee commitment
And the corresponding public inputs:
- Balance commitment to the value balance
- Fee commitment to the value of the fee
- Swap commitment
The zk-SNARK certifies that the public input swap commitment was derived as:
using the above witnessed values and where
ds is a constant domain separator:
ds = from_le_bytes(BLAKE2b-512(b"penumbra.swap")) mod q
The zk-SNARK certifies that the public input fee commitment was derived from the witnessed values as:
where is a constant generator and is an asset-specific generator point derived as described in Value Commitments.
The zk-SNARK certifies that the total public input balance commitment was derived from the witnessed values as:
where the first two terms are from the input amounts and assets, and is the fee commitment.