Building a compliance attestation system with selective disclosure on Midnight

// Standard MerkleTree — proofs break on concurrent inserts
export ledger unstableTree: MerkleTree<10, Bytes<32>>;

// HistoricMerkleTree — proofs remain valid across all future insertions
export ledger commitmentTree: HistoricMerkleTree<10, Bytes<32>>;

pragma language_version >= 0.23;
import CompactStandardLibrary;

export ledger commitmentTree: HistoricMerkleTree<10, Bytes<32>>;

export ledger ageNullifiers: Map<Bytes<32>, Boolean>;
export ledger residencyNullifiers: Map<Bytes<32>, Boolean>;
export ledger certNullifiers: Map<Bytes<32>, Boolean>;

export ledger attestationCount: Counter;

witness getSecret(): Bytes<32>;
witness getNonce(): Bytes<32>;
witness findCommitmentPath(commitment: Bytes<32>): MerkleTreePath<10, Bytes<32>>;

export circuit registerAttestation(commitment: Bytes<32>): [] {
    commitmentTree.insert(disclose(commitment));
    attestationCount.increment(1);
}

// Off-chain: authority computes commitment before calling registerAttestation
const commitment = persistentHash([
    pad(32, "attest:age-21:v1"),  // domain tag encodes property + version
    userSecret,                    // user's private credential secret
    userNonce                      // unique nonce per attestation
]);
await contract.registerAttestation(commitment);

export circuit proveAgeOver21(commitment: Bytes<32>): [] {
    const secret = getSecret();
    const nonce = getNonce();

    // Step 1: Re-derive commitment from private inputs.
    // "attest:age-21:v1" is specific to this property and version.
    // A residency commitment hashes under a different tag and cannot
    // satisfy this circuit, even with the same (secret, nonce).
    const recomputed = persistentHash<Vector<3, Bytes<32>>>([
        pad(32, "attest:age-21:v1"),
        secret,
        nonce
    ]);

    // Step 2: Preimage binding.
    // This assertion creates a ZK constraint: the proof is only valid if
    // (secret, nonce) hash to the claimed commitment. Without it, any caller
    // who observes a commitment in the public tree can produce a passing proof
    // without knowing the underlying secret.
    assert(recomputed == disclose(commitment), "Private inputs do not match commitment");

    // Step 3: Tree membership.
    // findCommitmentPath uses the public commitment to locate the correct path.
    // merkleTreePathRoot computes the root from that path (embedding commitment
    // as the leaf). checkRoot accepts any historic root — proofs stay valid
    // after future insertions.
    const path = findCommitmentPath(disclose(commitment));
    const root = merkleTreePathRoot<10, Bytes<32>>(path);
    assert(commitmentTree.checkRoot(disclose(root)), "Commitment not in attestation tree");

    // Step 4: Replay prevention with domain-separated nullifier.
    // "nullify:age:v1" differs from "attest:age-21:v1", so the nullifier hash
    // is completely unrelated to the commitment hash. An observer cannot tell
    // which commitment produced which nullifier.
    const nullifier = persistentHash<Vector<3, Bytes<32>>>([
        pad(32, "nullify:age:v1"),
        secret,
        nonce
    ]);
    assert(!ageNullifiers.member(disclose(nullifier)), "Age proof already consumed");
    ageNullifiers.insert(disclose(nullifier), disclose(true));
}

export circuit proveUSResidency(commitment: Bytes<32>): [] {
    const secret = getSecret();
    const nonce = getNonce();

    const recomputed = persistentHash<Vector<3, Bytes<32>>>([
        pad(32, "attest:residency-us:v1"),
        secret,
        nonce
    ]);
    assert(recomputed == disclose(commitment), "Private inputs do not match commitment");

    const path = findCommitmentPath(disclose(commitment));
    const root = merkleTreePathRoot<10, Bytes<32>>(path);
    assert(commitmentTree.checkRoot(disclose(root)), "Commitment not in attestation tree");

    const nullifier = persistentHash<Vector<3, Bytes<32>>>([
        pad(32, "nullify:residency:v1"),
        secret,
        nonce
    ]);
    assert(!residencyNullifiers.member(disclose(nullifier)), "Residency proof already consumed");
    residencyNullifiers.insert(disclose(nullifier), disclose(true));
}

export circuit proveCertification(commitment: Bytes<32>): [] {
    const secret = getSecret();
    const nonce = getNonce();

    const recomputed = persistentHash<Vector<3, Bytes<32>>>([
        pad(32, "attest:cert-dev:v1"),
        secret,
        nonce
    ]);
    assert(recomputed == disclose(commitment), "Private inputs do not match commitment");

    const path = findCommitmentPath(disclose(commitment));
    const root = merkleTreePathRoot<10, Bytes<32>>(path);
    assert(commitmentTree.checkRoot(disclose(root)), "Commitment not in attestation tree");

    const nullifier = persistentHash<Vector<3, Bytes<32>>>([
        pad(32, "nullify:cert:v1"),
        secret,
        nonce
    ]);
    assert(!certNullifiers.member(disclose(nullifier)), "Certification proof already consumed");
    certNullifiers.insert(disclose(nullifier), disclose(true));
}

import type { WitnessContext } from '@midnight-ntwrk/compact-runtime';

type PrivateState = {
    secret: Uint8Array;
    nonce: Uint8Array;
};

export const witnesses = {
    getSecret: (
        context: WitnessContext<Ledger, PrivateState>,
    ): [PrivateState, Uint8Array] => {
        return [context.privateState, context.privateState.secret];
    },

    getNonce: (
        context: WitnessContext<Ledger, PrivateState>,
    ): [PrivateState, Uint8Array] => {
        return [context.privateState, context.privateState.nonce];
    },

    findCommitmentPath: (
        context: WitnessContext<Ledger, PrivateState>,
        commitment: Uint8Array,
    ): [PrivateState, MerkleTreePath] => {
        const path = context.ledger.commitmentTree.findPathForLeaf(commitment);
        if (!path) throw new Error('Commitment not found in attestation tree');
        return [context.privateState, path];
    },
};

// ❌ Both commitment and nullifier use the same tag
const commitment = persistentHash<Vector<3, Bytes<32>>>([
    pad(32, "attest:age:v1"),
    secret, nonce
]);
const nullifier = persistentHash<Vector<3, Bytes<32>>>([
    pad(32, "attest:age:v1"),  // ← same tag
    secret, nonce
]);

// ✅ Distinct tags for commitment and nullifier
const commitment = persistentHash<Vector<3, Bytes<32>>>([
    pad(32, "attest:age-21:v1"), secret, nonce
]);
const nullifier = persistentHash<Vector<3, Bytes<32>>>([
    pad(32, "nullify:age:v1"),   secret, nonce  // ← different tag
]);

// ❌ Both age and residency circuits use the same tag
// proveAge:
const ageCommitment = persistentHash<Vector<3, Bytes<32>>>([
    pad(32, "attest:property:v1"), secret, nonce  // ← generic tag
]);
// proveResidency:
const residencyCommitment = persistentHash<Vector<3, Bytes<32>>>([
    pad(32, "attest:property:v1"), secret, nonce  // ← same tag
]);

// ✅ Each property uses a unique tag
const ageCommitment = persistentHash<Vector<3, Bytes<32>>>([
    pad(32, "attest:age-21:v1"),       secret, nonce
]);
const residencyCommitment = persistentHash<Vector<3, Bytes<32>>>([
    pad(32, "attest:residency-us:v1"), secret, nonce
]);

// ❌ Standard MerkleTree — proofs invalidate on any insertion
export ledger badTree: MerkleTree<10, Bytes<32>>;

export circuit prove(commitment: Bytes<32>): [] {
    const path = findPath(disclose(commitment));
    const root = merkleTreePathRoot<10, Bytes<32>>(path);
    assert(badTree.checkRoot(disclose(root)), "Not in tree");
    // ← fails if ANY insertion happened after the user computed their path
}

// ✅ HistoricMerkleTree — proofs remain valid across all future insertions
export ledger commitmentTree: HistoricMerkleTree<10, Bytes<32>>;
// checkRoot accepts any root the tree has ever held

// ❌ No constraint ties (secret, nonce) to the commitment
export circuit proveNoBinding(commitment: Bytes<32>): [] {
    const secret = getSecret();
    const nonce = getNonce();

    // secret and nonce are loaded from witnesses but never compared to commitment.
    // The ZK circuit has no constraint linking these private values to the
    // public commitment parameter.

    const path = findCommitmentPath(disclose(commitment));
    const root = merkleTreePathRoot<10, Bytes<32>>(path);
    assert(commitmentTree.checkRoot(disclose(root)), "Not in tree");

    const nullifier = persistentHash<Vector<3, Bytes<32>>>([
        pad(32, "nullify:age:v1"), secret, nonce
    ]);
    assert(!ageNullifiers.member(disclose(nullifier)), "Already spent");
    ageNullifiers.insert(disclose(nullifier), disclose(true));
}

// ✅ Preimage binding — add this before the path lookup
const recomputed = persistentHash<Vector<3, Bytes<32>>>([
    pad(32, "attest:age-21:v1"),
    secret,
    nonce
]);
assert(recomputed == disclose(commitment), "Private inputs do not match commitment");

// ❌ Compile error — no Set type
export ledger ageNullifiers: Set<Bytes<32>>;

// ✅ Use Map<K, Boolean> as an idiomatic set
export ledger ageNullifiers: Map<Bytes<32>, Boolean>;

// Check membership
assert(!ageNullifiers.member(disclose(nullifier)), "Already spent");

// Mark as seen
ageNullifiers.insert(disclose(nullifier), disclose(true));

// ❌ Panics if key absent
const val = myMap.lookup(disclose(key));

// ✅ Guard first
assert(myMap.member(disclose(key)), "Key not found");
const val = myMap.lookup(disclose(key));

potential witness-value disclosure must be declared but is not

// ❌ Missing disclose — compile error
ageNullifiers.insert(nullifier, true);

// ✅ Both key and value disclosed
ageNullifiers.insert(disclose(nullifier), disclose(true));

// ❌ Type error — string literal is not Bytes<32>
persistentHash<Vector<3, Bytes<32>>>([
    "attest:age-21:v1",
    secret,
    nonce
]);

// ✅ pad left-pads the string to exactly 32 bytes
persistentHash<Vector<3, Bytes<32>>>([
    pad(32, "attest:age-21:v1"),
    secret,
    nonce
]);

{protocol}:{property}:{threshold-or-variant}:v{version}