fix(sdk): implement real Merkle proof and Soroban proof serialization

- Implement incremental Merkle tree logic in merkle.ts
- Complete generateWithdrawProof with real path computation
- Implement serializeProofForSoroban for BN254 G1/G2 packing
- Align nullifier derivation with ZK circuits (Poseidon(secret))
- Update deserialization to recompute commitment and nullifier

Author: MarvyNwaokobia

packages/core/src/commitment.ts

@@ -10,8 +10,9 @@ import type { ShieldedNote } from './types';
 export async function createNote(amount: bigint, tokenId: bigint): Promise<ShieldedNote> {
   const poseidon = await buildPoseidon();
   const secret = BigInt('0x' + randomBytes(31).toString('hex'));
+  
   const commitment = poseidon([secret, amount, tokenId]);
-  const nullifier = poseidon([secret, BigInt(1)]);
+  const nullifier = poseidon([secret]);
 
   return {
     secret,
@@ -37,14 +38,22 @@ export function serializeNote(note: ShieldedNote): string {
   });
 }
 
-export function deserializeNote(raw: string): ShieldedNote {
+export async function deserializeNote(raw: string): Promise<ShieldedNote> {
+  const poseidon = await buildPoseidon();
   const parsed = JSON.parse(raw);
+  const secret = BigInt(parsed.secret);
+  const amount = BigInt(parsed.amount);
+  const tokenId = BigInt(parsed.tokenId);
+  
+  const commitment = poseidon([secret, amount, tokenId]);
+  const nullifier = poseidon([secret]);
+
   return {
-    secret: BigInt(parsed.secret),
-    amount: BigInt(parsed.amount),
-    tokenId: BigInt(parsed.tokenId),
-    commitment: '',  // recompute
-    nullifier: '',   // recompute
+    secret,
+    amount,
+    tokenId,
+    commitment: poseidon.F.toString(commitment),
+    nullifier: poseidon.F.toString(nullifier),
     index: parsed.index,
     spent: false,
   };

packages/core/src/merkle.ts

@@ -7,16 +7,37 @@ import { buildPoseidon } from 'circomlibjs';
 export class MerkleTree {
   private depth: number;
   private leaves: string[];
+  private zeros: string[] = [];
+  private poseidon: any;
 
   constructor(depth: number = 20, leaves: string[] = []) {
     this.depth = depth;
     this.leaves = leaves;
   }
 
+  private async init() {
+    if (this.poseidon) return;
+    this.poseidon = await buildPoseidon();
+    
+    // Precompute zeros
+    let current = '0';
+    this.zeros.push(current);
+    for (let i = 0; i < this.depth; i++) {
+      current = this.hash(current, current);
+      this.zeros.push(current);
+    }
+  }
+
+  private hash(left: string, right: string): string {
+    const res = this.poseidon([left, right]);
+    return this.poseidon.F.toString(res);
+  }
+
   /**
    * Adds a commitment to the tree.
    */
   async insert(leaf: string): Promise<number> {
+    await this.init();
     this.leaves.push(leaf);
     return this.leaves.length - 1;
   }
@@ -25,20 +46,66 @@ export class MerkleTree {
    * Computes the current root of the tree.
    */
   async getRoot(): Promise<string> {
-    const poseidon = await buildPoseidon();
-    // Simplified root computation
-    let currentHash = this.leaves.length > 0 ? this.leaves[0] : '0';
-    return currentHash;
+    await this.init();
+    let nodes = [...this.leaves];
+    
+    // Pad with zeros to next power of 2 if needed (for simple implementation)
+    // Actually, we can just hash up to the depth.
+    
+    let currentLevelNodes = nodes;
+    for (let i = 0; i < this.depth; i++) {
+      const nextLevelNodes: string[] = [];
+      for (let j = 0; j < currentLevelNodes.length; j += 2) {
+        const left = currentLevelNodes[j];
+        const right = j + 1 < currentLevelNodes.length ? currentLevelNodes[j + 1] : this.zeros[i];
+        nextLevelNodes.push(this.hash(left, right));
+      }
+      if (nextLevelNodes.length === 0) {
+          nextLevelNodes.push(this.zeros[i+1]);
+      }
+      currentLevelNodes = nextLevelNodes;
+    }
+    
+    return currentLevelNodes[0];
   }
 
   /**
    * Generates a Merkle inclusion proof for a leaf at a given index.
    */
   async generateProof(index: number) {
-    // TODO: implement actual Merkle proof generation
+    await this.init();
+    const pathElements: string[] = [];
+    const pathIndices: number[] = [];
+    
+    let currentIndex = index;
+    let currentLevelNodes = [...this.leaves];
+    
+    for (let i = 0; i < this.depth; i++) {
+      const isRight = currentIndex % 2 === 1;
+      const siblingIndex = isRight ? currentIndex - 1 : currentIndex + 1;
+      
+      const sibling = siblingIndex < currentLevelNodes.length 
+        ? currentLevelNodes[siblingIndex] 
+        : this.zeros[i];
+        
+      pathElements.push(sibling);
+      pathIndices.push(isRight ? 1 : 0);
+      
+      // Move to next level
+      const nextLevelNodes: string[] = [];
+      for (let j = 0; j < currentLevelNodes.length; j += 2) {
+        const left = currentLevelNodes[j];
+        const right = j + 1 < currentLevelNodes.length ? currentLevelNodes[j + 1] : this.zeros[i];
+        nextLevelNodes.push(this.hash(left, right));
+      }
+      currentLevelNodes = nextLevelNodes;
+      currentIndex = Math.floor(currentIndex / 2);
+    }
+    
     return {
-      pathElements: new Array(this.depth).fill('0'),
-      pathIndices: new Array(this.depth).fill(0),
+      pathElements,
+      pathIndices,
+      root: currentLevelNodes[0]
     };
   }
 }

packages/core/src/proof.ts

@@ -1,5 +1,6 @@
 import * as snarkjs from 'snarkjs';
 import type { WithdrawParams, ProofResult } from './types';
+import { MerkleTree } from './merkle';
 
 const WITHDRAW_WASM_PATH = './circuits/withdraw_js/withdraw.wasm';
 const WITHDRAW_ZKEY_PATH = './circuits/withdraw_final.zkey';
@@ -11,20 +12,23 @@ const WITHDRAW_ZKEY_PATH = './circuits/withdraw_final.zkey';
  * @returns Proof and public signals for on-chain submission
  */
 export async function generateWithdrawProof(params: WithdrawParams): Promise<ProofResult> {
-  const { note, recipient, relayer, fee, merkleTree } = params;
+  const { note, recipient, relayer, fee, merkleTree: treeState } = params;
 
+  if (note.index === null) {
+      throw new Error('Note index is required for Merkle proof generation');
+  }
+
   // Build Merkle path for the note
-  const pathElements: string[] = [];
-  const pathIndices: number[] = [];
-  // TODO: implement actual Merkle path computation from merkleTree state
+  const tree = new MerkleTree(treeState.depth, treeState.leaves);
+  const { pathElements, pathIndices, root } = await tree.generateProof(note.index);
 
   const input = {
     secret: note.secret.toString(),
     amount: note.amount.toString(),
     tokenId: note.tokenId.toString(),
     pathElements,
     pathIndices,
-    root: merkleTree.root,
+    root,
     nullifierHash: note.nullifier,
     recipient,
     relayer: relayer ?? '0',
@@ -43,13 +47,33 @@ export async function generateWithdrawProof(params: WithdrawParams): Promise<Pro
 
 /**
  * Serializes a proof for submission to the Soroban verifier contract.
- * Packs pi_a, pi_b, pi_c into a single Bytes object.
+ * Packs pi_a, pi_b, pi_c into a single 256-byte Uint8Array.
+ * Format: [pi_a (64)] [pi_b (128)] [pi_c (64)]
  */
 export function serializeProofForSoroban(proof: ProofResult['proof']): Uint8Array {
-  // Encode as: [pi_a (64 bytes)] [pi_b (128 bytes)] [pi_c (64 bytes)]
-  // Each coordinate is a 32-byte big-endian field element
-  const encoded: number[] = [];
-  // TODO: implement proper BN254 point serialization
-  let _ = (proof, encoded);
-  return new Uint8Array(encoded);
+  const encoded = new Uint8Array(256);
+  
+  // Helper to write a big-endian 32-byte field element
+  const writeFE = (fe: string, offset: number) => {
+    const hex = BigInt(fe).toString(16).padStart(64, '0');
+    for (let i = 0; i < 32; i++) {
+      encoded[offset + i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+  };
+
+  // pi_a: x, y
+  writeFE(proof.pi_a[0], 0);
+  writeFE(proof.pi_a[1], 32);
+
+  // pi_b: [[re, im], [re, im], [1, 1]] -> [x_re, x_im, y_re, y_im]
+  writeFE(proof.pi_b[0][1], 64);  // x_re
+  writeFE(proof.pi_b[0][0], 96);  // x_im
+  writeFE(proof.pi_b[1][1], 128); // y_re
+  writeFE(proof.pi_b[1][0], 160); // y_im
+
+  // pi_c: x, y
+  writeFE(proof.pi_c[0], 192);
+  writeFE(proof.pi_c[1], 224);
+
+  return encoded;
 }

packages/core/test/commitment.test.ts

@@ -12,7 +12,8 @@ describe('Commitment', () => {
     expect(note.nullifier).toBeDefined();
     expect(note.secret).toBeDefined();
 
-    // Commitment should be a hex string starting with 0x (or just hex)
+    // Commitment should be a string (large number as string)
     expect(typeof note.commitment).toBe('string');
+    expect(BigInt(note.commitment) > 0n).toBe(true);
   });
 });