VIII ZSA Guide: Zcash Shielded Assets: asset identity, issuance, transfer, and burn 3 Notes and note commitments 5 Burn and the binding signature

4 OrchardZSA Actions and Action Groups

This section shows that the membership exemption of Orchard dummy notes is unsound once the value base of an Action is a witness, and defines the Split Inputs that replace dummy consumed notes for Custom Assets (§4.1); constructs the split nullifier and proves its independence from the nullifier of the copied note (§4.2); states the OrchardZSA Action statement as a delta on the Orchard one, with named conditions (§4.3); states the assumptions on its proof and proves that a Split Input requires the spend authority of the copied note (§4.4); and defines the Action Group (§4.5). The objects of the section are taken from ZIP 226 and ZIP 228, both Draft, with the rules of ZIP 227 that bound the number of Action Groups. The Orchard objects they modify are those of the Ironwood Guide and are cited, not restated.

4.1 Dummy notes and Split Inputs

By the Ironwood Guide’s Definition “Dummy notes” (§“Actions, bundles, and dummy notes”), an Action whose consumed side is unused consumes a dummy note of value $0$ : under a fresh key or, when $\mathsf{enableCrossAddress}=0$ and the created note is real, at the expanded receiver of the created note and under the key from which that receiver derives. Condition A3 of that volume’s Definition “Orchard Action statement”, namely $v^{\mathsf{old}}\cdot(\mathit{root}-\mathit{rt})=0$ or some evaluation of $\mathsf{SinsemillaHash}$ in the fold returns $\bot$ , exempts every consumed note of value $0$ from membership (protocol specification, §“Dummy Notes (Orchard)” and §“Action Statement (Orchard)”). In the Orchard protocol the exemption is sound for value: condition A4 multiplies the value by the fixed generator $V^{\mathsf{Orchard}}$ (Ironwood Guide, Definition “Net value commitment”), so a consumed note of value $0$ contributes $[0]\,V^{\mathsf{Orchard}}=\mathcal{O}$ , whatever path it fails to prove. The per-Asset value commitment of Definition 3.8 multiplies by a witnessed Asset Base instead. The next proposition shows that the exemption, kept unchanged, then admits a balance violation.

Proposition 4.1 (Unsoundness of the dummy exemption under a witnessed base).

Let $\mathcal{R}^{-}$ be the relation obtained from the Ironwood Guide’s Definition “Orchard Action statement” by adding an auxiliary input $A\in\mathcal{E}^{*}$ and making three replacements: in A1 and A2, the commitment $\mathsf{NoteCommit}$ is replaced by $\mathsf{NoteCommit}^{\mathsf{OrchardZSA}}$ of Definition 3.2 with Asset Base $A$ for both notes; in A4, the net value commitment becomes

\mathsf{cv}^{\mathsf{net}}=[v^{\mathsf{old}}-v^{\mathsf{new}}]\,A+[\mathsf{rcv% }]\,R^{\mathsf{Orchard}},

as in Definition 3.8; condition A3 and conditions A5 to A10 are unchanged, so a consumed note of value $0$ is exempt from membership whatever $A$ is. Then for every $v\in\{1,\dots,2^{64}-1\}$ there is a bundle of two Actions whose witnesses satisfy $\mathcal{R}^{-}$ , with balancing value $0$ and no burn, whose binding signature verifies, and which creates a ZEC note, of Asset Base $V^{\mathsf{Orchard}}$ , of value $v$ while every consumed note has value $0$ :

Action 1 witnesses $A:=[-1]\,V^{\mathsf{Orchard}}$ , $v^{\mathsf{old}}=0$ and $v^{\mathsf{new}}=v$ ;
Action 2 witnesses $A:=V^{\mathsf{Orchard}}$ , a dummy consumed note and $v^{\mathsf{new}}=v$ .

More generally, a witnessed base $A=\sum_{i}[a_{i}]\,B_{i}$ with known coefficients $a_{i}$ over Asset Bases $B_{i}$ contributes $\sum_{i}[a_{i}v]\,B_{i}$ for a committed value $v$ , so a value committed on $A$ cancels values committed on the $B_{i}$ . This is the attack of ZIP 226, “Rationale for Split Notes”: without the enforcement “the prover could input a multiple (or linear combination) of an existing Asset Base, and thereby attack the network by overflowing the ZEC value balance and hence counterfeiting ZEC funds”. Status (Definition 1.3): proved here; ZIP 226 states the attack in words only.

Proof.

The point $[-1]\,V^{\mathsf{Orchard}}$ is not $\mathcal{O}$ , since $V^{\mathsf{Orchard}}$ has prime order $p_{\mathsf{Vesta}}$ , so Action 1 is well typed. Both consumed notes have value $0$ , so A3 holds for both Actions without a path, and A8 holds for either value of $\mathsf{enableSpends}$ ; A9 holds with $\mathsf{enableOutputs}=1$ . The remaining conditions hold when the commitments, the nullifiers and $\mathsf{rk}$ are computed from the witness by their definitions, under a key of the prover; each consumed note is placed at the expanded receiver of the note its Action creates, so that A10 holds for either value of $\mathsf{disableCrossAddress}$ , as in the Ironwood Guide’s Remark “Meaning of A10”. The net value commitments are

	$\displaystyle\mathsf{cv}^{\mathsf{net}}_{1}$	$\displaystyle=[0-v]\,\bigl{(}[-1]\,V^{\mathsf{Orchard}}\bigr{)}+[\mathsf{rcv}_% {1}]\,R^{\mathsf{Orchard}}=[v]\,V^{\mathsf{Orchard}}+[\mathsf{rcv}_{1}]\,R^{% \mathsf{Orchard}},$
	$\displaystyle\mathsf{cv}^{\mathsf{net}}_{2}$	$\displaystyle=[0-v]\,V^{\mathsf{Orchard}}+[\mathsf{rcv}_{2}]\,R^{\mathsf{% Orchard}}.$

With balancing value $0$ and no burn, the Ironwood Guide’s Definition “Binding validating key” gives

\mathsf{bvk}=\mathsf{cv}^{\mathsf{net}}_{1}+\mathsf{cv}^{\mathsf{net}}_{2}=[% \mathsf{rcv}_{1}+\mathsf{rcv}_{2}]\,R^{\mathsf{Orchard}},

whose discrete logarithm $\mathsf{bsk}=\mathsf{rcv}_{1}+\mathsf{rcv}_{2}$ to the base $R^{\mathsf{Orchard}}$ the prover knows, so that volume’s Construction “Binding signature” produces a valid signature. Action 2 creates a ZEC note of value $v$ , and no consumed note carries value. For the general case, $[w]\,\bigl{(}\sum_{i}[a_{i}]\,B_{i}\bigr{)}=\sum_{i}[a_{i}w]\,B_{i}$ for every integer $w$ , by bilinearity of scalar multiplication, and the same computation applies. □

Definition 4.2 (Split Input and Split Action).

Let $B\in\mathcal{E}^{*}$ with $B\neq V^{\mathsf{Orchard}}$ . A Split Input of Asset Base $B$ is an OrchardZSA note $n=(d,\mathsf{pk_{d}},v,B,\rho,\psi,\mathsf{rcm})$ (Definition 3.1), whose extracted commitment

\mathsf{Extract}_{\mathbb{P}}\bigl{(}\mathsf{NoteCommit}^{\mathsf{OrchardZSA}}% _{\mathsf{rcm}}(n)\bigr{)}

(Definition 3.2) is a leaf of the note commitment tree under the anchor of the consuming Action, consumed by an Action that sets the witness bit $\mathsf{split\_flag}:=1$ of the statement defined in “The OrchardZSA Action statement” (§4.3). A Split Input differs from a spend of $n$ in two respects only: its value is replaced by $0$ in the net value commitment, while the commitment still opens with the true value $v$ ; and the Action publishes the split nullifier of “Nullifiers of OrchardZSA notes” (§4.2) in place of the nullifier of $n$ . A Split Action is an Action whose consumed note is a Split Input. ZIP 226 calls $n$ “a previously issued input note (that is, a note that has previously been included in the Merkle tree)”; any leaf of Asset Base $B$ qualifies, whether its note was created by an Action or by issuance (ZIP 226, “Terminology” and “Split Notes”). Class: specified.

Padding rule. In a bundle (Ironwood Guide, Definition “Bundle”) of OrchardZSA Actions, for each Custom Asset whose Asset Base $B$ has fewer consumed notes than created notes, the sender gives each input-less Action of $B$ a Split Input of $B$ (ZIP 226, “Split Notes”). Actions of ZEC keep the dummy consumed notes of the Ironwood Guide’s Definition “Dummy notes”; Actions of Custom Assets take no dummy consumed note (ZIP 226, “Backward Compatibility”). Both regimes occur within one bundle of OrchardZSA Actions. That bundle is not the Orchard-pool bundle of a version- $6$ transaction: version $6$ is the format of ZIP 229, which carries no ZSA fields (ZIP 229, “Non-requirements”). ZIP 226 enforces in the statement that every consumed note of a Custom Asset, split or not and of any value, is a leaf: “for Custom Assets we enforce that every input note to an OrchardZSA Action must be proven to exist in the set of note commitments” (“Rationale for Split Notes”). The condition is constructed in “The OrchardZSA Action statement” (§4.3), and Corollary 9.4, in “Security”, states what it yields for the Asset Base of the created note.

Remark 4.3 (Choice of the copied note).

ZIP 226, “Split Notes”, lets the sender copy one of three notes of Asset Base $B$ :

(1)

another note of $B$ consumed by a real spend in the same bundle, but not by this Split Input;
(2)

a different unspent note of $B$ , which is not thereby spent;
(3)

an already spent note of $B$ , the zeroed value preventing a second spend.

It states that “we do not care about whether the previously issued note copied to create a Split Input is owned by the sender, or whether it was nullified before”. Proposition 4.12, in “The OrchardZSA Action proof” (§4.4), states which of these choices are available to a sender who does not hold the spend authority of the copied note. Under Remark 1.7, if OrchardZSA notes are in the Orchard pool, which ZIP 258, “Consensus rules from NU6.3 activation”, restricts to Actions with $\mathsf{enableCrossAddress}=0$ , then a Split Action whose created note is at an expanded receiver other than that of the copied note violates the cross-address rule. ZIP 226 does not address this case.

4.2 Nullifiers of OrchardZSA notes

An OrchardZSA note consumed by a real spend, with $\mathsf{split\_flag}=0$ , has the Orchard nullifier of the Ironwood Guide’s Definition “Nullifier”:

\mathsf{nf}=\mathsf{DeriveNullifier}_{\mathsf{nk}}(\rho,\psi,\mathsf{cm})=% \mathsf{Extract}_{\mathbb{P}}\bigl{(}[(\mathsf{PRF}^{\mathsf{nfOrchard}}_{% \mathsf{nk}}(\rho)+\psi)\bmod p_{\mathsf{Pallas}}]\,K^{\mathsf{Orchard}}+% \mathsf{cm}\bigr{)},

with $\mathsf{cm}=\mathsf{NoteCommit}^{\mathsf{OrchardZSA}}_{\mathsf{rcm}}(n)$ of Definition 3.2 (ZIP 226, “Note Structure and Commitment”: “generated in the same manner as in the Orchard protocol”; protocol specification, §“Computing $\rho$ values and Nullifiers”). It depends on the Asset Base only through $\mathsf{cm}$ ; for a note with $\mathsf{AssetBase}=V^{\mathsf{Orchard}}$ it is the Orchard nullifier bit for bit. The extension of the Ironwood Guide’s Lemma “One nullifier per note” to OrchardZSA notes is Lemma 9.6, in “Security”.

A Split Action publishes one nullifier, which enters the nullifier set of its pool, and a nullifier must not repeat, either within a transaction or across the block chain (Ironwood Guide, §“Nullifier sets”; protocol specification, §“Nullifier Sets”). The copied note may be unspent, choice (2) of Remark 4.3, or spent in the same bundle, choice (1). Publishing its nullifier would, in the first case, make it unspendable and, in the second, repeat a nullifier within the transaction, which invalidates the transaction. The nullifier of a Split Input must therefore differ from that of the copied note. ZIP 226 states the purpose of the change as privacy: it is made “to prevent the identification of notes” (“Circuit Statement”).

Construction 4.4 (Split nullifier).

Let $L^{\mathsf{Orchard}}:=\mathsf{GroupHash}(\texttt{z.cash:Orchard},\texttt{L})$ , the input of the second row of Table 3. For a Split Input with nullifier deriving key $\mathsf{nk}$ , element $\rho^{\mathsf{old}}$ and commitment $\mathsf{cm}^{\mathsf{old}}$ , the sender draws $\mathsf{rseed\_nf}$ uniformly from $\mathbb{B}^{\mathbb{Y}[32]}$ and sets

\psi^{\mathsf{nf}}:=\mathrm{ToBase}\bigl{(}\mathsf{PRFexpand}_{\mathsf{rseed\_% nf}}([\mathtt{0x0A}]\,\|\,\mathsf{I2LEOSP}_{256}(\rho^{\mathsf{old}}))\bigr{)}% \in\mathbb{F}_{p_{\mathsf{Pallas}}}.

The split nullifier is

\mathsf{nf}^{\mathsf{old}}:=\mathsf{Extract}_{\mathbb{P}}\bigl{(}[(\mathsf{PRF% }^{\mathsf{nfOrchard}}_{\mathsf{nk}}(\rho^{\mathsf{old}})+\psi^{\mathsf{nf}})% \bmod p_{\mathsf{Pallas}}]\,K^{\mathsf{Orchard}}+\mathsf{cm}^{\mathsf{old}}+L^% {\mathsf{Orchard}}\bigr{)}.

Against the Ironwood Guide’s Definition “Nullifier” there are two changes: $\psi^{\mathsf{old}}$ is replaced by the fresh $\psi^{\mathsf{nf}}$ , and the fixed point $L^{\mathsf{Orchard}}$ is added before extraction. The derivation adds one row to that volume’s Construction “Domain bytes of PRF expansion”:

$b$	Key $\kappa$	Remainder $t^{\prime}$	$f$	Output	Section
$\mathtt{0x0A}$	$\mathsf{rseed\_nf}$	$\mathsf{I2LEOSP}_{256}(\rho^{\mathsf{old}})$	$\mathrm{ToBase}$	$\psi^{\mathsf{nf}}$	§4.2

The key $\mathsf{rseed\_nf}$ is secret, uniform and used once. The byte $\mathtt{0x0A}$ is reserved for this use by ZIP 2005’s amendment of §“Sending Notes (Orchard)” (ZIP 2005, “Changes to the Protocol Specification”; ZIP 226, “Split Notes”); the specification’s own list of expansion uses (§“Pseudo Random Functions”) does not record it, and ZIP 2005’s amendment of that list adds $\mathtt{0x0A}$ and $\mathtt{0x0B}$ . It differs from the bytes $\mathtt{0x04}$ of $\mathsf{esk}$ , $\mathtt{0x05}$ and $\mathtt{0x0B}$ of $\mathsf{rcm}$ and $\mathtt{0x09}$ of $\psi$ of the Orchard sending derivations (protocol specification, §“Sending Notes (Orchard)”; Definition 3.5). Class: specified, as a sender rule; Remark 4.8 states what the statement enforces.

Proposition 4.5 (Independence of split nullifiers).

Let $n$ be an OrchardZSA note with commitment $\mathsf{cm}\neq\bot$ , elements $\rho,\psi$ , and nullifier $\mathsf{nf}$ under $\mathsf{nk}$ . For $\psi^{\prime}\in\mathbb{F}_{p_{\mathsf{Pallas}}}$ let $\mathsf{nf}^{\mathsf{split}}(\psi^{\prime})$ be the split nullifier of a copy of $n$ with $\psi^{\mathsf{nf}}=\psi^{\prime}$ .

(i)

Under the Ironwood Guide’s Assumptions “GroupHash as a random oracle” and “Discrete logarithms on Pallas”, no efficient algorithm outputs $\mathsf{nk}$ , a note $n$ with the opening of its commitment, and $\psi^{\prime}\in\mathbb{F}_{p_{\mathsf{Pallas}}}$ with $\mathsf{nf}^{\mathsf{split}}(\psi^{\prime})=\mathsf{nf}$ , except with negligible probability. This holds for every choice of $\psi^{\prime}$ , honest or not.
(ii)

Let $\mathsf{rseed\_nf}$ be uniform and used only for this derivation, and let $K^{\mathsf{Orchard}}\neq\mathcal{O}$ . To an adversary that knows $n$ , $\mathsf{nk}$ and the full viewing key, the split nullifier is indistinguishable from $\mathsf{Extract}_{\mathbb{P}}(U)$ for $U$ uniform on $\mathcal{E}(\mathbb{F}_{p_{\mathsf{Pallas}}})$ , with advantage at most

$\epsilon_{\mathsf{expand}}+\epsilon_{\mathsf{ToBase}}+\delta,$

where $\epsilon_{\mathsf{expand}}$ bounds the Ironwood Guide’s Assumption “Pseudorandomness of PRF expansion” for one query, $\epsilon_{\mathsf{ToBase}}\leq p_{\mathsf{Pallas}}/2^{512}<2^{-257}$ is the statistical distance of $\mathrm{ToBase}$ on a uniform $64$ -byte input from the uniform distribution on $\mathbb{F}_{p_{\mathsf{Pallas}}}$ , and $\delta:=(p_{\mathsf{Vesta}}-p_{\mathsf{Pallas}})/p_{\mathsf{Vesta}}$ as in that volume’s Proposition “Nullifier unlinkability”.

Status (Definition 1.3): proved here for the specified construction. Part (ii) concerns honest senders, since the statement does not enforce the derivation (Remark 4.8).

Proof.

(i) Write

s:=(\mathsf{PRF}^{\mathsf{nfOrchard}}_{\mathsf{nk}}(\rho)+\psi)\bmod p_{% \mathsf{Pallas}},\qquad s^{\prime}:=(\mathsf{PRF}^{\mathsf{nfOrchard}}_{% \mathsf{nk}}(\rho)+\psi^{\prime})\bmod p_{\mathsf{Pallas}},

and $K:=K^{\mathsf{Orchard}}$ , $L:=L^{\mathsf{Orchard}}$ . By the Ironwood Guide’s Lemma “Coordinate extraction identifies opposite points”, $\mathsf{nf}^{\mathsf{split}}(\psi^{\prime})=\mathsf{nf}$ means $[s^{\prime}]\,K+\mathsf{cm}+L=\pm([s]\,K+\mathsf{cm})$ . With the sign $+$ ,

L+[s^{\prime}-s]\,K=\mathcal{O};

with the sign $-$ ,

L+[s+s^{\prime}]\,K+[2]\,\mathsf{cm}=\mathcal{O}.

Given its opening, $\mathsf{cm}\neq\bot$ is a known integer combination of the Sinsemilla generators of its domain and of its blinding base, by the unfolding of the Ironwood Guide’s Construction “Sinsemilla hash on Pallas” used in the proof of its Proposition “Collision resistance of the Sinsemilla instances”; in either branch of Definition 3.2 these generators are values of $\mathsf{GroupHash}$ at inputs other than $(\texttt{z.cash:Orchard},\texttt{L})$ and $(\texttt{z.cash:Orchard},\texttt{K})$ . In both cases $L$ has coefficient $1$ , and its input differs from every other input involved (Lemma 2.8), so the algorithm has output a non-trivial relation among values of $\mathsf{GroupHash}$ at distinct inputs, which the Ironwood Guide’s Lemma “Relations among fixed generators” excludes except with negligible probability. This is the role of the offset $L$ , which ZIP 226 does not state: without it, $\psi^{\prime}=\psi$ reproduces $\mathsf{nf}$ .

(ii) The hybrids follow the proof of the Ironwood Guide’s Proposition “Nullifier unlinkability”. First, $\mathsf{PRFexpand}_{\mathsf{rseed\_nf}}$ , evaluated at the single input $[\mathtt{0x0A}]\,\|\,\mathsf{I2LEOSP}_{256}(\rho)$ , is replaced by a uniform $64$ -byte string, at cost $\epsilon_{\mathsf{expand}}$ : the key is used nowhere else, and the rest of the game is an efficient function of the answer and of $(n,\mathsf{nk})$ . Second, $\mathrm{ToBase}$ of that uniform string is replaced by a uniform $\psi^{\mathsf{nf}}\in\mathbb{F}_{p_{\mathsf{Pallas}}}$ , at cost $\epsilon_{\mathsf{ToBase}}$ (Math Guide, §“Uniform sampling and the bias of modular reduction”; Ironwood Guide, §“Pseudorandom functions and field reductions”). Translation by $\mathsf{PRF}^{\mathsf{nfOrchard}}_{\mathsf{nk}}(\rho)$ is a bijection of $\mathbb{F}_{p_{\mathsf{Pallas}}}$ , so $s^{\prime}$ is then uniform on $\{0,\dots,p_{\mathsf{Pallas}}-1\}$ and independent of $\mathsf{nk}$ , $\rho$ and all else. Third, $s^{\prime}$ , read in $\mathbb{F}_{p_{\mathsf{Vesta}}}$ , is replaced by a uniform scalar $u\in\mathbb{F}_{p_{\mathsf{Vesta}}}$ , at cost $\delta$ , the statistical distance computed in the cited proposition. Since $K\neq\mathcal{O}$ generates the group of prime order $p_{\mathsf{Vesta}}$ , the point $[u]\,K+\mathsf{cm}+L$ is then uniform on $\mathcal{E}(\mathbb{F}_{p_{\mathsf{Pallas}}})$ whatever $\mathsf{cm}$ and $L$ are, and the split nullifier is $\mathsf{Extract}_{\mathbb{P}}$ of a uniform point. □

In the model of the Ironwood Guide’s Assumption “GroupHash as a random oracle”, the event $K^{\mathsf{Orchard}}=\mathcal{O}$ excluded in part (ii) has probability $1/p_{\mathsf{Vesta}}$ .

4.3 The OrchardZSA Action statement

The statement is defined as a delta on the relation $\mathcal{R}_{\mathsf{Action}}$ of the Ironwood Guide’s Definition “Orchard Action statement”, itself a relation in the sense of the Crypto Guide’s Definition “Language, relation, witness” (§“Languages, relations, and witnesses”). Notation, types and conditions not named below are those of that definition; conditions A6 to A9 are cited by name and not restated.

Definition 4.6 (OrchardZSA Action statement).

Base. The seven components of the primary input of the Ironwood Guide’s Definition “Orchard Action statement” other than $\mathsf{disableCrossAddress}$ , and its conditions A1 to A9. The input $\mathsf{disableCrossAddress}$ and condition A10 are omitted (Remark 4.7).

Primary input.

\mathsf{pub}=\bigl{(}\mathit{rt},\,\mathsf{cv}^{\mathsf{net}},\,\mathsf{nf}^{% \mathsf{old}},\,\mathsf{rk},\,\mathsf{cmx},\,\mathsf{enableSpends},\,\mathsf{% enableOutputs},\,\mathsf{enableZSA}\bigr{)},

with the first seven components typed as in the cited definition and $\mathsf{enableZSA}\in\{0,1\}$ .

Auxiliary input. The auxiliary input $\mathsf{aux}$ of the cited definition, together with

\mathsf{AssetBase}\in\mathcal{E}^{*},\quad\mathsf{is\_native\_asset}\in\{0,1\}% ,\quad\mathsf{split\_flag}\in\{0,1\},\quad\psi^{\mathsf{nf}}\in\mathbb{F}_{p_{% \mathsf{Pallas}}}.

Notation. Let $v^{\prime}:=0$ if $\mathsf{split\_flag}=1$ and $v^{\prime}:=v^{\mathsf{old}}$ otherwise. With $M^{\mathsf{old}}$ and $M^{\mathsf{new}}$ the $1086$ -bit messages of the cited definition, built from the witnessed diversified bases, write $\mathsf{NoteCommit}^{\mathsf{OrchardZSA}}_{\mathsf{rcm}}(\mathsf{g_{d}}^{\star% },\mathsf{pk_{d}}^{\star},v,\rho,\psi,\mathsf{AssetBase})$ for the commitment of Definition 3.2 with $M(n)$ replaced by the message built from these arguments: $\mathsf{NoteCommit}_{\mathsf{rcm}}(M)$ in the native branch, and $\mathsf{SinsemillaHashToPoint}(\texttt{z.cash:ZSA-NoteCommit-M},M\,\|\,\mathsf% {AssetBase}^{\star})+[\mathsf{rcm}]\,H_{D}$ , or $\bot$ , in the custom branch. Let $L^{\mathsf{Orchard}}$ be as in Construction 4.4.

Relation. The relation $\mathcal{R}_{\mathsf{ActionZSA}}$ is the set of pairs $(\mathsf{pub},\mathsf{aux})$ of the types above that satisfy the following conditions.

A1^′.

Old note commitment integrity:

	$\displaystyle\mathsf{NoteCommit}^{\mathsf{OrchardZSA}}_{\mathsf{rcm}^{\mathsf{% old}}}\bigl{(}(\mathsf{g_{d}}^{\mathsf{old}})^{\star},(\mathsf{pk_{d}}^{% \mathsf{old}})^{\star},v^{\mathsf{old}},\rho^{\mathsf{old}},\psi^{\mathsf{old}% },\mathsf{AssetBase}\bigr{)}$
	$\displaystyle\qquad\in\{\mathsf{cm}^{\mathsf{old}},\bot\}.$

A2^′.

New note commitment integrity:

	$\displaystyle\mathsf{Extract}_{\mathbb{P}}^{\bot}\bigl{(}\mathsf{NoteCommit}^{% \mathsf{OrchardZSA}}_{\mathsf{rcm}^{\mathsf{new}}}\bigl{(}(\mathsf{g_{d}}^{% \mathsf{new}})^{\star},(\mathsf{pk_{d}}^{\mathsf{new}})^{\star},v^{\mathsf{new% }},\rho^{\mathsf{new}},\psi^{\mathsf{new}},\mathsf{AssetBase}\bigr{)}\bigr{)}$
	$\displaystyle\qquad\in\{\mathsf{cmx},\bot\},$

with $\rho^{\mathsf{new}}:=\mathsf{nf}^{\mathsf{old}}$ and the same $\mathsf{AssetBase}$ as in A1^′.

C1.

Native indicator: $\mathsf{is\_native\_asset}=1$ if and only if $\mathsf{AssetBase}=V^{\mathsf{Orchard}}$ .
C2.

Pause: if $\mathsf{enableZSA}=0$ , then $\mathsf{is\_native\_asset}=1$ .
A3^′.

Merkle path validity: $(v^{\mathsf{old}}=0$ and $\mathsf{is\_native\_asset}=1)$ , or $\mathit{root}=\mathit{rt}$ , or some evaluation of $\mathsf{SinsemillaHash}$ in the fold returns $\bot$ ; the value $\mathit{root}$ , the fold and the encoding bits $\mathsf{c}$ are those of A3.

A4^′.

Value commitment integrity:

	$\displaystyle\mathsf{cv}^{\mathsf{net}}$	$\displaystyle=\mathsf{ValueCommit}^{\mathsf{OrchardZSA}}_{\mathsf{rcv}}(% \mathsf{AssetBase},v^{\prime}-v^{\mathsf{new}})$
		$\displaystyle=[v^{\prime}-v^{\mathsf{new}}]\,\mathsf{AssetBase}+[\mathsf{rcv}]% \,R^{\mathsf{Orchard}},$

a variable-base multiplication by the witnessed $\mathsf{AssetBase}$ (Definition 3.8).

C3.

Split only for Custom Assets: if $\mathsf{split\_flag}=1$ , then $\mathsf{is\_native\_asset}=0$ .

A5^′.

Nullifier integrity: if $\mathsf{split\_flag}=0$ , then $\psi^{\mathsf{nf}}=\psi^{\mathsf{old}}$ and

\mathsf{nf}^{\mathsf{old}}=\mathsf{DeriveNullifier}_{\mathsf{nk}}(\rho^{% \mathsf{old}},\psi^{\mathsf{old}},\mathsf{cm}^{\mathsf{old}});

if $\mathsf{split\_flag}=1$ , then

	$\displaystyle\mathsf{nf}^{\mathsf{old}}=\mathsf{Extract}_{\mathbb{P}}\bigl{(}$	$\displaystyle[(\mathsf{PRF}^{\mathsf{nfOrchard}}_{\mathsf{nk}}(\rho^{\mathsf{% old}})+\psi^{\mathsf{nf}})\bmod p_{\mathsf{Pallas}}]\,K^{\mathsf{Orchard}}$
		$\displaystyle+\mathsf{cm}^{\mathsf{old}}+L^{\mathsf{Orchard}}\bigr{)},$

the split nullifier of Construction 4.4.

A6, A7.

Spend authority and diversified address integrity: unchanged and unconditional; no factor of $\mathsf{split\_flag}$ relaxes them.
A8, A9.

Enable spend flag and enable output flag: unchanged; A8 reads $v^{\mathsf{old}}$ , not $v^{\prime}$ , and A9 reads $v^{\mathsf{new}}$ .

(ZIP 226, “Circuit Statement”, paragraphs “Asset Base Equality”, “The enableZSA Flag”, “Value Commitment Correctness” and “Asset Identifier Consistency for Split Actions”; ZIP 226, “Split Notes” and “Note Structure and Commitment”; protocol specification, §“Action Statement (Orchard)”.) Class: specified at statement level; its status is stated in Remark 4.7.

The following consequences are read off Definition 4.6, Definition 3.2 and Definition 2.15.

One witness. Conditions A1^′, A2^′ and A4^′ use the single witnessed $\mathsf{AssetBase}$ , so the consumed and the created note of an Action have one Asset Base, and its net value commitment is on that base.

Native branch. By C1 and the case split of Definition 3.2, an Action with $\mathsf{AssetBase}=V^{\mathsf{Orchard}}$ and $\mathsf{split\_flag}=0$ satisfies A1^′, A2^′, A4^′ and A5^′ exactly when $\psi^{\mathsf{nf}}=\psi^{\mathsf{old}}$ and it satisfies the Orchard A1, A2, A4 and A5.

Pause. With $\mathsf{enableZSA}=0$ , C2 and C1 force $\mathsf{AssetBase}=V^{\mathsf{Orchard}}$ , and C3 then forces $\mathsf{split\_flag}=0$ , so the relation admits only Orchard Actions.

Membership. Since $0\leq v^{\mathsf{old}}<2^{64}<p_{\mathsf{Pallas}}$ , the first disjunct of A3^′ holds only for a consumed ZEC note of value $0$ . Every consumed note of a Custom Asset, split or not and of any value, satisfies $\mathit{root}=\mathit{rt}$ or the $\bot$ clause. The $\bot$ clause gives no escape: for witnesses extracted under Assumption 4.9, the argument of the Ironwood Guide’s Remark “ $\bot$ -weakened conditions”, by that volume’s Proposition “Collision resistance of the Sinsemilla instances” (iii) under its Assumptions “Discrete logarithms on Pallas” and “GroupHash as a random oracle”, excludes it except with negligible probability; the same holds for the $\bot$ cases of A1^′ and A2^′ in both branches of $\mathsf{NoteCommit}^{\mathsf{OrchardZSA}}$ , by Proposition 3.3(c) for the custom branch.

Split Actions. By A4^′ the copied value never enters $\mathsf{cv}^{\mathsf{net}}$ . By A8, which reads $v^{\mathsf{old}}$ , a Split Action that copies a note of non-zero value requires $\mathsf{enableSpends}=1$ , while one that copies a note of value $0$ does not.

These consequences are direct from the cited definitions and from the Ironwood Guide’s Remark “ $\bot$ -weakened conditions”, with Assumption 4.9 in place of that volume’s knowledge-soundness assumption (ZIP 226, “Circuit Statement” and “Overview”). Table 5 pairs each condition with the Orchard condition it replaces and its ZIP 226 paragraph; Figure 1 draws the new witnesses and the conditions that read them.

Condition	Replaces	ZIP 226, “Circuit Statement”, paragraph
A1^′	A1	“Asset Base Equality”
A2^′	A2	“Asset Base Equality”
C1	none	“Asset Base Equality” (the witness $\mathsf{is\_native\_asset}$ )
C2	none	“The enableZSA Flag”
A3^′	A3	“Asset Identifier Consistency for Split Actions” (Merkle Path Validity)
A4^′	A4	“Value Commitment Correctness”; “Asset Identifier Consistency for Split Actions” ( $v^{\prime}$ )
C3	none	“Asset Identifier Consistency for Split Actions”
A5^′	A5	“Asset Identifier Consistency for Split Actions” (Nullifier Integrity), with “Split Notes” for the formula and “Note Structure and Commitment” for $\mathsf{split\_flag}=0$
A6 to A9	themselves	none (unchanged)
A10	omitted	none (Remark 4.7)

Table 5: Conditions of the OrchardZSA Action statement of Definition 4.6: each condition, the condition of the Ironwood Guide’s Definition “Orchard Action statement” that it replaces, and the paragraph of ZIP 226, “Circuit Statement”, that states it.

Refer to caption — Figure 1: The witnessed Asset Base in the OrchardZSA Action statement of Definition 4.6. The four new witnesses are on the left, the new primary input $\mathsf{enableZSA}$ on the right, and the conditions that read them in the centre, each tagged with the Orchard condition it replaces or as new. One witness $\mathsf{AssetBase}$ enters A1^′, A2^′ and A4^′, which forces equal Asset Bases of the consumed and the created note and a value commitment on that base; through C1 and A3^′, only a consumed ZEC note of value $0$ escapes membership.

Remark 4.7 (Status of the OrchardZSA Action statement).

The delta is specified at statement level (ZIP 226, Draft, “Circuit Statement”). ZIP 226 states it against the specification’s statement with seven primary inputs and conditions A1 to A9. The current Orchard statement has the eighth primary input $\mathsf{disableCrossAddress}$ and condition A10 (Ironwood Guide, Definition “Orchard Action statement” and Remark “Status”; protocol specification, §“Action Descriptions”; ZIP 258, “Consensus rules from NU6.3 activation”), which ZIP 226 never mentions. The composition of the delta with A10 is therefore an open problem (Definition 1.2). The statement uses $\mathsf{enableZSA}$ , which ZIP 226 never lists as a primary input. The encoded instance of the current Orchard statement has ten elements, the nine that encode its first seven primary inputs and $\mathsf{disableCrossAddress}$ (Ironwood Guide, §“The Action statement”); no live text places $\mathsf{enableZSA}$ in it, so its position is an open problem. ZIP 226 defers “All modifications in the Circuit” to an unversioned document outside the ZIPs, “Modifications to the Orchard circuit for the OrchardZSA Protocol”; no ZIP fixes a complete OrchardZSA circuit, which is designed but unspecified. The reading of A8 on $v^{\mathsf{old}}$ is specified by the delta, which leaves A8 unchanged; only its confirmation in that circuit document is designed but unspecified, and Table 7 records it.

Remark 4.8 (What the OrchardZSA statement does not check).

Items (i) to (iii) of the Ironwood Guide’s Remark “What the statement does not check” carry over. In addition:

(iv)

The witness $\psi^{\mathsf{nf}}$ is constrained only through A5^′ to the published nullifier. For $\mathsf{split\_flag}=1$ only the equality $\psi^{\mathsf{nf}}=\psi^{\mathsf{old}}$ is switched off, and no condition derives $\psi^{\mathsf{nf}}$ from a seed. The derivation of Construction 4.4 is therefore a sender rule whose formula is specified and which nothing enforces: $\mathsf{rseed\_nf}$ is transmitted nowhere, and no text proposes an enforcement. Proposition 4.5(i) holds for every $\psi^{\mathsf{nf}}$ ; part (ii) holds for senders that follow the rule.
(v)

The derivations of $\mathsf{rcm}$ and $\psi$ from $\mathsf{rseed}$ are unchecked, as for Orchard.
(vi)

The witnessed $\mathsf{AssetBase}$ is checked only against the consumed leaf, through A1^′ and A3^′, and never against a record of issued Assets. Lemma 9.3, in “Security”, concerns the leaves.
(vii)

The statement does not check that the prover owns the copied note of a Split Input beyond A6 and A7; this is the subject of Proposition 4.12.

(ZIP 226, “Split Notes” and “Circuit Statement”.)

4.4 The OrchardZSA Action proof

The Ironwood Guide’s Assumptions “Knowledge soundness of the Action proof” and “Zero knowledge of the Action proof” name the relation $\mathcal{R}_{\mathsf{Action}}$ and its verifying key. The corresponding assumptions for $\mathcal{R}_{\mathsf{ActionZSA}}$ are stated here in the same form; the OrchardZSA verifying key denotes the verifying key of a circuit for $\mathcal{R}_{\mathsf{ActionZSA}}$ , which no ZIP names.

Assumption 4.9 (Knowledge soundness of the OrchardZSA Action proof).

Let the hash of the Fiat–Shamir transform be modelled as a random oracle. For every efficient adversary that outputs primary inputs $\mathsf{pub}_{1},\dots,\mathsf{pub}_{n}$ and an aggregate proof $\pi$ , there is an efficient extractor, with access to the adversary and to its random-oracle queries, that outputs auxiliary inputs $\mathsf{aux}_{1},\dots,\mathsf{aux}_{n}$ such that the probability of the event

	$\pi$ is accepted for $(\mathsf{pub}_{1},\dots,\mathsf{pub}_{n})$ under the OrchardZSA verifying key
	$\displaystyle\text{and }(\mathsf{pub}_{i},\mathsf{aux}_{i})\notin\mathcal{R}_{% \mathsf{ActionZSA}}\text{ for some }i$

is negligible. This is the knowledge-soundness clause of the Crypto Guide’s Definition “SNARK” (§“SNARKs: succinct non-interactive arguments of knowledge”) for the relation of Definition 4.6, for a Halo 2 proof (Halo 2 Guide, §“The Halo 2 proof system” and §“A rigorous treatment of knowledge soundness”), the primary input bound to the proof as in the Halo 2 Guide, §“Instance columns and binding the public statement”. It includes that every satisfying assignment of the circuit yields a witness of $\mathcal{R}_{\mathsf{ActionZSA}}$ ; in particular, the multiplication of A4^′ is by the witnessed $\mathsf{AssetBase}$ and nothing else. No ZIP names the circuit or the verifying key: the assumption concerns a designed but unspecified object.

Assumption 4.10 (Zero knowledge of the OrchardZSA Action proof).

Let the hash of the Fiat–Shamir transform be modelled as a programmable random oracle. There is an efficient simulator that, given only $\mathsf{pub}_{1},\dots,\mathsf{pub}_{n}$ and programming the random oracle, outputs an aggregate proof statistically indistinguishable from an honest proof under the OrchardZSA verifying key, for any $\mathsf{aux}_{1},\dots,\mathsf{aux}_{n}$ with $(\mathsf{pub}_{i},\mathsf{aux}_{i})\in\mathcal{R}_{\mathsf{ActionZSA}}$ for every $i$ , against every distinguisher that makes polynomially many random-oracle queries. This is zero knowledge of statistical grade in the non-interactive, random-oracle form of the Crypto Guide’s Definition “Zero knowledge” (§“The simulation paradigm and zero knowledge”), for a Halo 2 proof (Halo 2 Guide, §“Zero knowledge: hiding the witness in Halo 2”). It concerns the same designed but unspecified circuit and key.

Remark 4.11 (Circuit, verifying key and proof length).

The statement is specified at delta level (ZIP 226). Its arithmetisation exists only in the document outside the ZIPs named in Remark 4.7, so the circuit and its verifying key are designed but unspecified, and Assumptions 4.9 and 4.10 are the only hypotheses through which later results depend on them. Condition A4^′ is sound only if the circuit multiplies by the witnessed $\mathsf{AssetBase}$ and nothing else. The Orchard variable-base scalar multiplication was corrected at NU6.2 because it left the base under-constrained (ZIP 257, “NU6.2 deployment”). ZIP 226, which turns the value base into a witness (“Value Commitment Correctness”), does not mention the correction, which any OrchardZSA circuit must carry. ZIP 257 made the Orchard proof length $2720+2272\,n$ bytes, for $n$ Actions, a consensus rule (“Canonical Orchard Action proof length”). No ZIP fixes an OrchardZSA proof length, which the circuit determines and which no live text contradicts: it is designed but unspecified, as the circuit and the verifying key are.

Proposition 4.12 (Ownership of Split Inputs).

Consider the Ironwood Guide’s Definition “Spend-authority experiment” with $\mathcal{R}_{\mathsf{ActionZSA}}$ in place of $\mathcal{R}_{\mathsf{Action}}$ : a key generated with $\mathsf{use\_qsk}=\mathsf{false}$ , the adversary holding its full viewing key but not $\mathsf{ask}$ . Under Assumption 4.9 and the Ironwood Guide’s Assumptions “Discrete logarithms on Pallas”, “GroupHash as a random oracle”, “The RedPallas hash as a random oracle” and “Pseudorandomness of PRF expansion”, no efficient adversary outputs, except with negligible probability, a block chain with an accepted Split Action whose witness copies a leaf that is a note of the key, and whose spend-authorisation signature is valid under its $\mathsf{rk}$ on a signature digest for which it made no signing query with that $\mathsf{rk}$ . Consequently the sentence of ZIP 226, “Split Notes”, “we do not care about whether the previously issued note copied to create a Split Input is owned by the sender, or whether it was nullified before” holds for spentness and not for ownership: a sender can use choices (2) and (3) of Remark 4.3 only with the spend authority of the copied note, except for a note whose key is public, such as a reference note (Proposition 6.11). Status (Definition 1.3): proved here from specified conditions; conditional on Assumption 4.9, which concerns the designed but unspecified circuit.

Proof.

The proof is a reduction to the proof of the Ironwood Guide’s Theorem “Spend authority”. By Assumption 4.9 the extractor yields, for the accepted Split Action, a witness of $\mathcal{R}_{\mathsf{ActionZSA}}$ with $\mathsf{split\_flag}=1$ . By C3, $\mathsf{is\_native\_asset}=0$ , so A3^′ gives $\mathit{root}=\mathit{rt}$ outside its $\bot$ case, which is excluded as in the consequences of Definition 4.6; with the anchor rule, the Ironwood Guide’s Proposition “Membership soundness” makes $\mathsf{Extract}_{\mathbb{P}}(\mathsf{cm}^{\mathsf{old}})$ a leaf. Condition A1^′ with Proposition 3.3(b) makes the witnessed consumed note the note of that leaf, so its witnessed expanded receiver $(\mathsf{g_{d}}^{\mathsf{old}},\mathsf{pk_{d}}^{\mathsf{old}})$ is the receiver of the leaf’s note, a note of the key; the witness therefore consumes a note of the key in the sense of the experiment. Conditions A6 and A7, unchanged and unconditional, then bind $\mathsf{rk}$ to a randomisation of $\pm\mathsf{ak}^{\mathbb{P}}$ of that key, by the Ironwood Guide’s Proposition “Binding of $\mathsf{ivk}$ to $(\mathsf{ak},\mathsf{nk})$ ” and Lemma “Coordinate extraction identifies opposite points”, and a valid signature under $\mathsf{rk}$ without a matching signing query contradicts that volume’s Proposition “Unforgeability under re-randomisation”, exactly as in steps (1) to (5) of the proof of Theorem “Spend authority”. Neither $\mathsf{split\_flag}$ nor $v^{\prime}$ enters A6 or A7, the only conditions that proof uses; A1^′ and membership serve here only to identify the witnessed receiver with that of the copied leaf’s note, so the steps apply unchanged.

For spentness: by A4^′ the copied value is not committed, and by Proposition 4.5(i) the copied note’s nullifier is not published, except with negligible probability. Choice (1) of Remark 4.3 copies a note that the same bundle spends, so its sender holds that note’s spend authority in any case. □

4.5 Action Groups

Definition 4.13 (Action Group).

An Action Group is a non-empty finite sequence of OrchardZSA Actions together with one anchor $\mathit{rt}$ , the flags $\mathsf{enableSpends}$ , $\mathsf{enableOutputs}$ and $\mathsf{enableZSA}$ in $\{0,1\}$ , and one aggregate proof for the relation of Definition 4.6 at the primary inputs

\bigl{(}\mathit{rt},\,\mathsf{cv}^{\mathsf{net}}_{i},\,\mathsf{nf}_{i},\,% \mathsf{rk}_{i},\,\mathsf{cmx}_{i},\,\mathsf{enableSpends},\,\mathsf{% enableOutputs},\,\mathsf{enableZSA}\bigr{)}

of its Actions $i$ . Each Action carries the public fields $(\mathsf{cv}^{\mathsf{net}},\mathsf{nf},\mathsf{rk},\mathsf{cmx},\mathsf{epk},% C_{\mathsf{enc}},C_{\mathsf{out}})$ of an Orchard Action description (Ironwood Guide, Definition “Action description”) and its own spend-authorisation signature under $\mathsf{rk}$ . The term is that of ZIP 228, “Terminology”: Actions that share the tuple $(\mathit{rt},\mathsf{enableSpends},\mathsf{enableOutputs},\mathsf{enableZSA},% \mathsf{nAGExpiryHeight})$ . ZIP 227, “Specification: Consensus Rule Changes”, requires $\mathsf{nAGExpiryHeight}=0$ and at most one Action Group per transaction, so the fifth component is constant and is omitted. The nullifier $\mathsf{nf}_{0,0}$ of the first Action of the Action Group is the value that issuance uses (ZIP 227, “Computation of $\rho$ ”). The Action Group has no burn set; the remaining components of a transaction’s bundle are defined in “Burn sets and OrchardZSA bundles” (§5.1). Class: specified.

The structure is specified by ZIPs 226 to 228, all Draft. Its encoding exists only in ZIP 230, which is Withdrawn; the layout that ZIP 230 calls version $6$ is not the version $6$ of ZIP 229, which has no Action Groups (ZIP 229, “Transaction Format”). The byte lengths of the note ciphertext and of an Action depend on a plaintext encoding that no current ZIP defines (Definition 3.7). The flag $\mathsf{enableZSA}$ has no flag bit in any current format. ZIP 230 assigns it bit $2$ of the Orchard flags byte, which ZIP 229, “Consensus Rules”, reserves as $0$ in version $6$ and which is $\mathsf{enableCrossAddress}$ in the Ironwood flags byte (Ironwood Guide, §“Bundle flags”; ZIP 258, “Consensus rules from NU6.3 activation”). The design conflicts with live text, so the flag bit is an open problem (Definition 1.2).