Zcash Action Circuit

A Zcash Orchard transaction is defined as a sequence of one or more actions. The Zcash Orchard circuit defines what a valid action is. It is important to note that in addition to shielded UTXOs, Zcash also has a transparent value pool (i.e. the Zcash protocol also allows for transparent, traceable transactions).

The general idea is as follows: Each action allows the spending of up to one UTXO ($\mathsf{not}{\mathsf{e}}_{\mathsf{old}}$) and the creation of up to one new UTXO ($\mathsf{not}{\mathsf{e}}_{\mathsf{new}}$). To balance the value difference between them there is a balancing value (${\mathsf{v}}_{\mathsf{net}}$).

The equation applies:

$$\mathsf{not}{\mathsf{e}}_{\mathsf{old}}.v=\mathsf{not}{\mathsf{e}}_{\mathsf{new}}.v+{\mathsf{v}}_{\mathsf{net}}$$

where $.v$ refers to the value (i.e. the amount of ZEC) of a UTXO as defined in section 3.2 (p.14) of the Zcash Protocol Specification.

The value ${\mathsf{v}}_{\mathsf{net}}$ thus expresses whether the UTXO transfer of a single Orchard action results in a positive or negative value surplus. Over the entire transaction - i.e. over the sum of all actions - ${\mathsf{v}}_{\mathsf{net}}$ must obviously result in zero. This means that the sum of all inputs of a transaction must be equal to the sum of all outputs.

However, the actual value surplus of an action remains secret - just like the private inputs of the circuit (i.e. the sensitive UTXO data). Instead, only a so-called $\mathsf{ValueCommit}$ of ${\mathsf{v}}_{\mathsf{net}}$ is published, which is specified in section 5.4.8.3 of the Zcash Protocol Specification.

The $\mathsf{ValueCommit}$ is a Pedersen Commitment that has special cryptographic properties such as homomorphic addition. This property allows for the ${\mathsf{v}}_{\mathsf{net}}$ values of all actions of the same transaction to be balanced without having to disclose the actual differences ${\mathsf{v}}_{\mathsf{net}}$ of individual actions publicly: The homomorphically encrypted $\mathsf{ValueCommit}$ of all individual actions can be summed up and eventually balanced with a single transparent value from the transparent value pool (in case the sum is not zero). See section 4.14 of the Zcash Protocol Specification to learn more about the final balancing value of a shielded transaction.

A shielded transaction in Zcash Orchard therefore either generates a transparent output (${\mathsf{v}}_{\mathsf{net}}>0$), or it consumes a transparent input (${\mathsf{v}}_{\mathsf{net}}<0$), or ${\mathsf{v}}_{\mathsf{net}}$ equals zero, in which case it is a fully shielded transaction with no inputs or outputs from the transparent value pool.

The flexibility of this circuit design therefore allows the four different types of actions:

1. transparent → shielded ($\mathsf{not}{\mathsf{e}}_{\mathsf{old}}=0$, resembles a mint).
2. shielded → transparent ($\mathsf{not}{\mathsf{e}}_{\mathsf{new}}=0$, resembles a burn)
3. shielded → shielded (${\mathsf{v}}_{\mathsf{net}}=0$, resembles a shielded transfer)
4. mixed → mixed (either mint + shielded transfer or burn + shielded transfer)

The following schematic shows a highly simplified representation of the Zcash Orchard top level arithmetic circuit, reduced to the essential components. The black inputs are the private inputs of the arithmetic circuit and the blue inputs are the public inputs. Only if all equality gates (==) resolve to true the output of the circuit is $1$, otherwise it is $0$.

The circuit is divided into three areas, which are highlighted in different colors:

Area A contains all the logic regarding $\mathsf{not}{\mathsf{e}}_{\mathsf{old}}$. This is by far the most complex part of the circuit, since the validity of $\mathsf{not}{\mathsf{e}}_{\mathsf{old}}$ as well as the validity of $\text{spend\_auth}$ must be proven here. Specifically, it must be proven that:

1. There exists a sister path $\text{auth\_path}$ to the $\mathsf{NoteCommit}$ of $\mathsf{not}{\mathsf{e}}_{\mathsf{old}}$, which leads to a valid $\text{ROOT}$ of the merkle tree (i.e. $\mathsf{not}{\mathsf{e}}_{\mathsf{old}}$ is a valid UTXO).
2. The address of the UTXO $\mathsf{not}{\mathsf{e}}_{\mathsf{old}}$ can be derived from $\text{spend\_auth}$ (i.e. $\text{spend\_auth}$ is indeed the correct private key to $\mathsf{not}{\mathsf{e}}_{\mathsf{old}}$).
3. The nullifier is valid (i.e. $\text{NF}$ is indeed the nullifier of $\mathsf{not}{\mathsf{e}}_{\mathsf{old}}$).

Area B proves that $\text{CM\_NEW}$ is indeed the correct $\mathsf{NoteCommit}$ to the newly created UTXO $\mathsf{not}{\mathsf{e}}_{\mathsf{new}}$.

Area C proves that $\text{CV\_NET}$ actually represents the correct $\mathsf{ValueCommit}$ (aka Pedersen commitment) of the value surplus ${\mathsf{v}}_{\mathsf{net}}$.