MINTNFT

Mints a new non-fungible UTXO. This effectively moves a non-fungible asset from a transparent EOSIO/Antelope account into a private ZEOS wallet. For this operation only part B of the ZEOS Action Circuit $C_{zeos}$ is used since only one new UTXO is created by this action.

Since EOSIO/Antelope does not specify a standard for non-fungible tokens the token standard of AtomicAssets is applied.

Privacy Implications

This action provides only limited privacy protection:

• sender: traceable - the sender's EOSIO/Antelope account
• asset: traceable - asset id of the asset's smart contract's transfer¹ action
• memo: untraceable - hidden in UTXO ciphertext
• receiver: untraceable - hidden in UTXO ciphertext

¹ refers to the transfer action of the AtomicAssets smart contract

Flow

The following steps specify the flow of MINTNFT.

Step 0

The non-fungible EOSIO/Antelope asset $\mathsf{b}$ to be transferred is defined by the tuple:

• $\mathsf{id}$: The id of asset $\mathsf{b}$ as specified in the AtomicAssets developer documentation
• $\mathsf{code}$: The EOSIO/Antelope account of the AtomicAssets smart contract that issues asset $\mathsf{b}$

Step 1

Create a new UTXO tuple $\mathsf{not}{\mathsf{e}}_{\mathsf{b}}$ representing the non-fungible asset $\mathsf{b}$:

• $\mathsf{d}=$ Diversifier index of the receiving ZEOS wallet address
• $\mathsf{p}{\mathsf{k}}_{\mathsf{d}}=$ Public key of the receiving ZEOS wallet address
• $d1=b.id$
• $d2=0$
• $\mathsf{sc}=b.code$
• $\mathsf{nft}=1$
• $\rho =$ Choose a random value
• $\psi =$ Choose a random value
• $\mathsf{rcm}=$ Choose a random value

Step 2

Calculate the diversified transmission key of the receiving ZEOS wallet address (see section 5.4.1.6 of the Zcash Protocol Specification):

• ${{\mathsf{g}}_{\mathsf{d}}}_{\mathsf{not}{\mathsf{e}}_{\mathsf{b}}}=\mathsf{DiversifyHas}{\mathsf{h}}^{\mathsf{Orchard}}(\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.d)$

Step 3

Calculate the $\mathsf{NoteCommit}$ of $\mathsf{not}{\mathsf{e}}_{\mathsf{b}}$ (see UTXO Commitment):

• $\mathsf{c}{\mathsf{m}}_{\mathsf{not}{\mathsf{e}}_{\mathsf{b}}}={\mathsf{NoteCommit}}_{\mathsf{rcm}}^{\mathsf{Orchard}}({{\mathsf{g}}_{\mathsf{d}}}_{\mathsf{not}{\mathsf{e}}_{\mathsf{b}}},\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.\mathsf{p}{\mathsf{k}}_{\mathsf{d}},\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.d1,\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.\rho ,\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.\psi ,\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.d2,\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.sc,\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.nft)$

Step 4

Set the private inputs $\omega$ of the arithmetic circuit:

• $\mathsf{path}=0$
• $\mathsf{pos}=0$
• ${{\mathsf{g}}_{\mathsf{d}}}_a=0$
• ${\mathsf{p}{\mathsf{k}}_{\mathsf{d}}}_a=0$
• ${d1}_a=0$
• ${d2}_a=0$
• ${\rho }_a=0$
• ${\psi }_a=0$
• ${\mathsf{rcm}}_a=0$
• ${\mathsf{cm}}_a=0$
• $\alpha =0$
• $\mathsf{ak}=0$
• $\mathsf{nk}=0$
• $\mathsf{rivk}=0$
• ${{\mathsf{g}}_{\mathsf{d}}}_b={{\mathsf{g}}_{\mathsf{d}}}_{\mathsf{not}{\mathsf{e}}_{\mathsf{b}}}$
• ${\mathsf{p}{\mathsf{k}}_{\mathsf{d}}}_b=\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.\mathsf{p}{\mathsf{k}}_{\mathsf{d}}$
• ${d1}_b=\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.d1$
• ${d2}_b=\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.d2$
• ${\mathsf{sc}}_b=\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.sc$
• ${\rho }_b=\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.\rho$
• ${\psi }_b=\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.\psi$
• ${\mathsf{rcm}}_b=\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.rcm$
• ${\mathsf{acc}}_b=0$
• ${{\mathsf{g}}_{\mathsf{d}}}_c=0$
• ${\mathsf{p}{\mathsf{k}}_{\mathsf{d}}}_c=0$
• ${d1}_c=0$
• ${\psi }_c=0$
• ${\mathsf{rcm}}_c=0$
• ${\mathsf{acc}}_c=0$

Step 5

Set the public inputs $x$ of the arithmetic circuit:

• $\mathsf{ANCHOR}=0$
• $\mathsf{NF}=0$
• ${\mathsf{RK}}_X=0$
• ${\mathsf{RK}}_Y=0$
• $\mathsf{NFT}=1$
• ${\mathsf{B}}_{d1}=\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.d1$
• ${\mathsf{B}}_{d2}=\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.d2$
• ${\mathsf{B}}_{sc}=\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.sc$
• ${\mathsf{C}}_{d1}=0$
• ${\mathsf{CM}}_B=\mathsf{c}{\mathsf{m}}_{\mathsf{not}{\mathsf{e}}_{\mathsf{b}}}$
• ${\mathsf{CM}}_C=0$
• ${\mathsf{ACC}}_B=0$
• ${\mathsf{ACC}}_C=0$

Step 6

Generate ${\pi }_{C_{zeos},\omega ,x}$ a proof of knowledge of satisfying arguments $(\omega ,x)$ so that $C_{zeos}(\omega ,x)=1$

The pair $({\pi }_{C_{zeos},\omega ,x},x)$ is the zk-SNARK which attests to knowledge of private inputs $\omega$ without revealing them.

Step 7

Generate UTXO ciphertext ${\mathsf{not}{\mathsf{e}}_{\mathsf{b}}}_{\mathsf{enc}}$ of $\mathsf{not}{\mathsf{e}}_{\mathsf{b}}$ for the receiver of the UTXO (see section 4.19.1 of the Zcash Protocol Specification)

Step 8

Transfer asset $\mathsf{b}$ to the ZEOS smart contract. On reception, the ZEOS smart contract stores it in an asset buffer until MINTNFT is executed.

Step 9

Execute the MINTNFT action of the ZEOS smart contract. This action takes the following arguments:

• ${\pi }_{C_{zeos},\omega ,x}$: The zero knowledge proof of satisfying arguments $(\omega ,x)$
• $x$: The public inputs of the zero knowledge proof ${\pi }_{C_{zeos},\omega ,x}$
• ${\mathsf{not}{\mathsf{e}}_{\mathsf{b}}}_{\mathsf{enc}}$: The UTXO ciphertext which is transmitted to the receiver of $\mathsf{not}{\mathsf{e}}_{\mathsf{b}}$

The ZEOS smart contract then performs the following checks:

• Is the zero knowledge proof ${\pi }_{C_{zeos},\omega ,x}$ valid?
• Does the UTXO $\mathsf{not}{\mathsf{e}}_{\mathsf{b}}$ represent the correct asset $\mathsf{b}$ which is held in the asset buffer? I.e. are the following statements true:
  • $b.id=x.{\mathsf{B}}_{d1}$
  • $0=x.{\mathsf{B}}_{d2}$¹
  • $b.code=x.{\mathsf{B}}_{sc}$
• Is the NFT flag set ($x.\mathsf{NFT}=1$)?

¹NFTs of smart contracts following the AtomicAssets standard have a 64 Bit unique identifier only, thus no upper 64 Bits.

Step 10

If $\mathsf{true}$, the ZEOS smart contract performs the following operations:

• Add $x.\mathsf{C}{\mathsf{M}}_{\mathsf{B}}$, the note commitment of $\mathsf{not}{\mathsf{e}}_{\mathsf{b}}$, to the next free leaf of the Commitment Tree
• Add the new root of the Commitment Tree to the Commitment Tree Root Set
• Add ciphertext ${\mathsf{not}{\mathsf{e}}_{\mathsf{b}}}_{\mathsf{enc}}$ to the Transmitted UTXO Ciphertext List

If $\mathsf{false}$, cancel execution.