| // | |
| // Copyright (c) 2026 BEL ESPRIT D ACCORD TRUST HOLDINGS INC | |
| // All rights reserved. | |
| pragma circom 2.1.6; | |
| include "./node_modules/circomlib/circuits/bitify.circom"; | |
| template ShadowWalk(nBits) { | |
| // Private inputs: state and coin (each constrained to nBits bits) | |
| signal input state; | |
| signal input coin; | |
| // Public inputs: the expected outputs of the shadow walk step | |
| signal input next_state; | |
| signal input next_coin; | |
| // Constrain state and coin to be exactly nBits bits (i.e., in [0, 2^nBits - 1]) | |
| component num2bits_state = Num2Bits(nBits); | |
| num2bits_state.in <== state; | |
| component num2bits_coin = Num2Bits(nBits); | |
| num2bits_coin.in <== coin; | |
| // Calculate the shadow walk step: | |
| // next_coin = (state + coin) mod PrimeField | |
| // next_state = (state - next_coin) mod PrimeField | |
| // | |
| // Since state and coin are < 2^nBits, and we assume 2^(nBits+1) < PrimeField | |
| // (which holds for nBits <= 254 given PrimeField ~ 2^255), there is no | |
| // wrap-around in the addition. Thus: | |
| // next_coin = state + coin (as integers, which equals the field element) | |
| // next_state = state - next_coin (in the field) | |
| signal next_coin_calc; | |
| signal next_state_calc; | |
| next_coin_calc <== state + coin; | |
| next_state_calc <== state - next_coin_calc; | |
| // Constrain the calculated outputs to match the public inputs | |
| next_coin_calc === next_coin; | |
| next_state_calc === next_state; | |
| } | |
| // Default instantiation: 10-bit state space (1024 positions) | |
| // PrimeField = 21888242871839275222246405745257275088548364400416034343698204186575808495617 | |
| // For nBits <= 254, 2^(nBits+1) < PrimeField holds, so no wrap-around. | |
| component main {public [next_state, next_coin]} = ShadowWalk(10); | |