Struct Instance 

pub struct Instance {
    pub share_nullifier: Base,
    pub enc_share_c1_x: Base,
    pub enc_share_c2_x: Base,
    pub proposal_id: Base,
    pub vote_decision: Base,
    pub vote_comm_tree_root: Base,
    pub voting_round_id: Base,
    pub enc_share_c1_y: Base,
    pub enc_share_c2_y: Base,
}

Public inputs to the Share Reveal circuit (9 field elements).

The voting client (prover) chooses these values when assembling the proof; the verifier accepts them as the binding the proof must satisfy and checks the proof without seeing any private witnesses. The relationship is asymmetric: a malicious-custody client can choose any public-input vector it likes, so the verifier must source the correct values from authenticated chain state (see [crate::share_reveal::prove::verify_share_reveal_proof] for which fields require caller authentication versus which are proof-attested outputs).

The struct field order preserves the existing API layout and is not the Halo2 public input order. Use Self::to_halo2_instance and the *_PUBLIC_OFFSET constants as the canonical public-input mapping.

Fields

share_nullifier: Base

Poseidon nullifier for this share (prevents double-counting).

enc_share_c1_x: Base

Caller-supplied x-coordinate of the revealed share’s El Gamal C1 component, bound through condition 4’s selected share commitment.

enc_share_c2_x: Base

Caller-supplied x-coordinate of the revealed share’s El Gamal C2 component, bound through condition 4’s selected share commitment.

proposal_id: Base

Which proposal this vote is for.

vote_decision: Base

The voter’s choice.

vote_comm_tree_root: Base

Root of the vote commitment tree at anchor height.

voting_round_id: Base

The voting round identifier.

enc_share_c1_y: Base

Caller-supplied y-coordinate of the revealed share’s El Gamal C1 component.

Binds the proof to the exact curve point, preventing sign-malleability. This is transitively bound through the selected share commitment, not directly recovered from vote-proof public inputs.

enc_share_c2_y: Base

Caller-supplied y-coordinate of the revealed share’s El Gamal C2 component, transitively bound through the selected share commitment.

Implementations

impl Instance

pub const NUM_PUBLIC_INPUTS: usize = 9

Number of public inputs serialized by Self::to_halo2_instance.

pub fn from_parts( share_nullifier: Base, enc_share_c1_x: Base, enc_share_c2_x: Base, proposal_id: Base, vote_decision: Base, vote_comm_tree_root: Base, voting_round_id: Base, enc_share_c1_y: Base, enc_share_c2_y: Base, ) -> Self

Constructs an Instance from its constituent parts.

Callers should authenticate proposal_id, vote_decision, vote_comm_tree_root, and voting_round_id out-of-band before passing them here — see [crate::share_reveal::prove::verify_share_reveal_proof] for the trust contract. The ciphertext coordinate fields are caller-supplied reveal data bound through Poseidon(blind, c1_x, c2_x, c1_y, c2_y) = share_comm[share_index] and the transitive share_comm -> shares_hash -> vote_commitment chain; they are not direct public outputs of ZKP #2. The remaining fields are proof-attested outputs derived outside the circuit but constrained in-circuit against authenticated inputs and private witnesses.

pub fn to_halo2_instance(&self) -> Vec<Scalar>

Serializes public inputs for halo2 proof creation/verification.

The order must match the instance column offsets defined at the top of this file.

Trait Implementations

impl Clone for Instance

fn clone(&self) -> Instance

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Instance

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.