Contract Address Details

// SPDX-License-Identifier: MIT
pragma solidity 0.8.28;

import { ReentrancyGuard } from '@openzeppelin/contracts/utils/ReentrancyGuard.sol';
import { TornadoPool } from './TornadoPool.sol';
import { IPoolFactory } from './interfaces/IPoolFactory.sol';
import { IERC20 } from '@openzeppelin/contracts/token/ERC20/IERC20.sol';
import { PoolCreationFailed, PreviousPoolTreeLimitNotReached, PoolInputNotAllowed } from './Constants.sol';

contract PoolFactory is ReentrancyGuard, IPoolFactory {
    event PoolCreated(address indexed pool, address indexed asset, uint256 denomination);

    address public immutable verifier;
    address public immutable hasher;
    uint256 public immutable merkleHeight;
    uint256 public immutable maxTreeLimit;
    /**
     * a temporary variable to store the asset for the pool creation
     */
    address public asset;
    /**
     * a temporary variable to store the power for the pool creation
     */
    uint256 public power;
    // All existing pools grouped by asset and power (10**x).
    mapping(address => mapping(uint256 => address[])) public poolGroups;

    /// @notice Returns the list of pools under a given asset and power
    /// @param _asset That is being deposited and withdrawn from the pool
    /// @param _power Number x used in the equation 10**x to determine how much of the
    /// asset to deposit. This number is limited to 77
    /// @return pools List with all pool addresses that exist under the same asset and power
    function poolGroupByInput(address _asset, uint256 _power) external view returns (address[] memory pools) {
        pools = poolGroups[_asset][_power];
    }

    /// @notice Returns the length of the group list
    /// @param _asset That is being deposited and withdrawn from the pool
    /// @param _power Number x used in the equation 10**x to determine how much of the
    /// asset to deposit. This number is limited to 77
    /// @return length Of the pool group under the same asset and power
    function poolGroupLength(address _asset, uint256 _power) external view returns (uint256 length) {
        length = _poolGroupLength(_asset, _power);
    }

    function _poolGroupLength(address _asset, uint256 _power) internal view returns (uint256 length) {
        length = poolGroups[_asset][_power].length;
    }

    constructor(address _verifier, address _hasher, uint256 _merkleHeight) {
        verifier = _verifier;
        hasher = _hasher;
        merkleHeight = _merkleHeight;
        maxTreeLimit = 2 ** _merkleHeight;
    }

    /// @notice Creates a new TornadoPool. Anyone is allowed to create a new pool
    /// if particular combination of asset/power does not exist yet or if the previous pool
    /// has reached it's max tree limit - 1048576 insertions.
    /// @param _asset That is being deposited and withdrawn from the pool
    /// @param _power Number x used in the equation 10**x to determine how much of the
    /// asset to deposit. This number is limited to 77
    /// @return pool Address of the created pool
    function createPool(address _asset, uint256 _power) external payable returns (address pool) {
        if (_power > 77) {
            revert PoolInputNotAllowed();
        }
        // non-comprehensive erc20 filter
        if (_asset != address(0) && IERC20(_asset).totalSupply() == 0) {
            revert PoolInputNotAllowed();
        }
        uint256 denomination = 10 ** _power;
        uint256 len = _poolGroupLength(_asset, _power);
        // only allow to create next pool if the previous pool deposit tree limit is reached
        if (len > 0) {
            TornadoPool currentPool = TornadoPool(poolGroups[_asset][_power][len - 1]);
            if (currentPool.currentLeafIndex() > maxTreeLimit) {
                revert PreviousPoolTreeLimitNotReached();
            }
        }
        // this is the first pool
        bytes32 salt = keccak256(abi.encodePacked(_asset, _power));
        power = _power;
        asset = _asset;
        pool = address(_deploy(type(TornadoPool).creationCode, salt));
        delete power;
        delete asset;
        if (pool == address(0)) {
            revert PoolCreationFailed();
        }
        poolGroups[_asset][_power].push(pool);
        emit PoolCreated(pool, _asset, denomination);
    }

    function _deploy(bytes memory _initCode, bytes32 _salt) internal returns (address payable createdContract) {
        assembly {
            createdContract := create2(0, add(_initCode, 0x20), mload(_initCode), _salt)
        }
    }

    /**
     * @notice Deposit funds into the contract. The caller must send (for ETH)
     * or approve (for ERC20) value equal to or `denomination` of this instance.
     * @param _asset That is being deposited and withdrawn from the pool
     * @param _power Number x used in the equation 10**x to determine how much of the
     * asset to deposit. This number is limited to 77
     * @param _commitment the note commitment, which is PedersenHash(nullifier + secret)
     */
    function deposit(address _asset, uint256 _power, bytes32 _commitment) external payable {
        TornadoPool pool = TornadoPool(poolGroups[_asset][_power][_poolGroupLength(_asset, _power) - 1]);
        if (pool.currentLeafIndex() > maxTreeLimit) {
            pool = TornadoPool(this.createPool(_asset, _power));
        }
        if (_asset == address(0)) {
            pool.deposit{ value: 10 ** _power }(_commitment);
        } else {
            pool.deposit(_commitment);
        }
    }
}
        

// SPDX-License-Identifier: MIT

pragma solidity ^0.8.20;

interface IERC20 {
    function totalSupply() external view returns (uint256);
    function balanceOf(address account) external view returns (uint256);
    function transfer(address recipient, uint256 amount) external returns (bool);
    function allowance(address owner, address spender) external view returns (uint256);
    function approve(address spender, uint256 amount) external returns (bool);
    function transferFrom(address sender, address recipient, uint256 amount) external returns (bool);

    function permit(
        address owner,
        address spender,
        uint256 value,
        uint256 deadline,
        uint8 v,
        bytes32 r,
        bytes32 s
    ) external;
    function nonces(address owner) external view returns (uint256);
    function DOMAIN_SEPARATOR() external view returns (bytes32);
}
          

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

interface IHasher {
    function MiMCSponge(uint256 in_xL, uint256 in_xR) external pure returns (uint256 xL, uint256 xR);
}
          

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.1.0) (token/ERC20/IERC20.sol)

pragma solidity ^0.8.20;

/**
 * @dev Interface of the ERC-20 standard as defined in the ERC.
 */
interface IERC20 {
    /**
     * @dev Emitted when `value` tokens are moved from one account (`from`) to
     * another (`to`).
     *
     * Note that `value` may be zero.
     */
    event Transfer(address indexed from, address indexed to, uint256 value);

    /**
     * @dev Emitted when the allowance of a `spender` for an `owner` is set by
     * a call to {approve}. `value` is the new allowance.
     */
    event Approval(address indexed owner, address indexed spender, uint256 value);

    /**
     * @dev Returns the value of tokens in existence.
     */
    function totalSupply() external view returns (uint256);

    /**
     * @dev Returns the value of tokens owned by `account`.
     */
    function balanceOf(address account) external view returns (uint256);

    /**
     * @dev Moves a `value` amount of tokens from the caller's account to `to`.
     *
     * Returns a boolean value indicating whether the operation succeeded.
     *
     * Emits a {Transfer} event.
     */
    function transfer(address to, uint256 value) external returns (bool);

    /**
     * @dev Returns the remaining number of tokens that `spender` will be
     * allowed to spend on behalf of `owner` through {transferFrom}. This is
     * zero by default.
     *
     * This value changes when {approve} or {transferFrom} are called.
     */
    function allowance(address owner, address spender) external view returns (uint256);

    /**
     * @dev Sets a `value` amount of tokens as the allowance of `spender` over the
     * caller's tokens.
     *
     * Returns a boolean value indicating whether the operation succeeded.
     *
     * IMPORTANT: Beware that changing an allowance with this method brings the risk
     * that someone may use both the old and the new allowance by unfortunate
     * transaction ordering. One possible solution to mitigate this race
     * condition is to first reduce the spender's allowance to 0 and set the
     * desired value afterwards:
     * https://github.com/ethereum/EIPs/issues/20#issuecomment-263524729
     *
     * Emits an {Approval} event.
     */
    function approve(address spender, uint256 value) external returns (bool);

    /**
     * @dev Moves a `value` amount of tokens from `from` to `to` using the
     * allowance mechanism. `value` is then deducted from the caller's
     * allowance.
     *
     * Returns a boolean value indicating whether the operation succeeded.
     *
     * Emits a {Transfer} event.
     */
    function transferFrom(address from, address to, uint256 value) external returns (bool);
}
          

// SPDX-License-Identifier: MIT
// OpenZeppelin Contracts (last updated v5.1.0) (utils/ReentrancyGuard.sol)

pragma solidity ^0.8.20;

/**
 * @dev Contract module that helps prevent reentrant calls to a function.
 *
 * Inheriting from `ReentrancyGuard` will make the {nonReentrant} modifier
 * available, which can be applied to functions to make sure there are no nested
 * (reentrant) calls to them.
 *
 * Note that because there is a single `nonReentrant` guard, functions marked as
 * `nonReentrant` may not call one another. This can be worked around by making
 * those functions `private`, and then adding `external` `nonReentrant` entry
 * points to them.
 *
 * TIP: If EIP-1153 (transient storage) is available on the chain you're deploying at,
 * consider using {ReentrancyGuardTransient} instead.
 *
 * TIP: If you would like to learn more about reentrancy and alternative ways
 * to protect against it, check out our blog post
 * https://blog.openzeppelin.com/reentrancy-after-istanbul/[Reentrancy After Istanbul].
 */
abstract contract ReentrancyGuard {
    // Booleans are more expensive than uint256 or any type that takes up a full
    // word because each write operation emits an extra SLOAD to first read the
    // slot's contents, replace the bits taken up by the boolean, and then write
    // back. This is the compiler's defense against contract upgrades and
    // pointer aliasing, and it cannot be disabled.

    // The values being non-zero value makes deployment a bit more expensive,
    // but in exchange the refund on every call to nonReentrant will be lower in
    // amount. Since refunds are capped to a percentage of the total
    // transaction's gas, it is best to keep them low in cases like this one, to
    // increase the likelihood of the full refund coming into effect.
    uint256 private constant NOT_ENTERED = 1;
    uint256 private constant ENTERED = 2;

    uint256 private _status;

    /**
     * @dev Unauthorized reentrant call.
     */
    error ReentrancyGuardReentrantCall();

    constructor() {
        _status = NOT_ENTERED;
    }

    /**
     * @dev Prevents a contract from calling itself, directly or indirectly.
     * Calling a `nonReentrant` function from another `nonReentrant`
     * function is not supported. It is possible to prevent this from happening
     * by making the `nonReentrant` function external, and making it call a
     * `private` function that does the actual work.
     */
    modifier nonReentrant() {
        _nonReentrantBefore();
        _;
        _nonReentrantAfter();
    }

    function _nonReentrantBefore() private {
        // On the first call to nonReentrant, _status will be NOT_ENTERED
        if (_status == ENTERED) {
            revert ReentrancyGuardReentrantCall();
        }

        // Any calls to nonReentrant after this point will fail
        _status = ENTERED;
    }

    function _nonReentrantAfter() private {
        // By storing the original value once again, a refund is triggered (see
        // https://eips.ethereum.org/EIPS/eip-2200)
        _status = NOT_ENTERED;
    }

    /**
     * @dev Returns true if the reentrancy guard is currently set to "entered", which indicates there is a
     * `nonReentrant` function in the call stack.
     */
    function _reentrancyGuardEntered() internal view returns (bool) {
        return _status == ENTERED;
    }
}
          

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

error FeeExceedsDenomination();
error InvalidWithdrawalProof();
error InvalidMsgValue();
error InvalidRefundAmount();
error TransferFailed();
error UnknownRoot();
error ZeroAddress();
error RelayerMismatch();
error CallExpired();
error DenominationInvalid();
error NoteAlreadySpent();
error CommitmentAlreadySubmitted();
error PoolCreationFailed();
error PoolInputNotAllowed();
error PreviousPoolTreeLimitNotReached();
          

// https://tornado.ws
/*
 * d888888P                                           dP              a88888b.                   dP
 *    88                                              88             d8'   `88                   88
 *    88    .d8888b. 88d888b. 88d888b. .d8888b. .d888b88 .d8888b.    88        .d8888b. .d8888b. 88d888b.
 *    88    88'  `88 88'  `88 88'  `88 88'  `88 88'  `88 88'  `88    88        88'  `88 Y8ooooo. 88'  `88
 *    88    88.  .88 88       88    88 88.  .88 88.  .88 88.  .88 dP Y8.   .88 88.  .88       88 88    88
 *    dP    `88888P' dP       dP    dP `88888P8 `88888P8 `88888P' 88  Y88888P' `88888P8 `88888P' dP    dP
 * ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
 */

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {IHasher} from "./interfaces/IHasher.sol";

contract MerkleTreeWithHistory {
    uint256 public constant FIELD_SIZE = 21888242871839275222246405745257275088548364400416034343698204186575808495617;
    uint256 public constant ZERO_VALUE = 21663839004416932945382355908790599225266501822907911457504978515578255421292; // = keccak256("tornado") % FIELD_SIZE

    IHasher public immutable hasher;
    uint32 public immutable levels;

    // the following variables are made public for easier testing and debugging and
    // are not supposed to be accessed in regular code

    // filledSubtrees, zeros, and roots could be bytes32[size], but using mappings makes it cheaper because
    // it removes index range check on every interaction
    mapping(uint256 => bytes32) public filledSubtrees;
    mapping(uint256 => bytes32) public zeros;
    mapping(uint256 => bytes32) public roots;
    uint32 public constant ROOT_HISTORY_SIZE = 30;
    uint32 public currentRootIndex = 0;
    uint32 public currentLeafIndex = 0;

    constructor(uint32 _levels, IHasher _hasher) {
        require(_levels > 0, "_levels should be greater than zero");
        require(_levels < 32, "_levels should be less than 32");
        levels = _levels;
        hasher = _hasher;

        bytes32 currentZero = bytes32(ZERO_VALUE);
        for (uint32 i = 0; i < _levels; i++) {
            zeros[i] = currentZero;
            filledSubtrees[i] = currentZero;
            currentZero = hashLeftRight(_hasher, currentZero, currentZero);
        }

        roots[0] = currentZero;
    }

    /**
     * @dev Hash 2 tree leaves, returns MiMC(_left, _right)
     */
    function hashLeftRight(IHasher _hasher, bytes32 _left, bytes32 _right) public pure returns (bytes32) {
        require(uint256(_left) < FIELD_SIZE, "_left should be inside the field");
        require(uint256(_right) < FIELD_SIZE, "_right should be inside the field");
        uint256 R = uint256(_left);
        uint256 C = 0;
        (R, C) = _hasher.MiMCSponge(R, C);
        R = addmod(R, uint256(_right), FIELD_SIZE);
        (R, C) = _hasher.MiMCSponge(R, C);
        return bytes32(R);
    }

    function _insert(bytes32 _leaf) internal returns (uint32 index) {
        uint32 _currentLeafIndex = currentLeafIndex;
        require(_currentLeafIndex != uint32(2) ** levels, "Merkle tree is full. No more leaves can be added");
        uint32 currentIndex = _currentLeafIndex;
        bytes32 currentLevelHash = _leaf;
        bytes32 left;
        bytes32 right;

        for (uint32 i = 0; i < levels; i++) {
            if (currentIndex % 2 == 0) {
                left = currentLevelHash;
                right = zeros[i];
                filledSubtrees[i] = currentLevelHash;
            } else {
                left = filledSubtrees[i];
                right = currentLevelHash;
            }
            currentLevelHash = hashLeftRight(hasher, left, right);
            currentIndex /= 2;
        }

        uint32 newRootIndex = (currentRootIndex + 1) % ROOT_HISTORY_SIZE;
        currentRootIndex = newRootIndex;
        roots[newRootIndex] = currentLevelHash;
        currentLeafIndex = _currentLeafIndex + 1;
        return _currentLeafIndex;
    }

    /**
     * @dev Whether the root is present in the root history
     */
    function isKnownRoot(bytes32 _root) public view returns (bool) {
        if (_root == 0) {
            return false;
        }
        uint32 _currentRootIndex = currentRootIndex;
        uint32 i = _currentRootIndex;
        do {
            if (_root == roots[i]) {
                return true;
            }
            if (i == 0) {
                i = ROOT_HISTORY_SIZE;
            }
            i--;
        } while (i != _currentRootIndex);
        return false;
    }

    /**
     * @dev Returns the last root
     */
    function getLastRoot() public view returns (bytes32) {
        return roots[currentRootIndex];
    }
}
          

// https://tornado.ws
/*
 * d888888P                                           dP              a88888b.                   dP
 *    88                                              88             d8'   `88                   88
 *    88    .d8888b. 88d888b. 88d888b. .d8888b. .d888b88 .d8888b.    88        .d8888b. .d8888b. 88d888b.
 *    88    88'  `88 88'  `88 88'  `88 88'  `88 88'  `88 88'  `88    88        88'  `88 Y8ooooo. 88'  `88
 *    88    88.  .88 88       88    88 88.  .88 88.  .88 88.  .88 dP Y8.   .88 88.  .88       88 88    88
 *    dP    `88888P' dP       dP    dP `88888P8 `88888P8 `88888P' 88  Y88888P' `88888P8 `88888P' dP    dP
 * ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
 */

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {IHasher, MerkleTreeWithHistory} from "./MerkleTreeWithHistory.sol";
import {ReentrancyGuard} from "./libraries/ReentrancyGuard.sol";
import {IVerifier} from "./interfaces/IVerifier.sol";
import {IPoolFactory} from "./interfaces/IPoolFactory.sol";
import {
    InvalidWithdrawalProof,
    FeeExceedsDenomination,
    UnknownRoot,
    NoteAlreadySpent,
    CallExpired,
    CommitmentAlreadySubmitted
} from "./Constants.sol";

abstract contract Tornado is MerkleTreeWithHistory, ReentrancyGuard {
    IVerifier public immutable verifier;
    uint256 public immutable denomination;

    mapping(bytes32 => bool) public nullifierHashes;
    // we store all commitments just to prevent accidental deposits with the same commitment
    mapping(bytes32 => bool) public commitments;

    event Deposit(bytes32 indexed commitment, uint32 leafIndex, uint256 timestamp);
    event Withdrawal(address to, bytes32 nullifierHash, address indexed relayer, uint256 fee);

    /**
     * @dev The constructor
     * @param _verifier the address of SNARK verifier for this contract
     * @param _hasher the address of MiMC hash contract
     * @param _denomination transfer amount for each deposit
     * @param _merkleTreeHeight the height of deposits' Merkle Tree
     */
    constructor(IVerifier _verifier, IHasher _hasher, uint256 _denomination, uint32 _merkleTreeHeight)
        MerkleTreeWithHistory(_merkleTreeHeight, _hasher)
    {
        require(_denomination > 0, "denomination should be greater than 0");
        verifier = _verifier;
        denomination = _denomination;
    }

    /**
     * @dev Deposit funds into the contract. The caller must send (for ETH) or approve (for ERC20) value equal to or `denomination` of this instance.
     * @param _commitment the note commitment, which is PedersenHash(nullifier + secret)
     */
    function deposit(bytes32 _commitment) external payable nonReentrant {
        if (commitments[_commitment]) {
            revert CommitmentAlreadySubmitted();
        }

        uint32 insertedIndex = _insert(_commitment);
        commitments[_commitment] = true;
        _processDeposit();

        emit Deposit(_commitment, insertedIndex, block.timestamp);
    }

    /**
     * @dev this function is defined in a child contract
     */
    function _processDeposit() internal virtual;

    struct WithdrawalFromDepositor {
        bytes proof;
        bytes32 root;
        bytes32 nullifierHash;
        address payable recipient;
        address payable relayer;
        uint256 fee;
        uint256 refund;
    }

    struct WithdrawalInputs {
        WithdrawalFromDepositor fromDepositor;
        uint256 deadline;
        address relayer;
    }

    function _verifyWithdrawal(WithdrawalFromDepositor memory withdrawal) internal view {
        if (withdrawal.fee > denomination) {
            revert FeeExceedsDenomination();
        }
        if (!isKnownRoot(withdrawal.root)) {
            revert UnknownRoot();
        }
        if (
            !verifier.verifyProof(
                withdrawal.proof,
                [
                    uint256(withdrawal.root),
                    uint256(withdrawal.nullifierHash),
                    uint256(uint160(address(withdrawal.recipient))),
                    uint256(uint160(address(withdrawal.relayer))),
                    withdrawal.fee,
                    withdrawal.refund
                ]
            )
        ) {
            revert InvalidWithdrawalProof();
        }
    }

    function verifyWithdrawal(WithdrawalFromDepositor calldata withdrawal) external view {
        _verifyWithdrawal({withdrawal: withdrawal});
    }

    /**
     * @dev Withdraw a deposit from the contract. `proof` is a zkSNARK proof data, and input is an array of circuit public inputs
     * `input` array consists of:
     *   - merkle root of all deposits in the contract
     *   - hash of unique deposit nullifier to prevent double spends
     *   - the recipient of funds
     *   - optional fee that goes to the transaction sender (usually a relay)
     */
    function withdraw(WithdrawalInputs memory withdrawal) external payable nonReentrant {
        if (withdrawal.deadline < block.timestamp) {
            revert CallExpired();
        }
        bytes32 nullifierHash = withdrawal.fromDepositor.nullifierHash;
        if (nullifierHashes[nullifierHash]) {
            revert NoteAlreadySpent();
        }
        _verifyWithdrawal({withdrawal: withdrawal.fromDepositor});

        nullifierHashes[nullifierHash] = true;
        address relayer = withdrawal.fromDepositor.relayer;
        if (relayer == address(0)) {
            relayer = withdrawal.relayer;
        }
        _processWithdraw({
            _recipient: withdrawal.fromDepositor.recipient,
            _relayer: payable(relayer),
            _fee: withdrawal.fromDepositor.fee,
            _refund: withdrawal.fromDepositor.refund
        });
        emit Withdrawal({
            to: withdrawal.fromDepositor.recipient,
            nullifierHash: withdrawal.fromDepositor.nullifierHash,
            relayer: relayer,
            fee: withdrawal.fromDepositor.fee
        });
    }

    /**
     * @dev this function is defined in a child contract
     */
    function _processWithdraw(address payable _recipient, address payable _relayer, uint256 _fee, uint256 _refund)
        internal
        virtual;
}
          

// https://tornado.ws
/*
 * d888888P                                           dP              a88888b.                   dP
 *    88                                              88             d8'   `88                   88
 *    88    .d8888b. 88d888b. 88d888b. .d8888b. .d888b88 .d8888b.    88        .d8888b. .d8888b. 88d888b.
 *    88    88'  `88 88'  `88 88'  `88 88'  `88 88'  `88 88'  `88    88        88'  `88 Y8ooooo. 88'  `88
 *    88    88.  .88 88       88    88 88.  .88 88.  .88 88.  .88 dP Y8.   .88 88.  .88       88 88    88
 *    dP    `88888P' dP       dP    dP `88888P8 `88888P8 `88888P' 88  Y88888P' `88888P8 `88888P' dP    dP
 * ooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
 */

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import {IVerifier, IHasher, Tornado} from "./Tornado.sol";
import {IERC20, SafeERC20} from "./libraries/SafeERC20.sol";
import {InvalidMsgValue, InvalidRefundAmount, TransferFailed} from "./Constants.sol";
import {IPoolFactory} from "./interfaces/IPoolFactory.sol";

contract TornadoPool is Tornado {
    using SafeERC20 for IERC20;

    address public immutable token;

    constructor()
        Tornado(
            IVerifier(IPoolFactory(msg.sender).verifier()),
            IHasher(IPoolFactory(msg.sender).hasher()),
            10 ** IPoolFactory(msg.sender).power(),
            uint32(IPoolFactory(msg.sender).merkleHeight())
        )
    {
        token = IPoolFactory(msg.sender).asset();
    }

    function _processDeposit() internal override {
        if (token == address(0)) {
            if (msg.value != denomination) {
                revert InvalidMsgValue();
            }
        } else {
            if (msg.value != 0) {
                revert InvalidMsgValue();
            }
            IERC20(token).safeTransferFrom(msg.sender, address(this), denomination);
        }
    }

    function _processWithdraw(address payable _recipient, address payable _relayer, uint256 _fee, uint256 _refund)
        internal
        override
    {
        if (token == address(0)) {
            // sanity checks
            if (msg.value != 0) {
                revert InvalidMsgValue();
            }
            if (_refund != 0) {
                revert InvalidRefundAmount();
            }

            (bool success,) = _recipient.call{value: denomination - _fee}("");
            if (!success) {
                revert TransferFailed();
            }
            if (_fee > 0) {
                (success,) = _relayer.call{value: _fee}("");
                if (!success) {
                    revert TransferFailed();
                }
            }
        } else {
            if (msg.value != _refund) {
                revert InvalidRefundAmount();
            }

            IERC20(token).safeTransfer(_recipient, denomination - _fee);
            if (_fee > 0) {
                IERC20(token).safeTransfer(_relayer, _fee);
            }

            if (_refund > 0) {
                (bool success,) = _recipient.call{value: _refund}("");
                if (!success) {
                    // let's return _refund back to the relayer
                    _relayer.transfer(_refund);
                }
            }
        }
    }
}
          

// SPDX-License-Identifier: MIT

pragma solidity ^0.8.20;

interface IPoolFactory {
    /**
     * @notice the verifier of the pool
     * @dev this value is only set during pool creation
     */
    function verifier() external view returns (address);
    /**
     * @notice the hasher of the pool
     * @dev this value is only set during pool creation
     */
    function hasher() external view returns (address);
    /**
     * @notice the height of the merkle tree
     * @dev this value is only set during pool creation
     */
    function merkleHeight() external view returns (uint256);
    /**
     * @notice the asset of the pool
     * @dev this value is only set during pool creation
     */
    function asset() external view returns (address);
    /**
     * @notice the power of the pool
     * @dev the power is the exponent of the denomination
     * @dev the denomination is 10 ** power
     * @dev this value is only set during pool creation
     */
    function power() external view returns (uint256);
}
          

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

interface IVerifier {
    function verifyProof(bytes memory _proof, uint256[6] memory _input) external view returns (bool);
}
          

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

/**
 * @dev Contract module that helps prevent reentrant calls to a function.
 *
 * Inheriting from `ReentrancyGuard` will make the {nonReentrant} modifier
 * available, which can be applied to functions to make sure there are no nested
 * (reentrant) calls to them.
 *
 * Note that because there is a single `nonReentrant` guard, functions marked as
 * `nonReentrant` may not call one another. This can be worked around by making
 * those functions `private`, and then adding `external` `nonReentrant` entry
 * points to them.
 *
 * TIP: If you would like to learn more about reentrancy and alternative ways
 * to protect against it, check out our blog post
 * https://blog.openzeppelin.com/reentrancy-after-istanbul/[Reentrancy After Istanbul].
 */
abstract contract ReentrancyGuard {
    // Booleans are more expensive than uint256 or any type that takes up a full
    // word because each write operation emits an extra SLOAD to first read the
    // slot's contents, replace the bits taken up by the boolean, and then write
    // back. This is the compiler's defense against contract upgrades and
    // pointer aliasing, and it cannot be disabled.

    // The values being non-zero value makes deployment a bit more expensive,
    // but in exchange the refund on every call to nonReentrant will be lower in
    // amount. Since refunds are capped to a percentage of the total
    // transaction's gas, it is best to keep them low in cases like this one, to
    // increase the likelihood of the full refund coming into effect.
    uint256 private constant _NOT_ENTERED = 1;
    uint256 private constant _ENTERED = 2;

    uint256 private _status;

    constructor() {
        _status = _NOT_ENTERED;
    }

    /**
     * @dev Prevents a contract from calling itself, directly or indirectly.
     * Calling a `nonReentrant` function from another `nonReentrant`
     * function is not supported. It is possible to prevent this from happening
     * by making the `nonReentrant` function external, and make it call a
     * `private` function that does the actual work.
     */
    modifier nonReentrant() {
        // On the first call to nonReentrant, _notEntered will be true
        require(_status != _ENTERED, 'ReentrancyGuard: reentrant call');

        // Any calls to nonReentrant after this point will fail
        _status = _ENTERED;

        _;

        // By storing the original value once again, a refund is triggered (see
        // https://eips.ethereum.org/EIPS/eip-2200)
        _status = _NOT_ENTERED;
    }
}
          

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;

import { IERC20 } from '../interfaces/IERC20.sol';

library SafeERC20 {
    function safeTransfer(IERC20 token, address to, uint256 value) internal {
        (bool success, bytes memory data) = address(token).call(
            abi.encodeWithSelector(token.transfer.selector, to, value)
        );
        // Return native revert data from token
        if (!success) {
            assembly {
                revert(add(32, data), mload(data))
            }
        }
        require(data.length == 0 || abi.decode(data, (bool)), 'SafeERC20: safeTransfer failed');
    }

    function safeTransferFrom(IERC20 token, address from, address to, uint256 value) internal {
        (bool success, bytes memory data) = address(token).call(
            abi.encodeWithSelector(token.transferFrom.selector, from, to, value)
        );
        // Return native revert data from token
        if (!success) {
            assembly {
                revert(add(32, data), mload(data))
            }
        }
        require(data.length == 0 || abi.decode(data, (bool)), 'SafeERC20: safeTransferFrom failed');
    }

    function safeApprove(IERC20 token, address spender, uint256 value) internal {
        (bool success, bytes memory data) = address(token).call(
            abi.encodeWithSelector(token.approve.selector, spender, value)
        );
        // Return native revert data from token
        if (!success) {
            assembly {
                revert(add(32, data), mload(data))
            }
        }
        require(data.length == 0 || abi.decode(data, (bool)), 'SafeERC20: safeApprove failed');
    }
}