commitment = poseidon_hash(value || randomness)

nullifier = poseidon_hash(commitment || secret)

root = merkle_tree.root()  // Updated with each deposit

use paraloom::privacy::poseidon::{poseidon_hash, poseidon_hash_pair};

// Hash single value
let hash = poseidon_hash(&[1, 2, 3, 4]); // 32 bytes

// Hash two 32-byte values
let commitment = poseidon_hash_pair(&value, &randomness);
let nullifier = poseidon_hash_pair(&commitment, &secret);

pub struct WithdrawPublicInputs {
    nullifier: [u8; 32],      // Prevents double-spend
    amount: u64,               // Withdrawal amount
    recipient: [u8; 32],       // SOL address
    merkle_root: [u8; 32],     // Current tree root
}

struct WithdrawPrivateInputs {
    value: u64,                // Original deposit value
    randomness: [u8; 32],      // Commitment randomness
    secret: [u8; 32],          // Nullifier secret
    merkle_path: Vec<[u8; 32]>, // Merkle proof
}

fn withdraw_circuit(public: Public, private: Private) -> bool {
    // 1. Recompute commitment (500 constraints)
    let commitment = poseidon_hash(private.value || private.randomness);

    // 2. Verify merkle path (500 constraints per level)
    let root = verify_merkle_path(commitment, private.merkle_path);
    assert_eq!(root, public.merkle_root);

    // 3. Recompute nullifier (500 constraints)
    let nullifier = poseidon_hash(commitment || private.secret);
    assert_eq!(nullifier, public.nullifier);

    // 4. Check amount (1 constraint)
    assert!(private.value >= public.amount);

    true  // Circuit satisfied
}

cargo run --bin setup-withdrawal-ceremony

keys/
├── withdraw_proving.key    # 1.5 MB (secret, for provers)
└── withdraw_verifying.key  # 632 bytes (public, for verifiers)

cargo run --bin compute-poseidon-inputs

source /tmp/poseidon_exports.sh
cargo run --bin generate-withdrawal-proof