papers/lux-privacy-pool/sections/02-system-model.tex

\section{System Model}
\label{sec:model}

\subsection{Participants}

\begin{definition}[Privacy Pool Roles]
\begin{itemize}
    \item \textbf{Depositors}: Users who deposit tokens into the privacy pool.
    \item \textbf{Withdrawers}: Users who withdraw tokens from the pool (may be the same or different address as the depositor).
    \item \textbf{Association Set Providers (ASPs)}: Entities that curate and publish association sets of compliant deposit commitments.
    \item \textbf{Verifiers}: On-chain smart contracts that verify zero-knowledge proofs.
    \item \textbf{Regulators}: Off-chain entities that define compliance criteria for ASPs.
\end{itemize}
\end{definition}

\subsection{Cryptographic Building Blocks}

\begin{definition}[Commitment Scheme]
We use a Pedersen commitment over the Jubjub curve (embedded in BLS12-381):
\begin{equation}
    \mathsf{Commit}(v, r) = v \cdot G + r \cdot H
\end{equation}
where $v$ is the deposited amount, $r$ is a random blinding factor, and $G, H$ are independent generators.
\end{definition}

\begin{definition}[Nullifier]
Each deposit has a unique nullifier:
\begin{equation}
    \mathsf{nf} = H_{\text{null}}(\mathsf{sk}, \mathsf{leafIndex})
\end{equation}
where $\mathsf{sk}$ is the depositor's secret key and $\mathsf{leafIndex}$ is the deposit's position in the Merkle tree. Publishing the nullifier on withdrawal prevents double-spending without revealing the deposit.
\end{definition}

\begin{definition}[Incremental Merkle Tree]
Deposits are accumulated in a Merkle tree of depth $d = 20$ (capacity: $2^{20} \approx 1{,}048{,}576$ deposits). The tree root $R$ commits to all deposits:
\begin{equation}
    R = \mathsf{MerkleRoot}(\mathsf{leaf}_0, \mathsf{leaf}_1, \ldots, \mathsf{leaf}_{n-1})
\end{equation}
where each $\mathsf{leaf}_i = H(\mathsf{Commit}(v_i, r_i), \mathsf{pk}_i)$.
\end{definition}