papers/lux-privacy-pool/sections/03-association-sets.tex

\section{Association Sets}
\label{sec:association}

\subsection{Definition}

\begin{definition}[Association Set]
An association set $\mathcal{A} \subseteq \{0, 1, \ldots, n-1\}$ is a subset of deposit indices deemed compliant by an ASP. The ASP publishes the Merkle root of $\mathcal{A}$:
\begin{equation}
    R_{\mathcal{A}} = \mathsf{MerkleRoot}(\{\mathsf{leaf}_i : i \in \mathcal{A}\})
\end{equation}
\end{definition}

\subsection{Association Set Properties}

An association set must satisfy:
\begin{enumerate}
    \item \textbf{Inclusion}: $\mathcal{A} \subseteq \{0, \ldots, n-1\}$ (only actual deposits).
    \item \textbf{Non-empty}: $|\mathcal{A}| \geq k_{\min}$ (minimum anonymity set size).
    \item \textbf{Exclusion of sanctioned}: No deposit from a sanctioned address is in $\mathcal{A}$.
    \item \textbf{Timeliness}: $\mathcal{A}$ is updated within $\Delta_{\text{update}}$ epochs of new sanctions.
\end{enumerate}

\subsection{ASP Types}

\begin{table}[H]
\centering
\caption{Association Set Provider types and their properties.}
\label{tab:asps}
\begin{tabular}{p{3cm}p{3cm}rp{3.5cm}}
\toprule
\textbf{ASP Type} & \textbf{Inclusion Criteria} & \textbf{Set Size} & \textbf{Privacy Level} \\
\midrule
Permissive & All non-sanctioned & $\sim 99\%$ of deposits & Maximum privacy \\
Moderate & Non-sanctioned + not flagged & $\sim 90\%$ & Good privacy \\
Strict & KYC-verified only & $\sim 30\%$ & Moderate privacy \\
Custom & Application-defined & Variable & Application-specific \\
\bottomrule
\end{tabular}
\end{table}

\subsection{ASP Marketplace}

ASPs compete in a marketplace:

\begin{algorithm}[H]
\caption{ASP Registration and Set Publication}
\label{alg:asp}
\begin{algorithmic}[1]
\Procedure{RegisterASP}{aspAddress, criteria, bond}
    \State \textbf{require} $\mathsf{bond} \geq 10{,}000$ LUX
    \State Record ASP with compliance criteria
    \State ASP begins monitoring deposits
\EndProcedure
\Procedure{PublishSet}{$\mathcal{A}$, epoch}
    \State Compute $R_{\mathcal{A}} \gets \mathsf{MerkleRoot}(\{\mathsf{leaf}_i : i \in \mathcal{A}\})$
    \State Sign $\sigma \gets \mathsf{Sign}(\mathsf{sk}_{\text{ASP}}, R_{\mathcal{A}} \| \mathsf{epoch})$
    \State Publish $(R_{\mathcal{A}}, \mathsf{epoch}, \sigma)$ on-chain
\EndProcedure
\end{algorithmic}
\end{algorithm}

If an ASP includes a sanctioned deposit in its set, challengers can slash the ASP's bond:

\begin{definition}[ASP Slashing]
A challenge $(\mathsf{depositIdx}, \mathsf{sanctionProof})$ against ASP with set $\mathcal{A}$ succeeds if:
\begin{enumerate}
    \item $\mathsf{depositIdx} \in \mathcal{A}$ (Merkle proof of inclusion in $R_{\mathcal{A}}$).
    \item The deposit address is sanctioned ($\mathsf{sanctionProof}$ from oracle).
\end{enumerate}
On successful challenge: ASP bond slashed (50\% to challenger, 50\% burned).
\end{definition}