add refund mechanism for token withdrawal

circuits/withdraw.circom

@@ -33,6 +33,7 @@ template Withdraw(levels, rounds) {
     signal input receiver; // not taking part in any computations
     signal input relayer; // not taking part in any computations
     signal input fee; // not taking part in any computations
+    signal input refund; // not taking part in any computations
     signal private input nullifier;
     signal private input secret;
     signal private input pathElements[levels];
@@ -58,9 +59,11 @@ template Withdraw(levels, rounds) {
     signal receiverSquare;
     signal feeSquare;
     signal relayerSquare;
+    signal refundSquare;
     receiverSquare <== receiver * receiver;
     feeSquare <== fee * fee;
     relayerSquare <== relayer * relayer;
+    refundSquare <== refund * refund;
 }
 
 component main = Withdraw(16, 220);

cli.js

@@ -101,6 +101,7 @@ async function withdrawErc20(note, receiver, relayer) {
     receiver: bigInt(receiver),
     relayer: bigInt(relayer),
     fee: bigInt(web3.utils.toWei('0.01')),
+    refund: bigInt(0),
 
     // private
     nullifier: deposit.nullifier,
@@ -175,6 +176,7 @@ async function withdraw(note, receiver) {
     receiver: bigInt(receiver),
     relayer: bigInt(0),
     fee: bigInt(0),
+    refund: bigInt(0),
 
     // Private snark inputs
     nullifier: deposit.nullifier,

contracts/ERC20Mixer.sol

@@ -15,12 +15,9 @@ import "./Mixer.sol";
 
 contract ERC20Mixer is Mixer {
   address public token;
-  // ether value to cover network fee (for relayer) and to have some ETH on a brand new address
-  uint256 public userEther;
 
   constructor(
     address _verifier,
-    uint256 _userEther,
     uint8 _merkleTreeHeight,
     uint256 _emptyElement,
     address payable _operator,
@@ -28,21 +25,22 @@ contract ERC20Mixer is Mixer {
     uint256 _denomination
   ) Mixer(_verifier, _denomination, _merkleTreeHeight, _emptyElement, _operator) public {
     token = _token;
-    userEther = _userEther;
   }
 
   function _processDeposit() internal {
-    require(msg.value == userEther, "Please send `userEther` ETH along with transaction");
     safeErc20TransferFrom(msg.sender, address(this), denomination);
   }
 
-  function _processWithdraw(address payable _receiver, address payable _relayer, uint256 _fee) internal {
+  function _processWithdraw(address payable _receiver, address payable _relayer, uint256 _fee, uint256 _refund) internal {
-    _receiver.transfer(userEther);
+    require(msg.value == _refund, "Incorrect refund amount received by the contract");
 
     safeErc20Transfer(_receiver, denomination - _fee);
     if (_fee > 0) {
       safeErc20Transfer(_relayer, _fee);
     }
+    if (_refund > 0) {
+      _receiver.transfer(_refund);
+    }
   }
 
   function safeErc20TransferFrom(address from, address to, uint256 amount) internal {

contracts/ETHMixer.sol

@@ -23,7 +23,7 @@ contract ETHMixer is Mixer {
   ) Mixer(_verifier, _denomination, _merkleTreeHeight, _emptyElement, _operator) public {
   }
 
-  function _processWithdraw(address payable _receiver, address payable _relayer, uint256 _fee) internal {
+  function _processWithdraw(address payable _receiver, address payable _relayer, uint256 _fee, uint256 /* _refund */) internal {
     _receiver.transfer(denomination - _fee);
     if (_fee > 0) {
       _relayer.transfer(_fee);

contracts/Mixer.sol

@@ -14,7 +14,7 @@ pragma solidity ^0.5.8;
 import "./MerkleTreeWithHistory.sol";
 
 contract IVerifier {
-  function verifyProof(uint256[8] memory proof, uint256[5] memory input) public returns(bool);
+  function verifyProof(uint256[8] memory proof, uint256[6] memory input) public returns(bool);
 }
 
 contract Mixer is MerkleTreeWithHistory {
@@ -76,31 +76,32 @@ contract Mixer is MerkleTreeWithHistory {
   function _processDeposit() internal {}
 
   /**
-    @dev Withdraw deposit from the mixer. `a`, `b`, and `c` are zkSNARK proof data, and input is an array of circuit public inputs
+    @dev Withdraw deposit from the mixer. `proof` is a zkSNARK proof data, and input is an array of circuit public inputs
     `input` array consists of:
       - merkle root of all deposits in the mixer
       - hash of unique deposit nullifier to prevent double spends
       - the receiver of funds
       - optional fee that goes to the transaction sender (usually a relay)
   */
-  function withdraw(uint256[8] memory proof, uint256[5] memory input) public {
+  function withdraw(uint256[8] memory proof, uint256[6] memory input) public payable {
     uint256 root = input[0];
     uint256 nullifierHash = input[1];
     address payable receiver = address(input[2]);
     address payable relayer = address(input[3]);
     uint256 fee = input[4];
+    uint256 refund = input[5];
     require(fee < denomination, "Fee exceeds transfer value");
     require(!nullifierHashes[nullifierHash], "The note has been already spent");
 
     require(isKnownRoot(root), "Cannot find your merkle root"); // Make sure to use a recent one
     require(verifier.verifyProof(proof, input), "Invalid withdraw proof");
     nullifierHashes[nullifierHash] = true;
-    _processWithdraw(receiver, relayer, fee);
+    _processWithdraw(receiver, relayer, fee, refund);
     emit Withdraw(receiver, nullifierHash, relayer, fee);
   }
 
   /** @dev this function is defined in a child contract */
-  function _processWithdraw(address payable _receiver, address payable _relayer, uint256 _fee) internal {}
+  function _processWithdraw(address payable _receiver, address payable _relayer, uint256 _fee, uint256 _refund) internal {}
 
   /** @dev whether a note is already spent */
   function isSpent(uint256 nullifier) public view returns(bool) {

migrations/5_deploy_erc20_mixer.js

@@ -20,7 +20,6 @@ module.exports = function(deployer, network, accounts) {
     const mixer = await deployer.deploy(
       ERC20Mixer,
       verifier.address,
-      ETH_AMOUNT,
       MERKLE_TREE_HEIGHT,
       EMPTY_ELEMENT,
       accounts[0],