# How does ZK-snark work in zcash?

For a public one-way function $$f()$$, we can use zero proof to prove I know some secret $$x$$, such that the output of $$x$$ is a specific number $$y$$.

However, in zcash, I need to prove that I have some secret $$x$$, then $$cm$$ which is the commitment result of $$x$$ is a leaf in Merkle tree. Here, $$cm$$ is not a specific number and it is secret.

How should I prove this statement? I cannot figure out the circuit structure and the process using ZK-snark.

## 1 Answer

"[T]he process using ZK-snark" is to express the statement being proved as an R1CS system, produce proving and verifying public keys, produce and verify a snark-proof. A large non-trivial R1CS system is often expressed in terms of "gadgets" according to high-level "circuit structure".

A popular algorithm/proof was introduced at https://eprint.iacr.org/2016/260.pdf and implemented in libsnark. Zcash-specific "circuit" is documented in their "protocol" paper.