> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nullark.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Withdrawal proof inputs

Read the withdrawal verifier's nine positional public inputs and see exactly what the generated proof commits to.

Groth16 calldata is positional. The names below help humans review it; the verifier receives only the values in this exact order.

The current withdrawal verifier expects these public inputs in exact order:

| Index | Input |
| --- | --- |
| `0` | `root` |
| `1` | `nullifier` |
| `2` | `destination` |
| `3` | `grossAmount` |
| `4` | `fee` |
| `5` | `chainId` |
| `6` | `verifyingContract` |
| `7` | `proofContextHash` |
| `8` | `encryptedPayloadHash` |

> **Warning:**
> Names are explanatory labels. Verifier calldata is positional; reordering, dropping, or substituting one field produces a different statement.

## What each field fixes

| Index | Field | Meaning |
| ---: | --- | --- |
| `0` | `root` | An accepted Merkle-tree state containing the deposited bundle commitment |
| `1` | `nullifier` | The unique public spend marker for the selected child note |
| `2` | `destination` | Public ETH recipient |
| `3` | `grossAmount` | Selected child amount removed from shielded accounting |
| `4` | `fee` | Protocol fee calculated from the live fee rate |
| `5` | `chainId` | MegaETH chain where the proof is valid |
| `6` | `verifyingContract` | Exact pool where the proof is valid |
| `7` | `proofContextHash` | Runtime and withdrawal-call context |
| `8` | `encryptedPayloadHash` | Hash of the fixed-size cover payload sent with the withdrawal |

The remaining sibling was committed with the bundle at deposit and stays available until its own nullifier is spent.

## Integration rules

- Preserve the generated order. Never sort inputs by name.
- Compare every generated value with the intended root, nullifier, recipient, amount, fee, chain, pool, context, and payload.
- Reject missing, extra, malformed, or out-of-field values before encoding calldata.
- Build a fresh proof after any root, recipient, amount, fee, runtime, or payload change.

Changing even one field creates a different statement. A proof with nine values can still be wrong if one value or position differs.