Withdrawal proof inputs - Nullark

Groth16 calldata is positional. The names below help humans review it; the verifier receives only the values in this exact order. The current withdrawal verifier expects these public inputs in exact order:

Index	Input
`0`	`root`
`1`	`nullifier`
`2`	`destination`
`3`	`grossAmount`
`4`	`fee`
`5`	`chainId`
`6`	`verifyingContract`
`7`	`proofContextHash`
`8`	`encryptedPayloadHash`

Names are explanatory labels. Verifier calldata is positional; reordering, dropping, or substituting one field produces a different statement.

What each field fixes

Index	Field	Meaning
`0`	`root`	An accepted Merkle-tree state containing the deposited bundle commitment
`1`	`nullifier`	The unique public spend marker for the selected child note
`2`	`destination`	Public ETH recipient
`3`	`grossAmount`	Selected child amount removed from shielded accounting
`4`	`fee`	Protocol fee calculated from the live fee rate
`5`	`chainId`	MegaETH chain where the proof is valid
`6`	`verifyingContract`	Exact pool where the proof is valid
`7`	`proofContextHash`	Runtime and withdrawal-call context
`8`	`encryptedPayloadHash`	Hash of the fixed-size cover payload sent with the withdrawal

The remaining sibling was committed with the bundle at deposit and stays available until its own nullifier is spent.

Integration rules

Preserve the generated order. Never sort inputs by name.
Compare every generated value with the intended root, nullifier, recipient, amount, fee, chain, pool, context, and payload.
Reject missing, extra, malformed, or out-of-field values before encoding calldata.
Build a fresh proof after any root, recipient, amount, fee, runtime, or payload change.

Changing even one field creates a different statement. A proof with nine values can still be wrong if one value or position differs.