Privacy model
What a proof hides, and what it does not
Piece by piece
| Piece | Where it ends up | Effect | Keep in mind |
|---|---|---|---|
| Your identity secret | Never leaves your browser | — | Anyone holding it can claim in your place |
| Your member leaf | Public (MemberAdded event) | Every leaf of a gate is listed | Leaves are random-looking hashes, but whoever you sent your leaf to knows it is yours. Using one identity in several gates or with several attesters lets them match you by the leaf: make a separate identity where that matters |
| Which leaf a claim used | Hidden by the proof | — | The admin can still guess if the list is tiny or if only one member is active |
| Nullifier | Public (in the claim) | One per member per gate | Two claims in one gate by the same member share it (that is how the second is refused). Different gates give different nullifiers |
| Recipient address | Public | The claim is recorded for it | Pick a fresh address if you do not want the claim tied to your main one; it still needs gas or a friend to submit |
| Who sent the claim tx | Public | Any address may submit | The sender pays gas and is visible; it can differ from the recipient |
| Attested value | Never leaves your browser | — | The attester knows it: they made the commitment |
| Commitment | Public (Attested event + claim) | Links claims made with it | Bound to your leaf, so only you can prove with it. One commitment claims once per gate; using it in two gates links those two claims |
| Threshold and gate rules | Public | — | Anyone can read what the gate checks |
| Time and block | Public | — | Timing can link a claim to other activity |
Whom you still trust
- The gate admin
- Decides who is on an eligibility list and can add members until the list is sealed. Cannot claim for you, cannot see which member claimed, cannot undo a claim.
- The attester
- Decides what value goes into each commitment and can revoke it (stops future claims only). Knows the value, your leaf and whom they gave it to. Cannot prove in your place: that needs your secret.
- The setup contributor
- Phase 2 of the Groth16 setup had one contributor. If that randomness was kept, proofs could be forged. Nothing can show it was deleted.
- This website
- Serves the prover code and circuit files. A changed file could leak your secret: the code is open, and the SDK runs locally without this site.
- Elysium itself
- Runs the verifier and records claims. Elysium is an Arbitrum Orbit chain settling to HyperEVM; its sequencer orders transactions.
Trusted setup record
Not production-safe. Phase 2 had ONE contributor. Use these keys to try Zksium, not to guard anything of value. Before that, a multi-party phase 2 (several independent contributors), new verifiers and a new deployment are needed. That ceremony is planned, not done.
Phase 1: Powers of Tau
powersOfTau28_hez_final_13.ptau (2^13 constraints) from the Hermez ceremony, as linked in the snarkjs README. Its BLAKE2b-512 hash was checked against the one published there before use:
58efc8bf2834d04768a3d7ffcd8e1e23d461561729beaac4e3e7a47829a1c9066d5320241e124a1a8e8aa6c75be0ba66f65bc8239a0542ed38e11276f6fdb4d9
Phase 2: per circuit
One contribution from 64 random bytes held in memory and not written to disk, then a beacon from Elysium block 5,542,535 (2^10 iterations). The block was already final when chosen, so the beacon adds no safety of its own. snarkjs zkey verify passed for both circuits.
- eligibility.zkey sha256 4f8acedfeb197bef3990fe8aeef49a010ba41e19250de0c10f420b0587170ace
- threshold.zkey sha256 c5a15ebb98f7cfbc308cdd5414e196f3e4e1bbe00929c31c78f334e86bf55140
The full record (contribution hashes, file checksums, compiler version) is circuits/SETUP.txt in the repository. The circuit files this site serves are the same files: /developers lists their checksums.
What it is not
Zksium does not hide your wallet, your balance or your transactions, and it does not break the links between them. It lets you prove one fact while keeping the data behind that fact in your browser. Everything else about a Elysium transaction stays as public as it always was.