proof
Check it yourself
Nothing here asks you to trust this site. Each check runs in your browser and asks Ethereum itself, through a public RPC.
The ceremony's powers
Your browser makes proofs with 2,056 points from Ethereum's KZG ceremony, the one every blob already trusts. To check them, it commits to a random polynomial with all 2,056 at once, opens it at a random point, and asks Ethereum's point-evaluation precompile, which holds the ceremony's secret in the other group, whether the opening is right. Then it asks again with a wrong value, which must be refused. A point that is not the ceremony's would fail the first question.
The verifying key
The verifier on chain keeps a digest of its key. Your browser lays out the circuit row by row, commits to its 13 fixed columns with the powers above, checks the key's two points in the other group with Ethereum's pairing precompile, and recomputes the digest. A few seconds.
A proof from this browser, verified on chain
Your browser writes a random note into a small tree of its own, proves it the way a withdrawal does, and asks the deployed verifier. It must accept the proof, and refuse the same proof with one public input changed.
The deployed code
Each contract's code on chain is compared with the published build (the addresses it was given aside), and every address and number it was given is read back.
And what it does not
A withdrawal proof says, without saying which note:
- I know a nullifier n and a secret s, and the leaf H2(H1(n, s), measure) is in a tree whose root the spring has held.
- The nullifier hash this withdrawal spends is H3(n, 0). It can be spent once.
- This proof belongs to these terms: the recipient, the relayer and its fee, the mode, the minimum, the deadline, this chain, this spring. Change one and it fails.
Public inputs: the root, the nullifier hash, the measure, the hash of the terms. 2,240 bytes; 2,048 rows; 23 Poseidon permutations (the inner hash, the leaf, twenty levels of the tree, the nullifier). Each value the proof reveals is masked by four random coefficients, so it says nothing more even to someone who knows the ceremony's secret.