{
"creator": "Railgun",
"projectsForTvs": [
{
"projectId": "railgun",
"sinceTimestamp": 1651422389
}
],
"proofSystemInfo": "",
"techStack": {
"zkVM": [
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
},
{
"id": "Snarkjs",
"type": "Groth16",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Groth16 proving system written in JS."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "Snarkjs",
"type": "Groth16",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Groth16 proving system written in JS."
},
"id": "Railgun",
"name": "Railgun",
"risk": "yellow",
"participantCount": 55,
"shortDescription": "Circuit-specific trusted setup for 54 Groth16 Railgun circuits over BN254. It was built on top of 55 phase 1 contributions, with 304 phase 2 participants. Proving system could be broken if either phase 1 or 2 is compromised.",
"longDescription": "Circuit-specific Phase 2 trusted setup for Railgun's 54 Groth16 circuits (parameterised by\ntransaction input/output counts) over the BN254 curve. It [builds on the\nPolygon zkEVM ceremony](https://github.com/Railgun-Privacy/circuits-v2/blob/d0ec02dea0cbc8cd02a3b727b28de16e51f9a741/prepare_for_ceremony.sh#L13) as phase 1, which contains 55 participants.\n\nA separate Phase 2 ceremony was publicly announced,\nopen to anonymous and identified participants, and wrapped up in late December 2022.\n\nVerified against the ceremony artifact IPFS hash\n`QmWAySHYhaZqioKi1ufrPJC1n1ZVtHP2w4hLA9XqqJCFne`: the\n`/contributors` directory contains 328 sequentially-numbered attestation files with\nGitHub or Twitter handles, and the `/zkeys` directory contains 54 final zkey files (one\nper circuit). Parsing the final zkey binary for the 1x1 circuit shows 304 Phase 2\ncontributions on that circuit.\n\n- Phase 1 ceremony: .\n- Ceremony artifacts on IPFS: [https://ipfs.io/ipfs/QmWAySHYhaZqioKi1ufrPJC1n1ZVtHP2w4hLA9XqqJCFne](https://ipfs.io/ipfs/QmWAySHYhaZqioKi1ufrPJC1n1ZVtHP2w4hLA9XqqJCFne)\n- Ceremony announcement: [https://medium.com/@Railgun_Project/railgun-project-begins-setup-ceremony-with-an-emphasis-on-security-d1c63117c312](https://medium.com/@Railgun_Project/railgun-project-begins-setup-ceremony-with-an-emphasis-on-security-d1c63117c312)\n- Advanced Circuit ceremony user guide: [https://medium.com/@Railgun_Project/railgun-advanced-circuit-setup-ceremony-user-guide-32361c54242](https://medium.com/@Railgun_Project/railgun-advanced-circuit-setup-ceremony-user-guide-32361c54242)\n- Docs overview of the trusted setup: [https://docs.railgun.org/wiki/learn/privacy-system/trusted-setup-ceremony](https://docs.railgun.org/wiki/learn/privacy-system/trusted-setup-ceremony)\n- Railgun circuits repository with ceremony scripts: [https://github.com/Railgun-Privacy/circuits-v2](https://github.com/Railgun-Privacy/circuits-v2)"
}
],
"verifierHashes": [
{
"hash": "Railgun 91 circuit verifier 03.07.2026",
"name": "Railgun verifier",
"sourceLink": "https://github.com/Railgun-Privacy/circuits-v2/tree/0aa2d13763a9fcfbb7b7ea9c02e004e71f1394bb/src/library",
"proofSystem": {
"id": "Snarkjs",
"type": "Groth16",
"name": "Snarkjs",
"description": "Circom / iden3 implementation of Groth16 proving system written in JS."
},
"knownDeployments": [
{
"address": "eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "Railgun smart contract acts as a verifier for ZK proofs for all 91 Railgun circuits. 91 different verification keys for these circuits are stored onchain in the verifier smart contract. This regeneration attests that the verification keys stored onchain correspond to circuits published in Railgun repo.\n\nGenerally, to regenrate all Railgun verification keys, the following has to be done:\n\n1. Checkout the `main` branch of the [Railgun circuits-v2 repo](https://github.com/Railgun-Privacy/circuits-v2) (commit hash `0aa2d13763a9fcfbb7b7ea9c02e004e71f1394bb`).\n2. Download Railgun trusted setup artifacts, which could be found at IPFS CID `QmUsmnK4PFc7zDp2cmC4wBZxYLjNyRg Wfs5GNcJJ2uLcpU` or [on L2BEAT trusted setup hosting](https://trusted-setup-hosting.l2beat.com/privacy/railgun/trusted_setup_railgun.zip). It contains the proving keys for all 91 circuits, which contain circuit information and Groth16 phase 2 trusted setup information.\n3. Build required version of circom and compile circuit sources into `.r1cs` binaries.\n4. Download the phase 1 trusted setup files and use it to verify that all published prover keys correspond to the compiled circuits. This step will implicitly check the integrity of phase 2 contributions.\n5. Generate all 91 verification keys from all prover keys, and make sure that it is identical to the ones in the onchain smart contract.\n\nHelper scripts that implement the flow above and more detailed explainations could be found in this [script .zip archive](https://trusted-setup-hosting.l2beat.com/privacy/railgun/verification_railgun.zip). This .zip must be extracted in `circuits-v2` dir checked out on commit `0aa2d13763a9fcfbb7b7ea9c02e004e71f1394bb` before the execution."
"verificationSteps": "Railgun smart contract acts as a verifier for ZK proofs for all 91 Railgun circuits. 91 different verification keys for these circuits are stored onchain in the verifier smart contract. This regeneration attests that the verification keys stored onchain correspond to circuits published in Railgun repo.\n\nGenerally, to regenerate all Railgun verification keys, the following has to be done:\n\n1. Checkout the `main` branch of the [Railgun circuits-v2 repo](https://github.com/Railgun-Privacy/circuits-v2) (commit hash `0aa2d13763a9fcfbb7b7ea9c02e004e71f1394bb`).\n2. Download Railgun trusted setup artifacts, which could be found at IPFS CID `QmUsmnK4PFc7zDp2cmC4wBZxYLjNyRgWfs5GNcJJ2uLcpU` or [on L2BEAT trusted setup hosting](https://trusted-setup-hosting.l2beat.com/privacy/railgun/trusted_setup_railgun.zip). It contains the proving keys for all 91 circuits, which contain circuit information and Groth16 phase 2 trusted setup information.\n3. Build required version of circom and compile circuit sources into `.r1cs` binaries.\n4. Download the phase 1 trusted setup files and use it to verify that all published prover keys correspond to the compiled circuits. This step will implicitly check the integrity of phase 2 contributions.\n5. Generate all 91 verification keys from all prover keys, and make sure that it is identical to the ones in the onchain smart contract.\n\nHelper scripts that implement the flow above and more detailed explanations could be found in this [script .zip archive](https://trusted-setup-hosting.l2beat.com/privacy/railgun/verification_railgun.zip). This .zip must be extracted in `circuits-v2` dir checked out on commit `0aa2d13763a9fcfbb7b7ea9c02e004e71f1394bb` before the execution."
}
]
}
tornado-cash+1-1
zkCatalogInfo+1-1
{
"creator": "Tornado Cash",
"projectsForTvs": [
{
"projectId": "tornado-cash",
"sinceTimestamp": 1576523323
}
],
"proofSystemInfo": "",
"techStack": {
"zkVM": [
{
"id": "BN254",
"type": "curve",
"name": "BN254",
"description": "BN254, aka BN256, aka alt_bn128 pairing-friendly 254-bit prime field Weierstrass elliptic curve."
},
{
"id": "websnark",
"type": "Groth16",
"name": "websnark",
"description": "Fast browser-native ZK SNARK prover written in WASM by Tornado Cash team."
}
]
},
"trustedSetups": [
{
"proofSystem": {
"id": "websnark",
"type": "Groth16",
"name": "websnark",
"description": "Fast browser-native ZK SNARK prover written in WASM by Tornado Cash team."
},
"id": "TornadoCash",
"name": "Tornado Cash",
"risk": "yellow",
"participantCount": 30,
"shortDescription": "Circuit-specific trusted setup for Groth16 Tornado Cash circuits. It was built on top of 30 phase 1 contributions, and reached 1114 phase 2 participants. Proving system could be broken if either phase 1 or 2 is compromised.",
"longDescription": "Circuit-specific trusted setup for Groth16 Tornado Cash circuits. It was publicly announced as a Phase 2 ceremony\nbuilt on top of the [30th contribution to the Perpetual Powers of Tau ceremony](https://tornado-cash.medium.com/tornado-cash-trusted-setup-ceremony-b846e1e00be1), and completed in May 2020. It\ncollected 1114 contributions over 10 days, with 450 identified contributors and 664 anonymous ones. Tornado Cash\npublished the participant list, archive of contributions and artifacts, and the generated verifier contract.\n\n- Phase 1 ceremony (first 30 contributions are used): .\n- Ceremony completion announcement: [https://tornado-cash.medium.com/the-biggest-trusted-setup-ceremony-in-the-world-3c6ab9c8fffa](https://tornado-cash.medium.com/the-biggest-trusted-setup-ceremony-in-the-world-3c6ab9c8fffa)\n- Ceremony page with participant list and archive download: [https://ceremony.tornado.cash/](https://ceremony.tornado.cash/)\n- Initial ceremony announcement: [https://tornado-cash.medium.com/tornado-cash-trusted-setup-ceremony-b846e1e00be1](https://tornado-cash.medium.com/tornado-cash-trusted-setup-ceremony-b846e1e00be1)\n- Ceremony code repository: [https://github.com/tornadocash/phase2-bn254](https://github.com/tornadocash/phase2-bn254)"
}
],
"verifierHashes": [
{
"hash": "Tornado Cash verifier 03.07.2026",
"name": "Tornado Cash verifier v2.1",
"sourceLink": "https://github.com/tornadocash/tornado-core/tree/v2.1/circuits",
"proofSystem": {
"id": "websnark",
"type": "Groth16",
"name": "websnark",
"description": "Fast browser-native ZK SNARK prover written in WASM by Tornado Cash team."
},
"knownDeployments": [
{
"address": "eth:0xce172ce1F20EC0B3728c9965470eaf994A03557A"
}
],
"verificationStatus": "successful",
"attesters": [
{
"id": "l2beat",
"name": "L2BEAT",
"link": "https://l2beat.com"
}
],
"verificationSteps": "This regeneration attests that the verifier smart contract verification keys correspond to circuits published in Tornado Cash release.\n\nGenerally, to regenerate Tornado Cash verifier, the following has to be done:\n\n1. Checkout the correct branch of the sources: `https://github.com/tornadocash/tornado-core/tree/v2.1`.\n2. Compile the `.circom` circuit sources into `.json`.\n3. Fetch published prover keys for `tornado.params`. This file contains the circuit information and Groth16 phase 2 trusted setup information (final evaluation keys for all 1114 contributions). It does not contain phase 1 trusted setup data that must be fetched separately.\n4. Check that `tornado.params` was generated with the same compiled circuit as was obtained in step 2. This step will implicitly check the integrity of phase 2 trusted setup, and it will rely on the phase 1 trusted setup files downloaded in the previous step.\n5. Generate verification keys from the prover key and make sure that it is identical to the one in the solidity smart contract.\n\nelper scripts that implement the flow above and more detailed explainations could be found in this [script .zip archive](https://trusted-setup-hosting.l2beat.com/privacy/tornado-cash/verification_tornado_cash.zip). This .zip must be extracted in `tornado-core` dir checked out on tag `v2.1` (commit hash `a533ad9ffb62163a42d4fa9a09984c5dd4e5c41d`) before the execution."
"verificationSteps": "This regeneration attests that the verifier smart contract verification keys correspond to circuits published in Tornado Cash release.\n\nGenerally, to regenerate Tornado Cash verifier, the following has to be done:\n\n1. Checkout the correct branch of the sources: `https://github.com/tornadocash/tornado-core/tree/v2.1`.\n2. Compile the `.circom` circuit sources into `.json`.\n3. Fetch published prover keys for `tornado.params`. This file contains the circuit information and Groth16 phase 2 trusted setup information (final evaluation keys for all 1114 contributions). It does not contain phase 1 trusted setup data, which must be fetched separately.\n4. Check that `tornado.params` was generated with the same compiled circuit as was obtained in step 2. This step will implicitly check the integrity of phase 2 trusted setup, and it will rely on the separately fetched phase 1 trusted setup files.\n5. Generate verification keys from the prover key and make sure that it is identical to the one in the solidity smart contract.\n\nHelper scripts that implement the flow above and more detailed explanations could be found in this [script .zip archive](https://trusted-setup-hosting.l2beat.com/privacy/tornado-cash/verification_tornado_cash.zip). This .zip must be extracted in `tornado-core` dir checked out on tag `v2.1` (commit hash `a533ad9ffb62163a42d4fa9a09984c5dd4e5c41d`) before the execution."
}
]
}