d87aea9f (main)
and
55229b8a (PR)
+7 -7
+1 -1
{
"self": {
"stateValidation": {
"value": "Validity proofs (SN)",
"description": "SNARKs are succinct zero knowledge proofs that ensure state correctness, but require trusted setup.",
"sentiment": "good",
"orderHint": null,
"permissioned": false,
"executionDelay": 0,
"secondLine": "No execution delay"
},
"dataAvailability": {
"value": "Onchain (SD)",
"description": "State diffs needed to reconstruct the L2 state are published in Ethereum blobs. Public transaction bodies and client CHONK proofs propagate offchain, so withholding them can prevent permissionless proving; the affected pending checkpoints expire and are pruned rather than finalized.",
"sentiment": "good",
"orderHint": null
},
"exitWindow": {
"value": "∞",
"description": "Users can exit funds at any time because contracts are not upgradeable. Governance can register a new canonical rollup and bonus-instance validators automatically follow the latest version, but this does not mutate the current instance, its verifier, messaging contracts, or already-installed EscapeHatch. Governance can change bounded validator-entry parameters and can set the GSE proof-of-possession gas limit too low for new deposits; validators explicitly bound to this instance remain on it.",
"sentiment": "good",
"orderHint": null
},
"sequencerFailure": {
"value": "Decentralized Sequencer Set",
"sentiment": "good",
"description": "Users can permissionlessly become a sequencer by staking 200 K AZTEC to join the queue and wait to obtain committee-based block production rights. If the pseudo-randomly sampled committees censor proposals, anyone who bonds 332 M AZTEC will join the escape hatch candidate set. Every 2d 23h, a candidate is pseudo-randomly selected to propose and prove checkpoints fully autonomously. A candidate remains in the set until they are selected or leave voluntarily."
"description": "Users can permissionlessly become a sequencer by staking 200.00 K AZTEC to join the queue and wait to obtain committee-based block production rights. If the pseudo-randomly sampled committees censor proposals, anyone who bonds 332.00 M AZTEC will join the escape hatch candidate set. Every 2d 23h, a candidate is pseudo-randomly selected to propose and prove checkpoints fully autonomously. A candidate remains in the set until they are selected or leave voluntarily."
},
"proposerFailure": {
"value": "Self Propose",
"sentiment": "good",
"description": "Checkpoint proposals come from the open sequencer set, with the escape hatch providing a bonded fallback if the sampled committees are censoring or unavailable. Anyone with access to the required hardware can submit epoch root proofs which finalize the proven checkpoints."
}
}
}+6 -6
{
"dataAvailability": [
{
"name": "All transaction results (state diffs) are published in Ethereum blobs",
"description": "Each checkpoint proposal includes EIP-4844 blob commitments for state diffs, checked against the blob hashes in the proposing transaction. The epoch proof revalidates the accumulated commitments before finalization. Public transaction bodies and client CHONK proofs propagate offchain; withholding them can prevent permissionless proving, causing the pending checkpoint to expire and be pruned rather than finalized.",
"references": [
{
"title": "Rollup.sol - propose() on Etherscan",
"url": "https://etherscan.io/address/0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34#code"
},
{
"title": "Rollup.sol - validateBlobs() on Etherscan",
"url": "https://etherscan.io/address/0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34#code"
}
],
"risks": []
}
],
"exitMechanisms": [
{
"name": "Regular messaging",
"description": "The user initiates L2->L1 messages by submitting a regular transaction on this chain. When the block containing that transaction is settled, the message becomes available for processing on L1. ZK proofs are required to settle blocks. Once the epoch root proof has been verified, the rollup inserts the epoch root into the Outbox, from which withdrawals and other L2->L1 messages can be consumed on Ethereum. Withdrawals can be initiated privately on L2, revealing only the L1-facing portion of the transaction. There is no canonical bridge escrow: only the canonical messaging layer is immutable, while each token bridged through a locking escrow may introduce additional trust assumptions tied to that specific escrow.",
"risks": [],
"references": [
{
"title": "Rollup.sol - submitEpochRootProof() on Etherscan",
"url": "https://etherscan.io/address/0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34#code"
},
{
"title": "Outbox.sol - consume() on Etherscan",
"url": "https://etherscan.io/address/0x5B062aB5fD3A66BC7e73b04CeD38587673b6A2D7#code"
}
]
}
],
"forceTransactions": {
"name": "Bonded, probabilistic self-sequencing",
"description": "There is no L1 forced-transaction queue. A censored user must wait for an honest regular committee or for an honest, sufficiently capitalized escape-hatch candidate to enroll, become eligible, be selected, include the transaction, and produce a valid proof.",
"risks": [
{
"category": "Users can be censored if",
"text": "no honest regular proposer or eligible bonded escape-hatch proposer includes and proves their transactions."
}
],
"references": [
{
"title": "EscapeHatch.sol on Etherscan",
"url": "https://etherscan.io/address/0xF459348962F5eA3A9A101826B03A2CE1F459E51A#code"
}
]
},
"operator": {
"name": "There is no central operator",
"description": "There is no privileged sequencer. Anyone can stake 200 K AZTEC to join the sequencer queue, and anyone can call flushEntryQueue() to activate queued sequencers once the queue rules allow it.",
"description": "There is no privileged sequencer. Anyone can stake 200.00 K AZTEC to join the sequencer queue, and anyone can call flushEntryQueue() to activate queued sequencers once the queue rules allow it.",
"risks": [],
"references": [
{
"title": "Rollup.sol - deposit() on Etherscan",
"url": "https://etherscan.io/address/0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34#code"
},
{
"title": "Rollup.sol - flushEntryQueue() on Etherscan",
"url": "https://etherscan.io/address/0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34#code"
}
]
},
"otherConsiderations": [
{
"name": "Upgrades replace the canonical rollup",
"description": "The core contracts are immutable, but Governance owns the Registry and GSE and can register a new rollup version as canonical after the governance delay.",
"references": [
{
"title": "Registry.sol - addRollup() on Etherscan",
"url": "https://etherscan.io/address/0x35b22e09Ee0390539439E24f06Da43D83f90e298#code"
},
{
"title": "Governance.sol - execute() on Etherscan",
"url": "https://etherscan.io/address/0x1102471Eb3378FEE427121c9EfcEa452E4B6B75e#code"
}
],
"risks": []
},
{
"name": "No canonical bridge escrow",
"description": "There is no default canonical escrow. The rollup is deployed only with an immutable canonical messaging bridge, which can be used by any escrow. As a result, each token bridged to Aztec via Ethereum lock-mint must be assessed individually by examining its specific locking escrow. The trust assumptions of a given escrow may differ from those of the immutable rollup itself. Gas tokens are bridged through the FeeJuicePortal, an immutable one-way portal that only supports bridging to public L2 addresses. Although the rollup and its canonical messaging bridge are immutable, an upgradeable escrow could migrate its funds to a new rollup version without requiring users to migrate, effectively trading immutability for convenience.",
"references": [
{
"title": "FeeJuicePortal.sol - on Etherscan",
"url": "https://etherscan.io/address/eth:0xaf73Dd51D1eb8a079BB097f39c832cDD00ac691c#code"
},
{
"title": "Outbox.sol - on Etherscan",
"url": "https://etherscan.io/address/0x5B062aB5fD3A66BC7e73b04CeD38587673b6A2D7#code"
}
],
"risks": []
},
{
"name": "Inclusion is probabilistic",
"description": "All protocol-level censorship-resistance tools are probabilistic. Unlike an L1 forced-transaction queue, they do not guarantee inclusion after a fixed delay. The launch-era decentralized-sequencer model estimated 20d to reach its target exit probability under its stated assumptions; it is not a current protocol guarantee and does not model validator-set changes, the escape hatch, or adversarial queue saturation. Private transactions and the bonded escape hatch can improve inclusion probability, but neither creates a deterministic deadline.",
"references": [
{
"title": "CRsim - Simulated inclusion probability on Aztec",
"url": "https://sekuba.github.io/crsim"
}
],
"risks": []
}
],
"sequencing": {
"name": "Transactions are ordered by a staked validator committee",
"description": "Joining the sequencer set is permissionless and requires staking 200 K AZTEC. For each epoch, the Rollup samples a 48-member committee from the active set of 3466 and selects one proposer per slot. The proposer for slot N builds the checkpoint and collects attestations during slot N-1, then submits the assembled checkpoint to Ethereum in slot N. More than two-thirds of the sampled committee must attest; the proof path verifies the attestation data before the checkpoint can become final.",
"description": "Joining the sequencer set is permissionless and requires staking 200.00 K AZTEC. For each epoch, the Rollup samples a 48-member committee from the active set of 3466 and selects one proposer per slot. The proposer for slot N builds the checkpoint and collects attestations during slot N-1, then submits the assembled checkpoint to Ethereum in slot N. More than two-thirds of the sampled committee must attest; the proof path verifies the attestation data before the checkpoint can become final.",
"sequencerSetSpec": {
"blockTime": {
"value": "6s",
"description": "Current expected interval between L2 block proposals. Multiple blocks can be produced by the same proposer within one slot, so this interval can differ from the proposer rotation interval."
},
"proposerRotationTime": {
"value": "1m 12s"
},
"committeeRotationTime": {
"value": "38m 24s",
"description": "A random committee is sampled from the sequencer set for each epoch, a random block producer is sampled from the committee for each slot in the epoch"
},
"sequencerCount": {
"value": "3466 sequencers"
},
"blockProductionAccess": {
"value": "Open",
"sentiment": "good"
},
"stakePerValidator": {
"value": "200 K AZTEC, constant"
"value": "200.00 K AZTEC, constant"
},
"rateLimit": {
"value": "Up to 4 sequencers per epoch (current)",
"description": "Can be changed by onchain Governance, but the contract requires nonzero minimum, divisor, and maximum queue-flush parameters."
},
"deterministicCrGadget": {
"value": "No",
"sentiment": "warning"
},
"additionalCrGadgets": {
"value": "Bonded escape hatch, private transactions",
"sentiment": "good"
}
},
"inclusionDelayChart": {
"type": "committeelike",
"validatorCount": 3466,
"committeeSize": 48,
"epochSlots": 32,
"slotSeconds": 72,
"blockingThreshold": 15,
"target": 0.99,
"maxCensorFraction": 0.5,
"stakeDistribution": {
"stakeToken": "AZTEC",
"totalStake": 610642000,
"entities": [
{
"name": "Nethermind",
"stake": 113600000
},
{
"name": "Nansen | Stake to Stack Points",
"stake": 75800000
},
{
"name": "Sigma Prime",
"stake": 66800000
},
{
"name": "P2P.org",
"stake": 41600000
},
{
"name": "snoopfear|PON",
"stake": 37200000
},
{
"name": "ZKV",
"stake": 30816000
},
{
"name": "GabbexNodes",
"stake": 27400000
},
{
"name": "Wonderland",
"stake": 26600000
},
{
"name": "Nightwolf Labs",
"stake": 22800000
},
{
"name": "01node",
"stake": 21600000
}
]
}
},
"inclusionDelayChartDescription": "The chart models live-chain selective censorship only. It does not model the escape hatch, validator-set changes, validator-set lag, and blanket-censorship resistance gadgets.",
"censorshipResistance": "The regular committee can be circumvented by the escape hatch, which uses RANDAO to designate a previously enrolled bonded candidate that may publish checkpoints without committee attestations. Enrollment requires 332 M AZTEC, a high bond intended to protect the single-proof system while providing a last-resort path around the regular sequencer set. Aztec's private execution environment can also make selective censorship harder because transaction contents are hidden.\n\n### Selective censorship\n\nOn a live network with some censoring sequencers, users can submit private transactions or wait for an honest committee and proposer to include their public transaction.\n\n### Blanket censorship\n\nIf the entire active set censors or stops producing checkpoints, a new sequencer can join through the permissionless staking queue, subject to its churn limits. A sufficiently capitalized account can instead enroll for the escape hatch, but enrollment, candidate-set snapshots, eligibility, and RANDAO selection are lagged. Specialized proving hardware is still required. Adversaries can also saturate the entry queue or candidate set and reduce an honest user's inclusion probability.\n\n### Walkaway\n\nHatch opportunities occur approximately every 2d 23h, but the candidate set can be empty and selection, proposal, and proving can fail. The protocol therefore provides no deterministic maximum inclusion delay; permissionless validator entry and the bonded hatch only improve the probability that the chain eventually recovers.",
"censorshipResistance": "The regular committee can be circumvented by the escape hatch, which uses RANDAO to designate a previously enrolled bonded candidate that may publish checkpoints without committee attestations. Enrollment requires 332.00 M AZTEC, a high bond intended to protect the single-proof system while providing a last-resort path around the regular sequencer set. Aztec's private execution environment can also make selective censorship harder because transaction contents are hidden.\n\n### Selective censorship\n\nOn a live network with some censoring sequencers, users can submit private transactions or wait for an honest committee and proposer to include their public transaction.\n\n### Blanket censorship\n\nIf the entire active set censors or stops producing checkpoints, a new sequencer can join through the permissionless staking queue, subject to its churn limits. A sufficiently capitalized account can instead enroll for the escape hatch, but enrollment, candidate-set snapshots, eligibility, and RANDAO selection are lagged. Specialized proving hardware is still required. Adversaries can also saturate the entry queue or candidate set and reduce an honest user's inclusion probability.\n\n### Walkaway\n\nHatch opportunities occur approximately every 2d 23h, but the candidate set can be empty and selection, proposal, and proving can fail. The protocol therefore provides no deterministic maximum inclusion delay; permissionless validator entry and the bonded hatch only improve the probability that the chain eventually recovers.",
"references": [
{
"title": "Aztec docs - Privacy considerations",
"url": "https://github.com/AztecProtocol/aztec-packages/blob/next/docs/docs-developers/docs/resources/considerations/privacy_considerations.md#function-fingerprints-and-tx-fingerprints"
},
{
"title": "Rollup.sol - getProposerAt() on Etherscan",
"url": "https://etherscan.io/address/0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34#code"
},
{
"title": "EscapeHatch.sol - selectCandidates() on Etherscan",
"url": "https://etherscan.io/address/0xF459348962F5eA3A9A101826B03A2CE1F459E51A#code"
}
],
"risks": []
},
"stateValidation": {
"description": "Each epoch root proof is verified by the HonkVerifier smart contract on Ethereum before the proven checkpoint number is advanced and the epoch outbox state root is inserted into the Outbox. Proving is permissionless, and a single proof can cover one Checkpoint (1m 12s) to one epoch (38m 24s). The current maximum proof window is 1h 16m; checkpoints later in an epoch have less time, and unproven checkpoints are pruned.",
"categories": [
{
"title": "State root proposals",
"description": "The rollup only advances the proven chain after submitEpochRootProof() succeeds. That call verifies the epoch proof and then inserts the epoch outbox state root for L2->L1 messaging.",
"references": [
{
"title": "Rollup.sol - submitEpochRootProof() on Etherscan",
"url": "https://etherscan.io/address/0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34#code"
}
],
"risks": []
},
{
"title": "Validity proofs",
"description": "Each update to the system state must be accompanied by a ZK proof that ensures that the new state was derived by correctly applying a series of valid user transactions to the previous state. These proofs are then verified on Ethereum by a smart contract.",
"risks": [],
"references": [
{
"title": "Rollup.sol - submitEpochRootProof() on Etherscan",
"url": "https://etherscan.io/address/0x91fF8bbD8Ebb07893010D50A48A1609e5EBd8E34#code"
},
{
"title": "HonkVerifier.sol - verify() on Etherscan",
"url": "https://etherscan.io/address/0x098f47c00F4df22a8030746Eb11378236C24b4bC#code"
}
]
},
{
"title": "Slashing",
"description": "Each 200 K AZTEC stake used to join the sequencer set and vote in governance can be slashed. The designated proposer for each slot can submit one separate signed ballot on L1. Ballots are grouped into rounds spanning 4 epochs (2h 33m).\n\nSlashing conditions are implemented in sequencer-node software and can change when operators update or modify that software. The onchain `SlashingProposer` enforces the voting and execution rules:\n\n* Ballots in a round target committee members from 2 rounds earlier.\n* Quorum is evaluated separately for each validator position and penalty level, not for the round as a whole. At least 65 matching ballots out of up to 128 slots are required. Votes for a higher penalty also count toward every lower level, and each validator is slashed once at the highest level that reaches quorum.\n* A round becomes executable after more than 28 rounds (approximately 2d 23h) and expires at age 34 rounds, leaving a 6-round execution window.\n* Anyone can call `executeRound()` during that window. It verifies committee commitments, skips escape-hatch epochs, deploys a deterministic payload for the approved actions, and asks the authorized Slasher to execute it.\n\nThe current onchain penalty levels are large (5.00 K AZTEC), medium (5.00 K AZTEC), and small (2.00 K AZTEC). Offenses that node software can ballot for include:\n\n* **Inactivity:** a sequencer fails to attest or propose when selected.\n* **Data withholding:** a sequencer publishes state-diff blobs but withholds public transaction bodies or CHONK proofs needed for permissionless proving.\n* **Invalidity or equivocation:** a sequencer attests to an invalid proposal, signs conflicting proposals or attestations, or uses an invalid signature.\n\nThis list and the mapping of offenses to penalty levels are not exhaustive or defined by the L1 contracts; they depend on the software each sequencer runs.\n\nThe SlashVeto Council is a 5/9 Multisig. It can permanently veto a specific payload, repeatedly renew a global 3d pause, or re-enable slashing before a pause expires. Governance can submit Slasher payloads without ballot approval, but it cannot bypass these veto and pause checks.",
"description": "Each 200.00 K AZTEC stake used to join the sequencer set and vote in governance can be slashed. The designated proposer for each slot can submit one separate signed ballot on L1. Ballots are grouped into rounds spanning 4 epochs (2h 33m).\n\nSlashing conditions are implemented in sequencer-node software and can change when operators update or modify that software. The onchain `SlashingProposer` enforces the voting and execution rules:\n\n* Ballots in a round target committee members from 2 rounds earlier.\n* Quorum is evaluated separately for each validator position and penalty level, not for the round as a whole. At least 65 matching ballots out of up to 128 slots are required. Votes for a higher penalty also count toward every lower level, and each validator is slashed once at the highest level that reaches quorum.\n* A round becomes executable after more than 28 rounds (approximately 2d 23h) and expires at age 34 rounds, leaving a 6-round execution window.\n* Anyone can call `executeRound()` during that window. It verifies committee commitments, skips escape-hatch epochs, deploys a deterministic payload for the approved actions, and asks the authorized Slasher to execute it.\n\nThe current onchain penalty levels are large (5.00 K AZTEC), medium (5.00 K AZTEC), and small (2.00 K AZTEC). Offenses that node software can ballot for include:\n\n* **Inactivity:** a sequencer fails to attest or propose when selected.\n* **Data withholding:** a sequencer publishes state-diff blobs but withholds public transaction bodies or CHONK proofs needed for permissionless proving.\n* **Invalidity or equivocation:** a sequencer attests to an invalid proposal, signs conflicting proposals or attestations, or uses an invalid signature.\n\nThis list and the mapping of offenses to penalty levels are not exhaustive or defined by the L1 contracts; they depend on the software each sequencer runs.\n\nThe SlashVeto Council is a 5/9 Multisig. It can permanently veto a specific payload, repeatedly renew a global 3d pause, or re-enable slashing before a pause expires. Governance can submit Slasher payloads without ballot approval, but it cannot bypass these veto and pause checks.",
"references": [
{
"title": "SlashingProposer.sol on Etherscan",
"url": "https://etherscan.io/address/eth:0x8A36b8F2Ca71D8d8Bd98e03Ebf8B4D0939Daf0bA#code"
},
{
"title": "Slasher.sol on Etherscan",
"url": "https://etherscan.io/address/eth:0xCD6855470A01aBcd989126A1183Fb50673952548#code"
},
{
"title": "SlashVeto Council - Github",
"url": "https://github.com/aztec-slash-veto/council"
},
{
"title": "slashveto.me - Monitor Slashing",
"url": "https://slashveto.me"
}
],
"risks": []
}
]
},
"upgradesAndGovernance": {
"content": "# Standard path (sequencer signaling)\n\nSequencers stake AZTEC to secure the L2 and also participate in protocol governance. Every proposal is a smart contract payload on Ethereum. The public proposal flow takes at least 12d before execution, after which Governance can change the bounded parameters described below or deploy and register a new canonical rollup version.\n\n## 1. Signaling (`GovernanceProposer`)\n\nAztec uses an onchain \"Empire\" signaling system. The designated proposer for each slot on the canonical rollup can separately signal support for one payload on L1. A round consists of 1,000 slots. A payload that receives at least 600 signals wins the round and can be submitted to `Governance`.\n\n## 2. Token voting (`Governance`)\n\nOnce submitted, a proposal passes through these states:\n\n* **Pending (3d):** voting power is snapshotted at the end of this delay.\n* **Active (7d):** AZTEC holders vote. The snapshot must contain at least 100 M AZTEC of total voting power, at least 20% of that power must vote, and `yea` must be strictly greater than 66.5% of votes cast (the configured `yea`-minus-`nay` margin is 33%).\n* **Queued (2d):** a successful proposal waits before it can be executed. This final phase alone is shorter than the validator withdrawal delay, but the complete public process provides at least 12d of notice. Initiating an exit immediately removes a validator from the active set, while its stake becomes withdrawable after 4d.\n* **Executable (7d):** anyone can execute the proposal during this grace period; otherwise it expires.\n\n## Emergency proposal path\n\nIf sequencer signaling is unavailable, anyone can call `proposeWithLock()` directly on `Governance`. The proposer must lock **258 M AZTEC**, roughly 2.5% of the total supply, for 3mo. The payload then follows the same pending, voting, queued, and executable phases as a signaled proposal.\n\n## Immutable deployments and bounded ownership\n\nThe `Rollup`, verifier, `Inbox`, `Outbox`, and installed `EscapeHatch` code cannot be upgraded in place. Feature upgrades deploy a new stack and use Governance to register its Rollup in the `Registry` and GSE. Validators staked to the bonus instance (`0x9064Fb41156D300196d5Eb95E0B3c1f08eBc39a8`) follow the newest GSE Rollup automatically; validators explicitly bound to an older Rollup remain associated with it.\n\nGovernance owns the Rollup, but its setter surface is intentionally constrained: it can change the sequencer/prover reward split and checkpoint reward, only increase the mana target, change proving cost delayed and within bounds, and update validator-entry rate within non-zero values. It can queue a replacement Slasher with a 2mo delay. The outgoing Slasher then remains active for 1mo. The EscapeHatch, the reward distributor and reward-booster addresses are fixed for the deployment.\n\nGovernance also owns the GSE and can register a new latest Rollup or set the proof-of-possession gas limit too low for new validator deposits. These powers can move incentives and bonus-instance validators away from the current version, but they do not mutate this deployment's verifier, messaging contracts, or installed EscapeHatch.\n\n## Slashing and the SlashVeto Council\n\nAztec's onchain slashing path uses `SlashingProposer` ballots and the `Slasher`. Governance can bypass the proposer and submit a payload directly to the Slasher, and can rotate the authorized Slasher through the delayed Rollup process described above. Both the ballot and direct-governance paths remain subject to payload vetoes and global pauses by the SlashVeto Council.\n\nThe **Vetoer** role is held by the SlashVeto Council. It cannot upgrade the protocol or relay arbitrary calls. It can:\n\n* veto a specific payload permanently; and\n* disable all slashing for 3d. Calling the function again renews the pause, while the Council can also re-enable slashing early.\n\n## Economics and treasury\n\n* **CoinIssuer:** the owner can mint AZTEC within an annual cap of 20% of the current total supply.\n* **ProtocolTreasury:** the DAO's treasury is gated until approximately Nov 2026 and is additionally subject to an ATP-derived activation timestamp and proposal-ordering checks. Once every gate is satisfied, a Governance proposal can relay arbitrary calls and value through the treasury."
"content": "# Standard path (sequencer signaling)\n\nSequencers stake AZTEC to secure the L2 and also participate in protocol governance. Every proposal is a smart contract payload on Ethereum. The public proposal flow takes at least 12d before execution, after which Governance can change the bounded parameters described below or deploy and register a new canonical rollup version.\n\n## 1. Signaling (`GovernanceProposer`)\n\nAztec uses an onchain \"Empire\" signaling system. The designated proposer for each slot on the canonical rollup can separately signal support for one payload on L1. A round consists of 1,000 slots. A payload that receives at least 600 signals wins the round and can be submitted to `Governance`.\n\n## 2. Token voting (`Governance`)\n\nOnce submitted, a proposal passes through these states:\n\n* **Pending (3d):** voting power is snapshotted at the end of this delay.\n* **Active (7d):** AZTEC holders vote. The snapshot must contain at least 100.00 M AZTEC of total voting power, at least 20% of that power must vote, and `yea` must be strictly greater than 66.5% of votes cast (the configured `yea`-minus-`nay` margin is 33%).\n* **Queued (2d):** a successful proposal waits before it can be executed. This final phase alone is shorter than the validator withdrawal delay, but the complete public process provides at least 12d of notice. Initiating an exit immediately removes a validator from the active set, while its stake becomes withdrawable after 4d.\n* **Executable (7d):** anyone can execute the proposal during this grace period; otherwise it expires.\n\n## Emergency proposal path\n\nIf sequencer signaling is unavailable, anyone can call `proposeWithLock()` directly on `Governance`. The proposer must lock **258.75 M AZTEC**, roughly 2.5% of the total supply, for 3mo. The payload then follows the same pending, voting, queued, and executable phases as a signaled proposal.\n\n## Immutable deployments and bounded ownership\n\nThe `Rollup`, verifier, `Inbox`, `Outbox`, and installed `EscapeHatch` code cannot be upgraded in place. Feature upgrades deploy a new stack and use Governance to register its Rollup in the `Registry` and GSE. Validators staked to the bonus instance (`0x9064Fb41156D300196d5Eb95E0B3c1f08eBc39a8`) follow the newest GSE Rollup automatically; validators explicitly bound to an older Rollup remain associated with it.\n\nGovernance owns the Rollup, but its setter surface is intentionally constrained: it can change the sequencer/prover reward split and checkpoint reward, only increase the mana target, change proving cost delayed and within bounds, and update validator-entry rate within non-zero values. It can queue a replacement Slasher with a 2mo delay. The outgoing Slasher then remains active for 1mo. The EscapeHatch, the reward distributor and reward-booster addresses are fixed for the deployment.\n\nGovernance also owns the GSE and can register a new latest Rollup or set the proof-of-possession gas limit too low for new validator deposits. These powers can move incentives and bonus-instance validators away from the current version, but they do not mutate this deployment's verifier, messaging contracts, or installed EscapeHatch.\n\n## Slashing and the SlashVeto Council\n\nAztec's onchain slashing path uses `SlashingProposer` ballots and the `Slasher`. Governance can bypass the proposer and submit a payload directly to the Slasher, and can rotate the authorized Slasher through the delayed Rollup process described above. Both the ballot and direct-governance paths remain subject to payload vetoes and global pauses by the SlashVeto Council.\n\nThe **Vetoer** role is held by the SlashVeto Council. It cannot upgrade the protocol or relay arbitrary calls. It can:\n\n* veto a specific payload permanently; and\n* disable all slashing for 3d. Calling the function again renews the pause, while the Council can also re-enable slashing early.\n\n## Economics and treasury\n\n* **CoinIssuer:** the owner can mint AZTEC within an annual cap of 20% of the current total supply.\n* **ProtocolTreasury:** the DAO's treasury is gated until approximately Nov 2026 and is additionally subject to an ATP-derived activation timestamp and proposal-ordering checks. Once every gate is satisfied, a Governance proposal can relay arbitrary calls and value through the treasury."
}
}+1 -1
+1 -1
{
"architectureImage": "opstack-rollup-superchain-opfp",
"dataAvailability": [
{
"name": "All data required for proofs is published on chain",
"description": "All the data that is used to construct the system state is published on chain in the form of cheap blobs or calldata. This ensures that it will be available for enough time.",
"risks": [],
"references": [
{
"title": "Derivation: Batch submission - OP Mainnet specs",
"url": "https://github.com/ethereum-optimism/specs/blob/main/specs/protocol/derivation.md#batch-submission"
},
{
"title": "BatchInbox - address",
"url": "https://etherscan.io/address/0xfFF0000000000000000000000000000000000288#code"
},
{
"title": "OptimismPortal2.sol - source code, depositTransaction function",
"url": "https://etherscan.io/address/0x97cEbbf8959e2A5476fbe9B98A21806Ec234609B#code"
}
]
}
],
"exitMechanisms": [
{
"name": "Regular exits",
"description": "The user initiates the withdrawal by submitting a regular transaction on this chain. When a state root containing such transaction is settled, the funds become available for withdrawal on L1 after 3d 12h. Withdrawal inclusion can be proven before state root settlement, but a 7d period has to pass before it becomes actionable. The process of state root settlement takes a challenge period of at least 3d 12h to complete. Finally the user submits an L1 transaction to claim the funds. This transaction requires a merkle proof.",
"risks": [],
"references": [
{
"title": "OptimismPortal2.sol - Etherscan source code, proveWithdrawalTransaction function",
"url": "https://etherscan.io/address/0x97cEbbf8959e2A5476fbe9B98A21806Ec234609B#code"
},
{
"title": "OptimismPortal2.sol - Etherscan source code, finalizeWithdrawalTransaction function",
"url": "https://etherscan.io/address/0x97cEbbf8959e2A5476fbe9B98A21806Ec234609B#code"
}
]
},
{
"name": "Forced messaging",
"description": "If the user experiences censorship from the operator with regular L2->L1 messaging they can submit their messages directly on L1. The system is then obliged to service this request or halt all messages, including forced withdrawals from L1 and regular messages initiated on L2. Once the force operation is submitted and if the request is serviced, the operation follows the flow of a regular message.",
"risks": [],
"references": [
{
"title": "Forced withdrawal from an OP Stack blockchain",
"url": "https://docs.optimism.io/stack/transactions/forced-transaction"
}
]
}
],
"forceTransactions": {
"name": "Users can force any transaction",
"description": "Because the state of the system is based on transactions submitted on the underlying host chain and anyone can submit their transactions there it allows the users to circumvent censorship by interacting with the smart contract on the host chain directly.",
"risks": [],
"references": [
{
"title": "Sequencing Window - OP Mainnet Specs",
"url": "https://github.com/ethereum-optimism/optimism/blob/51eeb76efeb32b3df3e978f311188aa29f5e3e94/specs/glossary.md#sequencing-window"
},
{
"title": "OptimismPortal2.sol - source code, depositTransaction function",
"url": "https://etherscan.io/address/0x97cEbbf8959e2A5476fbe9B98A21806Ec234609B#code"
}
]
},
"operator": {
"name": "The system has a centralized operator",
"description": "The operator is the only entity that can propose blocks. A live and trustworthy operator is vital to the health of the system.",
"risks": [
{
"category": "MEV can be extracted if",
"text": "the operator exploits their centralized position and frontruns user transactions."
}
],
"references": []
},
"otherConsiderations": [
{
"name": "EVM compatible smart contracts are supported",
"description": "OP stack chains are pursuing the EVM Equivalence model. No changes to smart contracts are required regardless of the language they are written in, i.e. anything deployed on L1 can be deployed on L2.",
"risks": [],
"references": [
{
"title": "Introducing EVM Equivalence",
"url": "https://medium.com/ethereum-optimism/introducing-evm-equivalence-5c2021deb306"
}
]
}
],
"stateValidation": {
"description": "Updates to the system state can be proposed and challenged by permissioned operators only. If a state root passes the challenge period, it is optimistically considered correct and made actionable for withdrawals.",
"categories": [
{
"title": "State root proposals",
"description": "Proposers submit state roots as children of the latest confirmed state root (called anchor state), by calling the `create` function in the DisputeGameFactory. A state root can have multiple conflicting children. Each proposal requires a stake, currently set to 0.0 ETH, that can be slashed if the proposal is proven incorrect via a fraud proof. Stakes can be withdrawn only after the proposal has been confirmed. A state root gets confirmed if the challenge period has passed and it is not countered.",
"references": [
{
"title": "OP stack specification: Fault Dispute Game",
"url": "https://specs.optimism.io/fault-proof/stage-one/fault-dispute-game.html#fault-dispute-game"
}
],
"risks": [
{
"category": "Funds can be stolen if",
"text": "no whitelisted challenger disputes an invalid state root before the challenge window expires.",
"isCritical": true
}
]
},
{
"title": "Challenges",
"description": "Challenges are opened to disprove invalid state roots using bisection games. Each bisection move requires a stake that increases expontentially with the depth of the bisection, with a factor of 1.09493. The maximum depth is 73, and reaching it therefore requires a cumulative stake of 0.00 ETH from depth 0. Actors can participate in any challenge by calling the `defend` or `attack` functions, depending whether they agree or disagree with the latest claim and want to move the bisection game forward. Actors that disagree with the top-level claim are called challengers, and actors that agree are called defenders. Each actor might be involved in multiple (sub-)challenges at the same time, meaning that the protocol operates with [full concurrency](https://medium.com/l2beat/fraud-proof-wars-b0cb4d0f452a). Challengers and defenders alternate in the bisection game, and they pass each other a clock that starts with 3d 12h. If a clock expires, the claim is considered defeated if it was countered, or it gets confirmed if uncountered. Since honest parties can inherit clocks from malicious parties that play both as challengers and defenders (see [freeloader claims](https://specs.optimism.io/fault-proof/stage-one/fault-dispute-game.html#freeloader-claims)), if a clock gets inherited with less than 3h, it generally gets extended by 3h with the exception of 6h right before depth 30, and 0s right before the last depth. The maximum clock extension that a top level claim can get is therefore 0s. Since unconfirmed state roots are independent of one another, users can decide to exit with a subsequent confirmed state root if the previous one is delayed. Winners get the entire losers' stake, meaning that sybils can potentially play against each other at no cost. The final instruction found via the bisection game is then executed onchain in the MIPS one step prover contract who determines the winner. The protocol does not enforce valid bisections, meaning that actors can propose correct initial claims and then provide incorrect midpoints. The protocol can be subject to resource exhaustion attacks ([Spearbit 5.1.3](https://github.com/ethereum-optimism/optimism/blob/develop/docs/security-reviews/2024_08_Fault-Proofs-No-MIPS_Spearbit.pdf)).",
"description": "Challenges are opened to disprove invalid state roots using bisection games. Each bisection move requires a stake that increases expontentially with the depth of the bisection, with a factor of 1.09493. The maximum depth is 73, and reaching it therefore requires a cumulative stake of 0.00 ETH from depth 0. Actors can participate in any challenge by calling the `defend` or `attack` functions, depending whether they agree or disagree with the latest claim and want to move the bisection game forward. Actors that disagree with the top-level claim are called challengers, and actors that agree are called defenders. Each actor might be involved in multiple (sub-)challenges at the same time, meaning that the protocol operates with [full concurrency](https://medium.com/l2beat/fraud-proof-wars-b0cb4d0f452a). Challengers and defenders alternate in the bisection game, and they pass each other a clock that starts with 3d 12h. If a clock expires, the claim is considered defeated if it was countered, or it gets confirmed if uncountered. Since honest parties can inherit clocks from malicious parties that play both as challengers and defenders (see [freeloader claims](https://specs.optimism.io/fault-proof/stage-one/fault-dispute-game.html#freeloader-claims)), if a clock gets inherited with less than 3h, it generally gets extended by 3h with the exception of 6h right before depth 30, and 1d right before the last depth. The maximum clock extension that a top level claim can get is therefore 10d. Since unconfirmed state roots are independent of one another, users can decide to exit with a subsequent confirmed state root if the previous one is delayed. Winners get the entire losers' stake, meaning that sybils can potentially play against each other at no cost. The final instruction found via the bisection game is then executed onchain in the MIPS one step prover contract who determines the winner. The protocol does not enforce valid bisections, meaning that actors can propose correct initial claims and then provide incorrect midpoints. The protocol can be subject to resource exhaustion attacks ([Spearbit 5.1.3](https://github.com/ethereum-optimism/optimism/blob/develop/docs/security-reviews/2024_08_Fault-Proofs-No-MIPS_Spearbit.pdf)).",
"references": [
{
"title": "Fraud Proof Wars: OPFP",
"url": "https://medium.com/l2beat/fraud-proof-wars-b0cb4d0f452a"
}
]
}
]
}
}+2 -2
+1 -1
[
{
"address": "0xE3cbE3A636AB6A754e9e41B12b09d09Ce9E53Db3",
"sinceTimestamp": 1692341159,
"tokens": [
"USDC"
],
"contract": {
"isVerified": true,
"address": "eth:0xE3cbE3A636AB6A754e9e41B12b09d09Ce9E53Db3",
"upgradeability": {
"proxyType": "StarkWare proxy",
"admins": [
"eth:0xFF57A3bB6465501c993acF8f3b29125a862661C0"
],
"implementations": [
"eth:0xDcbD52FFaF81BF0aA5bD38B0c15F60345e8Eec86"
],
"immutable": false
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1692341231,
"transactionHash": "0x25fbb19a94fb450c7254e45b992272c2d6dd6b24692e34e87052621e4df3cfed",
"implementations": [
"eth:0x6Fd62239f3A441d1898683C5a84ce3681bB42C16"
]
},
{
"timestamp": 1716894071,
"transactionHash": "0x015d716fec0e72b13c6ec480a008653d2402eb0e216c3b1adcb87d13582c6a7a",
"implementations": [
"eth:0x8A4e51ff0F2a45899519e6049FB2D1F038Be1e77"
]
},
{
"timestamp": 1718445143,
"transactionHash": "0x7288e6bd014f04b9aa916599a60854eb8de2106cb95030762a2372751de95922",
"implementations": [
"eth:0x8A4e51ff0F2a45899519e6049FB2D1F038Be1e77"
]
},
{
"timestamp": 1747418723,
"transactionHash": "0x6df9f1b6e2fe53f2ea980ff4908aca6e43dc77e17cfdb869c67e4879c49eabf2",
"implementations": [
"eth:0x8A4e51ff0F2a45899519e6049FB2D1F038Be1e77"
]
},
{
"timestamp": 1771682039,
"transactionHash": "0xb0ea49fedd399a118b3f8a0c6a05b3e73a8235a184e1e5c61f57c601f94b59e7",
"implementations": [
"eth:0xDcbD52FFaF81BF0aA5bD38B0c15F60345e8Eec86"
]
}
],
"description": "Paradex USDC Escrow. The current bridge cap is 500 M USDC.",
"description": "Paradex USDC Escrow. The current bridge cap is 500.00 M USDC.",
"upgradableBy": [
{
"name": "USDC Escrow owner",
"delay": "0s"
}
],
"url": "https://etherscan.io/address/0xE3cbE3A636AB6A754e9e41B12b09d09Ce9E53Db3#code"
},
"chain": "ethereum",
"includeInTotal": true,
"chainId": 1
}
]+1 -1
{
"addresses": {
"ethereum": [
{
"name": "Paradex",
"isVerified": true,
"address": "eth:0xF338cad020D506e8e3d9B4854986E0EcE6C23640",
"upgradeability": {
"proxyType": "StarkWare proxy",
"admins": [
"eth:0x0a64d3D7747549aF6d65C225D56ac8f71e436B93",
"eth:0xFF57A3bB6465501c993acF8f3b29125a862661C0"
],
"implementations": [
"eth:0x9961D34D3baE6914635c882e8FE382e14E0F172A"
],
"immutable": false
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1689851135,
"transactionHash": "0x7862f09db4097dc43ad1972ca9ee11eaf64a1fbfdb21fe6f84ad6b68d4b9fa56",
"implementations": [
"eth:0xA964D693cd45FCBe4303524E0EFe0988cfF5ed08"
]
},
{
"timestamp": 1710346919,
"transactionHash": "0x7292984e71d89bd82d8555a1060cf741e9090f33874c6bc3b87db6d1352784d0",
"implementations": [
"eth:0x6E0aCfDC3cf17A7f99ed34Be56C3DFb93F464e24"
]
},
{
"timestamp": 1725811535,
"transactionHash": "0xe78b11cbf1332af60b8da9b2eaf51ec52cdc5bdc7cc0a89af3c2fbb0936c14d8",
"implementations": [
"eth:0x47103A9b801eB6a63555897d399e4b7c1c8Eb5bC"
]
},
{
"timestamp": 1744056299,
"transactionHash": "0x63d55b2c0cfa3b1866e99b66c6632e5474e177ce0e3b5d5b68ed8b801d76cc53",
"implementations": [
"eth:0x2793010E6711Acd5C46ed17f2183a9d58db71e04"
]
},
{
"timestamp": 1778419811,
"transactionHash": "0x1e964f795063d0e9b55f3f260bcbd3f11b3f3b43df658b9da2b78ce919bd4009",
"implementations": [
"eth:0x9961D34D3baE6914635c882e8FE382e14E0F172A"
]
}
],
"description": "Central Starknet rollup contract. For every state update it derives a SHARP fact from the state-transition output and either the Starknet OS or aggregator program hash, checks that fact through the configured SHARP call proxy, and requires the output's OS-config hash to match. It also processes L1 <-> L2 messages and stores the finalized L2 state.\n* Roles:\n * **admin**: Paradex Multisig, Paradex Multisig 2\n * **operators**: EOA 1, EOA 2",
"upgradableBy": [
{
"name": "Paradex Multisig",
"delay": "no"
},
{
"name": "Paradex Multisig 2",
"delay": "no"
}
],
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xF338cad020D506e8e3d9B4854986E0EcE6C23640#code"
},
{
"name": "CpuVerifierAllSolidity_2026_13",
"isVerified": true,
"address": "eth:0x015381651F240Ed6C44122dCba6Cf807c9442CD6",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Immutable Solidity verifier for one Cairo CPU layout. It checks the STARK proof using layout-specific constraint, OODS, Merkle, FRI, and periodic-column helper contracts. The SHARP verifier can select any configured layout by `cairoVerifierId`.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x015381651F240Ed6C44122dCba6Cf807c9442CD6#code"
},
{
"name": "CpuVerifierDex_2026_13",
"isVerified": true,
"address": "eth:0x0cD0cDf0132c566db61B691BCEEBA2c4D8cA5CdC",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Immutable Solidity verifier for one Cairo CPU layout. It checks the STARK proof using layout-specific constraint, OODS, Merkle, FRI, and periodic-column helper contracts. The SHARP verifier can select any configured layout by `cairoVerifierId`.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x0cD0cDf0132c566db61B691BCEEBA2c4D8cA5CdC#code"
},
{
"name": "CairoBootloaderProgram",
"isVerified": true,
"address": "eth:0x24105e6697AdD9B4B1BDE04079a91BDFCCa24A47",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Stores the complete compiled Cairo outer bootloader used as the top-level program of a SHARP proof. The SHARP verifier copies these words into public memory, pinning this exact executable onchain independently of the separately committed simple, applicative, and recursive-verifier programs.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x24105e6697AdD9B4B1BDE04079a91BDFCCa24A47#code"
},
{
"name": "CpuVerifierRecursive_2026_13",
"isVerified": true,
"address": "eth:0x2867A4509B0969531641A42a3D4A9B0A07109B6B",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Immutable Solidity verifier for one Cairo CPU layout. It checks the STARK proof using layout-specific constraint, OODS, Merkle, FRI, and periodic-column helper contracts. The SHARP verifier can select any configured layout by `cairoVerifierId`.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x2867A4509B0969531641A42a3D4A9B0A07109B6B#code"
},
{
"name": "CpuVerifierSmall_2026_13",
"isVerified": true,
"address": "eth:0x30F3AB988Cb00fe3Fb5ab891F50c13684770419b",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Immutable Solidity verifier for one Cairo CPU layout. It checks the STARK proof using layout-specific constraint, OODS, Merkle, FRI, and periodic-column helper contracts. The SHARP verifier can select any configured layout by `cairoVerifierId`.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x30F3AB988Cb00fe3Fb5ab891F50c13684770419b#code"
},
{
"name": "MemoryPageFactRegistry_2023_9",
"isVerified": true,
"address": "eth:0x40864568f679c10aC9e72211500096a5130770fA",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Permissionless commitment calculator and registry used by the Solidity STARK verifiers. Anyone may submit a public-memory page and interaction elements; the contract computes its hash and cumulative product and registers the fact key committing to them, which the CPU verifier must bind to the proof. It is part of the proof verifier, not an application-level program registry. A malicious or nonconforming implementation can break public-memory soundness; binding to a different honest registry generally causes a liveness failure instead.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x40864568f679c10aC9e72211500096a5130770fA#code"
},
{
"name": "SHARPVerifierCallProxy",
"isVerified": true,
"address": "eth:0x47312450B3Ac8b5b8e247a6bB6d523e7605bDb60",
"upgradeability": {
"proxyType": "StarkWare proxy",
"admins": [
"eth:0x21F9eC47b19d95b5C2DDFB6Ae5D4F92fAdacAEc4"
],
"implementations": [
"eth:0x3597c5CBCbCB30079a0bD2A68cDE5f98272f9feb"
],
"immutable": false
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1635080785,
"transactionHash": "0x80ebb7a22a207d00e26464db2f8a719d43eb3b836740a693aad13d5ef922f5e4",
"implementations": [
"eth:0xD4C4044ACa68ebBcB81B13cC2699e1Bca2d3F458"
]
},
{
"timestamp": 1651510161,
"transactionHash": "0x604e235c6207b7909f6fc8dc0bd86b410e935dcf2f6f6bd37a5567a89379353a",
"implementations": [
"eth:0xD4C4044ACa68ebBcB81B13cC2699e1Bca2d3F458"
]
},
{
"timestamp": 1659869409,
"transactionHash": "0xc31b74237a0c68aa1b95fe2ed28ad54cf6d7df42a8beab1ea947532c95dda20a",
"implementations": [
"eth:0xD4C4044ACa68ebBcB81B13cC2699e1Bca2d3F458"
]
},
{
"timestamp": 1678106063,
"transactionHash": "0xbaa8ffb1b7e5177dbf75de753b9b2ff2fc313b244ff910cfd6d7f1f6254b6e1a",
"implementations": [
"eth:0xD4C4044ACa68ebBcB81B13cC2699e1Bca2d3F458"
]
},
{
"timestamp": 1708939523,
"transactionHash": "0x31e3caf3940dde662a1e98580259f79963dc5e098793b6519311e201d4e19312",
"implementations": [
"eth:0xD4C4044ACa68ebBcB81B13cC2699e1Bca2d3F458"
]
},
{
"timestamp": 1708939523,
"transactionHash": "0x31e3caf3940dde662a1e98580259f79963dc5e098793b6519311e201d4e19312",
"implementations": [
"eth:0xD4C4044ACa68ebBcB81B13cC2699e1Bca2d3F458"
]
},
{
"timestamp": 1722161267,
"transactionHash": "0x7c71592ea4c455371365d843f1a21bbf647aad7d6fae12f7187650ce24805f00",
"implementations": [
"eth:0xD4C4044ACa68ebBcB81B13cC2699e1Bca2d3F458"
]
},
{
"timestamp": 1722197315,
"transactionHash": "0x4b25445a8e86b4620b9a19f747122b518d8973975ea73aa474b210395e277b66",
"implementations": [
"eth:0xD4C4044ACa68ebBcB81B13cC2699e1Bca2d3F458"
]
},
{
"timestamp": 1747066175,
"transactionHash": "0x0764cd09cc5c9a96b151dd222bf14b9c33111c80bdddf27721a6406f4c0e1f3f",
"implementations": [
"eth:0xD4C4044ACa68ebBcB81B13cC2699e1Bca2d3F458"
]
},
{
"timestamp": 1760862467,
"transactionHash": "0x7b4a25af246b28b6d5bed86942696273a84e57abc629b83072be370df2bdb797",
"implementations": [
"eth:0x3597c5CBCbCB30079a0bD2A68cDE5f98272f9feb"
]
},
{
"timestamp": 1765192091,
"transactionHash": "0xed93cf713d33ac63297d8c7e2eafc0d9f277b718b4074600536eb9a4205bcb81",
"implementations": [
"eth:0x3597c5CBCbCB30079a0bD2A68cDE5f98272f9feb"
]
},
{
"timestamp": 1769954759,
"transactionHash": "0x257cfdefacd18f0c221b1e486ee002cb974d14bb292884dfaf7f5aa987cc7170",
"implementations": [
"eth:0x3597c5CBCbCB30079a0bD2A68cDE5f98272f9feb"
]
},
{
"timestamp": 1777465247,
"transactionHash": "0xf088946bc461774cf86ce348fcee4d52bb27ebf049d99f3fab806226053b0d5b",
"implementations": [
"eth:0x3597c5CBCbCB30079a0bD2A68cDE5f98272f9feb"
]
},
{
"timestamp": 1782033359,
"transactionHash": "0x57f323ff6c828c8fe0c65c9c89d5b242264455cd5f3a5bacd25a78efa17b0ed4",
"implementations": [
"eth:0x3597c5CBCbCB30079a0bD2A68cDE5f98272f9feb"
]
},
{
"timestamp": 1783857227,
"transactionHash": "0x7f1e6f9a7268ea6ce5b3b2ce055c3ce420ee776c63c41f57823a0e9cb782e254",
"implementations": [
"eth:0x3597c5CBCbCB30079a0bD2A68cDE5f98272f9feb"
]
}
],
"description": "Upgradeable call router through which Starknet and other applications access SHARP fact registries. It uses `call`, not `delegatecall`, so facts and immutable verifier configuration remain at each target registry. The explicit `isValid` entry point always queries the default target. Other calls handled by the fallback, principally proof submissions, can be routed per caller to a still-active registry in the default target's reference chain. The default target can be replaced by SHARP Multisig after 8d.\n* Roles:\n * **admin**: SHARP Multisig\n * **appGovernor**: SHARP Multisig\n * **appRoleAdmin**: SHARP Multisig\n * **governanceAdmin**: SHARP Multisig",
"upgradableBy": [
{
"name": "SHARP Multisig",
"delay": "8d"
}
],
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x47312450B3Ac8b5b8e247a6bB6d523e7605bDb60#code"
},
{
"name": "SHARPVerifier",
"isVerified": true,
"address": "eth:0x4956bda1d23F75B988644329c5B06BD1494a72b6",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Immutable GPS statement verifier shared by Starknet and other StarkWare systems. It verifies a STARK proof of the exact Cairo bootloader stored onchain, forces the bootloader configuration into public memory, and registers a fact for every bootloader task. A fact is also considered valid when it exists in the time-limited reference fact registry.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x4956bda1d23F75B988644329c5B06BD1494a72b6#code"
},
{
"name": "SHARPVerifier_2026_13_1",
"isVerified": true,
"address": "eth:0x5C1Ce45534A9c5f7F3E6683Cd79a8ad57EE3a9fe",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Immutable GPS statement verifier shared by Starknet and other StarkWare systems. It verifies a STARK proof of the exact Cairo bootloader stored onchain, forces the bootloader configuration into public memory, and registers a fact for every bootloader task. A fact is also considered valid when it exists in the time-limited reference fact registry.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x5C1Ce45534A9c5f7F3E6683Cd79a8ad57EE3a9fe#code"
},
{
"name": "CpuVerifierDexWithBitwise_2026_13",
"isVerified": true,
"address": "eth:0x6a67796ee97700B5B5f5aFBCFFDCbc5F80803F11",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Immutable Solidity verifier for one Cairo CPU layout. It checks the STARK proof using layout-specific constraint, OODS, Merkle, FRI, and periodic-column helper contracts. The SHARP verifier can select any configured layout by `cairoVerifierId`.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x6a67796ee97700B5B5f5aFBCFFDCbc5F80803F11#code"
},
{
"name": "CpuVerifierStarknet_2026_13",
"isVerified": true,
"address": "eth:0x71574057D12541ccDa98643aC56441838353A26D",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Immutable Solidity verifier for one Cairo CPU layout. It checks the STARK proof using layout-specific constraint, OODS, Merkle, FRI, and periodic-column helper contracts. The SHARP verifier can select any configured layout by `cairoVerifierId`.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x71574057D12541ccDa98643aC56441838353A26D#code"
},
{
"name": "SHARPVerifier_2026_13_2",
"isVerified": true,
"address": "eth:0x7Da1225C752ab37E610a242D9D8a0548262E3fF7",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Immutable GPS statement verifier shared by Starknet and other StarkWare systems. It verifies a STARK proof of the exact Cairo bootloader stored onchain, forces the bootloader configuration into public memory, and registers a fact for every bootloader task. A fact is also considered valid when it exists in the time-limited reference fact registry.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x7Da1225C752ab37E610a242D9D8a0548262E3fF7#code"
},
{
"name": "CpuVerifierRecursiveLargeOutput_2026_13",
"isVerified": true,
"address": "eth:0xbe0F8F150Fd10798524B4de80eD75751658CAEF3",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Immutable Solidity verifier for one Cairo CPU layout. It checks the STARK proof using layout-specific constraint, OODS, Merkle, FRI, and periodic-column helper contracts. The SHARP verifier can select any configured layout by `cairoVerifierId`.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xbe0F8F150Fd10798524B4de80eD75751658CAEF3#code"
},
{
"name": "MemoryPageFactRegistry",
"isVerified": true,
"address": "eth:0xe583BcDE0160b637330b27a3ea1F3c02ba2eC460",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Permissionless commitment calculator and registry used by the Solidity STARK verifiers. Anyone may submit a public-memory page and interaction elements; the contract computes its hash and cumulative product and registers the fact key committing to them, which the CPU verifier must bind to the proof. It is part of the proof verifier, not an application-level program registry. A malicious or nonconforming implementation can break public-memory soundness; binding to a different honest registry generally causes a liveness failure instead.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xe583BcDE0160b637330b27a3ea1F3c02ba2eC460#code"
},
{
"name": "SHARPVerifier_2026_13_3",
"isVerified": true,
"address": "eth:0xE67515a751291445B85b2F176c1eCdf08e86b406",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Immutable GPS statement verifier shared by Starknet and other StarkWare systems. It verifies a STARK proof of the exact Cairo bootloader stored onchain, forces the bootloader configuration into public memory, and registers a fact for every bootloader task. A fact is also considered valid when it exists in the time-limited reference fact registry.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xE67515a751291445B85b2F176c1eCdf08e86b406#code"
},
{
"name": "CpuVerifierPerpetual_2026_13",
"isVerified": true,
"address": "eth:0xFFC7974cd74b95f631f454cd787AAc28F0476b44",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Immutable Solidity verifier for one Cairo CPU layout. It checks the STARK proof using layout-specific constraint, OODS, Merkle, FRI, and periodic-column helper contracts. The SHARP verifier can select any configured layout by `cairoVerifierId`.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xFFC7974cd74b95f631f454cd787AAc28F0476b44#code"
},
{
"name": "StarkgateRegistry",
"isVerified": true,
"address": "eth:0xc50E4DF59aad8Ab494d10d2B66a90C9F0298f280",
"upgradeability": {
"proxyType": "StarkWare proxy",
"admins": [
"eth:0xFF57A3bB6465501c993acF8f3b29125a862661C0"
],
"implementations": [
"eth:0x61D146CfE95Dc5Ba6d9c5d9C83c39C1bff018bD3"
],
"immutable": false
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1771091351,
"transactionHash": "0xcf488e7f151fe248bd1c51fd3e8d1ecb40286adccb5527079d40886583cae510",
"implementations": [
"eth:0x61D146CfE95Dc5Ba6d9c5d9C83c39C1bff018bD3"
]
}
],
"description": "A simple registry that maps tokens to their StarkGate escrows. It also keeps a list of tokens that are blocked from being added to StarkGate.\n* Roles:\n * **admin**: Paradex Multisig 2\n * **govAdmin**: EOA 3",
"upgradableBy": [
{
"name": "Paradex Multisig 2",
"delay": "no"
}
],
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xc50E4DF59aad8Ab494d10d2B66a90C9F0298f280#code"
},
{
"name": "USDC Bridge",
"isVerified": true,
"address": "eth:0xE3cbE3A636AB6A754e9e41B12b09d09Ce9E53Db3",
"upgradeability": {
"proxyType": "StarkWare proxy",
"admins": [
"eth:0xFF57A3bB6465501c993acF8f3b29125a862661C0"
],
"implementations": [
"eth:0xDcbD52FFaF81BF0aA5bD38B0c15F60345e8Eec86"
],
"immutable": false
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1692341231,
"transactionHash": "0x25fbb19a94fb450c7254e45b992272c2d6dd6b24692e34e87052621e4df3cfed",
"implementations": [
"eth:0x6Fd62239f3A441d1898683C5a84ce3681bB42C16"
]
},
{
"timestamp": 1716894071,
"transactionHash": "0x015d716fec0e72b13c6ec480a008653d2402eb0e216c3b1adcb87d13582c6a7a",
"implementations": [
"eth:0x8A4e51ff0F2a45899519e6049FB2D1F038Be1e77"
]
},
{
"timestamp": 1718445143,
"transactionHash": "0x7288e6bd014f04b9aa916599a60854eb8de2106cb95030762a2372751de95922",
"implementations": [
"eth:0x8A4e51ff0F2a45899519e6049FB2D1F038Be1e77"
]
},
{
"timestamp": 1747418723,
"transactionHash": "0x6df9f1b6e2fe53f2ea980ff4908aca6e43dc77e17cfdb869c67e4879c49eabf2",
"implementations": [
"eth:0x8A4e51ff0F2a45899519e6049FB2D1F038Be1e77"
]
},
{
"timestamp": 1771682039,
"transactionHash": "0xb0ea49fedd399a118b3f8a0c6a05b3e73a8235a184e1e5c61f57c601f94b59e7",
"implementations": [
"eth:0xDcbD52FFaF81BF0aA5bD38B0c15F60345e8Eec86"
]
}
],
"description": "Standard Starkware bridge escrow (single token). Withdrawals can be throttled to 0% of the locked funds per 24 hours.\n* Roles:\n * **admin**: Paradex Multisig 2\n * **govAdmin**: Paradex Multisig 2\n * **manager**: StarkgateManager\n * **secAdmin**: Paradex Multisig 2\n * **secAgent**: EOA 4, EOA 5, Paradex Multisig 2",
"upgradableBy": [
{
"name": "Paradex Multisig 2",
"delay": "no"
}
],
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xE3cbE3A636AB6A754e9e41B12b09d09Ce9E53Db3#code"
},
{
"name": "CpuFrilessVerifier",
"isVerified": true,
"address": "eth:0x03Fa911dfCa026D9C8Edb508851b390accF912e8",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x03Fa911dfCa026D9C8Edb508851b390accF912e8#code"
},
{
"name": "CpuFrilessVerifier",
"isVerified": true,
"address": "eth:0x217750c27bE9147f9e358D9FF26a8224F8aCC214",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x217750c27bE9147f9e358D9FF26a8224F8aCC214#code"
},
{
"name": "CairoBootloaderProgram_2022_7",
"isVerified": true,
"address": "eth:0x5d07afFAfc8721Ef3dEe4D11A2D1484CBf6A9dDf",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x5d07afFAfc8721Ef3dEe4D11A2D1484CBf6A9dDf#code"
},
{
"name": "CpuFrilessVerifier",
"isVerified": true,
"address": "eth:0x630A97901Ac29590DF83f4A64B8D490D54caf239",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x630A97901Ac29590DF83f4A64B8D490D54caf239#code"
},
{
"name": "CpuFrilessVerifier",
"isVerified": true,
"address": "eth:0x78Af2BFB12Db15d35f7dE8DD77f29C299C78c590",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x78Af2BFB12Db15d35f7dE8DD77f29C299C78c590#code"
},
{
"name": "CpuFrilessVerifier",
"isVerified": true,
"address": "eth:0x8488e8f4e26eBa40faE229AB653d98E341cbE57B",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x8488e8f4e26eBa40faE229AB653d98E341cbE57B#code"
},
{
"name": "CpuFrilessVerifier",
"isVerified": true,
"address": "eth:0x9E614a417f8309575fC11b175A51599661f2Bd21",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x9E614a417f8309575fC11b175A51599661f2Bd21#code"
},
{
"name": "CpuFrilessVerifier",
"isVerified": true,
"address": "eth:0xC879aF7D5eD80e4676C203FD300E640C297F31e3",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xC879aF7D5eD80e4676C203FD300E640C297F31e3#code"
},
{
"name": "CpuFrilessVerifier",
"isVerified": true,
"address": "eth:0xe9664D230490d5A515ef7Ef30033d8075a8D0E24",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xe9664D230490d5A515ef7Ef30033d8075a8D0E24#code"
},
{
"name": "MemoryPageFactRegistry_2022_7",
"isVerified": true,
"address": "eth:0xFD14567eaf9ba941cB8c8a94eEC14831ca7fD1b4",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xFD14567eaf9ba941cB8c8a94eEC14831ca7fD1b4#code"
}
]
},
"escrows": [
{
"address": "0xE3cbE3A636AB6A754e9e41B12b09d09Ce9E53Db3",
"sinceTimestamp": 1692341159,
"tokens": [
"USDC"
],
"contract": {
"isVerified": true,
"address": "eth:0xE3cbE3A636AB6A754e9e41B12b09d09Ce9E53Db3",
"upgradeability": {
"proxyType": "StarkWare proxy",
"admins": [
"eth:0xFF57A3bB6465501c993acF8f3b29125a862661C0"
],
"implementations": [
"eth:0xDcbD52FFaF81BF0aA5bD38B0c15F60345e8Eec86"
],
"immutable": false
},
"chain": "ethereum",
"pastUpgrades": [
{
"timestamp": 1692341231,
"transactionHash": "0x25fbb19a94fb450c7254e45b992272c2d6dd6b24692e34e87052621e4df3cfed",
"implementations": [
"eth:0x6Fd62239f3A441d1898683C5a84ce3681bB42C16"
]
},
{
"timestamp": 1716894071,
"transactionHash": "0x015d716fec0e72b13c6ec480a008653d2402eb0e216c3b1adcb87d13582c6a7a",
"implementations": [
"eth:0x8A4e51ff0F2a45899519e6049FB2D1F038Be1e77"
]
},
{
"timestamp": 1718445143,
"transactionHash": "0x7288e6bd014f04b9aa916599a60854eb8de2106cb95030762a2372751de95922",
"implementations": [
"eth:0x8A4e51ff0F2a45899519e6049FB2D1F038Be1e77"
]
},
{
"timestamp": 1747418723,
"transactionHash": "0x6df9f1b6e2fe53f2ea980ff4908aca6e43dc77e17cfdb869c67e4879c49eabf2",
"implementations": [
"eth:0x8A4e51ff0F2a45899519e6049FB2D1F038Be1e77"
]
},
{
"timestamp": 1771682039,
"transactionHash": "0xb0ea49fedd399a118b3f8a0c6a05b3e73a8235a184e1e5c61f57c601f94b59e7",
"implementations": [
"eth:0xDcbD52FFaF81BF0aA5bD38B0c15F60345e8Eec86"
]
}
],
"description": "Paradex USDC Escrow. The current bridge cap is 500 M USDC.",
"description": "Paradex USDC Escrow. The current bridge cap is 500.00 M USDC.",
"upgradableBy": [
{
"name": "USDC Escrow owner",
"delay": "0s"
}
],
"url": "https://etherscan.io/address/0xE3cbE3A636AB6A754e9e41B12b09d09Ce9E53Db3#code"
},
"chain": "ethereum",
"includeInTotal": true,
"chainId": 1
}
],
"programHashes": [
{
"title": "Starknet OS",
"proverSystemProject": "stwo",
"description": "Proves correct state transition for a range of consecutive Starknet transactions.",
"programUrl": "https://github.com/starkware-libs/sequencer/blob/c294a8ba263834d45cf525217d8700f5de24a260/crates/apollo_starknet_os_program/src/cairo/starkware/starknet/core/os/os.cairo#L69",
"verificationStatus": "successful",
"verificationSteps": "1. Install python and pip.\n2. Install rust: `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh`.\n3. Checkout the correct version of [https://github.com/starkware-libs/sequencer/tree/main](https://github.com/starkware-libs/sequencer/tree/main): `git checkout c294a8ba263834d45cf525217d8700f5de24a260`.\n4. Install required python dependencies: `python3 -m venv sequencer_venv`, then `. sequencer_venv/bin/activate && pip install -r scripts/requirements.txt`.\n5. Run `UPDATE_EXPECT=1 cargo test -p apollo_starknet_os_program test_program_hashes` to regenerate program hashes in `crates/apollo_starknet_os_program/src/program_hash.json`. The `\"os\"` value of this file will be equivalent to dec value of the hash.",
"hash": "2733003247060056328192560178934419513655729851806095615814023997114795707702"
},
{
"title": "Aggregation program for SHARP prover",
"description": "Aggregates proofs of correct execution for several consecutive transaction ranges generated by Starknet OS.",
"proverSystemProject": "stwo",
"programUrl": "https://github.com/starkware-libs/sequencer/blob/c294a8ba263834d45cf525217d8700f5de24a260/crates/apollo_starknet_os_program/src/cairo/starkware/starknet/core/aggregator/main.cairo#L15",
"verificationStatus": "successful",
"verificationSteps": "1. Install python and pip.\n2. Install rust: `curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh`.\n3. Checkout the correct version of [https://github.com/starkware-libs/sequencer/tree/main](https://github.com/starkware-libs/sequencer/tree/main): `git checkout c294a8ba263834d45cf525217d8700f5de24a260`.\n4. Install required python dependencies: `python3 -m venv sequencer_venv`, then `. sequencer_venv/bin/activate && pip install -r scripts/requirements.txt`.\n5. Run `UPDATE_EXPECT=1 cargo test -p apollo_starknet_os_program test_program_hashes` to regenerate program hashes in `crates/apollo_starknet_os_program/src/program_hash.json`. The `\"aggregator_with_prefix\"` value of this file will be equivalent to dec value of the hash.",
"hash": "2571508110958925737463010241874806654058743535666147712534445437599630018294"
},
{
"title": "Outer bootloader Cairo program StarkWare_GpsStatementVerifier_2026_13",
"description": "Top-level Cairo program executed by SHARP.",
"proverSystemProject": "stwo",
"programUrl": "https://github.com/starkware-libs/cairo-lang/tree/56407b69f3f19f69302a8623baa8c5f71f967eed/src/starkware/cairo/bootloaders/bootloader",
"verificationStatus": "successful",
"verificationSteps": "These steps reproduce the current 1,166-felt SHARP outer bootloader on Linux. \n\nDependencies: Git, Bazelisk configured to use Bazel 7.4.1, JDK 21, GMP development headers, Python 3, and Foundry `cast`.\n\n1. Check out the exact public source revision:\n\n```bash\ngit clone https://github.com/starkware-libs/cairo-lang.git\ncd cairo-lang\ngit checkout 56407b69f3f19f69302a8623baa8c5f71f967eed\n```\n\nThe Cairo compiler version at this revision is `0.15.0a0`. The entrypoint is `src/starkware/cairo/bootloaders/bootloader/bootloader.cairo`.\n\n2. Build the official proof-mode target:\n\n```bash\nUSE_BAZEL_VERSION=7.4.1 bazelisk build \\\n //src/starkware/cairo/bootloaders/bootloader:bootloader_program\n```\n\nThe destination for the compiled program will be printed by the build script, the instruction array will be in the `\"data\"` json field in hex format. The target uses `--proof_mode --debug_info_with_source`.\n\n3. Check that the compiled instruction array is identical to the one pinned by the immutable Ethereum contract at `0x24105e6697AdD9B4B1BDE04079a91BDFCCa24A47`, which could be fetched by calling:\n\n```bash\ncast call 0x24105e6697AdD9B4B1BDE04079a91BDFCCa24A47 \\\n 'getCompiledProgram()(uint256[1166])' \\\n --rpc-url \"$ETHEREUM_RPC_URL\" \\\n --json > /tmp/sharp_outer_bootloader_onchain.json\n```",
"hash": "3427958597398434235135013788958741576989752718219267963615783564775551242024"
},
{
"title": "Supported simple bootloader programs commitment StarkWare_GpsStatementVerifier_2026_13",
"description": "Pedersen commitment to the ordered list of accepted simple-bootloader executable hashes.",
"proverSystemProject": "stwo",
"programUrl": "https://github.com/starkware-libs/cairo-lang/tree/1c5dace6fbd1dc9d1ae2eb878dc1dd85f23512ab/src/starkware/cairo/bootloaders/simple_bootloader",
"verificationStatus": "successful",
"verificationSteps": "The steps below are supposed to be run on linux OS. They could also be run on macOS, but several tweaks need to be made: update from `lru-dict==1.1.8` to `lru-dict==1.3.0` in `scripts/requirements.txt` and update `python_interpreter` in `bazel_utils/python/stub.sh` to the correct location.\n\n1. Install [bazel](https://bazel.build) version 7.4.1 and `gmp` library using [brew](https://brew.sh):\n```\nbrew install bazelisk\nUSE_BAZEL_VERSION=7.4.1 bazelisk version\nbrew install gmp # or sudo apt-get install libgmp-dev\n```\n\n2. On linux, install JDK if you don't have it: `sudo apt install openjdk-21-jre`.\n\n3. Check out the correct commit of repo:\n```\ngit clone https://github.com/starkware-libs/cairo-lang.git\ncd cairo-lang\ngit checkout 1c5dace6fbd1dc9d1ae2eb878dc1dd85f23512ab\n```\n\n4. Update `cairo-lang/src/starkware/cairo/bootloaders/BUILD` file by appending [this snippet](/files/starkware_proghash_artifacts/56407b69f3f19f69302a8623baa8c5f71f967eed/BUILD_ADDITION) at the end.\n5. Copy [this hash_bootloaders.py script](/files/starkware_proghash_artifacts/1c5dace6fbd1dc9d1ae2eb878dc1dd85f23512ab/hash_bootloaders.py) that computes bootloader hashes into `cairo-lang/src/starkware/cairo/bootloaders/`.\n6. Execute the script above by `USE_BAZEL_VERSION=7.4.1 bazel run //src/starkware/cairo/bootloaders:cairo_hash_bootloaders_exe`. The output of the script should contain the correct hash.",
"hash": "3442855748187296636739564186904728563385971901122957091055928358173521721079"
},
{
"title": "Applicative bootloader Cairo program StarkWare_GpsStatementVerifier_2026_13",
"description": "Runs an aggregator program, checks that its input matches the recursively unpacked task outputs, and relabels the resulting fact with the domain-separated aggregator program hash.",
"proverSystemProject": "stwo",
"programUrl": "https://github.com/starkware-libs/cairo-lang/tree/1c5dace6fbd1dc9d1ae2eb878dc1dd85f23512ab/src/starkware/cairo/bootloaders/applicative_bootloader",
"verificationStatus": "successful",
"verificationSteps": "The steps below are supposed to be run on linux OS. They could also be run on macOS, but several tweaks need to be made: update from `lru-dict==1.1.8` to `lru-dict==1.3.0` in `scripts/requirements.txt` and update `python_interpreter` in `bazel_utils/python/stub.sh` to the correct location.\n\n1. Install [bazel](https://bazel.build) version 7.4.1 and `gmp` library using [brew](https://brew.sh):\n```\nbrew install bazelisk\nUSE_BAZEL_VERSION=7.4.1 bazelisk version\nbrew install gmp # or sudo apt-get install libgmp-dev\n```\n\n2. On linux, install JDK if you don't have it: `sudo apt install openjdk-21-jre`.\n\n3. Check out the correct commit of repo:\n```\ngit clone https://github.com/starkware-libs/cairo-lang.git\ncd cairo-lang\ngit checkout 1c5dace6fbd1dc9d1ae2eb878dc1dd85f23512ab\n```\n\n4. Update `cairo-lang/src/starkware/cairo/bootloaders/BUILD` file by appending [this snippet](/files/starkware_proghash_artifacts/56407b69f3f19f69302a8623baa8c5f71f967eed/BUILD_ADDITION) at the end.\n5. Copy [this hash_bootloaders.py script](/files/starkware_proghash_artifacts/1c5dace6fbd1dc9d1ae2eb878dc1dd85f23512ab/hash_bootloaders.py) that computes bootloader hashes into `cairo-lang/src/starkware/cairo/bootloaders/`.\n6. Execute the script above by `USE_BAZEL_VERSION=7.4.1 bazel run //src/starkware/cairo/bootloaders:cairo_hash_bootloaders_exe`. The output of the script should contain the correct hash.",
"hash": "2358844945297786488640123814540854423585455959362109345448922524567546993330"
},
{
"title": "Supported recursive Cairo verifier programs commitment StarkWare_GpsStatementVerifier_2026_13_4",
"description": "Pedersen commitment to the ordered allowlist of Cairo programs that may recursively verify and unpack nested SHARP proofs.",
"proverSystemProject": "stwo",
"programUrl": "https://github.com/starkware-libs/cairo-lang/blob/cf9bf972bede402a125e8638bb258e77563ae933/src/starkware/cairo/bootloaders/bootloader/supported_program_hashes.json",
"verificationStatus": "successful",
"verificationSteps": "This value is not a hash of a single program. It is a Pedersen hash chain committing to the ordered 30-entry `supported_cairo_verifier_program_hashes` list from [supported_program_hashes.json](https://github.com/starkware-libs/cairo-lang/blob/cf9bf972bede402a125e8638bb258e77563ae933/src/starkware/cairo/bootloaders/bootloader/supported_program_hashes.json) at cairo-lang `cf9bf972bede402a125e8638bb258e77563ae933` (v0.14.3). The list contains the program hashes of all Cairo verifier programs that the SHARP bootloader accepts for recursive proof verification:\n\n- 21 entries are Stone Cairo verifiers built from the same cairo-lang commit: 7 layouts (`dex`, `recursive`, `small`, `starknet`, `starknet_with_keccak`, `dynamic`, `recursive_with_poseidon`), each hashed with the pedersen (entries 1-7), poseidon (11-17) and blake (21-27) program hash function.\n- 9 entries are Stwo Cairo verifiers built from [stwo-cairo](https://github.com/starkware-libs/stwo-cairo/tree/sharp-7.4.RC3) at tag `sharp-7.4.RC3` (commit `9b93cc39c87838cee3132ee1f8237590700f0689`): 3 feature builds (`poseidon252_verifier` with poseidon output packing, `qm31_opcode` with poseidon output packing, `qm31_opcode` with blake output packing), each hashed with pedersen (entries 8-10), poseidon (18-20) and blake (28-30).\n\n1. Reproduce the 21 Stone verifier hashes following [these steps](/files/starkware_proghash_artifacts/cf9bf972bede402a125e8638bb258e77563ae933/stone_verifier_steps.md).\n2. Reproduce the 9 Stwo verifier hashes following [these steps](/files/starkware_proghash_artifacts/cf9bf972bede402a125e8638bb258e77563ae933/stwo_verifier_steps.md). You will need [this stwo_features.patch](/files/starkware_proghash_artifacts/cf9bf972bede402a125e8638bb258e77563ae933/stwo_features.patch) and [this hash_stwo_verifiers.py helper script](/files/starkware_proghash_artifacts/cf9bf972bede402a125e8638bb258e77563ae933/hash_stwo_verifiers.py).\n3. From the cairo-lang checkout, using a python 3.9 environment with `scripts/requirements.txt` installed, compute the commitment to the now-verified list:\n\n```\nPYTHONPATH=src python -c \"\nimport json\nfrom starkware.cairo.common.hash_state import \n compute_hash_on_elements\ndoc = json.load(open('src/starkware/cairo/\n bootloaders/bootloader/supported_program_hashes.json'))\nprint(compute_hash_on_elements([int(h, 16) \n for h in doc['supported_cairo_verifier_program_hashes']]))\n\"\n```\n\nThe output should be the program hash.",
"hash": "2549868507195840500193135872505150687001846773665388230794631345999578394351"
}
],
"risks": [
{
"category": "Funds can be stolen if",
"text": "a contract receives a malicious code upgrade. There is no delay on code upgrades.",
"isCritical": true
}
],
"zkVerifiers": [
"eth:0x4956bda1d23F75B988644329c5B06BD1494a72b6"
]
}+2 -2
+2 -2
{
"attributes": [
{
"id": "zk",
"label": "ZK",
"description": "Uses zero-knowledge proofs to prove private actions without revealing private data."
},
{
"id": "transfers",
"label": "Transfers",
"description": "Private transfers within the shielded pool."
},
{
"id": "defi",
"label": "DeFi",
"description": "Interop with DeFi (swaps, vaults) from within the shielded pool."
},
{
"id": "anyAmount",
"label": "Any amount",
"description": "Deposits and withdrawals can have any size."
}
],
"exitWindow": {
"value": "7d",
"sentiment": "warning",
"orderHint": 604800,
"description": "DAO-approved upgrades wait 7d before they can execute, giving users time to unshield funds if they do not approve the change.",
"walkawayTest": {
"passed": true
}
},
"privacy": {
"value": "Optional compliance",
"sentiment": "good",
"description": "Compliance is optional at the core protocol level: users can create proofs of innocence to disassociate deposits from flagged addresses, and relayers can choose to require them."
},
"reproducibility": {
"value": "Reproducible",
"sentiment": "good",
"description": "The contracts, circuits, and supporting software needed to participate in the protocol are publicly available and can be run locally."
},
"riskSummary": "## Funds can be stolen if\n1. the zk proof system is broken, allowing invalid spends or withdrawals.\n2. the [trusted setup](#trusted-setups) is compromised or all ceremony participants collude, allowing invalid spends or withdrawals.\n3. the DAO passes a malicious [upgrade](#upgrades-and-governance) and users do not react before the 7-day execution delay expires.\n
\n## Funds can be lost if\n1. a user loses the private keys required to control their private balance.\n
\n## Privacy can be lost if\n1. no broadcaster is available and transactions must be sent from a public address that can be linked to the user.",
"tokens": [
{
"token": {
"address": "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2",
"iconUrl": "https://assets.coingecko.com/coins/images/2518/large/weth.png?1696503332",
"symbol": "WETH",
"decimals": 18,
"priceId": "weth",
"sinceTimestamp": 1573689600
},
"buckets": [
{
"id": "railgun-WETH",
"type": "pool",
"label": "WETH",
"address": "eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
"sinceTimestamp": 1651422389,
"deposit": {
"event": "0x3a5b9dc26075a3801a6ddccf95fec485bb7500a91b44cec1add984c21ee6db3b",
"extractor": "railgunShield",
"params": {
"tokenAddress": "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2"
}
},
"withdrawal": {
"event": "0xd93cf895c7d5b2cd7dc7a098b678b3089f37d91f48d9b83a0800a91cbdf05284",
"extractor": "railgunUnshield",
"params": {
"tokenAddress": "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2"
}
}
}
]
},
{
"token": {
"address": "0xdAC17F958D2ee523a2206206994597C13D831ec7",
"iconUrl": "https://assets.coingecko.com/coins/images/325/large/Tether.png?1696501661",
"symbol": "USDT",
"decimals": 6,
"priceId": "tether",
"sinceTimestamp": 1573689600
},
"buckets": [
{
"id": "railgun-USDT",
"type": "pool",
"label": "USDT",
"address": "eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
"sinceTimestamp": 1651422389,
"deposit": {
"event": "0x3a5b9dc26075a3801a6ddccf95fec485bb7500a91b44cec1add984c21ee6db3b",
"extractor": "railgunShield",
"params": {
"tokenAddress": "0xdAC17F958D2ee523a2206206994597C13D831ec7"
}
},
"withdrawal": {
"event": "0xd93cf895c7d5b2cd7dc7a098b678b3089f37d91f48d9b83a0800a91cbdf05284",
"extractor": "railgunUnshield",
"params": {
"tokenAddress": "0xdAC17F958D2ee523a2206206994597C13D831ec7"
}
}
}
]
},
{
"token": {
"address": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
"iconUrl": "https://assets.coingecko.com/coins/images/6319/large/usdc.png?1696506694",
"symbol": "USDC",
"decimals": 6,
"priceId": "usd-coin",
"sinceTimestamp": 1573689600
},
"buckets": [
{
"id": "railgun-USDC",
"type": "pool",
"label": "USDC",
"address": "eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
"sinceTimestamp": 1651422389,
"deposit": {
"event": "0x3a5b9dc26075a3801a6ddccf95fec485bb7500a91b44cec1add984c21ee6db3b",
"extractor": "railgunShield",
"params": {
"tokenAddress": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"
}
},
"withdrawal": {
"event": "0xd93cf895c7d5b2cd7dc7a098b678b3089f37d91f48d9b83a0800a91cbdf05284",
"extractor": "railgunUnshield",
"params": {
"tokenAddress": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48"
}
}
}
]
},
{
"token": {
"address": "0x6B175474E89094C44Da98b954EedeAC495271d0F",
"iconUrl": "https://assets.coingecko.com/coins/images/9956/large/Badge_Dai.png?1696509996",
"symbol": "DAI",
"decimals": 18,
"priceId": "dai",
"sinceTimestamp": 1574121600
},
"buckets": [
{
"id": "railgun-DAI",
"type": "pool",
"label": "DAI",
"address": "eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
"sinceTimestamp": 1651422389,
"deposit": {
"event": "0x3a5b9dc26075a3801a6ddccf95fec485bb7500a91b44cec1add984c21ee6db3b",
"extractor": "railgunShield",
"params": {
"tokenAddress": "0x6B175474E89094C44Da98b954EedeAC495271d0F"
}
},
"withdrawal": {
"event": "0xd93cf895c7d5b2cd7dc7a098b678b3089f37d91f48d9b83a0800a91cbdf05284",
"extractor": "railgunUnshield",
"params": {
"tokenAddress": "0x6B175474E89094C44Da98b954EedeAC495271d0F"
}
}
}
]
},
{
"token": {
"address": "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599",
"iconUrl": "https://assets.coingecko.com/coins/images/7598/large/wrapped_bitcoin_wbtc.png?1696507857",
"symbol": "WBTC",
"decimals": 8,
"priceId": "wrapped-bitcoin",
"sinceTimestamp": 1573689600
},
"buckets": [
{
"id": "railgun-WBTC",
"type": "pool",
"label": "WBTC",
"address": "eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
"sinceTimestamp": 1651422389,
"deposit": {
"event": "0x3a5b9dc26075a3801a6ddccf95fec485bb7500a91b44cec1add984c21ee6db3b",
"extractor": "railgunShield",
"params": {
"tokenAddress": "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599"
}
},
"withdrawal": {
"event": "0xd93cf895c7d5b2cd7dc7a098b678b3089f37d91f48d9b83a0800a91cbdf05284",
"extractor": "railgunUnshield",
"params": {
"tokenAddress": "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599"
}
}
}
]
},
{
"token": {
"address": "0x85F17Cf997934a597031b2E18a9aB6ebD4B9f6a4",
"iconUrl": "https://coin-images.coingecko.com/coins/images/71681/large/near.png?1768905174",
"symbol": "NEAR",
"decimals": 24,
"priceId": "rainbow-bridged-near-ethereum",
"sinceTimestamp": 1768867200
},
"buckets": [
{
"id": "railgun-NEAR",
"type": "pool",
"label": "NEAR",
"address": "eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
"sinceTimestamp": 1768867200,
"deposit": {
"event": "0x3a5b9dc26075a3801a6ddccf95fec485bb7500a91b44cec1add984c21ee6db3b",
"extractor": "railgunShield",
"params": {
"tokenAddress": "0x85F17Cf997934a597031b2E18a9aB6ebD4B9f6a4"
}
},
"withdrawal": {
"event": "0xd93cf895c7d5b2cd7dc7a098b678b3089f37d91f48d9b83a0800a91cbdf05284",
"extractor": "railgunUnshield",
"params": {
"tokenAddress": "0x85F17Cf997934a597031b2E18a9aB6ebD4B9f6a4"
}
}
}
]
},
{
"token": {
"address": "0x6f40d4A6237C257fff2dB00FA0510DeEECd303eb",
"iconUrl": "https://coin-images.coingecko.com/coins/images/14688/large/Logo_1_%28brighter%29.png?1734430693",
"symbol": "FLUID",
"decimals": 18,
"priceId": "instadapp",
"sinceTimestamp": 1623801600
},
"buckets": [
{
"id": "railgun-FLUID",
"type": "pool",
"label": "FLUID",
"address": "eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
"sinceTimestamp": 1651422389,
"deposit": {
"event": "0x3a5b9dc26075a3801a6ddccf95fec485bb7500a91b44cec1add984c21ee6db3b",
"extractor": "railgunShield",
"params": {
"tokenAddress": "0x6f40d4A6237C257fff2dB00FA0510DeEECd303eb"
}
},
"withdrawal": {
"event": "0xd93cf895c7d5b2cd7dc7a098b678b3089f37d91f48d9b83a0800a91cbdf05284",
"extractor": "railgunUnshield",
"params": {
"tokenAddress": "0x6f40d4A6237C257fff2dB00FA0510DeEECd303eb"
}
}
}
]
},
{
"token": {
"address": "0xe76C6c83af64e4C60245D8C7dE953DF673a7A33D",
"iconUrl": "https://coin-images.coingecko.com/coins/images/16840/large/railgun.jpeg?1696516407",
"symbol": "RAIL",
"decimals": 18,
"priceId": "railgun",
"sinceTimestamp": 1625270400
},
"buckets": [
{
"id": "railgun-RAIL",
"type": "pool",
"label": "RAIL",
"address": "eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9",
"sinceTimestamp": 1651422389,
"deposit": {
"event": "0x3a5b9dc26075a3801a6ddccf95fec485bb7500a91b44cec1add984c21ee6db3b",
"extractor": "railgunShield",
"params": {
"tokenAddress": "0xe76C6c83af64e4C60245D8C7dE953DF673a7A33D"
}
},
"withdrawal": {
"event": "0xd93cf895c7d5b2cd7dc7a098b678b3089f37d91f48d9b83a0800a91cbdf05284",
"extractor": "railgunUnshield",
"params": {
"tokenAddress": "0xe76C6c83af64e4C60245D8C7dE953DF673a7A33D"
}
}
}
]
}
],
"upgradesAndGovernance": {
"content": "Railgun features an omnipotent DAO governed by the stakers of the RAIL token. The DAO has the authority to change ZK circuit logic on the core Railgun contract, which can arbitrarily change the rules for shielded tokens; as well as manage blacklisted tokens, mint RAIL tokens and manage governance rewards. See docs here: ",
"governanceInfo": {
"upgrades": {
"Normal upgrade path": "Create a proposal with an IPFS link and onchain calldata in the [Voting contract](https://etherscan.io/address/0xc480F68A3dcC3EdD82134FAB45C14A0FcF1dA3CC) → collect **500 K RAIL** sponsorship within 1mo → wait 2d → cast Yay votes within 5d and Nay votes within 6d → pass with a simple majority and **2.00 M RAIL** quorum → wait 7d → permissionless execution through the Delegator within 14d.",
"Normal upgrade path": "Create a proposal with an IPFS link and onchain calldata in the [Voting contract](https://etherscan.io/address/0xc480F68A3dcC3EdD82134FAB45C14A0FcF1dA3CC) → collect **500.00 K RAIL** sponsorship within 1mo → wait 2d → cast Yay votes within 5d and Nay votes within 6d → pass with a simple majority and **2.00 M RAIL** quorum → wait 7d → permissionless execution through the Delegator within 14d.",
"Exit window": "**7d** — a passed proposal must wait this long before it can be executed, giving users time to unshield funds."
},
"tokenGovernance": {
"Governance token": "`RAIL` 1 token = 1 vote, delegated. Total supply: **60.00 M RAIL**, DAO-owned treasury (unavailable for voting): **2.51 M RAIL**, staked for voting: **41.16 M RAIL**, the rest is circulating supply.",
"Stake lock": "Unstaking has **1mo** delay.",
"Voting venue": "[Voting contract](https://etherscan.io/address/0xc480F68A3dcC3EdD82134FAB45C14A0FcF1dA3CC) on Ethereum. Proposal text is distributed over IPFS, its CID is available as a parameter of `createPropsal()` call on the voting contract.",
"Proposal threshold": "**No threshold to create a proposal.** A proposal must receive sponsorship from **500 K RAIL** stake within 1mo.",
"Proposal threshold": "**No threshold to create a proposal.** A proposal must receive sponsorship from **500.00 K RAIL** stake within 1mo.",
"Quorum": "**2.00 M RAIL**, with a simple majority required for acceptance.",
"Execution model": "**Onchain calldata · Permissionless execution through the Delegator.** A passed proposal waits 7d, after which anyone can execute it through the [Delegator contract](https://etherscan.io/address/0xB6d513f6222Ee92Fff975E901bd792E2513fB53B) within 14d."
}
}
}
}+2 -2
+2 -2
{
"attributes": [
{
"id": "zk",
"label": "ZK",
"description": "Uses zero-knowledge proofs to prove private actions without revealing private data."
},
{
"id": "fixedAmounts",
"label": "Fixed amounts",
"description": "Pre-defined transfer amounts use distinct buckets (anonymity sets)."
}
],
"exitWindow": {
"value": "Infinite",
"sentiment": "good",
"orderHint": 9007199254740991,
"description": "The core Tornado Cash contracts are immutable and have no admin upgrade path, so users can always withdraw with a valid note and proof.",
"walkawayTest": {
"passed": true
}
},
"privacy": {
"value": "Unconditional",
"sentiment": "good",
"description": "There is no protocol-level compliance mechanism or way to compromise user privacy."
},
"reproducibility": {
"value": "Reproducible",
"sentiment": "good",
"description": "There is at least one practical way to participate in Tornado Cash using published source code that can be audited and run locally."
},
"riskSummary": "## Funds can be stolen if\n1. the zk proof system is broken, allowing invalid withdrawals.\n2. the [trusted setup](#trusted-setups) is compromised or all ceremony participants collude, allowing invalid withdrawals.\n
\n## Funds can be lost if\n1. a user loses the note secrets required to withdraw. \n
\n## Privacy can be lost if\n1. no relayer is available and the withdrawal must be submitted from an address that can be linked to the user (see [best practice page](/publications/privacy-best-practices) for more info).",
"tokens": [
{
"token": {
"address": "0x5d3a536E4D6DbD6114cc1Ead35777bAB948E3643",
"iconUrl": "https://assets.coingecko.com/coins/images/9281/large/cDAI.png?1696509390",
"symbol": "cDAI",
"decimals": 8,
"priceId": "cdai",
"sinceTimestamp": 1577297782
},
"buckets": [
{
"id": "tornado-cDAI-5000",
"type": "denomination",
"label": "cDAI 5000",
"address": "eth:0x22aaA7720ddd5388A3c0A3333430953C68f1849b",
"sinceTimestamp": 1577297782,
"denomination": "5000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "500000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "500000000000"
}
}
},
{
"id": "tornado-cDAI-50000",
"type": "denomination",
"label": "cDAI 50000",
"address": "eth:0x03893a7c7463AE47D46bc7f091665f1893656003",
"sinceTimestamp": 1616155055,
"denomination": "50000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "5000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "5000000000000"
}
}
},
{
"id": "tornado-cDAI-500000",
"type": "denomination",
"label": "cDAI 500000",
"address": "eth:0x2717c5e28cf931547B621a5dddb772Ab6A35B701",
"sinceTimestamp": 1616135923,
"denomination": "500000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "50000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "50000000000000"
}
}
},
{
"id": "tornado-cDAI-5000000",
"type": "denomination",
"label": "cDAI 5000000",
"address": "eth:0xD21be7248e0197Ee08E0c20D4a96DEBdaC3D20Af",
"sinceTimestamp": 1616115450,
"denomination": "5000000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "500000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "500000000000000"
}
}
}
]
},
{
"token": {
"address": "0x6B175474E89094C44Da98b954EedeAC495271d0F",
"iconUrl": "https://assets.coingecko.com/coins/images/9956/large/Badge_Dai.png?1696509996",
"symbol": "DAI",
"decimals": 18,
"priceId": "dai",
"sinceTimestamp": 1576534688
},
"buckets": [
{
"id": "tornado-DAI-100",
"type": "denomination",
"label": "DAI 100",
"address": "eth:0xD4B88Df4D29F5CedD6857912842cff3b20C8Cfa3",
"sinceTimestamp": 1576534688,
"denomination": "100",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "100000000000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "100000000000000000000"
}
}
},
{
"id": "tornado-DAI-1000",
"type": "denomination",
"label": "DAI 1000",
"address": "eth:0xFD8610d20aA15b7B2E3Be39B396a1bC3516c7144",
"sinceTimestamp": 1577297383,
"denomination": "1000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000000000000000"
}
}
},
{
"id": "tornado-DAI-10000",
"type": "denomination",
"label": "DAI 10000",
"address": "eth:0x07687e702b410Fa43f4cB4Af7FA097918ffD2730",
"sinceTimestamp": 1616114822,
"denomination": "10000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "10000000000000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "10000000000000000000000"
}
}
},
{
"id": "tornado-DAI-100000",
"type": "denomination",
"label": "DAI 100000",
"address": "eth:0x23773E65ed146A459791799d01336DB287f25334",
"sinceTimestamp": 1616115387,
"denomination": "100000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "100000000000000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "100000000000000000000000"
}
}
}
]
},
{
"token": {
"address": "0xEeeeeEeeeEeEeeEeEeEeeEEEeeeeEeeeeeeeEEeE",
"iconUrl": "https://assets.coingecko.com/coins/images/279/large/ethereum.png?1595348880",
"symbol": "ETH",
"decimals": 18,
"priceId": "ethereum",
"sinceTimestamp": 1576523323
},
"buckets": [
{
"id": "tornado-ETH-0.1",
"type": "denomination",
"label": "ETH 0.1",
"address": "eth:0x12D66f87A04A9E220743712cE6d9bB1B5616B8Fc",
"sinceTimestamp": 1576523323,
"denomination": "0.1",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "100000000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "100000000000000000"
}
}
},
{
"id": "tornado-ETH-1",
"type": "denomination",
"label": "ETH 1",
"address": "eth:0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936",
"sinceTimestamp": 1576534673,
"denomination": "1",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000000000000"
}
}
},
{
"id": "tornado-ETH-10",
"type": "denomination",
"label": "ETH 10",
"address": "eth:0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbF",
"sinceTimestamp": 1576536415,
"denomination": "10",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "10000000000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "10000000000000000000"
}
}
},
{
"id": "tornado-ETH-100",
"type": "denomination",
"label": "ETH 100",
"address": "eth:0xA160cdAB225685dA1d56aa342Ad8841c3b53f291",
"sinceTimestamp": 1577296976,
"denomination": "100",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "100000000000000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "100000000000000000000"
}
}
}
]
},
{
"token": {
"address": "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48",
"iconUrl": "https://assets.coingecko.com/coins/images/6319/large/usdc.png?1696506694",
"symbol": "USDC",
"decimals": 6,
"priceId": "usd-coin",
"sinceTimestamp": 1577298068
},
"buckets": [
{
"id": "tornado-USDC-100",
"type": "denomination",
"label": "USDC 100",
"address": "eth:0xd96f2B1c14Db8458374d9Aca76E26c3D18364307",
"sinceTimestamp": 1577298068,
"denomination": "100",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "100000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "100000000"
}
}
},
{
"id": "tornado-USDC-1000",
"type": "denomination",
"label": "USDC 1000",
"address": "eth:0x4736dCf1b7A3d580672CcE6E7c65cd5cc9cFBa9D",
"sinceTimestamp": 1577298155,
"denomination": "1000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000"
}
}
}
]
},
{
"token": {
"address": "0xdAC17F958D2ee523a2206206994597C13D831ec7",
"iconUrl": "https://assets.coingecko.com/coins/images/325/large/Tether.png?1696501661",
"symbol": "USDT",
"decimals": 6,
"priceId": "tether",
"sinceTimestamp": 1577298900
},
"buckets": [
{
"id": "tornado-USDT-100",
"type": "denomination",
"label": "USDT 100",
"address": "eth:0x169AD27A470D064DEDE56a2D3ff727986b15D52B",
"sinceTimestamp": 1577298900,
"denomination": "100",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "100000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "100000000"
}
}
},
{
"id": "tornado-USDT-1000",
"type": "denomination",
"label": "USDT 1000",
"address": "eth:0x0836222F2B2B24A3F36f98668Ed8F0B38D1a872f",
"sinceTimestamp": 1577298985,
"denomination": "1000",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000"
}
}
}
]
},
{
"token": {
"address": "0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599",
"iconUrl": "https://assets.coingecko.com/coins/images/7598/large/wrapped_bitcoin_wbtc.png?1696507857",
"symbol": "WBTC",
"decimals": 8,
"priceId": "wrapped-bitcoin",
"sinceTimestamp": 1616123193
},
"buckets": [
{
"id": "tornado-WBTC-0.1",
"type": "denomination",
"label": "WBTC 0.1",
"address": "eth:0x178169B423a011fff22B9e3F3abeA13414dDD0F1",
"sinceTimestamp": 1616134868,
"denomination": "0.1",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "10000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "10000000"
}
}
},
{
"id": "tornado-WBTC-1",
"type": "denomination",
"label": "WBTC 1",
"address": "eth:0x610B717796ad172B316836AC95a2ffad065CeaB4",
"sinceTimestamp": 1616123193,
"denomination": "1",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "100000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "100000000"
}
}
},
{
"id": "tornado-WBTC-10",
"type": "denomination",
"label": "WBTC 10",
"address": "eth:0xbB93e510BbCD0B7beb5A853875f9eC60275CF498",
"sinceTimestamp": 1616135758,
"denomination": "10",
"deposit": {
"event": "0xa945e51eec50ab98c161376f0db4cf2aeba3ec92755fe2fcd388bdbbb80ff196",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000"
}
},
"withdrawal": {
"event": "0xe9e508bad6d4c3227e881ca19068f099da81b5164dd6d62b2eaf1e8bc6c34931",
"extractor": "fixedAmount",
"params": {
"amount": "1000000000"
}
}
}
]
}
],
"upgradesAndGovernance": {
"content": "Tornado cash has a TORN DAO, which does not have the authority to upgrade or modify existing pools in any way. However it controls a significant portion of the Tornado cash protocol and periphery, including:\n\n1. **Default router for deposits and withdrawals and the official registry of supported pools**. Malicious upgrades of these components could lead to users losing deposited tokens. \n2. **Standard UI IPFS hash registered on ENS** ([link](https://app.ens.domains/tornadocash.eth)). Malicious upgrades of these components could lead to users losing deposited tokens. \n3. **TORN token itself**. Malicious upgrades of the token could lead to token transfers being frozen. \n4. **Registered relayers**. Malicious upgrades of these components could remove all registered relayers, disrupting user-relayer coordination and complicating private withdrawals.",
"governanceInfo": {
"upgrades": {
"Normal upgrade path": "Lock and optionally delegate TORN in the [Governance contract](https://etherscan.io/address/0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce) → submit a proposal with at least **1.00 K TORN** → wait 1m 15s → vote for 5d (extended by 6h if the outcome changes during the last 1h) → pass with a simple majority and **100 K TORN** quorum → wait 2d → permissionless execution within 3d. The DAO controls protocol and periphery components, but cannot upgrade or modify existing pools.",
"Normal upgrade path": "Lock and optionally delegate TORN in the [Governance contract](https://etherscan.io/address/0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce) → submit a proposal with at least **1.00 K TORN** → wait 1m 15s → vote for 5d (extended by 6h if the outcome changes during the last 1h) → pass with a simple majority and **100.00 K TORN** quorum → wait 2d → permissionless execution within 3d. The DAO controls protocol and periphery components, but cannot upgrade or modify existing pools.",
"Exit window": "**2d** for DAO-controlled changes — an accepted proposal remains timelocked for this period before it can be executed. Existing Tornado Cash pools are immutable and cannot be upgraded by the DAO."
},
"tokenGovernance": {
"Governance token": "`TORN`, 1 token = 1 vote, delegated. Total supply: **9.99 M TORN**, DAO-owned TORN (unavailable for voting): **4.73 M TORN**, staked for voting: **2.60 M TORN**, the rest is circulating supply.",
"Stake lock": "After voting or proposing, staked tokens are locked for **5d 6h** after proposal ends, preventing governance hopping.",
"Voting venue": "[Governance contract](https://etherscan.io/address/0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce) on Ethereum. Proposals are viewable on the voting tab of the frontend, see the note on secure frontend above.",
"Proposal threshold": "**1.00 K TORN** locked in governance.",
"Quorum": "**100 K TORN**, with a simple majority required for acceptance.",
"Quorum": "**100.00 K TORN**, with a simple majority required for acceptance.",
"Execution model": "**Permissionless execution after an onchain vote and timelock.** An accepted proposal waits 2d and can then be executed by anyone within 3d. Proposal executable payload is committed in the `propose()` transaction."
}
}
}
}