Security
What's guaranteed by code, who can change what, and current status.
What the shield guarantees
| Guarantee | Why it holds |
|---|---|
| Nobody can take your deposit without your note | A withdrawal needs a proof only the note can produce. |
| A note can only be spent once | Spending it records its nullifier; a second use is refused. |
| Relayers can't redirect or overcharge | The destination and fee are part of the proof. |
| Withdrawals don't depend on a server | Proofs are checked by the program itself, in the same transaction that pays out. |
| Your note stays on your device | Proofs are built in your browser. |
Tokens themselves have the usual protections — supply fixed at launch, no freeze, liquidity locked on graduation. The basics lists them.
The setup ceremony
The shield's proofs rely on a key made once, in a setup. Whoever ran that setup alone could, if they kept a secret from it, forge withdrawals. The safe way is a multi-party ceremony: many people each add randomness, and the result is secure as long as any single one of them throws theirs away. The key can then be frozen on chain, so it can never be swapped for another.
A Groth16 setup has two phases. Ztonk's phase 1 is the public Perpetual Powers of Tau, with 80 independent contributors. Phase 2 is specific to our circuit: it has one contribution so far, sealed with a public random beacon (a Solana mainnet blockhash). The full transcript is in the repository and anyone can re-verify it.
What the admin key can do
| Can | Can't |
|---|---|
| Pause shield deposits and withdrawals | Spend, move or see which deposit is whose |
| Pause trading, launching or pool swaps | Change anyone's balance or create tokens |
| Install the shield key, until it's frozen | Change the key once it's frozen |
| Change fees for future tokens, within hard caps | Change an existing token's fees or pricing |
| Limit who may trigger graduation (default: anyone) | Unlock pool liquidity |
Current status
| Status | |
|---|---|
| Programs | Written and tested, including full end-to-end runs with real zero-knowledge proofs |
| Deployment | Solana mainnet (beta) |
| Independent audit | Not done — internal review only |
| Setup ceremony | Public phase 1 (80 contributors); phase 2 has one contributor so far |
| Admin key | Single owner wallet (offered by the deploy key, accepted on chain). Not yet a multisig |