Circuits

Opaque's proofs are Groth16 over BN254, written in circom.

transact

The circuit behind every Shield transaction. Two inputs, two outputs, one asset.

For each input note it checks the commitment, derives the nullifier from the commitment, the leaf index and the note's spending secret, and checks a Merkle path to the public root. An input with amount zero is a placeholder and needs no path. For each output it checks the commitment and range-checks the amount so the balance equation cannot wrap.

It enforces in₀ + in₁ + publicAmount = out₀ + out₁, where publicAmount is the net amount crossing the pool boundary (a deposit, a withdrawal plus fee, or zero). When it is non-zero the hidden asset is bound to the public one.

Finally it seals the transaction to the audit key: ElGamal on Baby Jubjub with a Poseidon keystream, encrypting the asset, the input indices and amounts, and the output amounts and owners. The ciphertext and ephemeral point are outputs of the circuit, so a transaction cannot verify without them.

order

The circuit behind a Cross reveal. It proves one funding note exists in the tree and belongs to the revealer, publishes its nullifier, checks that the note covers the order (its cost at the batch price for a buy, its size for a sell) and that the private limit admits the batch price. It binds the outputs to a one-time owner key and seals the order to the audit key.

holdings

The circuit behind a statement. Up to four notes of one asset, each with its own spending secret; for each active note it checks the commitment, a Merkle path to the root, and that its leaf index is at most the bound, and outputs its nullifier. It enforces that the active amounts sum to at least the threshold.

Trusted setup

Groth16 needs a per-circuit setup. Opaque's circuits use the public Hermez phase-one ceremony and a multi-party phase two. The transcripts and every contribution are published, and the verifying keys on chain are derived from them.