# Privacy Boost Markdown version of https://ethbeat.org/privacy/projects/privacy-boost ## Summary - Total Value Locked: $728.00 K (-1.91% compared to seven days ago) - Assets tracked: 18 - Buckets tracked: 18 - Deposits 7D: 335 (-2.61% compared to the previous seven days) - Deposits 30D: 1.47 K - Deposits Total: 22.12 K - Tracked on: Base Chain - Runs on: Base Chain, Ink, OP Mainnet, Soneium - Attributes: ZK, TEE, Transfers, DeFi, Any amount - Reference app: Privacy Boost wallet (closed source) ### Risks - Privacy: Link privacy. Public observer: Link private (sentiment: good); Chain analyst: Link exposed (sentiment: bad); Network observer: Link exposed (sentiment: bad); Privileged insider: Link exposed (sentiment: bad); Future adversary: Link exposed (sentiment: bad). - Trusted setup: 16 participants (sentiment: bad). Privacy Boost v3: Circuit-specific trusted setup for the 12 Groth16 Privacy Boost epoch, forced withdrawal and gift claim circuits deployed in late September 2026. Phase 1 used 61 Perpetual Powers of Tau participant contributions and a public randomness beacon. The published phase 2 round record reports 16 participants and 16 contributions per circuit. Its public bundle reproduces the deployed keys. The proving system could be broken if either phase 1 or 2 is compromised. - Exit window: None (sentiment: bad). The admin multisig upgrades the pool and both registries instantly through their ProxyAdmins. This protocol fails the walkaway test: users cannot fully use it if every centralized participant disappears. Without the TEE operator, deposits and private transfers stop and only forced withdrawals remain. - Reproducibility: Partially reproducible (sentiment: warning). The circuits and the trusted setup transcripts are published, and every deployed verification key reproduces from them. The source code of the TEE and of the SDK's compiled core is unpublished. ### About A shielded ledger for ERC-20 tokens on Base, aimed at institutional users, whose privacy rests on the operator's TEE. ### Links - Website: https://www.privacyboost.io/ - Docs: https://docs.privacyboost.io/ - Repository: https://github.com/sunnyside-io/privacy-boost-protocol, https://github.com/sunnyside-io/privacy-boost-ceremony - Contracts explorer (Disco): https://disco.l2beat.com/ui/p/privacy-boost ## Protocol description Privacy Boost lets apps on Base give their users a private ERC-20 balance. The user deposits tokens, sends them privately to other users, uses them in DeFi through approved gateways and withdraws to any address. Everything inside stays hidden from the chain, while the operator's enclave sees every transfer in plaintext. Users trust the operator, Sunnyside Labs, whose TEE processes and whose relay submits every transaction. They also trust the admin multisig, which can upgrade every contract instantly. If the operator stops, a forced withdrawal takes funds out after 3 days, in public. ### Architecture Deposits become notes whose Poseidon2 commitments enter an onchain Merkle tree, and spending a note publishes its nullifier. The TEE collects the transfers and withdrawals users approve and batches them into epochs. A permissioned relay submits each epoch with a Groth16 validity proof. The TEE's code is unpublished, so what it does with the plaintext cannot be checked. Its isolation rests on the hardware vendor and on resistance to attacks by anyone with physical access. ### Flow 1. **Deposit.** You deposit tokens directly, or anyone sends them to a portal address (EIP-7702) you generate locally. A sweep then moves them into the pool for you. Depositor, token and amount are public. 2. **Transfer.** You approve a spend, and the TEE includes it in the next epoch. 3. **Gift.** A gift note goes to its recipient, or back to the sender after a deadline. Either way runs privately through the relay or through a public gift exit. 4. **Withdraw.** The pool pays out to any address and can call an approved gateway for DeFi. Recipient, token and amount are public. ### Keys The closed SDK can derive the private account's keys from a wallet signature, which links that wallet to the account. The hosted wallet uploads a backup of the private keys to the operator by default, encrypted with a key from one wallet signature, which restores them in any browser. Accounts approve spends with registered keys or with onchain spend approvals. Both are leaves of an auth Merkle tree in the AuthRegistry contract. Epoch proofs may use a tree root up to 10 minutes old, so a revoked key or approval stays usable that long. ### App Apps integrate the Privacy Boost SDK, whose core is closed source. The operator's hosted wallet is the only public app. It runs that core as WebAssembly and reads the chain through Alchemy under the operator's key. Each visit loads the newest core the operator has deployed, since the app pins no core version. ### Exits **Forced withdrawal.** If the operator turns malicious or stops processing withdrawals, a user can prove a forced withdrawal of up to 13 notes locally. The contract checks the authorization at request time, and anyone can execute the withdrawal 3 days later if the notes are still unspent. The account owner can cancel it. It publishes the spent notes and exposes the linked account. ### Compliance Auditors appointed by the admin multisig can query the TEE's Audit API for the balance and history of any address, without the user's consent. The AuditGateway lists 0 auditors today. The TEE is meant to record each access on that contract, but with its code unpublished this is unverifiable. ### Fees Standard deposits pay no protocol fee. Portal deposits pay a sweeper fee of 0%, capped at 10%, and have token-specific minimum sweep amounts. Withdrawals, forced withdrawals and public gift exits pay 0.4% to the treasury. A forced withdrawal fixes its fee at request time. ## Privacy **What the protocol promises:** Hides everything inside the ledger, including which deposits fund a withdrawal. Deposits and withdrawals are public. **Apps** - **[Privacy Boost wallet](https://app.privacyboost.io)** (Reference): The ratings assume this app, since 2026-10-13 · Closed source, build dpl_GoQKQWZv8oxvnAMMf5RVDPBhoipo, checked 2026-10-30 [How we pick the reference](https://ethbeat.org/publications/privacy-methodology#reference-app) Ethereum is public by default. Each protocol is rated on its main privacy promise, like hiding who paid, who received, how much, or which deposit became which withdrawal. Against each adversary, the colour says whether it holds for a careful user with the app's own settings: green yes, yellow only with significant extra work, red no. Fields marked at risk stay private only under the condition in their note. ### Public observer Link private (sentiment: good) **Who:** Everyone with a block explorer and some basic tools. Sees every public onchain event, but does no correlation beyond following links. Examples: A curious counterparty, an employer, a journalist. Transfers inside publish only encrypted notes. Deposits and withdrawals show address, token and amount. Each epoch pairs every exit with the nullifiers and note shape of the transfer that funded it. Forced withdrawals publish the spent notes and the account, public gift exits the destination. **Advice:** Exit through the operator's relay. **Inside** - Sender: private - Recipient: private - Amount: at risk. Public in gateway DeFi legs. - Asset: at risk. Public in gateway DeFi legs. - Link: at risk. Exposed in a forced withdrawal. **Sources** - [PrivacyBoost](https://ethbeat.org/privacy/projects/privacy-boost#PrivacyBoost) - [Epoch calldata: withdrawals, nullifiers and transfer shapes](https://github.com/sunnyside-io/privacy-boost-protocol/blob/5792c139b9529ed80643262d75b5489055be11b0/contracts/src/interfaces/IPrivacyBoost.sol#L828-L852) - [Forced withdrawal publishes account and notes](https://github.com/sunnyside-io/privacy-boost-protocol/blob/5792c139b9529ed80643262d75b5489055be11b0/contracts/src/interfaces/IPrivacyBoost.sol#L582-L591) - [Public gift exit names the destination](https://github.com/sunnyside-io/privacy-boost-protocol/blob/5792c139b9529ed80643262d75b5489055be11b0/contracts/src/interfaces/IPrivacyBoost.sol#L707) ### Chain analyst Link exposed (sentiment: bad) **Who:** Scrapes all public data and correlates it: timing, amounts, gas and wallet fingerprints, address clusters. Examples: Chain analytics firms, ZachXBT, data brokers. The anonymity set is very small. Most pool activity is one address that keeps depositing and withdrawing 0.001 WETH, which an analyst can filter out. **Inside, compared with a public observer** - Sender: at risk - Recipient: at risk - Amount: at risk. Bounded by the public deposit and exit amounts. - Asset: at risk - Link: exposed. The set is too small to hide in. **Sources** - [Address behind 2,638 of 2,677 WETH deposits (2026-10-30)](https://basescan.org/address/0xf977237b7d978dde922ee4909619740c73d8a49b) - [Pool transfers: 54 other depositors since 2026-09-02, 25 in WETH and 26 in USDC (2026-10-30)](https://basescan.org/address/0x71A0fD3C76E3E937d8275A3cb6a467b70123bD40#tokentxns) ### Network observer Link exposed (sentiment: bad) **Who:** Sits between the user and the services and sees traffic only: ISPs, VPNs, Tor exits, public RPCs and relayers. Ties requests to a user by content, session or timing: what they name, a shared IP or login, and when they arrive. Services the operator runs count as the insider. Examples: Infura or Alchemy, a Tornado relayer, a wallet vendor selling telemetry, Google captcha or analytics in the dapp frontend. Alchemy, under the operator's key, sees the signed-in wallet in the session that submits each withdrawal, so it can pair them by timing. The hosted wallet works over Tor but has no RPC setting to leave Alchemy out. Its key core runs in an iframe without network access and reaches only the operator's server and Alchemy through the page. Other third parties get token ids or nothing. **Inside, compared with a public observer** - Link: at risk. Private only on a busy pool, since Alchemy sees the wallet in each withdrawal session. **Sources** - [Operator endpoint](https://base.privacyboost.io/api/v1/info) - [SDK 1.2.5, configured with one server URL](https://www.npmjs.com/package/@sunnyside-io/privacy-boost/v/1.2.5) - [The compiled core builds and sends every request, its Rust source is unpublished](https://www.npmjs.com/package/@sunnyside-io/privacy-boost/v/1.2.5?activeTab=code) ### Privileged insider Link exposed (sentiment: bad) **Who:** Holds an operator role, custodies funds, receives keys or plaintext by design, or delivers the app: upgrade admin, custodian, view key holder, enclave operator, association set provider, hosted prover, registry, frontend host. Examples: A compliance backdoor key, a DAO with an upgrade key, a KMS committee, an ASP operator, a custodial bridge. The operator's enclave holds every transfer in plaintext and a key to every note. The SDK trusts the enclave key it fetches from the operator's endpoint. Auditors appointed by the admin can pull any account's history without consent. **Inside, compared with a public observer** - Sender: exposed - Recipient: exposed - Amount: exposed - Asset: exposed - Link: exposed **Sources** - [AuditGateway](https://ethbeat.org/privacy/projects/privacy-boost#AuditGateway) - [Admin and operator multisigs](https://ethbeat.org/privacy/projects/privacy-boost#permissions) - [SDK fetches the enclave key from the endpoint](https://www.npmjs.com/package/@sunnyside-io/privacy-boost/v/1.2.5) - [Notes wrap a key for the enclave beside the receiver](https://github.com/sunnyside-io/privacy-boost-protocol/blob/5792c139b9529ed80643262d75b5489055be11b0/contracts/src/interfaces/IStructs.sol#L36-L56) ### Future adversary Link exposed (sentiment: bad) **Who:** Harvest now, decrypt later. Holds every byte ever published and runs the known quantum attacks: elliptic curves, pairings and RSA fall. Hashes, symmetric ciphers and post-quantum schemes stand until an attack on them is known. Examples: An intelligence agency archiving chain data today, then anyone once a break is public. Whoever breaks elliptic-curve cryptography decrypts every note, since each one also wraps its key to the enclave's long-lived public key. That one key opens the entire history, deposits included. **Inside, compared with a public observer** - Sender: exposed - Recipient: exposed - Amount: exposed - Asset: exposed - Link: exposed **Sources** - [Every output and deposit ciphertext carries an enclave key](https://github.com/sunnyside-io/privacy-boost-protocol/blob/5792c139b9529ed80643262d75b5489055be11b0/contracts/src/interfaces/IStructs.sol#L36-L125) ## Value Locked The interactive value chart is shown on [the HTML page](https://ethbeat.org/privacy/projects/privacy-boost#privacy-tvl). ## Flows The interactive flows chart is shown on [the HTML page](https://ethbeat.org/privacy/projects/privacy-boost#privacy-flows). ## Assets Breakdown | Asset | Deposits 7D | Deposits 30D | Deposits Total | Value Locked | | --- | --- | --- | --- | --- | | wstETH | 0 ($0.00) | 2 ($4.60 K) | 7 ($1.36 M) | $698.30 K | | USDC | 4 ($35.31) | 47 ($559.64 K) | 137 ($878.41 K) | $18.79 K | | gtwethb | 0 ($0.00) | 0 ($0.00) | 5 ($12.54 K) | $9.58 K | | bbqUSDC | 0 ($0.00) | 1 ($260.14) | 3 ($1.05 K) | $1.04 K | | WETH | 331 ($1.06 K) | 1.42 K ($24.76 K) | 21.94 K ($272.89 K) | $249.34 | | AAPLc | 0 ($0.00) | 0 ($0.00) | 1 ($7.19) | $7.65 | | USDT | 0 ($0.00) | 3 ($183.87) | 10 ($199.67) | $6.20 | | gtusdcf | 0 ($0.00) | 0 ($0.00) | 5 ($19.35 K) | $4.80 | | CSUSDC | 0 ($0.00) | 0 ($0.00) | 2 ($9.19) | $4.59 | | edgeUSDC | 0 ($0.00) | 0 ($0.00) | 1 ($1.90) | $1.91 | | BRETT | 0 ($0.00) | 0 ($0.00) | 1 ($0.24) | $0.16 | | AERO | 0 ($0.00) | 0 ($0.00) | 0 ($0.00) | — | | Basecat | 0 ($0.00) | 0 ($0.00) | 0 ($0.00) | — | | cbBTC | 0 ($0.00) | 0 ($0.00) | 0 ($0.00) | — | | cbXRP | 0 ($0.00) | 0 ($0.00) | 0 ($0.00) | — | | EURC | 0 ($0.00) | 0 ($0.00) | 1 ($0.03) | — | | SOL | 0 ($0.00) | 0 ($0.00) | 0 ($0.00) | — | | TOSHI | 0 ($0.00) | 0 ($0.00) | 0 ($0.00) | — | | Total | 335 ($1.09 K) | 1.47 K ($589.45 K) | 22.12 K ($2.54 M) | $728.01 K | ## Milestones & Incidents - 2026-09-08: [Privacy Boost live on Base](https://privacyboost.io/resources/blog/privacy-boost-live-on-base). Sunnyside Labs opens the hosted wallet and SDK to anyone on Base. - 2026-04-20: [Privacy Boost live on OP Mainnet](https://optimism.io/blog/privacy-comes-to-the-op-stack). Sunnyside Labs opens Privacy Boost to its customers on OP Mainnet. ## Risk summary ### Funds can be stolen if 1. the zk proof system is broken, allowing invalid spends or withdrawals. 2. all [trusted setup](https://ethbeat.org/privacy/projects/privacy-boost#trusted-setups) participants collude or leak their secrets, allowing forged proofs. 3. the admin multisig deploys a malicious [upgrade](https://ethbeat.org/privacy/projects/privacy-boost#upgrades-and-governance) of the pool or registers a malicious verifying key, with no delay. ### Funds can be lost if 1. a user loses their note secrets, or both the account-owner wallet and every usable authorization key. ### Privacy can be lost if 1. the TEE's hardware vendor, or anyone with physical access to the enclave, breaks its isolation (see privileged insider). 2. an auditor appointed by the admin multisig fetches the user's history through the Audit API (see privileged insider). 3. a user exits through a forced withdrawal (see public observer). 4. a user relies on today's anonymity set, which is too small to hide in (see chain analyst). 5. the operator deploys an enclave image or a closed SDK core that leaks user data (see privileged insider). 6. Alchemy pairs the signed-in wallet with the withdrawal by timing (see network observer). 7. elliptic-curve cryptography is broken, which decrypts every note through the enclave's long-lived public key (see future adversary). ## Upgrades & Governance The 3/4 admin multisig upgrades the pool, registries and AuditGateway instantly. It can replace all five verifiers and their keys, set withdrawal and portal fees up to 10% each, configure portal minimum sweeps, appoint auditors, and change the treasury, operator and gateway route manager. The gateway owner manages target and selector policies, picks the guardian and can pause execution. The guardian can pause and remove policies. Stranded gateway tokens return to the pool only while paused. ## Trusted setup Risk levels follow the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381). Yellow (medium risk): all contributions are published and the final output can be verified, the ceremony client is open source, there were at least 30 contributions, participation was open to the public and announced, and participants are publicly identified. Green (lowest risk): everything required for yellow, with at least 150 contributions. Red (highest risk): at least one requirement for yellow is not met. N/A: the proof system needs no trusted setup. ### Privacy Boost v3 - Risk: red (highest risk) - Proof systems: Gnark (Groth16) - Phase 1: 61 contributions - Phase 2: 16 participants (16 contributions per circuit across 12 circuits.) Circuit-specific trusted setup for 12 Groth16 circuits of the Privacy Boost protocol over the BN254 curve, run by Sunnyside Labs as its third production round (`prod-ceremony-2026-03`, release `ceremony/v0.0.5`). Its keys were registered onchain on 23 September 2026 and replace the second round keys of the epoch (9 shapes, down from 13), forced withdrawal and gift claim circuits, which were recompiled with gnark v0.16.3 after the EdDSA signature check was rewritten. The deposit and portal deposit circuits keep their second round keys. It uses the `ppot_0080` files from the public [Perpetual Powers of Tau](https://github.com/privacy-ethereum/perpetualpowersoftau) ceremony as Phase 1. These contain 61 participant contributions and one public randomness beacon. Contribution 0078 resumes from 0058 after a fork, so the included IDs are 0001–0058 and 0078–0080, rather than the first 80 contributions. Phase 2 is a gnark-native MPC ceremony finalized on 23 September 2026. The published round record reports **16 participants** and **192 accepted contributions**, 16 per circuit. Participants are identified by GitHub username, and four of them show a Sunnyside Labs affiliation there. The coordinator served plain HTTP and contributions carry no signatures, so participant names rest on the coordinator's records. The public verification bundle, published on 29 October 2026, re-derives every registered key from these contributions. - Phase 1 ceremony and fork: . - Ceremony repository and contributor tooling: [https://github.com/sunnyside-io/privacy-boost-ceremony](https://github.com/sunnyside-io/privacy-boost-ceremony) - Round record with the published counts and bundle digests: [rounds/2026-03.md](https://github.com/sunnyside-io/privacy-boost-ceremony/blob/e1e5a01d9bc4ce5b0917d6302aa4d294b6539894/rounds/2026-03.md) - Contributor release: [ceremony/v0.0.5](https://github.com/sunnyside-io/privacy-boost-ceremony/releases/tag/ceremony%2Fv0.0.5) - Offline verification procedure: [PUBLIC_VERIFICATION.md](https://github.com/sunnyside-io/privacy-boost-ceremony/blob/e1e5a01d9bc4ce5b0917d6302aa4d294b6539894/PUBLIC_VERIFICATION.md) - Public verification bundle: [https://file.ceremony.privacyboost.io/prod-20260923-public.tar.gz](https://file.ceremony.privacyboost.io/prod-20260923-public.tar.gz) - Derived key bundle: [https://file.ceremony.privacyboost.io/prod-20260923-keys.tar.gz](https://file.ceremony.privacyboost.io/prod-20260923-keys.tar.gz) ## Verifier IDs ### Privacy Boost epoch verifier, 9 circuits Verifies the batched private transfer and withdrawal proofs. - Verifier ID: `Privacy Boost epoch verifier 23.09.2026` - Source: https://github.com/sunnyside-io/privacy-boost-protocol/blob/5792c139b9529ed80643262d75b5489055be11b0/frontend/epoch_circuit.go - Verification: successful (verified by [ETHBEAT](https://ethbeat.org)) - Used in: [Privacy Boost](https://ethbeat.org/privacy/projects/privacy-boost) **Known deployments** - [0xB144eb785E2CCe17681395Cd475093C01AEeb11e](https://basescan.org/address/0xB144eb785E2CCe17681395Cd475093C01AEeb11e#code) on Base Chain, used in: [Privacy Boost](https://ethbeat.org/privacy/projects/privacy-boost) #### Verification steps The epoch, forced withdrawal and gift claim verifiers store the 12 verification keys of the third production ceremony: epoch shapes `s1`, `s5`, `m1`, `m4`, `l1`, `l3`, `sp1`, `w51` and `w201`, forced withdrawal `f13` and gift claims `g1` and `g3`. The steps below re-derive all 12 keys from the circuit sources and the ceremony transcript and match them to the keys the verifiers read. The re-derivation takes about 2 hours, stays under 6 GiB of RAM and needs about 10 GB of disk. A [helper script](https://ethbeat.org/files/privacy_boost_artifacts/ceremony-r3.sh) runs all four steps, with the untrusted builds in Docker: `ceremony-r3.sh all`, with `BASE_RPC_URL` set to a Base endpoint. 1. Download the public bundle and the keys, and check their digests against the [round record](https://github.com/sunnyside-io/privacy-boost-ceremony/blob/e1e5a01d9bc4ce5b0917d6302aa4d294b6539894/rounds/2026-03.md): `d584146c…` for the bundle, `3dfe30e5…` for the keys and `626faf00…` for `public/manifest.json`. ``` curl -LO https://file.ceremony.privacyboost.io/prod-20260923-public.tar.gz curl -LO https://file.ceremony.privacyboost.io/prod-20260923-keys.tar.gz shasum -a 256 prod-20260923-public.tar.gz prod-20260923-keys.tar.gz tar xzf prod-20260923-public.tar.gz tar xzf prod-20260923-keys.tar.gz shasum -a 256 public/manifest.json ``` 2. Build the verifier from [privacy-boost-ceremony](https://github.com/sunnyside-io/privacy-boost-ceremony) at commit `e1e5a01d`. It compiles the `frontend/` circuits of [privacy-boost-protocol](https://github.com/sunnyside-io/privacy-boost-protocol) at `f8a866ce` with gnark v0.16.3 and gnark-crypto v0.21.0, the versions embedded in the signed `ceremony/v0.0.5` release binaries. The protocol commit linked above, `5792c139`, differs from `f8a866ce` only in tests and a Solidity constants file. ``` git clone https://github.com/sunnyside-io/privacy-boost-ceremony cd privacy-boost-ceremony git checkout e1e5a01d9bc4ce5b0917d6302aa4d294b6539894 go build -o ./bin/ceremony ./cmd/ceremony ``` 3. Run the public verification. It checks the bundle root and each contribution chain, recompiles every circuit and matches its R1CS hash, fetches the Perpetual Powers of Tau `pot28_0080` file for the circuit's power and checks its hash, verifies the 16 contributions in order from a freshly computed origin, and matches the re-derived proving and verifying keys with the manifest. ``` ./bin/ceremony verify-public --bundle-dir public ``` 4. Check that each `keys/.vk` hashes to the manifest's `vkSha256` and compare it with the chain. The verifier reads 448 bytes of constants (alpha, then the negated beta, gamma and delta, each G2 point as x1, x0, y1, y0) and the x and y coordinates of the IC points from SSTORE2 contracts. `getEpochVKInfo(maxTransfers, maxInputsPerTransfer, maxOutputsPerTransfer)` on the epoch verifier and `getVKInfo(param)` on the forced withdrawal (`13`) and gift claim (`1`, `3`) verifiers return the IC length and the constants contract. The IC contracts sit in the key registry at storage slot 5 for the epoch verifier, keyed by the three parameters, and at slot 2 for the other two. ### Privacy Boost deposit verifier, 3 circuits Verifies the batched deposit epoch proofs. - Verifier ID: `Privacy Boost deposit verifier 09.09.2026` - Source: https://github.com/sunnyside-io/privacy-boost-protocol/blob/9e3f34e1a91c20497bc7d8f47492761bc868843c/frontend/deposit_epoch_circuit.go - Verification: successful (verified by [ETHBEAT](https://ethbeat.org)) - Used in: [Privacy Boost](https://ethbeat.org/privacy/projects/privacy-boost) **Known deployments** - [0xac60252EF8dbC139e0da63cE7F2a13D25a5B627d](https://basescan.org/address/0xac60252EF8dbC139e0da63cE7F2a13D25a5B627d#code) on Base Chain, used in: [Privacy Boost](https://ethbeat.org/privacy/projects/privacy-boost) #### Verification steps The deposit verifier stores verification keys for 3 different batched deposit circuits across 3 registered batch sizes (`d1`, `d4`, `d14`). The steps below reproduce all 3 verification keys from circuit sources and trusted setup files. They require about 24 GiB RAM with two parallel workers and ~35 GiB disk space. Helper scripts implementing all of the reproduction steps are in the [script archive](https://trusted-setup-hosting.l2beat.com/privacy/privacy-boost/privacy_boost_vk_digest_v2.zip). 1. Download the second production ceremony public bundle (about 9.8 GB, gzip-compressed despite the `.tar` name) and extract it. The archive used for this attestation hashes to `91ad38d7775259116d00e5288630aaec565fbec8ff38a76dc874c13412ae530a`. ``` curl -LO https://file.ceremony.privacyboost.io/prod-20260902-public.tar shasum -a 256 prod-20260902-public.tar tar xzf prod-20260902-public.tar ``` 2. Check that the ceremony's circuit matrix in `public/config.snapshot.json` matches the circuit shapes registered on the verifier, and that the manifest's `circuitSpecJson` for each circuit agrees with them and with `circuit-setup/configs/production.ceremony.config.json` in [privacy-boost-ceremony](https://github.com/sunnyside-io/privacy-boost-ceremony) at commit `e645b68d`. 3. Re-derive every key from the transcript. The circuits are the `frontend/` package of [privacy-boost-protocol](https://github.com/sunnyside-io/privacy-boost-protocol) at commit `9e3f34e1a91c`. Note that the ceremony coordinator compiled them with **gnark v0.15.0 and gnark-crypto v0.20.1**, as recorded in the build information embedded in the signed `ceremony/v0.0.x` release binaries. The public ceremony repository pins gnark v0.14.0 instead, which compiles to different constraint systems, so its `verify-public` command fails at the R1CS hash check. The script archive contains a per-circuit helper built against gnark v0.15.0 that recompiles each circuit's R1CS from its spec, checks it against the manifest, fetches and digest-checks the pinned Perpetual Powers of Tau artifact for the required power, recomputes the origin of the phase 2 transcript, verifies every contribution against its predecessor, and seals the proving and verifying keys, comparing them to the manifest commitments. ``` python3 run.py prepare python3 onchain.py python3 run.py run --jobs 2 ``` 4. For each circuit, encode the re-derived `.vk` into the onchain layout (negate `beta`, `gamma`, `delta`; interleave `G1.K`) and confirm its digest equals the value read from chain. The helper reads all registered keys at one finalized OP Mainnet block (equivalent to the Base deployment), recomputing the storage slots from the circuit parameters and cross-checking them against the getters. ### Privacy Boost forced withdrawal verifier, 1 circuit Verifies the client-side forced withdrawal proofs. - Verifier ID: `Privacy Boost forced withdrawal verifier 23.09.2026` - Source: https://github.com/sunnyside-io/privacy-boost-protocol/blob/5792c139b9529ed80643262d75b5489055be11b0/frontend/forced_withdraw_circuit.go - Verification: successful (verified by [ETHBEAT](https://ethbeat.org)) - Used in: [Privacy Boost](https://ethbeat.org/privacy/projects/privacy-boost) **Known deployments** - [0x40e93d3357A5A3d249437717Da936f6141ba85cE](https://basescan.org/address/0x40e93d3357A5A3d249437717Da936f6141ba85cE#code) on Base Chain, used in: [Privacy Boost](https://ethbeat.org/privacy/projects/privacy-boost) #### Verification steps The epoch, forced withdrawal and gift claim verifiers store the 12 verification keys of the third production ceremony: epoch shapes `s1`, `s5`, `m1`, `m4`, `l1`, `l3`, `sp1`, `w51` and `w201`, forced withdrawal `f13` and gift claims `g1` and `g3`. The steps below re-derive all 12 keys from the circuit sources and the ceremony transcript and match them to the keys the verifiers read. The re-derivation takes about 2 hours, stays under 6 GiB of RAM and needs about 10 GB of disk. A [helper script](https://ethbeat.org/files/privacy_boost_artifacts/ceremony-r3.sh) runs all four steps, with the untrusted builds in Docker: `ceremony-r3.sh all`, with `BASE_RPC_URL` set to a Base endpoint. 1. Download the public bundle and the keys, and check their digests against the [round record](https://github.com/sunnyside-io/privacy-boost-ceremony/blob/e1e5a01d9bc4ce5b0917d6302aa4d294b6539894/rounds/2026-03.md): `d584146c…` for the bundle, `3dfe30e5…` for the keys and `626faf00…` for `public/manifest.json`. ``` curl -LO https://file.ceremony.privacyboost.io/prod-20260923-public.tar.gz curl -LO https://file.ceremony.privacyboost.io/prod-20260923-keys.tar.gz shasum -a 256 prod-20260923-public.tar.gz prod-20260923-keys.tar.gz tar xzf prod-20260923-public.tar.gz tar xzf prod-20260923-keys.tar.gz shasum -a 256 public/manifest.json ``` 2. Build the verifier from [privacy-boost-ceremony](https://github.com/sunnyside-io/privacy-boost-ceremony) at commit `e1e5a01d`. It compiles the `frontend/` circuits of [privacy-boost-protocol](https://github.com/sunnyside-io/privacy-boost-protocol) at `f8a866ce` with gnark v0.16.3 and gnark-crypto v0.21.0, the versions embedded in the signed `ceremony/v0.0.5` release binaries. The protocol commit linked above, `5792c139`, differs from `f8a866ce` only in tests and a Solidity constants file. ``` git clone https://github.com/sunnyside-io/privacy-boost-ceremony cd privacy-boost-ceremony git checkout e1e5a01d9bc4ce5b0917d6302aa4d294b6539894 go build -o ./bin/ceremony ./cmd/ceremony ``` 3. Run the public verification. It checks the bundle root and each contribution chain, recompiles every circuit and matches its R1CS hash, fetches the Perpetual Powers of Tau `pot28_0080` file for the circuit's power and checks its hash, verifies the 16 contributions in order from a freshly computed origin, and matches the re-derived proving and verifying keys with the manifest. ``` ./bin/ceremony verify-public --bundle-dir public ``` 4. Check that each `keys/.vk` hashes to the manifest's `vkSha256` and compare it with the chain. The verifier reads 448 bytes of constants (alpha, then the negated beta, gamma and delta, each G2 point as x1, x0, y1, y0) and the x and y coordinates of the IC points from SSTORE2 contracts. `getEpochVKInfo(maxTransfers, maxInputsPerTransfer, maxOutputsPerTransfer)` on the epoch verifier and `getVKInfo(param)` on the forced withdrawal (`13`) and gift claim (`1`, `3`) verifiers return the IC length and the constants contract. The IC contracts sit in the key registry at storage slot 5 for the epoch verifier, keyed by the three parameters, and at slot 2 for the other two. ### Privacy Boost portal deposit verifier, 2 circuits Verifies the batched hidden-recipient portal deposit proofs. - Verifier ID: `Privacy Boost portal deposit verifier 09.09.2026` - Source: https://github.com/sunnyside-io/privacy-boost-protocol/blob/9e3f34e1a91c20497bc7d8f47492761bc868843c/frontend/deposit_portal_circuit.go - Verification: successful (verified by [ETHBEAT](https://ethbeat.org)) - Used in: [Privacy Boost](https://ethbeat.org/privacy/projects/privacy-boost) **Known deployments** - [0x0c8bb018a3d8DF4c5fC86518ca57F8E1445BCF63](https://basescan.org/address/0x0c8bb018a3d8DF4c5fC86518ca57F8E1445BCF63#code) on Base Chain, used in: [Privacy Boost](https://ethbeat.org/privacy/projects/privacy-boost) #### Verification steps The portal deposit verifier stores verification keys for 2 different batched portal deposit circuits across 2 registered batch sizes (`p1`, `p6`). The steps below reproduce both verification keys from circuit sources and trusted setup files. They require about 24 GiB RAM with two parallel workers and ~35 GiB disk space. Helper scripts implementing all of the reproduction steps are in the [script archive](https://trusted-setup-hosting.l2beat.com/privacy/privacy-boost/privacy_boost_vk_digest_v2.zip). 1. Download the second production ceremony public bundle (about 9.8 GB, gzip-compressed despite the `.tar` name) and extract it. The archive used for this attestation hashes to `91ad38d7775259116d00e5288630aaec565fbec8ff38a76dc874c13412ae530a`. ``` curl -LO https://file.ceremony.privacyboost.io/prod-20260902-public.tar shasum -a 256 prod-20260902-public.tar tar xzf prod-20260902-public.tar ``` 2. Check that the ceremony's circuit matrix in `public/config.snapshot.json` matches the circuit shapes registered on the verifier, and that the manifest's `circuitSpecJson` for each circuit agrees with them and with `circuit-setup/configs/production.ceremony.config.json` in [privacy-boost-ceremony](https://github.com/sunnyside-io/privacy-boost-ceremony) at commit `e645b68d`. 3. Re-derive every key from the transcript. The circuits are the `frontend/` package of [privacy-boost-protocol](https://github.com/sunnyside-io/privacy-boost-protocol) at commit `9e3f34e1a91c`. Note that the ceremony coordinator compiled them with **gnark v0.15.0 and gnark-crypto v0.20.1**, as recorded in the build information embedded in the signed `ceremony/v0.0.x` release binaries. The public ceremony repository pins gnark v0.14.0 instead, which compiles to different constraint systems, so its `verify-public` command fails at the R1CS hash check. The script archive contains a per-circuit helper built against gnark v0.15.0 that recompiles each circuit's R1CS from its spec, checks it against the manifest, fetches and digest-checks the pinned Perpetual Powers of Tau artifact for the required power, recomputes the origin of the phase 2 transcript, verifies every contribution against its predecessor, and seals the proving and verifying keys, comparing them to the manifest commitments. Reading the transcript lazily keeps the peak below 10 GB per circuit. ``` python3 run.py prepare python3 onchain.py python3 run.py run --jobs 2 ``` 4. For each circuit, encode the re-derived `.vk` into the onchain layout (negate `beta`, `gamma`, `delta`; interleave `G1.K`) and confirm its digest equals the value read from chain. The helper reads all registered keys at one finalized OP Mainnet block (equivalent to the Base deployment), recomputing the storage slots from the circuit parameters and cross-checking them against the getters. ### Privacy Boost gift claim verifier, 2 circuits Verifies the batched gift claim, refund and public gift exit proofs. - Verifier ID: `Privacy Boost gift claim verifier 23.09.2026` - Source: https://github.com/sunnyside-io/privacy-boost-protocol/blob/5792c139b9529ed80643262d75b5489055be11b0/frontend/gift_claim_circuit.go - Verification: successful (verified by [ETHBEAT](https://ethbeat.org)) - Used in: [Privacy Boost](https://ethbeat.org/privacy/projects/privacy-boost) **Known deployments** - [0x8f394a08A7544daf39aF38FEA5B2E348180bDC05](https://basescan.org/address/0x8f394a08A7544daf39aF38FEA5B2E348180bDC05#code) on Base Chain, used in: [Privacy Boost](https://ethbeat.org/privacy/projects/privacy-boost) #### Verification steps The epoch, forced withdrawal and gift claim verifiers store the 12 verification keys of the third production ceremony: epoch shapes `s1`, `s5`, `m1`, `m4`, `l1`, `l3`, `sp1`, `w51` and `w201`, forced withdrawal `f13` and gift claims `g1` and `g3`. The steps below re-derive all 12 keys from the circuit sources and the ceremony transcript and match them to the keys the verifiers read. The re-derivation takes about 2 hours, stays under 6 GiB of RAM and needs about 10 GB of disk. A [helper script](https://ethbeat.org/files/privacy_boost_artifacts/ceremony-r3.sh) runs all four steps, with the untrusted builds in Docker: `ceremony-r3.sh all`, with `BASE_RPC_URL` set to a Base endpoint. 1. Download the public bundle and the keys, and check their digests against the [round record](https://github.com/sunnyside-io/privacy-boost-ceremony/blob/e1e5a01d9bc4ce5b0917d6302aa4d294b6539894/rounds/2026-03.md): `d584146c…` for the bundle, `3dfe30e5…` for the keys and `626faf00…` for `public/manifest.json`. ``` curl -LO https://file.ceremony.privacyboost.io/prod-20260923-public.tar.gz curl -LO https://file.ceremony.privacyboost.io/prod-20260923-keys.tar.gz shasum -a 256 prod-20260923-public.tar.gz prod-20260923-keys.tar.gz tar xzf prod-20260923-public.tar.gz tar xzf prod-20260923-keys.tar.gz shasum -a 256 public/manifest.json ``` 2. Build the verifier from [privacy-boost-ceremony](https://github.com/sunnyside-io/privacy-boost-ceremony) at commit `e1e5a01d`. It compiles the `frontend/` circuits of [privacy-boost-protocol](https://github.com/sunnyside-io/privacy-boost-protocol) at `f8a866ce` with gnark v0.16.3 and gnark-crypto v0.21.0, the versions embedded in the signed `ceremony/v0.0.5` release binaries. The protocol commit linked above, `5792c139`, differs from `f8a866ce` only in tests and a Solidity constants file. ``` git clone https://github.com/sunnyside-io/privacy-boost-ceremony cd privacy-boost-ceremony git checkout e1e5a01d9bc4ce5b0917d6302aa4d294b6539894 go build -o ./bin/ceremony ./cmd/ceremony ``` 3. Run the public verification. It checks the bundle root and each contribution chain, recompiles every circuit and matches its R1CS hash, fetches the Perpetual Powers of Tau `pot28_0080` file for the circuit's power and checks its hash, verifies the 16 contributions in order from a freshly computed origin, and matches the re-derived proving and verifying keys with the manifest. ``` ./bin/ceremony verify-public --bundle-dir public ``` 4. Check that each `keys/.vk` hashes to the manifest's `vkSha256` and compare it with the chain. The verifier reads 448 bytes of constants (alpha, then the negated beta, gamma and delta, each G2 point as x1, x0, y1, y0) and the x and y coordinates of the IC points from SSTORE2 contracts. `getEpochVKInfo(maxTransfers, maxInputsPerTransfer, maxOutputsPerTransfer)` on the epoch verifier and `getVKInfo(param)` on the forced withdrawal (`13`) and gift claim (`1`, `3`) verifiers return the IC length and the constants contract. The IC contracts sit in the key registry at storage slot 5 for the epoch verifier, keyed by the three parameters, and at slot 2 for the other two. ## Updates Each date links the update on the HTML page, which also shows its contract diffs. ### [2026-10-01 10:55 UTC](https://ethbeat.org/privacy/projects/privacy-boost?update=4a45e933) (18 changes) Switched privacy boost discovery to base from op mainnet. ### [2026-09-28 14:00 UTC](https://ethbeat.org/privacy/projects/privacy-boost?update=7e3ac8d8) (high severity, 18 changes) Redeployed identical PrivacyBoost implementation (https://disco.l2beat.com/diff/oeth:0x9CB144D35748932EC44950d0837248fcF8747828/oeth:0x319785d27Bd9889248804FA803FAC3e58D9ca002) together with redeploying three verifiers (Groth16EpochVerifier, Groth16ForcedVerifier and Groth16GiftClaimVerifier). These three verifiers have different verification keys because forced withdrawal and gift claim circuits were recompiled with gnark v0.16.3 after the EdDSA signature check was rewritten to a double-base scalar multiplication ([PR #10](https://github.com/sunnyside-io/privacy-boost-protocol/pull/10)) and some circuit shapes are no longer supported. New circuits also introduce a new trusted setup. Trusted setup artifacts are not yet published so the verification keys could not be regenerated. ### [2026-09-15 09:31 UTC](https://ethbeat.org/privacy/projects/privacy-boost?update=b6c9f26f) (4 changes) Added a new member to the admin ms: 2/3 -> 3/4. ### [2026-09-07 13:21 UTC](https://ethbeat.org/privacy/projects/privacy-boost?update=19595947) (high severity, 100 changes) Feature upgrade: replaces PrivacyBoost/AuthRegistry logic and all three verifiers, adds portal and gift features + verifiers, an external-call gateway, and expands the token registry to 11 assets. Auth snapshots are **removed**. New keys remain unverified because the trusted setup records are not yet published. external call gateway: whitelisted defi interactions portal: reusable recipient addresses gift: claim to a custom address (private or public) using a 'gift note' AuthRegistry: https://disco.l2beat.com/diff/oeth:0xcCdF755866c708A4a8D0002DC3f1a574226DF38b/oeth:0xA2072F7B4b261F997035f9522648c7c5bAF9370a TokenRegistry: https://disco.l2beat.com/diff/oeth:0x238e6ec4968c9b00b16293139951c23815Ca1134/oeth:0x86A891632594Ae26834275925Eb4Fde37F1eBb19 AuditGateway: https://disco.l2beat.com/diff/oeth:0xfEfb6bD314680BDbc1B00FE2eA5A038655Bb4478/oeth:0x384D1460107D88b1a21CA202825583c19cb6A808 PrivacyBoost: https://disco.l2beat.com/diff/oeth:0x0b9B98d3B95D74487C481e7830ab440896aE62E5/oeth:0x9CB144D35748932EC44950d0837248fcF8747828 ### [2026-08-21 08:53 UTC](https://ethbeat.org/privacy/projects/privacy-boost?update=16a592bd) (14 changes) Initial discovery of privacy boost. ## Permissions Explore these contracts and permissions in Disco, ETHBEAT's contract explorer: https://disco.l2beat.com/ui/p/privacy-boost ### Base Chain #### Actors ##### OperatorMultisig Addresses: [0x420A8a682892bae85cba7fb0e5Cd806807C5Bf95](https://basescan.org/address/0x420A8a682892bae85cba7fb0e5Cd806807C5Bf95) A Multisig with 2/3 threshold. - Can interact with ExternalCallGateway - pause the gateway and remove external call policies - Can interact with AuthRegistry - manage the allowlist of relays that can submit key operations to the AuthRegistry on behalf of users - Can interact with PrivacyBoost - approve or revoke external gateway routes used by proof-authorized withdrawals - manage the allowlist of relays that submit epochs to the pool Participants (3): [0x769ef261964f1eDe0a554b74e9bB900d3Fb4AF1E](https://basescan.org/address/0x769ef261964f1eDe0a554b74e9bB900d3Fb4AF1E), [0x90d3EbF1bbE3075F41772bB6f0A54e6038C84244](https://basescan.org/address/0x90d3EbF1bbE3075F41772bB6f0A54e6038C84244), [0xfEa8d7D07365a1A429319EF7A7a265CB4F530237](https://basescan.org/address/0xfEa8d7D07365a1A429319EF7A7a265CB4F530237) ##### AdminMultisig Addresses: [0x78DFf7F33E3d5edD68D13D6d1fE23078062866f7](https://basescan.org/address/0x78DFf7F33E3d5edD68D13D6d1fE23078062866f7) A Multisig with 3/4 threshold. - Can upgrade **with no delay** - TokenRegistry [via: TokenRegistryProxyAdmin] - AuthRegistry [via: AuthRegistryProxyAdmin] - PrivacyBoost [via: PrivacyBoostProxyAdmin] - AuditGateway [via: AuditGatewayProxyAdmin] - Can interact with ExternalCallGateway - set the guardian, install or remove external call policies, pause or unpause the gateway, and sweep stranded tokens back to the pool while paused - Can interact with Groth16PortalDepositVerifier - register and replace the Groth16 verification keys used to validate portal deposit epoch proofs - Can interact with TokenRegistry - register new ERC-20 tokens to be accepted by the PrivacyBoost pool - Can interact with Groth16ForcedVerifier - register and replace the Groth16 verification keys used to validate forced withdrawal proofs - Can interact with AuthRegistry - set the operator address of the AuthRegistry - Can interact with PrivacyBoost - replace all five proof verifiers, set withdrawal and portal sweep fees (each up to 10%), set token-specific portal minimum sweeps, and change the treasury, operator and gateway route manager - Can interact with AuditGateway - manage the list of registered auditors and set the auditLogger address of the AuditGateway - Can interact with Groth16GiftClaimVerifier - register and replace the Groth16 verification keys used to validate gift settlement and public gift exit proofs - Can interact with Groth16DepositVerifier - register and replace the Groth16 verification keys used to validate deposit epoch proofs - Can interact with Groth16EpochVerifier - register and replace the Groth16 verification keys used to validate epoch proofs Participants (4): [0xcf01AB4fa0C5796811Ad939daB8dEd833cf90683](https://basescan.org/address/0xcf01AB4fa0C5796811Ad939daB8dEd833cf90683), [0x769ef261964f1eDe0a554b74e9bB900d3Fb4AF1E](https://basescan.org/address/0x769ef261964f1eDe0a554b74e9bB900d3Fb4AF1E), [0xB30347E816B525453468cC95C17231Ab04a0C0A9](https://basescan.org/address/0xB30347E816B525453468cC95C17231Ab04a0C0A9), [0xfEa8d7D07365a1A429319EF7A7a265CB4F530237](https://basescan.org/address/0xfEa8d7D07365a1A429319EF7A7a265CB4F530237) ##### TreasuryMultisig Addresses: [0x04484B6065A43fa286e05E9C28a6c4Db77d917f8](https://basescan.org/address/0x04484B6065A43fa286e05E9C28a6c4Db77d917f8) A Multisig with 2/3 threshold. Participants (3): [0x769ef261964f1eDe0a554b74e9bB900d3Fb4AF1E](https://basescan.org/address/0x769ef261964f1eDe0a554b74e9bB900d3Fb4AF1E), [0x90d3EbF1bbE3075F41772bB6f0A54e6038C84244](https://basescan.org/address/0x90d3EbF1bbE3075F41772bB6f0A54e6038C84244), [0xfEa8d7D07365a1A429319EF7A7a265CB4F530237](https://basescan.org/address/0xfEa8d7D07365a1A429319EF7A7a265CB4F530237) ##### EOA 1 Addresses: [0x6Bd37032571F47e50f312542ae05D548B69DC9B0](https://basescan.org/address/0x6Bd37032571F47e50f312542ae05D548B69DC9B0) - Can interact with AuthRegistry - submit account key registrations, rotations and revocations with valid owner signatures - Can interact with PrivacyBoost - submit private transfer, withdrawal, deposit, portal deposit and gift settlement epochs with validity proofs, and simulate gateway withdrawals ##### EOA 2 Addresses: [0xE7F9E649b5406bf0751EA242CAc712151e1c73eB](https://basescan.org/address/0xE7F9E649b5406bf0751EA242CAc712151e1c73eB) - Can interact with AuditGateway - log audit queries performed by registered auditors on the AuditGateway ## Smart contracts Explore these contracts and permissions in Disco, ETHBEAT's contract explorer: https://disco.l2beat.com/ui/p/privacy-boost ### Base Chain #### ExternalCallGateway Addresses: [0x02Eb6E5779f5780A5ABB354341962d9312b7ABe6](https://basescan.org/address/0x02Eb6E5779f5780A5ABB354341962d9312b7ABe6#code) Gateway executing pool-authorized external calls against an allowlist of target addresses and function selectors, with optional input/output token constraints. Enforces proof-bound settlement receipts and redeposits returned funds into the pool. - Roles: - **guardian**: OperatorMultisig - **owner**: AdminMultisig #### Groth16PortalDepositVerifier Addresses: [0x0c8bb018a3d8DF4c5fC86518ca57F8E1445BCF63](https://basescan.org/address/0x0c8bb018a3d8DF4c5fC86518ca57F8E1445BCF63#code) Groth16 verifier for PrivacyBoost portal deposit epoch proofs. Verification keys are stored in SSTORE2 data contracts. - Roles: - **owner**: AdminMultisig #### AuthRegistryProxyAdmin Addresses: [0x321e0edAb1b628aEF03DBe19CC9C7dAB844f84bc](https://basescan.org/address/0x321e0edAb1b628aEF03DBe19CC9C7dAB844f84bc#code) Admin contract of the AuthRegistry proxy. - Roles: - **owner**: AdminMultisig #### TokenRegistryProxyAdmin Addresses: [0x32b0998c86d33b1b6898F486dC78D80FaA27095f](https://basescan.org/address/0x32b0998c86d33b1b6898F486dC78D80FaA27095f#code) Admin contract of the TokenRegistry proxy. - Roles: - **owner**: AdminMultisig #### TokenRegistry Addresses: [0x3A0bea3a715881793cFD698dDEBcF03784f0bE03](https://basescan.org/address/0x3A0bea3a715881793cFD698dDEBcF03784f0bE03#code), [0x2D90FB53C5194E2Dd9a3dc4D4Cf71253799e555E](https://basescan.org/address/0x2D90FB53C5194E2Dd9a3dc4D4Cf71253799e555E#code) (Implementation (Upgradable)), [0x32b0998c86d33b1b6898F486dC78D80FaA27095f](https://basescan.org/address/0x32b0998c86d33b1b6898F486dC78D80FaA27095f#code) (Admin) **Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A) - 2026-09-02 19:24 UTC, deployment of [TokenRegistry](https://basescan.org/address/0x3A0bea3a715881793cFD698dDEBcF03784f0bE03#code): transaction [0x9a59d1b1a8f3dadc2f78b3741ac3b477bc00f039fd22c45a1da9ce0e1488b2a1](https://basescan.org/tx/0x9a59d1b1a8f3dadc2f78b3741ac3b477bc00f039fd22c45a1da9ce0e1488b2a1), implementations: [0x2D90FB53C5194E2Dd9a3dc4D4Cf71253799e555E](https://basescan.org/address/0x2D90FB53C5194E2Dd9a3dc4D4Cf71253799e555E#code) Registry mapping compact token IDs to the ERC-20 tokens accepted by the PrivacyBoost pool. - Roles: - **admin**: TokenRegistryProxyAdmin; ultimately AdminMultisig - **owner**: AdminMultisig Can be upgraded by: AdminMultisig with no delay #### Groth16ForcedVerifier Addresses: [0x40e93d3357A5A3d249437717Da936f6141ba85cE](https://basescan.org/address/0x40e93d3357A5A3d249437717Da936f6141ba85cE#code) Groth16 verifier for PrivacyBoost forced withdrawal proofs. Verification keys are stored in SSTORE2 data contracts. - Roles: - **owner**: AdminMultisig #### AuthRegistry Addresses: [0x4daC7dA2c8cA097B3e0FF42aBFCebd2833196eB3](https://basescan.org/address/0x4daC7dA2c8cA097B3e0FF42aBFCebd2833196eB3#code), [0xECBB712DC58156228187587783286B0662Bc06da](https://basescan.org/address/0xECBB712DC58156228187587783286B0662Bc06da#code) (Implementation (Upgradable)), [0x321e0edAb1b628aEF03DBe19CC9C7dAB844f84bc](https://basescan.org/address/0x321e0edAb1b628aEF03DBe19CC9C7dAB844f84bc#code) (Admin) **Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A) - 2026-09-02 19:24 UTC, deployment of [AuthRegistry](https://basescan.org/address/0x4daC7dA2c8cA097B3e0FF42aBFCebd2833196eB3#code): transaction [0xbc1b2d84d7c1c8379f51ad1b4dfb79891b544ab497bae54485badd192dd7b7a7](https://basescan.org/tx/0xbc1b2d84d7c1c8379f51ad1b4dfb79891b544ab497bae54485badd192dd7b7a7), implementations: [0xECBB712DC58156228187587783286B0662Bc06da](https://basescan.org/address/0xECBB712DC58156228187587783286B0662Bc06da#code) Registry of PrivacyBoost account authorization keys and onchain spend approvals. Supports BabyJubJub keys authorized by account-owner signatures, approval-only accounts and revocable batches of spend approvals. Tracks current and recently superseded auth roots; forced withdrawals validate live auth records directly. - Roles: - **admin**: AuthRegistryProxyAdmin; ultimately AdminMultisig - **allowedRelays**: EOA 1 - **operator**: OperatorMultisig - **owner**: AdminMultisig Can be upgraded by: AdminMultisig with no delay #### PrivacyBoost Addresses: [0x71A0fD3C76E3E937d8275A3cb6a467b70123bD40](https://basescan.org/address/0x71A0fD3C76E3E937d8275A3cb6a467b70123bD40#code), [0x508798455053B0b8BF892454a2A73d88891d9fFd](https://basescan.org/address/0x508798455053B0b8BF892454a2A73d88891d9fFd#code) (Implementation (Upgradable)), [0xd4C0599a5d9A2CcA46Ee05a03405B3ad3407b15e](https://basescan.org/address/0xd4C0599a5d9A2CcA46Ee05a03405B3ad3407b15e#code) (Admin) **Past upgrades** (Count of upgrades: 1, Last upgrade: 1mo 11d ago, Avg upgrade interval: 1mo 1d) - 2026-09-23 22:24 UTC, upgrade of [PrivacyBoost](https://basescan.org/address/0x71A0fD3C76E3E937d8275A3cb6a467b70123bD40#code): transaction [0x016cebde28f09c82a06bdf92d6bbb4631e39767d8ec96c337f1e1eb478324af6](https://basescan.org/tx/0x016cebde28f09c82a06bdf92d6bbb4631e39767d8ec96c337f1e1eb478324af6), implementations: [0x508798455053B0b8BF892454a2A73d88891d9fFd](https://basescan.org/address/0x508798455053B0b8BF892454a2A73d88891d9fFd#code) ([diff](https://disco.l2beat.com/diff/base:0x2944dB0B9500c3F82Af6b231ff83cf4c5B8f5037/base:0x508798455053B0b8BF892454a2A73d88891d9fFd)) - 2026-09-02 19:37 UTC, deployment of [PrivacyBoost](https://basescan.org/address/0x71A0fD3C76E3E937d8275A3cb6a467b70123bD40#code): transaction [0xb57d5d9d8b938eb5567222a01bbddfba9b327ffe0b5219fdb7a410f1f4c006fd](https://basescan.org/tx/0xb57d5d9d8b938eb5567222a01bbddfba9b327ffe0b5219fdb7a410f1f4c006fd), implementations: [0x2944dB0B9500c3F82Af6b231ff83cf4c5B8f5037](https://basescan.org/address/0x2944dB0B9500c3F82Af6b231ff83cf4c5B8f5037#code) Main contract of the PrivacyBoost pool. Escrows ERC-20 tokens and verifies relay-submitted private transfer, withdrawal, deposit, portal deposit and gift settlement proofs. Supports approved external gateway calls and permissionless exits through delayed forced withdrawals or public gift exits. - Roles: - **admin**: PrivacyBoostProxyAdmin; ultimately AdminMultisig - **allowedRelays**: EOA 1 - **gatewayRouteManager**: OperatorMultisig - **operator**: OperatorMultisig - **owner**: AdminMultisig Can be upgraded by: AdminMultisig with no delay #### AuditGateway Addresses: [0x7Bb891f7D7c78A8d6770cb273aBC603A148824b6](https://basescan.org/address/0x7Bb891f7D7c78A8d6770cb273aBC603A148824b6#code), [0x27776Ed100A4D1C6e1479319BE6eB2e262F7CEc4](https://basescan.org/address/0x27776Ed100A4D1C6e1479319BE6eB2e262F7CEc4#code) (Implementation (Upgradable)), [0xB32ef2884794999e1E260a3f68368A24CEF25b35](https://basescan.org/address/0xB32ef2884794999e1E260a3f68368A24CEF25b35#code) (Admin) **Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A) - 2026-09-02 19:37 UTC, deployment of [AuditGateway](https://basescan.org/address/0x7Bb891f7D7c78A8d6770cb273aBC603A148824b6#code): transaction [0xcd03e41021bbf07f85cf52f45650313df42320ba0e64e9b439d8ba5a7b5b514a](https://basescan.org/tx/0xcd03e41021bbf07f85cf52f45650313df42320ba0e64e9b439d8ba5a7b5b514a), implementations: [0x27776Ed100A4D1C6e1479319BE6eB2e262F7CEc4](https://basescan.org/address/0x27776Ed100A4D1C6e1479319BE6eB2e262F7CEc4#code) Manages the list of auditors authorized to query private user data through the Audit API of the TEE, and stores an onchain log of every audit access so that users can publicly verify whether and when their private data was disclosed. - Roles: - **admin**: AuditGatewayProxyAdmin; ultimately AdminMultisig - **auditLogger**: EOA 2 - **owner**: AdminMultisig Can be upgraded by: AdminMultisig with no delay #### AuthPoseidon Addresses: [0x8b72188D4A15661E0a3D232ACecCA7A26757C42D](https://basescan.org/address/0x8b72188D4A15661E0a3D232ACecCA7A26757C42D#code) Poseidon2 hashing helper used by AuthRegistry to compute account IDs, authorization leaves, spend approval commitments and Merkle tree nodes. #### Groth16GiftClaimVerifier Addresses: [0x8f394a08A7544daf39aF38FEA5B2E348180bDC05](https://basescan.org/address/0x8f394a08A7544daf39aF38FEA5B2E348180bDC05#code) Groth16 verifier for PrivacyBoost gift settlement and public gift exit proofs. Verification keys are stored in SSTORE2 data contracts. - Roles: - **owner**: AdminMultisig #### Groth16DepositVerifier Addresses: [0xac60252EF8dbC139e0da63cE7F2a13D25a5B627d](https://basescan.org/address/0xac60252EF8dbC139e0da63cE7F2a13D25a5B627d#code) Groth16 verifier for PrivacyBoost deposit epoch proofs. Verification keys are stored in SSTORE2 data contracts. - Roles: - **owner**: AdminMultisig #### Groth16EpochVerifier Addresses: [0xB144eb785E2CCe17681395Cd475093C01AEeb11e](https://basescan.org/address/0xB144eb785E2CCe17681395Cd475093C01AEeb11e#code) Groth16 verifier for PrivacyBoost private transfer and withdrawal epochs. Keys are indexed by (max transfers, inputs per transfer, outputs per transfer). The nested key registry is not enumerable and emits no registration events; discovery monitors the reviewed production circuit configurations. - Roles: - **owner**: AdminMultisig #### AuditGatewayProxyAdmin Addresses: [0xB32ef2884794999e1E260a3f68368A24CEF25b35](https://basescan.org/address/0xB32ef2884794999e1E260a3f68368A24CEF25b35#code) Admin contract of the AuditGateway proxy. - Roles: - **owner**: AdminMultisig #### PrivacyBoostProxyAdmin Addresses: [0xd4C0599a5d9A2CcA46Ee05a03405B3ad3407b15e](https://basescan.org/address/0xd4C0599a5d9A2CcA46Ee05a03405B3ad3407b15e#code) Admin contract of the PrivacyBoost proxy. - Roles: - **owner**: AdminMultisig