Search
Search projects, tokens and protocols by name or address
Pin a project to keep it here. Saved only in this browser.
RailgunRailgun
About
A shielded ledger on Ethereum for ERC-20 tokens, with private transfers and DeFi calls, run by no operator and governed by RAIL stakers.
RailOxide v0.2.0-beta.10most private of 5 checkedAbout
A shielded ledger on Ethereum for ERC-20 tokens, with private transfers and DeFi calls, run by no operator and governed by RAIL stakers.
Railgun lets the user shield tokens on Ethereum, send them privately to other Railgun users, use them in DeFi and unshield them to any address. Sender, recipient, token and amount stay hidden inside the pool, including which shield funds which unshield. Shields and unshields are public.
No operatorAn operator is the entity charged with managing a rollup and progressing its state. A rollup operator can be a centralized sequencer, proposer, prover, challenger, pauser of admin that is able to perform upgrades. holds a key into the pool. RAIL stakers govern the core contract through a DAO, whose upgrades wait 7 days. Leaving is permissionlessAnyone willing should be able to join and leave the network at any time, without causing significant disturbance to the network or being detrimental to the party in question. No single entity should have the power to allowlist or blocklist participants.: the user can submit their own unshield at any time.
Architecture
Balances are encrypted notes in a public tree of commitments. Spending a note publishes its nullifier, and a zk-SNARKShort for "succinct non-interactive argument of knowledge", a SNARK is a widely used type of zero-knowledge proof that is short and fast to verify. Different kinds of SNARKs are usually systematized by proof size, verification time, and type of setup. The most famous SNARKs are Groth16, PLONK/Marlin, Bulletproofs, and STARKs. proves the spend without revealing which note it was. Each note is encrypted to the recipient’s 0zk address.
Flow
- Shield. You send tokens to the pool, which creates a note for your 0zk address. Your address, token and amount are public.
- Transfer. Your wallet proves the spend locally. A broadcaster, reached over the Waku network, submits it and pays the gasA virtual fuel used to execute smart contracts on a rollup. The EVM (or other VM within the rollup) uses an accounting mechanism to correspond the consumption of gas to the consumption of computing resources, and to limit the consumption of computing resources. for a fee paid in a private note.
- DeFi. A DeFi bundle unshields tokens to an adapter contract, runs the calls and shields the results back in one transaction. Tokens and amounts of the calls are public.
- Unshield. The pool pays out to any address. Recipient, token and amount are public.
Keys
The user’s wallet derives spending and viewing keys from a recovery phrase. The user can share a read-only viewing key, which discloses all their private transactions.
App
The app sends its traffic over built-in Tor, each sensitive call on its own circuitA program written for the purpose of being proven within a proving system. A circuit is a mathematical representation of the computation to be executed, arithmetic circuits and zkVM execution trace are examples of circuits. Circuits can be written in different languages, ranging from low-level to high-level.. It builds Private Proofs of Innocence (PPoI) from a local copy of the lists. Instead of a broadcaster, the user can submit from a public account that pays the gas. On Ethereum, a public account without ETH can submit too, and the transaction pays a block builder from the private balance.
Swaps
The app swaps through CoW Protocol. Each swap uses a fresh swap account as its adapter. A broadcaster submits the account’s EIP-7702 delegation to RelayAdapt7702. The account signs a CoW order, which the app sends over a separate Tor circuit. The order carries the signed unshield, so its nullifiers are public before it fills. At settlementThe mechanism with which the execution of rollup blocks and the resultant state is verified and possible disputes are resolved. In the context of rollups or other modular blockchains, it often refers to the proof system used--validity (ZK) or fraud proofs, or a combination thereof. Sometimes it will refer to this mechanism along with where the mechanism's outputs are ultimately published and verified, as in Ethereum being a settlement layer by verifying the proofs and allowing for withdrawals. the account unshields, trades and shields the proceeds back, or CoW pays them to an address the user names. Across or NEAR Intents can deliver them on another chain instead. The account ties the setup to the swap, and an unfilled order to the later spend of its notes.
Compliance
Screening happens offchain. A PPoI proves that a note descends only from shields a list provider accepted. The default list screens shields with Chainalysis’s sanctions API. Broadcasters on Ethereum require a PPoI, and a transaction the user submits directly skips the check.
Fees
Shields pay a protocol fee of 0.25% and unshields 0.25%, both to the Railgun Treasury. The NFT fee is 0. Broadcasters charge their own fee per transaction.
Anonymity setIn privacy protocols, anonymity set denotes all users, to which a particular withdrawal could be plausibly attributed. Anonymity set depends on a particular withdrawal, the size of the anonymity set is a metric for level of user's privacy.
Each token has its own anonymity set. Private transfers between users mix their notes within it.
What the protocol promises: Hides everything inside the pool, including which shield funds which unshield. Shields and unshields are public.
RailwayLeaks moreAsks a PPoI node about the user's notes in batches without Tor, so the node can tie them together and to the user's IP.
Fix: Build PPoI from a local copy of the lists, as RailOxide does. · Source
Anon WalletLeaks moreSends the user's public and 0zk addresses to Anon's server at setup, even without a username, so Anon can link them.
Fix: Create wallets without registering the user's addresses with Anon's server. · Source (checked 2026-10-30)
Terminal WalletLeaks moreAsks a PPoI node about the user's notes in batches without Tor, so the node can tie them together and to the user's IP.
Fix: Build PPoI from a local copy of the lists, as RailOxide does. · Source
FacelessLeaks moreAsks a PPoI node about the user's notes in batches, so the node can tie them together.
Fix: Build PPoI from a local copy of the lists, as RailOxide does. · Source (checked 2026-10-30)
Ethereum is public by default. Each protocol is rated on its main privacy promise, like hiding who paid, who received, how much, or which deposit became which withdrawal. Against each adversary, the colour says whether it holds for a careful user with the app's own settings: green yes, yellow only with significant extra work, red no. Fields marked at risk stay private only under the condition in their note.
Everything inside the pool is hidden, including which shield funds which unshield. Shields and unshields show address, token and amount. DeFi bundles unshield to an adapter in cleartext.
Advice: Exit through a broadcaster, so none of the user's wallets pay gas for the receiving address.
The candidates for an unshield are the shields of the same token. In-pool transfers break a one-to-one match, while timing and exact amounts narrow it.
Advice: Use a pool with a large anonymity set. Withdraw common amounts rather than everything at once. Wait before exiting and pick a different time of day than the deposit. Exit to a fresh address every time and spend from it with a different wallet than the one that deposited.
Inside, the same as for a public observer.
With a local nodeA software client that participates in the network. as direct endpoint for reads, RailOxide keeps Ethereum reads local and sends the rest over built-in Tor. By default public RPCs get the reads that name the user, each over its own Tor circuitA program written for the purpose of being proven within a proving system. A circuit is a mathematical representation of the computation to be executed, arithmetic circuits and zkVM execution trace are examples of circuits. Circuits can be written in different languages, ranging from low-level to high-level., so only timing ties them.
Advice: Before unlocking, set a local Ethereum node as the direct endpoint for reads, and keep one public endpoint for submissions.
Only the user holds viewing keys, and DAO upgrades wait 7 days. PPoI list providers can refuse a shield, which leaves a self-broadcast exit. RailOxide builds PPoIs from a local copy of the lists. After each transaction it sends the PPoI nodeA software client that participates in the network. only that transaction’s new notes with their proofs.
Advice: Watch governance proposals and unshield before an upgrade the user rejects executes.
Whoever breaks elliptic-curve cryptography decrypts every note sent to a 0zk address they know. A user who gives theirs to payers depends on each of them keeping it private.
Advice: Share the user's 0zk address privately, with a fresh one per counterparty where possible.
30 day historic anonymity set
How many unique depositors you could have blended in with if you withdrew on a particular day after depositing during the previous 30 days. This metric is a proxy for the historic anonymity set and shows how it developed over time.
The metric looks backwards: it counts deposits that already happened, including from addresses that have since withdrawn. Your real anonymity also depends on deposits made after yours, which cannot be known in advance.
Estimated anonymity set by holding duration
An estimate of how many unique depositors you blend in with, depending on how long you leave your deposit in the pool. It is based on historic data of past deposits: each point counts depositors from the preceding period, so holding for up to 30 days effectively means blending in with everyone who deposited during the last 30 days.
Asset | Deposits 7D | Deposits 30D | Deposits Total | Value Locked |
|---|---|---|---|---|
 WETH | 412 $2.99 M | 1.96 K $19.14 M | 46.16 K $1.53 B | $47.95 M |
 USDT | 326 $3.83 M | 1.51 K $23.04 M | 13.23 K $432.60 M | $29.27 M |
 USDC | 157 $2.16 M | 623 $9.14 M | 10.00 K $311.10 M | $16.53 M |
 DAI | 19 $1.28 M | 69 $2.91 M | 2.23 K $199.92 M | $5.71 M |
 NEAR | 0 $0.00 | 0 $0.00 | 0 $0.00 | $3.33 M |
 WBTC | 9 $394.08 K | 26 $1.02 M | 689 $42.50 M | $2.85 M |
 RAIL | 2 $37.39 | 14 $2.18 M | 356 $5.87 M | $2.59 M |
 FLUID | 0 $0.00 | 0 $0.00 | 2 $1.55 M | $219.82 K |
| Total | 925 $10.67 M | 4.21 K $57.46 M | 72.68 K $2.53 B | $108.47 M |
Current pool goes live on Ethereum
8 May 2022
The proxy that holds today’s pool is unpaused with the RailgunLogic implementation.
Funds can be stolen if
- the zk proof systemThe infrastructure that allows projects to verify their state transitions. It is composed by onchain verifiers and offchain provers. The main two flavors are optimistic and ZK proof systems, but they can be combined in a hybrid model. In general though, if a system is able to accept state roots optimistically, even if it has a ZK component, it is considered an optimistic proof system. is broken, allowing invalid spends or withdrawals.
- all trusted setup participants collude or leak their secrets, allowing forged proofs.
- the DAO passes a malicious upgrade and users stay in the pool past its 7 days execution delay.
Funds can be lost if
- a user loses the keys of their private balance.
Privacy can be lost if
- a user sends transactions from their own public address (see public observer).
- a user keeps RailOxide’s public RPCs, which can pair their public addresses with their private transactions by timing (see networkA constellation of nodes (peers) that communicate via a peer-to-peer protocol, for example, in propagating transactions and blocks to other nodes. observer).
- elliptic-curve cryptography is broken, which decrypts every note sent to a 0zk address the attacker knows (see future adversary).
RAIL stakers govern Railgun through a DAO. It can upgrade the core contract and its circuits, which changes the rules for every shielded token. It can also blockAn ordered list of transactions and chain-related metadata that gets bundled together and published to the L1/DA layer. Nodes execute the transactions contained within blocks to change the rollup chain’s state. Protocol rules dictate what constitutes a valid block, and invalid blocks are skipped over. tokens from new shields, mint RAIL and manage governance rewards. Governance docs.
Upgrades
Normal upgrade path
- Create a proposal with an IPFS link and onchain calldata in the Voting contract
- Collect 500.00 K RAIL sponsorship within 1mo
- Wait 2d
- Cast Yay votes within 5d and Nay votes within 6d
- Pass with a simple majority and 2.00 M RAIL quorum
- Wait 7d
- PermissionlessAnyone willing should be able to join and leave the network at any time, without causing significant disturbance to the network or being detrimental to the party in question. No single entity should have the power to allowlist or blocklist participants. execution through the Delegator within 14d
Exit window
7d — a passed proposal must wait this long before it can be executed, giving users time to unshield funds.
Token governance
- Governance token
RAIL1 token = 1 vote, delegated. Total supply: 60.00 M RAIL, DAO-owned treasury (unavailable for voting): 2.02 M RAIL, staked for voting: 42.52 M RAIL, the rest is circulating supply.- Stake lock
Unstaking has 1mo delay.
- Voting venue
Voting contract on Ethereum. Proposal text is distributed over IPFS, its CID is available as a parameter of
createPropsal()call on the voting contract.- Proposal threshold
No threshold to create a proposal. A proposal must receive sponsorship from 500.00 K RAIL stake within 1mo.
- Quorum
2.00 M RAIL, with a simple majority required for acceptance.
- Execution model
Onchain calldata · PermissionlessAnyone willing should be able to join and leave the network at any time, without causing significant disturbance to the network or being detrimental to the party in question. No single entity should have the power to allowlist or blocklist participants. execution through the Delegator. A passed proposal waits 7d, after which anyone can execute it through the Delegator contract within 14d.
Railgun
- 1Phase 1 · Universal54contributions
- 2Phase 2 · Circuit-specific304contributions
Counted in the published 1×1 circuit transcript.
Detailed description
CircuitA program written for the purpose of being proven within a proving system. A circuit is a mathematical representation of the computation to be executed, arithmetic circuits and zkVM execution trace are examples of circuits. Circuits can be written in different languages, ranging from low-level to high-level.-specific Phase 2For Groth16 trusted setup, phase 2 represents circuit-dependent part of the trusted setup. It generates a part of the secret cryptographic data required for Groth16 ZK protocol to work. If the outcome of phase 2 trusted setup ceremony is known, arbitrary proofs could be forged. trusted setupGeneration of a piece of data that must then be used for some cryptographic protocol to run. Generating this data requires some secret information. The "trust" comes from the fact the secret must be destroyed after the ceremony, otherwise cryptographic properties of the protocol could be broken. Once the data is generated, and the secrets are forgotten, no further participation from the creators of the ceremony is required.
There are two types of trusted setups for SNARKs: (i) trusted setup per circuit where it is generated from scratch for each circuit, (ii) trusted universal setup per proving system where it can be used for several circuits. for Railgun’s 54 Groth16A zk-SNARK proving system introduced by Groth in 2016 that proves arithmetic circuits and requires a separate trusted setup for each circuit. It allows extremely efficient proof verification. circuits (parameterised by
transaction input/output counts) over the BN254 curve. It builds on the
Hermez ceremony as Phase 1For Groth16 trusted setup, phase 1 represents circuit-independent part of the trusted setup (e.g. Perpetual Powers of Tau), which could be reused across different circuits. It generates a part of the secret cryptographic data required for Groth16 ZK protocol to work. If the outcome of phase 1 trusted setup ceremony is known, arbitrary proofs could be forged., using powersOfTau28_hez_final_20.ptau.
This contains 54 Perpetual Powers of Tau participant contributions and one public
randomness beacon, for 55 transcript records. The beacon is not an additional participant.
A separate Phase 2 ceremony was publicly announced, open to anonymous and identified participants, and wrapped up in late December 2022.
Verified against the ceremony artifact IPFS hashA fixed-length fingerprint of variable-size input, produced by a hash function.
QmWAySHYhaZqioKi1ufrPJC1n1ZVtHP2w4hLA9XqqJCFne: the
/contributors directory contains 328 sequentially-numbered attestation files with
GitHub or Twitter handles, and the /zkeys directory contains 54 final zkey files (one
per circuit). Parsing the final zkey binary for the 1x1 circuit shows 304 Phase 2
contributions on that circuit.
- Phase 1 ceremony: https://github.com/iden3/snarkjs/tree/master?tab=readme-ov-file.
- Prepared file description (54 contributions and a beacon): https://github.com/iden3/snarkjs#7-prepare-phase-2.
- Ceremony artifacts on IPFS: https://ipfs.io/ipfs/QmWAySHYhaZqioKi1ufrPJC1n1ZVtHP2w4hLA9XqqJCFne
- Ceremony announcement: https://medium.com/@Railgun_Project/railgun-project-begins-setup-ceremony-with-an-emphasis-on-security-d1c63117c312
- Advanced Circuit ceremony user guide: https://medium.com/@Railgun_Project/railgun-advanced-circuit-setup-ceremony-user-guide-32361c54242
- Docs overview of the trusted setup: https://docs.railgun.org/wiki/learn/privacy-system/trusted-setup-ceremony
- Railgun circuits repository with ceremony scripts: https://github.com/Railgun-Privacy/circuits-v2
Verification | Used in | Known deployments | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Railgun verifier | by | | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verifier ID: Railgun 91 circuit verifier 03.07.2026Known deployments1 Used in Verification steps Railgun smart contract acts as a verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. for ZK proofs for all 91 Railgun circuits. 91 different verification keys for these circuits are stored onchain in the verifier smart contract. This regeneration attests that the verification keys stored onchain correspond to circuits published in Railgun repo. Generally, to regenerate all Railgun verification keys, the following has to be done:
Helper scripts that implement the flow above and more detailed explanations could be found in this script .zip archive. This .zip must be extracted in | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Ossification
Contracts our research team classifies as critical form the project's critical perimeter. Its clock starts at the ossification genesis, and every critical change resets it (changes within 24 hours count as one). The ossification score is the share of recorded code-bug exploits whose exploited code was younger than this perimeter is today. Battle-tested exposure is the value secured, summed over that unchanged period.
Discovery updates
High severity11changesDiscover both RelayAdapt7702 deployments, Railgun's EIP-7702 delegation targets: 0x1F74 from Railgun's shared config and 0x05ae, which RailOxide pins.
Discover both RelayAdapt7702 deployments, Railgun’s EIP-7702 delegation targets: 0x1F74 from Railgun’s shared config and 0x05ae, which RailOxide pins.
| contract RelayAdapt7702_1F74 (eth:0x1F74b4339990Db761bC0168F20D294A3a141497e) [railgun/RelayAdapt7702] { | |
| +++ description: Implementation that accounts delegate to with EIP-7702 to run Railgun DeFi actions. A delegated account unshields through Railgun, runs calls and shields or sends the resulting tokens. Each action needs a signature from the account's own key, so anyone, such as a broadcaster, can submit it. | |
| type: | |
| - | "EOA" |
| + | "Contract" |
| proxyType: | |
| - | "EOA" |
| + | "immutable" |
| template: | |
| + | "railgun/RelayAdapt7702" |
| sourceHashes: | |
| + | ["0xe677c8fcceecb91897609845535917eb2012931220853e62705536acc690e42b"] |
| description: | |
| + | "Implementation that accounts delegate to with EIP-7702 to run Railgun DeFi actions. A delegated account unshields through Railgun, runs calls and shields or sends the resulting tokens. Each action needs a signature from the account's own key, so anyone, such as a broadcaster, can submit it." |
| deployerAddress: | |
| + | "eth:0x43b89E9f43b2ded5392D4eB9B21543bAFCE38e1B" |
| sinceTimestamp: | |
| + | 1790628623 |
| sinceBlock: | |
| + | 26078451 |
| values: | |
| + | {"$immutable":true,"adaptImplementation":"eth:0x1F74b4339990Db761bC0168F20D294A3a141497e","DOMAIN_SEPARATOR":"0x62615f60e6de8a1f4686082f9507bcd1b989a17bf7aad577657d344991d12c56","EXECUTE_TYPEHASH":"0xf24df5a0a7b800b8aa018f2ee7814e1f20511e66c80cc9b50ad5e68d95c85ff0","MULTICALL_TYPEHASH":"0x8bc0c0cf848c4ed87fd79dd13bc882697157c33ae51240463630f848bc06cd18","nonce":0,"railgun":"eth:0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9","wBase":"eth:0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2"} |
| implementationNames: | |
| + | {"eth:0x1F74b4339990Db761bC0168F20D294A3a141497e":"RelayAdapt7702"} |
| } | |
New and verified contracts
| + | Status: CREATED |
| contract RelayAdapt7702_05ae (eth:0x05ae73c5925d843864ae6F261f3175De2ebCd963) [railgun/RelayAdapt7702] | |
| +++ description: Implementation that accounts delegate to with EIP-7702 to run Railgun DeFi actions. A delegated account unshields through Railgun, runs calls and shields or sends the resulting tokens. Each action needs a signature from the account's own key, so anyone, such as a broadcaster, can submit it. | |
High severity2changesBoth VerificationKeySetters were moved into SETTING state by their EOA owners, thus preventing the possibility of changing Railgun contract verification keys to an older version by a single EOA without DAO participation.
Both VerificationKeySetters were moved into SETTING state by their EOA owners, thus preventing the possibility of changing Railgun contract verification keys to an older version by a single EOA without DAO participation.
| contract VerificationKeySetter_64DA (eth:0x64DA0892E8E24fECa6Eb5E3D8cbf2D9b6Fbe7598) [railgun/VKeySetter] { | |
| +++ description: Auxiliary verifier-key staging contract. Its owner stores replacement verification keys locally and, if Railgun governance switches the contract into COMMITTING state, can register the new keys in the Railgun smart wallet verifier. | |
| +++ description: Current workflow phase: SETTING, WAITING, or COMMITTING. Only COMMITTING allows the owner to forward staged verification keys to the verifier. | |
| +++ severity: HIGH | |
| values.state: | |
| - | 2 |
| + | 0 |
| } | |
| contract VerificationKeySetter_9086 (eth:0x9086aFC6FC88667d4031Cabd556AfDD0E3903B46) [railgun/VKeySetter] { | |
| +++ description: Auxiliary verifier-key staging contract. Its owner stores replacement verification keys locally and, if Railgun governance switches the contract into COMMITTING state, can register the new keys in the Railgun smart wallet verifier. | |
| +++ description: Current workflow phase: SETTING, WAITING, or COMMITTING. Only COMMITTING allows the owner to forward staged verification keys to the verifier. | |
| +++ severity: HIGH | |
| values.state: | |
| - | 2 |
| + | 0 |
| } | |
High severity1changeFour new proposals (IDs 29-32) created 2026-09-06 by the same proposer (0x5964ed1e...), all byte-identical, so effectively one proposal submitted four times. Title: "Add USDC and USDT to AGR Rewards". Single action: Delegator calls addTokens([USDT, USDC]) on GovernorRewards, adding both stablecoins to the Active Governor Rewards distribution set (4.2% of Treasury balance per 2-week interval streamed to stakers). No other parameter changes. Only ID 32 has sponsorship (~90.7k of the 500k RAIL threshold), 29-31 have none. None has gone to vote or been executed. Proposal 28 (swap ~15.1k Treasury USDC to DAI via Curve 3pool, all DAI returned to Treasury) is still open with zero sponsorship. Governance UI: https://governance.railgun.org/proposals/v2/32 (proposal document on IPFS: bafkreia5rfx3x4phxl3tyscjc55eaac5sd7dnfjpsk4nywlgq55viy4e5e).
Four new proposals (IDs 29-32) created 2026-09-06 by the same proposer (0x5964ed1e…), all byte-identical, so effectively one proposal submitted four times. Title: “Add USDC and USDT to AGR Rewards”. Single action: Delegator calls addTokens([USDT, USDC]) on GovernorRewards, adding both stablecoins to the Active Governor Rewards distribution set (4.2% of Treasury balance per 2-week interval streamed to stakers). No other parameter changes. Only ID 32 has sponsorship (~90.7k of the 500k RAIL threshold), 29-31 have none. None has gone to vote or been executed. Proposal 28 (swap ~15.1k Treasury USDC to DAI via Curve 3pool, all DAI returned to Treasury) is still open with zero sponsorship.
Governance UI: https://governance.railgun.org/proposals/v2/32 (proposal document on IPFS: bafkreia5rfx3x4phxl3tyscjc55eaac5sd7dnfjpsk4nywlgq55viy4e5e).
| contract Voting (eth:0xc480F68A3dcC3EdD82134FAB45C14A0FcF1dA3CC) [railgun/Voting] { | |
| +++ description: Token-weighted Railgun governance contract. Proposals must be sponsored, voted through quorum, and then executed through the Delegator. | |
| +++ severity: HIGH | |
| values.proposalCount: | |
| - | 29 |
| + | 33 |
| } | |
High severity4changesSwap USDC to DAI proposal: https://tools.l2beat.com/decoder-new/?hash=0x83963ddea866aa6d77200fd5f6633d59aa6d4dc9a807496277f6910cc76a0369&data=AwA Actions: 1. Treasury → Delegator: 15109.211424 USDC 2. Delegator: USDC.approve(Curve3pool, 15109.211424) 3. Curve3pool: exchange USDC→DAI (min dy = 15031.466111962828487747 DAI, 0.5% slippage) 4. Delegator → Treasury: 15031.466111962828487747 DAI (floor) 5. Delegator → Treasury: 75.535005587752906974 DAI (expected bonus)
Swap USDC to DAI proposal: https://tools.l2beat.com/decoder-new/?hash=0x83963ddea866aa6d77200fd5f6633d59aa6d4dc9a807496277f6910cc76a0369&data=AwA
Actions:
- Treasury → Delegator: 15109.211424 USDC
- Delegator: USDC.approve(Curve3pool, 15109.211424)
- Curve3pool: exchange USDC→DAI (min_dy = 15031.466111962828487747 DAI, 0.5% slippage)
- Delegator → Treasury: 15031.466111962828487747 DAI (floor)
- Delegator → Treasury: 75.535005587752906974 DAI (expected bonus)
| EOA (eth:0x5a02474A3083Bc969f20F92E7a8bd3824EC607f0) { | |
| +++ description: None | |
| proxyType: | |
| - | "EOA" |
| + | "EIP7702 EOA" |
| sourceHashes: | |
| + | ["0xd9649be084919b1ae25d4d396555667632253f10ddb6a9bddc939db45f797b10"] |
| values: | |
| + | {"$implementation":"eth:0x5A7FC11397E9a8AD41BF10bf13F22B0a63f96f6d","nonce":0} |
| } | |
| contract Voting (eth:0xc480F68A3dcC3EdD82134FAB45C14A0FcF1dA3CC) [railgun/Voting] { | |
| +++ description: Token-weighted Railgun governance contract. Proposals must be sponsored, voted through quorum, and then executed through the Delegator. | |
| +++ severity: HIGH | |
| values.proposalCount: | |
| - | 28 |
| + | 29 |
| } | |
High severity1changeNew proposal on Railgun DAO: "Base deployment of RAILGUN Privacy System". Onchain execution of this proposal sends tasks to OPStackSender contract: https://tools.l2beat.com/decoder-new/?hash=0xfd5860b22fad6d5bf81cd4e9c809b2016ed08971b0fbf96aaf033fdbf87b52ec&data=AwA. These tasks initialize verification keys for all railgun circuits on the main Railgun contract on Base ( base:0x0047d1F97674614189E80566575FB615788AcF25 ). Railgun smart contracts on Base are already deployed, with bytecode matching the deployment on Ethereum. The proposal doesn't look malicious.
New proposal on Railgun DAO: “Base deployment of RAILGUN Privacy System”.
Onchain execution of this proposal sends tasks to OPStackSender contract: https://tools.l2beat.com/decoder-new/?hash=0xfd5860b22fad6d5bf81cd4e9c809b2016ed08971b0fbf96aaf033fdbf87b52ec&data=AwA. These tasks initialize verification keys for all railgun circuits on the main Railgun contract on Base (base:0x0047d1F97674614189E80566575FB615788AcF25).
Railgun smart contracts on Base are already deployed, with bytecode matching the deployment on Ethereum.
The proposal doesn’t look malicious.
| contract Voting (eth:0xc480F68A3dcC3EdD82134FAB45C14A0FcF1dA3CC) [railgun/Voting] { | |
| +++ description: Token-weighted Railgun governance contract. Proposals must be sponsored, voted through quorum, and then executed through the Delegator. | |
| +++ severity: HIGH | |
| values.proposalCount: | |
| - | 27 |
| + | 28 |
| } | |
Ethereum
Actors:
Token-weighted Railgun governance contract. Proposals must be sponsored, voted through quorum, and then executed through the Delegator.
- Can upgrade with no delay
- GovernorRewards Delegator → ProxyAdmin
- LegacySweeper Delegator
- Treasury Delegator → ProxyAdmin
- RailgunSmartWallet Delegator → ProxyAdmin
- Can interact with VerificationKeySetter_64DA
- switch the VKeySetter into COMMITTING so its owner can push stored verification keys to the verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. Delegator
- Can interact with VerificationKeySetter_9086
- switch the VKeySetter into COMMITTING so its owner can push stored verification keys to the verifier Delegator
- Can interact with GovernorRewards
- add or remove allowed reward safety vectors Delegator
- add or remove reward tokens from the distribution set Delegator
- change the per-interval reward rate Delegator
- pause, unpause, transfer proxy ownership, or upgrade the GovernorRewards implementation Delegator → ProxyAdmin
- Can interact with LegacySweeper
- pause, unpause, transfer proxy ownership, or upgrade the legacy Sweeper implementation Delegator
- Can interact with Delegator
- grant or revoke delegated caller permissions and transfer ownership of the Delegator
- Can interact with Rail Token
- mint additional RAIL up to the hard cap and transfer token ownership Delegator
- Can interact with Treasury
- grant or revoke treasury roles, including who can move ETH and ERC20s out of the treasury Delegator
- pause, unpause, transfer proxy ownership, or upgrade the treasury implementation Delegator → ProxyAdmin
- transfer ETH or ERC20s out of the treasury Delegator → ProxyAdmin → GovernorRewards - or Delegator → LegacySweeper - or Delegator
- Can interact with RailgunSmartWallet
- add or remove allowed SNARKShort for "succinct non-interactive argument of knowledge", a SNARK is a widely used type of zero-knowledge proof that is short and fast to verify. Different kinds of SNARKs are usually systematized by proof size, verification time, and type of setup. The most famous SNARKs are Groth16, PLONK/Marlin, Bulletproofs, and STARKs. safety vectors Delegator
- add or remove tokens from the shielding blocklist Delegator
- change the shield, unshield, and NFT fee schedule Delegator
- change the treasury that receives protocol fees Delegator
- pause, unpause, transfer proxy ownership, or upgrade the Railgun smart wallet implementation Delegator → ProxyAdmin
- Can interact with VerificationKeySetter_9086
- stage replacement verification keys and manage the helper’s local SETTING and WAITING states
- Can interact with VerificationKeySetter_64DA
- stage replacement verification keys and manage the helper’s local SETTING and WAITING states
Ethereum
Collects Railgun fees. Managed through access control roles.
- Roles:
- admin: ProxyAdmin; ultimately Voting
- defaultAdminRoleMembers: Delegator; ultimately Voting
- transferRoleMembers: Delegator, GovernorRewards, IntervalPayouts, LegacySweeper; ultimately Voting
Main system contract and escrow that accepts shielded deposits, verifies private transactions and unshields, and maintains the commitment tree.
- Roles:
- admin: ProxyAdmin; ultimately Voting
- owner: Delegator; ultimately Voting
Admin interface for Railgun’s pausable upgradeable proxies. It does not hold funds, but its controller can operate every proxy attached to it.
- Roles:
- owner: Delegator
Auxiliary verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover.-key staging contract. Its owner stores replacement verification keys locally and, if Railgun governance switches the contract into COMMITTING state, can register the new keys in the Railgun smart wallet verifier.
- Roles:
- delegator: Delegator; ultimately Voting
- owner: EOA 2
Auxiliary verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover.-key staging contract. Its owner stores replacement verification keys locally and, if Railgun governance switches the contract into COMMITTING state, can register the new keys in the Railgun smart wallet verifier.
- Roles:
- delegator: Delegator; ultimately Voting
- owner: EOA 1
Reward distributor that pulls assets from the Railgun treasury and allocates them to stakers via token voting.
- Roles:
- admin: ProxyAdmin; ultimately Voting
- owner: Delegator; ultimately Voting
Older Railgun sweeper generation that still holds Treasury transfer rights. It is upgradeable and forwards balances to an immutable receiver.
- Roles:
- admin: Delegator; ultimately Voting
Permission router proxy owned by Railgun governance.
- Roles:
- owner: Voting
- verificationKeyDelegates: VerificationKeySetter_64DA, VerificationKeySetter_9086
RAIL governance token contract with a capped (100,000,000 RAIL total supply) mint schedule and an early anti-bot transfer override.
- Roles:
- owner: Delegator; ultimately Voting
RAIL staking contract that tracks delegated voting power, enforces a 1mo unstake delay, and snapshots staking balances for governance every 1d. Its parameters define the governance voting system.
Immutable payout stream that can pull a fixed amount of a configured asset from the Railgun treasury to a fixed beneficiary whenever the next interval is due.
Implementation that accounts delegate to with EIP-7702 to run Railgun DeFi actions. A delegated account unshields through Railgun, runs calls and shields or sends the resulting tokens. Each action needs a signature from the account’s own key, so anyone, such as a broadcaster, can submit it.
Implementation that accounts delegate to with EIP-7702 to run Railgun DeFi actions. A delegated account unshields through Railgun, runs calls and shields or sends the resulting tokens. Each action needs a signature from the account’s own key, so anyone, such as a broadcaster, can submit it.
Execution adapter contract for Railgun. To interact with public contracts from shielded pools, tokens are unshielded to RelayAdapter, which performs specified calls and shields tokens back to the same user.