Search
Search projects, tokens and protocols by name or address
Pin a project to keep it here. Saved only in this browser.
Tacit PayTacit Pay
About
A shielded ledger for ETH with private transfers, proven in the browser, with immutable contracts and an app stored on Ethereum.
About
A shielded ledger for ETH with private transfers, proven in the browser, with immutable contracts and an app stored on Ethereum.
Tacit Pay lets you shield ETH into a private balance, pay any Tacit address privately and withdraw any part to any address. Inside the pool, who pays whom and how much stays hidden, and a withdrawal does not show which deposit paid it. Deposits and withdrawals show address and amount.
The contracts have no owner, pause or upgrade. Users trust Tacit’s relay, which sends spends by default. They also trust Tacit’s app owner, a single key that controls the app’s name and the endpoints the app reads. Users can send their own spends and withdraw without Tacit.
Architecture
A note is a private record of ETH, published only as a hashA fixed-length fingerprint of variable-size input, produced by a hash function. of its value, its owner’s key and a random value. The TacitEvmPool holds all deposits, a tree of note hashes and the spent nullifiers. Spending a note publishes its nullifier, a hash only the owner can compute, which marks the note spent without naming it. Each transaction carries one proof that spends up to two notes and creates up to two. Each new note carries a memo with its value, encrypted to the recipient’s view key. Wallets find their notes by decrypting memos on the device.
Deposit addresses
A deposit address is an ordinary address derived from the user’s keys. Anyone can pay it, and anyone can sweep its balance into the pool as a note for that user. The app issues a new one for each payer who asks. A payment link names one deposit address and carries a signature over it by the payee’s view key.
Flow
- Sign in. Your wallet signs a fixed message, and the page derives your Tacit keys from the signature. Nothing goes onchain.
- Shield. You deposit from your wallet, or pay one of your deposit addresses from any wallet, which the relay then sweeps in. Your address and the amount are public.
- Send. The page proves on your device and the relay submits the proof. Only nullifiers, note hashes and encrypted memos become public.
- Withdraw. The relay pays the address and amount you choose and takes its fee from your balance. The recipient and amount are public, the change stays a note.
Keys
All keys derive from one signature of the user’s wallet over a fixed message, so whoever obtains that signature controls the funds. Contract wallets cannot sign in. A Tacit address holds three public keys: one that checks spends, one behind each note’s nullifier and one that payers encrypt memos to. A .wei, .gwei or .eth name can publish the whole address onchain in its finance.tacit text record, so payers can pay the name. Deposit addresses can be found again from the keys alone.
App
anon.wei is one HTML page stored as contract code on Ethereum, each version immutable. The reviewed version is the TacitPay8244 contract below. Save it from your own nodeA software client that participates in the network. with cast call 0x0000000d42137547140b0812E1178F025e08bc49 "html()(string)" --rpc-url <node> --json | jq -j '.[0]' > anon.html, check that the file’s sha256 is 3b94ab980316470756345dd754cd212dde57067e0ef95dce1531fcaecfde9c08 and serve it from localhost. Its sign-in note sends users to anon.wei.limo, which serves whichever version the app owner names. The page checks the proving files against pinned hashes.
NetworkA constellation of nodes (peers) that communicate via a peer-to-peer protocol, for example, in propagating transactions and blocks to other nodes.
The page reads the chain through public RPC nodes and syncs from the relay’s history feed. It keeps a feed page only where the tree it builds matches a root the pool has held. The feed can still hide a note, which Rebuild recovers from chain logs. Under Endpoints the user can set their own node and another relay or none.
Exits
Any account can submit a proof, and the proof fixes recipient, amount, relayer and fee, so a relayer can change none of them. A withdrawal that creates no notes cannot be made stale by other transactions. Any account can sweep a deposit address, and its owner can do so without a fee.
Fees
The contracts take no fee. The relay charges the transaction’s gasA virtual fuel used to execute smart contracts on a rollup. The EVM (or other VM within the rollup) uses an accounting mechanism to correspond the consumption of gas to the consumption of computing resources, and to limit the consumption of computing resources. plus a margin, which the page checks against a ceiling. Sweeping a deposit address costs at most 0.25% of its balance, and the relay sweeps only balances that cover its gas.
Anonymity setIn privacy protocols, anonymity set denotes all users, to which a particular withdrawal could be plausibly attributed. Anonymity set depends on a particular withdrawal, the size of the anonymity set is a metric for level of user's privacy.
The set counts each account that sent a deposit into the ETH pool on Ethereum. A deposit through a deposit address counts the account that sent the sweep, usually the relay. Accounts that withdraw their deposits back to themselves still count, though they hide no one.
What the protocol promises: Hides which deposit funds which withdrawal, and who pays whom and how much inside the pool. Deposits and withdrawals show address and amount.
tacit.financeLeaks moreSends ten of the user's deposit addresses per request to one public node at every sign-in, with no setting for the user's own node.
Fix: Read each deposit address in its own request and offer an own-node setting, as anon.wei does. · Source (checked 2026-11-09)
Ethereum is public by default. Each protocol is rated on its main privacy promise, like hiding who paid, who received, how much, or which deposit became which withdrawal. Against each adversary, the colour says whether it holds for a careful user with the app's own settings: green yes, yellow only with significant extra work, red no. Fields marked at risk stay private only under the condition in their note.
A zero-knowledgeA cryptographic technology and sub-discipline of cryptography that allows an individual to prove that a statement or computation is true without revealing any additional information. proof hides which notes a withdrawal or transfer spends, and a transfer publishes only note hashes and encrypted memos. Payments to one deposit address are public and linked to each other. Anyone holding a payment link can tell its deposit address belongs to the payee.
Advice: Exit through a relay, so none of the user's wallets pay gas for the receiving address. Give each payer its own deposit address.
Fewer than 50 wallets deposited into the Ethereum pool, besides wallets that only cycle funds back, so timing and amounts can pair the two ends. Any amount is allowed, so an unusual amount pairs the two ends. Paying gasA virtual fuel used to execute smart contracts on a rollup. The EVM (or other VM within the rollup) uses an accounting mechanism to correspond the consumption of gas to the consumption of computing resources, and to limit the consumption of computing resources. from the user’s wallet instead of a relay exposes its fingerprint, account implementation and fee habits, even from a fresh address.
The user’s own Ethereum nodeA software client that participates in the network. can take every read that names a deposit address or the recipient, leaving third parties only pool-wide logs. By default, Tenderly and dRPC receive the deposit addresses and the withdrawal recipient in one session, so either can tie both sides. Base and Robinhood Chain nodes still receive the deposit addresses, which are the same on every chain.
Advice: Set your own Ethereum node under Endpoints and in your wallet before signing in, and shield from that wallet rather than through a deposit address.
Tacit holds no key to any note, but its app owner can change the page anon.wei serves, its relay host and RPC nodes without delay. The reviewed page version is an immutable contract, but running a saved copy of it takes command-line work. Tacit’s relay sees the IP at sign-in, each exit’s recipient with the IP that asked, and each deposit address the user views in the app.
Advice: Serve the page from localhost as the App section describes, not from anon.wei.limo. Exit as the network observer advice says.
Whoever breaks elliptic-curve cryptography recovers the key of each wallet that signed in and sent a transaction, which opens its notes and links. Accounts created from a wallet signature reduce to that wallet’s key. A Tacit address published in a name record yields its view and nullifier keys the same way, exposing its incoming notes and their spends.
30 day historic anonymity set
How many unique depositors you could have blended in with if you withdrew on a particular day after depositing during the previous 30 days. This metric is a proxy for the historic anonymity set and shows how it developed over time.
The metric looks backwards: it counts deposits that already happened, including from addresses that have since withdrawn. Your real anonymity also depends on deposits made after yours, which cannot be known in advance.
Estimated anonymity set by holding duration
An estimate of how many unique depositors you blend in with, depending on how long you leave your deposit in the pool. It is based on historic data of past deposits: each point counts depositors from the preceding period, so holding for up to 30 days effectively means blending in with everyone who deposited during the last 30 days.
Asset | Deposits 7D | Deposits 30D | Deposits Total | Value Locked |
|---|---|---|---|---|
 ETH | 23 $11.90 K | 94 $112.30 K | 210 $327.65 K | $17.52 K |
| Total | 23 $11.90 K | 94 $112.30 K | 210 $327.65 K | $17.52 K |
anon.wei app stored onchain
3 Oct 2026
The reference app is published as contract code on Ethereum, each version immutable.
Tacit Pay pool launch
27 Sep 2026
The ETH pool, router and verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. go live with the ceremony key and no owner.
Funds can be stolen if
- the zk proof systemThe infrastructure that allows projects to verify their state transitions. It is composed by onchain verifiers and offchain provers. The main two flavors are optimistic and ZK proof systems, but they can be combined in a hybrid model. In general though, if a system is able to accept state roots optimistically, even if it has a ZK component, it is considered an optimistic proof system. is broken, allowing invalid spends or withdrawals.
- all trusted setup participants collude or leak their secrets, allowing forged proofs.
Funds can be lost if
- a user loses the wallet whose signature derives their keys.
- a user signs the Tacit identity message on a malicious site, which can then spend their notes.
- a user sends a token other than ETH to a deposit address, which releases only ETH.
Privacy can be lost if
- few depositors use the pool, so timing and amounts can pair a withdrawal with its deposit (see chain analyst).
- Tacit’s relay, the only one running, refuses a withdrawal, so the user must self-relay from a public wallet (see chain analyst).
- a user keeps the default RPC nodes, which receive the deposit addresses and the withdrawal recipient in one session (see networkA constellation of nodes (peers) that communicate via a peer-to-peer protocol, for example, in propagating transactions and blocks to other nodes. observer).
- Tacit’s app owner points anon.wei at another page or changes the default relay host and RPC nodes, without delay (see privileged insider).
- elliptic-curve cryptography is broken, which opens every note derived from a wallet that signed in and sent a transaction (see future adversary).
The TacitEvmPool, its router, zap and verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. are immutable and have no owner, pause or admin function. A new circuitA program written for the purpose of being proven within a proving system. A circuit is a mathematical representation of the computation to be executed, arithmetic circuits and zkVM execution trace are examples of circuits. Circuits can be written in different languages, ranging from low-level to high-level. or rule needs a new pool at a new address, and users move by withdrawing and depositing again.
The anon.wei app is a chain of immutable page contracts. Tacit’s app owner, a single key, appends new versions and owns the name anon.wei, which it can point at any contract. It also owns two registries the app reads every six hours. Through these it can add RPC nodes, replace the relay host and add proving-key mirrors, all without delay. An RPC nodeA software client that participates in the network. or relay the user sets in the app takes precedence.
Transact circuit ceremony
- 1Phase 1 · Universal54contributions
- 2Phase 2 · Circuit-specific176contributions
Under self-made keys, 171 named "anonymous" and 5 operator test entries. One key could contribute any number of times.
Detailed description
CircuitA program written for the purpose of being proven within a proving system. A circuit is a mathematical representation of the computation to be executed, arithmetic circuits and zkVM execution trace are examples of circuits. Circuits can be written in different languages, ranging from low-level to high-level.-specific Phase 2For Groth16 trusted setup, phase 2 represents circuit-dependent part of the trusted setup. It generates a part of the secret cryptographic data required for Groth16 ZK protocol to work. If the outcome of phase 2 trusted setup ceremony is known, arbitrary proofs could be forged. trusted setupGeneration of a piece of data that must then be used for some cryptographic protocol to run. Generating this data requires some secret information. The "trust" comes from the fact the secret must be destroyed after the ceremony, otherwise cryptographic properties of the protocol could be broken. Once the data is generated, and the secrets are forgotten, no further participation from the creators of the ceremony is required.
There are two types of trusted setups for SNARKs: (i) trusted setup per circuit where it is generated from scratch for each circuit, (ii) trusted universal setup per proving system where it can be used for several circuits. for the single Groth16A zk-SNARK proving system introduced by Groth in 2016 that proves arithmetic circuits and requires a separate trusted setup for each circuit. It allows extremely efficient proof verification. circuit, transact.circom
(2 inputs, 2 outputs, 44,414 constraints), over the BN254 curve. It builds on the Hermez ceremony as
Phase 1For Groth16 trusted setup, phase 1 represents circuit-independent part of the trusted setup (e.g. Perpetual Powers of Tau), which could be reused across different circuits. It generates a part of the secret cryptographic data required for Groth16 ZK protocol to work. If the outcome of phase 1 trusted setup ceremony is known, arbitrary proofs could be forged., using powersOfTau28_hez_final_16.ptau, which contains 54 Perpetual Powers of Tau participant
contributions and one public randomness beacon.
Tacit’s own server coordinated Phase 2 from its website. It opened to everyone on 26 September 2026 at 18:21 UTC and closed 18 hours later. The hashA fixed-length fingerprint of variable-size input, produced by a hash function. of Bitcoin blockAn ordered list of transactions and chain-related metadata that gets bundled together and published to the L1/DA layer. Nodes execute the transactions contained within blocks to change the rollup chain’s state. Protocol rules dictate what constitutes a valid block, and invalid blocks are skipped over. 968840 sealed it as a beacon. The transcript lists 176 contributions. 171 are named “anonymous” and 5 are Tacit test entries. A contributor proves only a key they generate themselves. The coordinator accepts any number of contributions from one key, so the contributions identify no participants. We found no public announcement of the ceremony. The final key verifies against the circuit and the Phase 1 file with snarkjs, and its contribution hashes equal the transcript’s.
- Phase 1 file description (54 contributions and a beacon): https://github.com/iden3/snarkjs#7-prepare-phase-2.
- Ceremony bundle with transcript, keys and verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover.: IPFS bafybeia4yvn…ypfy
- Transcript, 171 contributions named “anonymous”: transcript.json
- Open ceremony without an eligibility proof: worker/src/index.js#L9747-L9751
- Repeat contributions from one key: worker/src/index.js#L11231-L11234
- Ceremony opened: 27b575a4, closed and sealed: ed2ffbf0
- Rebuild and check instructions: docs/EVM-POOL.md#rebuild-and-check-it
Verification | Used in | Known deployments | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Transact verifier | by | | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verifier ID: Tacit Pay transact verifier 27.09.2026Known deployments1 Used in Verification steps Tacit Pay uses one Groth16A zk-SNARK proving system introduced by Groth in 2016 that proves arithmetic circuits and requires a separate trusted setup for each circuit. It allows extremely efficient proof verification. circuitA program written for the purpose of being proven within a proving system. A circuit is a mathematical representation of the computation to be executed, arithmetic circuits and zkVM execution trace are examples of circuits. Circuits can be written in different languages, ranging from low-level to high-level., Steps, all on
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Ossification
Contracts our research team classifies as critical form the project's critical perimeter. Its clock starts at the ossification genesis, and every critical change resets it (changes within 24 hours count as one). The ossification score is the share of recorded code-bug exploits whose exploited code was younger than this perimeter is today. Battle-tested exposure is the value secured, summed over that unchanged period.
Discovery updates
10changesInitial discovery of Tacit Pay on Ethereum: the ETH pool, its router, zap, Groth16 verifier, box implementation and Poseidon hasher, and the anon.wei page contract with the two registries the page reads its endpoints from.
Initial discovery of Tacit Pay on Ethereum: the ETH pool, its router, zap, Groth16 verifier, box implementation and Poseidon hasher, and the anon.wei page contract with the two registries the page reads its endpoints from.
Initial discovery
| + | Status: CREATED |
| contract TacitPay8244 (eth:0x0000000d42137547140b0812E1178F025e08bc49) [tacit-pay/TacitPay8244] | |
| +++ description: One version of the anon.wei web app stored as contract code (ERC-8244). html() returns the page from immutable chunk contracts and checks it against PAGE_HASH. The steward can append one successor version, which latest() follows. | |
| + | Status: CREATED |
| contract zEndpoints (eth:0x00000051F365d898132f4ebF345Cd3968e02F288) [tacit-pay/zEndpoints] | |
| +++ description: Owner-curated registry of service URLs per key and chain, which apps read at load to find their RPC nodes, relays and file mirrors. | |
| + | Status: CREATED |
| contract TacitEvmPoolRouter (eth:0x0000006C96Afa6f1cD4DF8FE19bc0d8B6A6Cd7B5) [tacit-pay/TacitEvmPoolRouter] | |
| +++ description: Periphery of one pool. It derives deposit and receive boxes, addresses anyone can pay and anyone can sweep into the pool as notes the owner fixed in advance, and runs withdrawals that call other contracts in the same transaction. | |
| + | Status: CREATED |
| contract TacitEvmPoolZap (eth:0x0000008EbBF2323f95c4fBc18254f3D65C53998c) [tacit-pay/TacitEvmPoolZap] | |
| +++ description: Swaps the caller's token for ETH through zRouter and deposits it into the pool with the caller's proof, in one transaction. It holds nothing between transactions. | |
| + | Status: CREATED |
| contract TransactVerifier (eth:0x000000b1c0e84CEc8AdF8278B90c4d6400DfB153) [tacit-pay/TransactVerifier] | |
| +++ description: Groth16 verifier for the transact circuit, with the verification key of its trusted setup hard-coded. | |
| + | Status: CREATED |
| contract TacitEvmPool (eth:0x000000c2A20657CE25f2Ba99737933D031AFBEE9) [tacit-pay/TacitEvmPool] | |
| +++ description: Shielded pool for one asset. Each transaction carries one Groth16 proof that deposits, transfers inside the pool or withdraws, and inserts its new notes into a Poseidon tree the proof updates. It stores every root it has held and the spent nullifiers. | |
| + | Status: CREATED |
| EOA (eth:0x1C0Aa8cCD568d90d61659F060D1bFb1e6f855A20) | |
| +++ description: None | |
| + | Status: CREATED |
| contract TacitBox (eth:0x4618B85d52F0d5b4a5540961F98b180b4313a0ea) [tacit-pay/TacitBox] | |
| +++ description: Implementation behind the router's boxes: clones at addresses fixed by each intent, which hold payments and release them only when the router instructs. | |
| + | Status: CREATED |
| contract PoseidonT5 (eth:0x555333f3f677Ca3930Bf7c56ffc75144c51D9767) [tacit-pay/PoseidonT5] | |
| +++ description: Four-input Poseidon hash from poseidon-solidity. The router computes the note of each receive box sweep with it. | |
| + | Status: CREATED |
| contract zRpcList (eth:0x8C7348D039f58C4e9cfA936EF410eec759213b12) [tacit-pay/zRpcList] | |
| +++ description: Owner-curated list of Ethereum RPC URLs that apps read at load. | |
Ethereum
Actors:
- Can interact with TacitPay8244
- append the successor version of the app, which latest() then returns
- point the name anon.wei at any contract, which anon.wei.limo then serves
- Can interact with zEndpoints
- replace the URLs apps read from this registry, such as their RPC nodes, relay host and file mirrors, effective at their next read
- Can interact with zRpcList
- replace the RPC URLs apps read from this list, effective at their next read
Ethereum
Periphery of one pool. It derives deposit and receive boxes, addresses anyone can pay and anyone can sweep into the pool as notes the owner fixed in advance, and runs withdrawals that call other contracts in the same transaction.
Swaps the caller’s token for ETH through zRouter and deposits it into the pool with the caller’s proof, in one transaction. It holds nothing between transactions.
Shielded pool for one asset. Each transaction carries one Groth16A zk-SNARK proving system introduced by Groth in 2016 that proves arithmetic circuits and requires a separate trusted setup for each circuit. It allows extremely efficient proof verification. proof that deposits, transfers inside the pool or withdraws, and inserts its new notes into a Poseidon tree the proof updates. It stores every root it has held and the spent nullifiers.
Implementation behind the router’s boxes: clones at addresses fixed by each intent, which hold payments and release them only when the router instructs.
Groth16A zk-SNARK proving system introduced by Groth in 2016 that proves arithmetic circuits and requires a separate trusted setup for each circuit. It allows extremely efficient proof verification. verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. for the transact circuitA program written for the purpose of being proven within a proving system. A circuit is a mathematical representation of the computation to be executed, arithmetic circuits and zkVM execution trace are examples of circuits. Circuits can be written in different languages, ranging from low-level to high-level., with the verification key of its trusted setupGeneration of a piece of data that must then be used for some cryptographic protocol to run. Generating this data requires some secret information. The "trust" comes from the fact the secret must be destroyed after the ceremony, otherwise cryptographic properties of the protocol could be broken. Once the data is generated, and the secrets are forgotten, no further participation from the creators of the ceremony is required. There are two types of trusted setups for SNARKs: (i) trusted setup per circuit where it is generated from scratch for each circuit, (ii) trusted universal setup per proving system where it can be used for several circuits. hard-coded.
Four-input Poseidon hashA fixed-length fingerprint of variable-size input, produced by a hash function. from poseidon-solidity. The router computes the note of each receive box sweep with it.
One version of the anon.wei web app stored as contract code (ERC-8244). html() returns the page from immutable chunk contracts and checks it against PAGE_HASH. The steward can append one successor version, which latest() follows.
- Roles:
- anonWeiOwner: EOA 1
- steward: EOA 1
Owner-curated registry of service URLs per key and chain, which apps read at load to find their RPC nodes, relays and file mirrors.
- Roles:
- owner: EOA 1
Owner-curated list of Ethereum RPC URLs that apps read at load.
- Roles:
- owner: EOA 1