# Tacit Pay

Markdown version of https://ethbeat.org/privacy/projects/tacit-pay

## Summary

- Total Value Locked: $17.52 K (-3.59% compared to seven days ago)
- Assets tracked: 1
- Buckets tracked: 1
- Deposits 7D: 23 (-25.8% compared to the previous seven days)
- Deposits 30D: 94
- Deposits Total: 210
- Active Relayers 30D: 1
- Tracked on: Ethereum
- Runs on: Base Chain, Robinhood Chain, MegaETH
- Attributes: ZK, Transfers, Any amount
- Reference app: anon.wei (most private of 2 checked)

### Risks

- Privacy: Link privacy. Public observer: Link private (sentiment: good); Chain analyst: Link exposed (sentiment: bad); Network observer: Link private (sentiment: good); Privileged insider: Link at risk (sentiment: warning); Future adversary: Link exposed (sentiment: bad).
- Trusted setup: 176 contributions (sentiment: bad). Transact circuit ceremony: Circuit-specific trusted setup for the Groth16 transact circuit over BN254. Phase 1 used 54 participant contributions and a public randomness beacon. Phase 2 counts 176 contributions under self-made keys with repeats allowed, so the number of participants is unknown. Proving system could be broken if either phase 1 or 2 is compromised.
- Exit window: Infinite (sentiment: good). The pool, its router and verifier are immutable and cannot be paused, so users can always withdraw with a valid proof. This protocol passes the walkaway test: users can still fully use it if every centralized participant disappears.
- Reproducibility: Reproducible (sentiment: good). The contracts, circuit, app and relay are public under MIT, and every contract is verified. The verifier rebuilds from the circuit and the ceremony key, and the deployed app rebuilds byte for byte from its readable source.

### About

A shielded ledger for ETH with private transfers, proven in the browser, with immutable contracts and an app stored on Ethereum.

### Links

- Website: https://tacit.finance
- Docs: https://github.com/src-company/tacit/blob/main/docs/EVM-POOL.md
- Repository: https://github.com/src-company/tacit, https://github.com/ERC8244/dapps
- Contracts explorer (Disco): https://disco.ethbeat.org/ui/p/tacit-pay

## Protocol description

Tacit Pay lets you shield ETH into a private balance, pay any Tacit address privately and withdraw any part to any address. Inside the pool, who pays whom and how much stays hidden, and a withdrawal does not show which deposit paid it. Deposits and withdrawals show address and amount.

The contracts have no owner, pause or upgrade. Users trust Tacit's relay, which sends spends by default. They also trust Tacit's app owner, a single key that controls the app's name and the endpoints the app reads. Users can send their own spends and withdraw without Tacit.

### Architecture

A note is a private record of ETH, published only as a hash of its value, its owner's key and a random value. The TacitEvmPool holds all deposits, a tree of note hashes and the spent nullifiers. Spending a note publishes its nullifier, a hash only the owner can compute, which marks the note spent without naming it. Each transaction carries one proof that spends up to two notes and creates up to two. Each new note carries a memo with its value, encrypted to the recipient's view key. Wallets find their notes by decrypting memos on the device.

### Deposit addresses

A deposit address is an ordinary address derived from the user's keys. Anyone can pay it, and anyone can sweep its balance into the pool as a note for that user. The app issues a new one for each payer who asks. A payment link names one deposit address and carries a signature over it by the payee's view key.

### Flow

1. **Sign in.** Your wallet signs a fixed message, and the page derives your Tacit keys from the signature. Nothing goes onchain.
2. **Shield.** You deposit from your wallet, or pay one of your deposit addresses from any wallet, which the relay then sweeps in. Your address and the amount are public.
3. **Send.** The page proves on your device and the relay submits the proof. Only nullifiers, note hashes and encrypted memos become public.
4. **Withdraw.** The relay pays the address and amount you choose and takes its fee from your balance. The recipient and amount are public, the change stays a note.

### Keys

All keys derive from one signature of the user's wallet over a fixed message, so whoever obtains that signature controls the funds. Contract wallets cannot sign in. A Tacit address holds three public keys: one that checks spends, one behind each note's nullifier and one that payers encrypt memos to. A .wei, .gwei or .eth name can publish the whole address onchain in its `finance.tacit` text record, so payers can pay the name. Deposit addresses can be found again from the keys alone.

### App

anon.wei is one HTML page stored as contract code on Ethereum, each version immutable. The reviewed version is the TacitPay8244 contract below. Save it from your own node with `cast call 0x0000000d42137547140b0812E1178F025e08bc49 "html()(string)" --rpc-url <node> --json | jq -j '.[0]' > anon.html`, check that the file's sha256 is `3b94ab980316470756345dd754cd212dde57067e0ef95dce1531fcaecfde9c08` and serve it from localhost. Its sign-in note sends users to anon.wei.limo, which serves whichever version the app owner names. The page checks the proving files against pinned hashes.

### Network

The page reads the chain through public RPC nodes and syncs from the relay's history feed. It keeps a feed page only where the tree it builds matches a root the pool has held. The feed can still hide a note, which Rebuild recovers from chain logs. Under Endpoints the user can set their own node and another relay or none.

### Exits

Any account can submit a proof, and the proof fixes recipient, amount, relayer and fee, so a relayer can change none of them. A withdrawal that creates no notes cannot be made stale by other transactions. Any account can sweep a deposit address, and its owner can do so without a fee.

### Fees

The contracts take no fee. The relay charges the transaction's gas plus a margin, which the page checks against a ceiling. Sweeping a deposit address costs at most 0.25% of its balance, and the relay sweeps only balances that cover its gas.

### Anonymity set

The set counts each account that sent a deposit into the ETH pool on Ethereum. A deposit through a deposit address counts the account that sent the sweep, usually the relay. Accounts that withdraw their deposits back to themselves still count, though they hide no one.

## Privacy

**What the protocol promises:** Hides which deposit funds which withdrawal, and who pays whom and how much inside the pool. Deposits and withdrawals show address and amount.

**Apps**

- **[anon.wei](https://etherscan.io/address/0x0000000d42137547140b0812E1178F025e08bc49#readContract#F15)** (Reference): The ratings assume this app, since 2026-11-09 · Source [bf39cc0](https://github.com/ERC8244/dapps/tree/bf39cc0b4d8c5eabdcd76f8b0672ec97b645a986)
- **tacit.finance** (Leaks more): Sends ten of the user's deposit addresses per request to one public node at every sign-in, with no setting for the user's own node. Fix: Read each deposit address in its own request and offer an own-node setting, as anon.wei does. · [Source (checked 2026-11-09)](https://tacit.finance/pay/eth/)

[How we pick the reference](https://ethbeat.org/publications/privacy-methodology#reference-app)

Ethereum is public by default. Each protocol is rated on its main privacy promise, like hiding who paid, who received, how much, or which deposit became which withdrawal. Against each adversary, the colour says whether it holds for a careful user with the app's own settings: green yes, yellow only with significant extra work, red no. Fields marked at risk stay private only under the condition in their note.

### Public observer

Link private (sentiment: good)

**Who:** Everyone with a block explorer and some basic tools. Sees every public onchain event, but does no correlation beyond following links. Examples: A curious counterparty, an employer, a journalist.

A zero-knowledge proof hides which notes a withdrawal or transfer spends, and a transfer publishes only note hashes and encrypted memos. Payments to one deposit address are public and linked to each other. Anyone holding a payment link can tell its deposit address belongs to the payee.

**Advice:** Exit through a relay, so none of the user's wallets pay gas for the receiving address. Give each payer its own deposit address.

**Inside**

- Sender: private
- Recipient: private
- Amount: private
- Asset: exposed
- Link: at risk. A spend sent from the depositing wallet names it.

**Sources**

- [TacitEvmPool](https://ethbeat.org/privacy/projects/tacit-pay#TacitEvmPool)
- [Transact circuit](https://github.com/src-company/tacit/blob/389dd680cf18541eca1c0de922368fde2f5596f5/dapp/circuits/evm-pool/transact.circom)
- [What each action shows](https://github.com/src-company/tacit/blob/389dd680cf18541eca1c0de922368fde2f5596f5/docs/EVM-POOL.md#what-each-action-shows)

### Chain analyst

Link exposed (sentiment: bad)

**Who:** Scrapes all public data and correlates it: timing, amounts, gas and wallet fingerprints, address clusters. Examples: Chain analytics firms, ZachXBT, data brokers.

Fewer than 50 wallets deposited into the Ethereum pool, besides wallets that only cycle funds back, so timing and amounts can pair the two ends. Any amount is allowed, so an unusual amount pairs the two ends. Paying gas from the user's wallet instead of a relay exposes its fingerprint, account implementation and fee habits, even from a fresh address.

**Inside, compared with a public observer**

- Link: exposed

**Sources**

- [Pool deposits: 37 direct depositors and at most 12 more through deposit addresses and zaps, self-cycling wallets excluded (counted 2026-11-09)](https://etherscan.io/address/0x000000c2A20657CE25f2Ba99737933D031AFBEE9)
- [Withdrawing well: amounts and timing](https://github.com/src-company/tacit/blob/389dd680cf18541eca1c0de922368fde2f5596f5/docs/EVM-POOL.md#withdrawing-well)

### Network observer

Link private (sentiment: good)

**Who:** Sits between the user and the services and sees traffic only: ISPs, VPNs, Tor exits, public RPCs and relayers. Ties requests to a user by content, session or timing: what they name, a shared IP or login, and when they arrive. Services the operator runs count as the insider. Examples: Infura or Alchemy, a Tornado relayer, a wallet vendor selling telemetry, Google captcha or analytics in the dapp frontend.

The user's own Ethereum node can take every read that names a deposit address or the recipient, leaving third parties only pool-wide logs. By default, Tenderly and dRPC receive the deposit addresses and the withdrawal recipient in one session, so either can tie both sides. Base and Robinhood Chain nodes still receive the deposit addresses, which are the same on every chain.

**Advice:** Set your own Ethereum node under Endpoints and in your wallet before signing in, and shield from that wallet rather than through a deposit address.

**Inside, compared with a public observer**

- Link: at risk. Private only with your own node set before sign-in.

**Sources**

- [Deposit addresses read one per request from random nodes](https://github.com/ERC8244/dapps/blob/bf39cc0b4d8c5eabdcd76f8b0672ec97b645a986/tacit-pay/dapp/page.html#L4760-L4790)
- [The recipient is checked for code at public nodes](https://github.com/ERC8244/dapps/blob/bf39cc0b4d8c5eabdcd76f8b0672ec97b645a986/tacit-pay/dapp/page.html#L8485-L8492)
- [Own node and relay under Endpoints](https://github.com/ERC8244/dapps/blob/bf39cc0b4d8c5eabdcd76f8b0672ec97b645a986/tacit-pay/dapp/page.html#L1673-L1690)
- [Reads that name the wallet go to the wallet's own node](https://github.com/ERC8244/dapps/blob/bf39cc0b4d8c5eabdcd76f8b0672ec97b645a986/tacit-pay/dapp/page.html#L4317)

### Privileged insider

Link at risk (sentiment: warning)

**Who:** Holds an operator role, custodies funds, receives keys or plaintext by design, or delivers the app: upgrade admin, custodian, view key holder, enclave operator, association set provider, hosted prover, registry, frontend host. Examples: A compliance backdoor key, a DAO with an upgrade key, a KMS committee, an ASP operator, a custodial bridge.

Tacit holds no key to any note, but its app owner can change the page anon.wei serves, its relay host and RPC nodes without delay. The reviewed page version is an immutable contract, but running a saved copy of it takes command-line work. Tacit's relay sees the IP at sign-in, each exit's recipient with the IP that asked, and each deposit address the user views in the app.

**Advice:** Serve the page from localhost as the App section describes, not from anon.wei.limo. Exit as the network observer advice says.

**Inside, compared with a public observer**

- Recipient: at risk. The relay sees the recipient of every exit, with the IP that asked.
- Link: at risk. Private only on a saved copy of the reviewed page version.

**Sources**

- [html(): the page, fixed per version](https://ethbeat.org/privacy/projects/tacit-pay#TacitPay8244)
- [What the relay sees](https://github.com/src-company/tacit/blob/389dd680cf18541eca1c0de922368fde2f5596f5/docs/EVM-POOL.md#the-relay)
- [Registry entries go ahead of the built-in relay host](https://github.com/ERC8244/dapps/blob/bf39cc0b4d8c5eabdcd76f8b0672ec97b645a986/tacit-pay/dapp/page.html#L3135-L3139)
- [zEndpoints](https://ethbeat.org/privacy/projects/tacit-pay#zEndpoints)

### Future adversary

Link exposed (sentiment: bad)

**Who:** Harvest now, decrypt later. Holds every byte ever published and runs the known quantum attacks: elliptic curves, pairings and RSA fall. Hashes, symmetric ciphers and post-quantum schemes stand until an attack on them is known. Examples: An intelligence agency archiving chain data today, then anyone once a break is public.

Whoever breaks elliptic-curve cryptography recovers the key of each wallet that signed in and sent a transaction, which opens its notes and links. Accounts created from a wallet signature reduce to that wallet's key. A Tacit address published in a name record yields its view and nullifier keys the same way, exposing its incoming notes and their spends.

**Inside, compared with a public observer**

- Sender: exposed
- Recipient: exposed
- Amount: exposed
- Link: exposed

**Sources**

- [The key is a hash of one wallet signature](https://github.com/src-company/tacit/blob/389dd680cf18541eca1c0de922368fde2f5596f5/dapp/identity-message.js)
- [Note keys tweak the address keys by an ECDH secret](https://github.com/src-company/tacit/blob/389dd680cf18541eca1c0de922368fde2f5596f5/dapp/btc-pool-zk.js#L126-L160)
- [Names publish a Tacit address in a text record](https://github.com/src-company/tacit/blob/389dd680cf18541eca1c0de922368fde2f5596f5/docs/EVM-POOL.md#names)
- [Trusted setup](https://ethbeat.org/privacy/projects/tacit-pay#trusted-setups)

## Value Locked

The interactive value chart is shown on [the HTML page](https://ethbeat.org/privacy/projects/tacit-pay#privacy-tvl).

## Anonymity sets

### 30 day historic anonymity set

How many unique depositors you could have blended in with if you withdrew on a particular day after depositing during the previous 30 days. This metric is a proxy for the historic anonymity set and shows how it developed over time.

The metric looks backwards: it counts deposits that already happened, including from addresses that have since withdrawn. Your real anonymity also depends on deposits made after yours, which cannot be known in advance.

### Estimated anonymity set by holding duration

An estimate of how many unique depositors you blend in with, depending on how long you leave your deposit in the pool. It is based on historic data of past deposits: each point counts depositors from the preceding period, so holding for up to 30 days effectively means blending in with everyone who deposited during the last 30 days.

The interactive charts are shown on [the HTML page](https://ethbeat.org/privacy/projects/tacit-pay#privacy-anonymity-set).

## Flows

The interactive flows chart is shown on [the HTML page](https://ethbeat.org/privacy/projects/tacit-pay#privacy-flows).

## Assets Breakdown

| Asset | Deposits 7D | Deposits 30D | Deposits Total | Value Locked |
| --- | --- | --- | --- | --- |
| ETH | 23 ($11.90 K) | 94 ($112.30 K) | 210 ($327.65 K) | $17.52 K |
| Total | 23 ($11.90 K) | 94 ($112.30 K) | 210 ($327.65 K) | $17.52 K |

## Milestones & Incidents

- 2026-10-03: [anon.wei app stored onchain](https://github.com/ERC8244/dapps/blob/bf39cc0b4d8c5eabdcd76f8b0672ec97b645a986/tacit-pay/deploy/TACIT-PAY-8244.deployed.md). The reference app is published as contract code on Ethereum, each version immutable.
- 2026-09-27: [Tacit Pay pool launch](https://github.com/src-company/tacit/blob/389dd680cf18541eca1c0de922368fde2f5596f5/contracts/deployments/evm-pool.json). The ETH pool, router and verifier go live with the ceremony key and no owner.

## Risk summary

### Funds can be stolen if
1. the zk proof system is broken, allowing invalid spends or withdrawals.
2. all [trusted setup](https://ethbeat.org/privacy/projects/tacit-pay#trusted-setups) participants collude or leak their secrets, allowing forged proofs.

### Funds can be lost if
1. a user loses the wallet whose signature derives their keys.
2. a user signs the Tacit identity message on a malicious site, which can then spend their notes.
3. a user sends a token other than ETH to a deposit address, which releases only ETH.

### Privacy can be lost if
1. few depositors use the pool, so timing and amounts can pair a withdrawal with its deposit (see chain analyst).
2. Tacit's relay, the only one running, refuses a withdrawal, so the user must self-relay from a public wallet (see chain analyst).
3. a user keeps the default RPC nodes, which receive the deposit addresses and the withdrawal recipient in one session (see network observer).
4. Tacit's app owner points anon.wei at another page or changes the default relay host and RPC nodes, without delay (see privileged insider).
5. elliptic-curve cryptography is broken, which opens every note derived from a wallet that signed in and sent a transaction (see future adversary).

## Upgrades & Governance

The TacitEvmPool, its router, zap and verifier are immutable and have no owner, pause or admin function. A new circuit or rule needs a new pool at a new address, and users move by withdrawing and depositing again.

The anon.wei app is a chain of immutable page contracts. Tacit's app owner, a single key, appends new versions and owns the name anon.wei, which it can point at any contract. It also owns two registries the app reads every six hours. Through these it can add RPC nodes, replace the relay host and add proving-key mirrors, all without delay. An RPC node or relay the user sets in the app takes precedence.

## Trusted setup

Risk levels follow the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381). Yellow (medium risk): all contributions are published and the final output can be verified, the ceremony client is open source, there were at least 30 contributions, participation was open to the public and announced, and participants are publicly identified. Green (lowest risk): everything required for yellow, with at least 150 contributions. Red (highest risk): at least one requirement for yellow is not met. N/A: the proof system needs no trusted setup.

### Transact circuit ceremony

- Risk: red (highest risk)
- Proof systems: Snarkjs (Groth16)
- Phase 1: 54 contributions
- Phase 2: 176 contributions (Under self-made keys, 171 named "anonymous" and 5 operator test entries. One key could contribute any number of times.)

Circuit-specific Phase 2 trusted setup for the single Groth16 circuit, `transact.circom`
(2 inputs, 2 outputs, 44,414 constraints), over the BN254 curve. It builds on the Hermez ceremony as
Phase 1, using `powersOfTau28_hez_final_16.ptau`, which contains 54 Perpetual Powers of Tau participant
contributions and one public randomness beacon.

Tacit's own server coordinated Phase 2 from its website. It opened to everyone on 26 September 2026 at
18:21 UTC and closed 18 hours later. The hash of Bitcoin block 968840 sealed it as a beacon. The
transcript lists 176 contributions. 171 are named "anonymous" and 5 are Tacit test entries. A contributor
proves only a key they generate themselves. The coordinator accepts any number of contributions from
one key, so the contributions identify no participants. We found no public announcement of the
ceremony. The final key verifies against the circuit and the Phase 1 file with snarkjs, and its contribution
hashes equal the transcript's.

- Phase 1 file description (54 contributions and a beacon): <https://github.com/iden3/snarkjs#7-prepare-phase-2>.
- Ceremony bundle with transcript, keys and verifier: [IPFS bafybeia4yvn…ypfy](https://ipfs.filebase.io/ipfs/bafybeia4yvn2zoggvgpjwg5vpwpt6aivjbcm6tgzxoxsukao2nm5yyypfy)
- Transcript, 171 contributions named "anonymous": [transcript.json](https://ipfs.filebase.io/ipfs/bafybeia4yvn2zoggvgpjwg5vpwpt6aivjbcm6tgzxoxsukao2nm5yyypfy/transcript.json)
- Open ceremony without an eligibility proof: [worker/src/index.js#L9747-L9751](https://github.com/src-company/tacit/blob/389dd680cf18541eca1c0de922368fde2f5596f5/worker/src/index.js#L9747-L9751)
- Repeat contributions from one key: [worker/src/index.js#L11231-L11234](https://github.com/src-company/tacit/blob/389dd680cf18541eca1c0de922368fde2f5596f5/worker/src/index.js#L11231-L11234)
- Ceremony opened: [27b575a4](https://github.com/src-company/tacit/commit/27b575a43a37ccbb91e812b378f5e108248cb14e), closed and sealed: [ed2ffbf0](https://github.com/src-company/tacit/commit/ed2ffbf0a0947a0d54a5424b03b95134ddaad847)
- Rebuild and check instructions: [docs/EVM-POOL.md#rebuild-and-check-it](https://github.com/src-company/tacit/blob/389dd680cf18541eca1c0de922368fde2f5596f5/docs/EVM-POOL.md#rebuild-and-check-it)

## Verifier IDs

### Transact verifier

- Verifier ID: `Tacit Pay transact verifier 27.09.2026`
- Source: https://github.com/src-company/tacit/tree/389dd680cf18541eca1c0de922368fde2f5596f5/dapp/circuits/evm-pool
- Verification: successful (verified by [ETHBEAT](https://ethbeat.org))
- Used in: [Tacit Pay](https://ethbeat.org/privacy/projects/tacit-pay)

**Known deployments**

- [0x000000b1c0e84CEc8AdF8278B90c4d6400DfB153](https://etherscan.io/address/0x000000b1c0e84CEc8AdF8278B90c4d6400DfB153#code) on Ethereum, used in: [Tacit Pay](https://ethbeat.org/privacy/projects/tacit-pay)

#### Verification steps

Tacit Pay uses one Groth16 circuit, `transact.circom` (2 inputs, 2 outputs, 44,414 constraints). The TacitEvmPool names the TransactVerifier, which hard-codes the circuit's verification key. The steps below tie the deployed bytecode to the published circuit and ceremony key.

Steps, all on `src-company/tacit` commit `389dd680cf18541eca1c0de922368fde2f5596f5`:

1. In `dapp/circuits`, install the locked dependencies (circomlib 2.0.5, snarkjs 0.7.6) and compile `evm-pool/transact.circom` with circom 2.2.3 and `--O2`. The sha256 of `transact.r1cs` is `b0a246d1790151c722e42ccfa89450cb96c7f5a9f4b70a2162b7d9fc79b6ddb3` and of `transact_js/transact.wasm` is `02dd5e84970e5bc629a7a3cd4d7eae5fc9ca05579fa22c9b39b5ea70c8d8a6c1`, as `dapp/evm-pool/pin.json` records.
2. Download the phase 1 file `powersOfTau28_hez_final_16.ptau`, BLAKE2b `6a6277a2f74e1073601b4f9fed6e1e55226917efb0f0db8a07d98ab01df1ccf43eb0e8c3159432acd4960e2f29fe84a4198501fa54c8dad9e43297453efec125` as the snarkjs README lists it. Tacit pins a copy at IPFS `bafybeie73kd3suqjeshnitj6pmr3qxf6ckjbwxxuqyaaixk77ezeoohtau`.
3. The committed `dapp/evm-pool/transact_final.zkey` has sha256 `40758061a0786fb0bdc5e5dec4c354bbf85fc106f7412716e25e781af4e79c4b`, like the copy in the ceremony bundle `bafybeia4yvn2zoggvgpjwg5vpwpt6aivjbcm6tgzxoxsukao2nm5yyypfy`.
4. Run `snarkjs zkey verify transact.r1cs powersOfTau28_hez_final_16.ptau transact_final.zkey`. The key verifies with 176 contributions and a beacon from the hash of Bitcoin block 968840, and the contribution hashes equal those in the bundle's `transcript.json`.
5. Run `snarkjs zkey export verificationkey transact_final.zkey`. It equals the committed `dapp/evm-pool/transact_vk.json`, and every coordinate of `vk_alpha_1`, `vk_beta_2`, `vk_gamma_2`, `vk_delta_2` and the 12 `IC` points equals a constant of `contracts/src/TransactVerifier.sol`.
6. The source of the verifier at `0x000000b1c0e84CEc8AdF8278B90c4d6400DfB153`, verified on Etherscan and Sourcify, equals `contracts/src/TransactVerifier.sol`, and `VERIFIER()` of the pool returns that address.

## Ossification & Updates

Each date links the update on the HTML page, which also shows its contract diffs.

### [2026-11-09 09:16 UTC](https://ethbeat.org/privacy/projects/tacit-pay?update=f46f560c) (10 changes)

Initial discovery of Tacit Pay on Ethereum: the ETH pool, its router, zap, Groth16 verifier, box implementation and Poseidon hasher, and the anon.wei page contract with the two registries the page reads its endpoints from.

## Permissions

Explore these contracts and permissions in Disco, ETHBEAT's contract explorer: https://disco.ethbeat.org/ui/p/tacit-pay

### Ethereum

#### Actors

##### EOA 1

Addresses: [0x1C0Aa8cCD568d90d61659F060D1bFb1e6f855A20](https://etherscan.io/address/0x1C0Aa8cCD568d90d61659F060D1bFb1e6f855A20)

- Can interact with TacitPay8244
  - append the successor version of the app, which latest() then returns
  - point the name anon.wei at any contract, which anon.wei.limo then serves
- Can interact with zEndpoints
  - replace the URLs apps read from this registry, such as their RPC nodes, relay host and file mirrors, effective at their next read
- Can interact with zRpcList
  - replace the RPC URLs apps read from this list, effective at their next read

## Smart contracts

Explore these contracts and permissions in Disco, ETHBEAT's contract explorer: https://disco.ethbeat.org/ui/p/tacit-pay

### Ethereum

#### TacitEvmPoolRouter

Addresses: [0x0000006C96Afa6f1cD4DF8FE19bc0d8B6A6Cd7B5](https://etherscan.io/address/0x0000006C96Afa6f1cD4DF8FE19bc0d8B6A6Cd7B5#code)

Periphery of one pool. It derives deposit and receive boxes, addresses anyone can pay and anyone can sweep into the pool as notes the owner fixed in advance, and runs withdrawals that call other contracts in the same transaction.

#### TacitEvmPoolZap

Addresses: [0x0000008EbBF2323f95c4fBc18254f3D65C53998c](https://etherscan.io/address/0x0000008EbBF2323f95c4fBc18254f3D65C53998c#code)

Swaps the caller's token for ETH through zRouter and deposits it into the pool with the caller's proof, in one transaction. It holds nothing between transactions.

#### TacitEvmPool

Addresses: [0x000000c2A20657CE25f2Ba99737933D031AFBEE9](https://etherscan.io/address/0x000000c2A20657CE25f2Ba99737933D031AFBEE9#code)

Shielded pool for one asset. Each transaction carries one Groth16 proof that deposits, transfers inside the pool or withdraws, and inserts its new notes into a Poseidon tree the proof updates. It stores every root it has held and the spent nullifiers.

#### TacitBox

Addresses: [0x4618B85d52F0d5b4a5540961F98b180b4313a0ea](https://etherscan.io/address/0x4618B85d52F0d5b4a5540961F98b180b4313a0ea#code)

Implementation behind the router's boxes: clones at addresses fixed by each intent, which hold payments and release them only when the router instructs.

#### TransactVerifier

Addresses: [0x000000b1c0e84CEc8AdF8278B90c4d6400DfB153](https://etherscan.io/address/0x000000b1c0e84CEc8AdF8278B90c4d6400DfB153#code)

Groth16 verifier for the transact circuit, with the verification key of its trusted setup hard-coded.

#### PoseidonT5

Addresses: [0x555333f3f677Ca3930Bf7c56ffc75144c51D9767](https://etherscan.io/address/0x555333f3f677Ca3930Bf7c56ffc75144c51D9767#code)

Four-input Poseidon hash from poseidon-solidity. The router computes the note of each receive box sweep with it.

#### TacitPay8244

Addresses: [0x0000000d42137547140b0812E1178F025e08bc49](https://etherscan.io/address/0x0000000d42137547140b0812E1178F025e08bc49#code)

One version of the anon.wei web app stored as contract code (ERC-8244). html() returns the page from immutable chunk contracts and checks it against PAGE_HASH. The steward can append one successor version, which latest() follows.
- Roles:
  - **anonWeiOwner**: EOA 1
  - **steward**: EOA 1

#### zEndpoints

Addresses: [0x00000051F365d898132f4ebF345Cd3968e02F288](https://etherscan.io/address/0x00000051F365d898132f4ebF345Cd3968e02F288#code)

Owner-curated registry of service URLs per key and chain, which apps read at load to find their RPC nodes, relays and file mirrors.
- Roles:
  - **owner**: EOA 1

#### zRpcList

Addresses: [0x8C7348D039f58C4e9cfA936EF410eec759213b12](https://etherscan.io/address/0x8C7348D039f58C4e9cfA936EF410eec759213b12#code)

Owner-curated list of Ethereum RPC URLs that apps read at load.
- Roles:
  - **owner**: EOA 1