Search

Search projects, tokens and protocols by name or address

Privacy
SummaryProtocol descriptionPrivacyValue LockedFlowsAssets BreakdownMilestones & IncidentsRisk summaryUpgrades & GovernanceUpdatesPermissionsSmart contracts

Zama Confidential Tokens logo
Zama Confidential Tokens

About

Confidential amounts for ERC-20 tokens on Ethereum: wrappers that encrypt balances and transfer amounts with FHE, decrypted by a committee of KMS operators.

  • Total Value Locked
    $117.80 M12.5%
    across 25 assets and 25 buckets
  • TVL
    $117.80 M12.5%
  • Assets tracked
    25
  • Buckets tracked
    25
  • Deposits 7D
    16812.9%
  • Deposits 30D
    919
  • Deposits Total
    15.28 K
  • Privacy
    Amount privacy
  • Trusted setup
  • Exit window
  • Reproducibility
  • Tracked on
    Ethereum logo
  • Attributes
    FHEPrivate amountsAny amountDeFi
  • Reference app
    Zama appclosed source, most private of 5 checked
    • Public observerChain analystNetwork observerPrivileged insiderFuture adversary

    About

    Confidential amounts for ERC-20 tokens on Ethereum: wrappers that encrypt balances and transfer amounts with FHE, decrypted by a committee of KMS operators.

    Protocol description

    Zama Confidential Tokens let users hold and send tokens on Ethereum with hidden balances and transfer amounts. A user wraps a token into its confidential version, such as USDC into cUSDC, swaps, lends, pays others with it and unwraps it back. Who pays whom and every wrap and unwrap amount stay public.

    Users trust the 13 operators of the key management service (KMS), who share the decryption key. They also trust 5 coprocessor operators, Zama for the relayer and app, and Zama’s governance multisigs. Any 5 KMS operators together can decrypt every amount, and the multisigs can upgrade every contract instantly. Unwraps need 7 KMS signatures, so funds leave only while the KMS and the coprocessors run.

    Zama Confidential Tokens architecture

    Architecture

    The tokens follow ERC-7984 and use fully homomorphic encryptionA type of encryption that allows computations to be performed on encrypted data without decrypting it, making it useful for privacy-preserving computation. (FHE), which lets contracts compute on encrypted amounts. One FHE key pair protects every balance and amount. Wallets encrypt with its public key, and the coprocessors compute on the ciphertexts without decrypting them. The KMS operators hold the secret key in shares and decrypt on request.

    Flow

    1. Wrap. You deposit a token into its confidential wrapper, such as USDC into cUSDC. Your address and the amount are public.
    2. Transfer. Your wallet encrypts the amount, and the coprocessors update both balances without decrypting them. Sender and recipient are public.
    3. Unwrap. The wrapper asks the KMS to decrypt the amount, and the tokens are paid out once enough operators sign it. The amount is public.

    App

    Before every write, the app checks the address with Zama’s screening service, which refuses fresh addresses. A clientSometimes labelled interchangeably as a “node”, they are tasked with processing transactions and managing the blockchains's state. They run the computations for each transaction according to the rollup's virtual machine and protocol rules. If comparing to Ethereum clients, these would be execution clients such as Geth, as opposed to consensus clients. built on Zama’s open SDK needs a Zama API key or a self-run relayer. The vault deposit form shares the user’s vault balance with Merkl for extra rewards, on by default, opt-out available.

    Yield vaults

    Vault deposits are batched. You join the open batch with an encrypted amount. After about 24 hours the batch total is unwrapped publicly, deposited into the Morpho vault and the shares wrapped back. Each depositor claims an encrypted share. The app also joins other vaults’ batches with encrypted zero amounts as decoys to hide which vault the user actually joined.

    Swaps

    A swap is a sealed-bid auction on ConfidentialSwap. It locks the user’s tokens in the swap contract’s escrow until it settles or is reclaimed. Approved market makers quote every order, including decoys. The winner is public, sees the real order and has to settle it within a time window.

    KMS

    The KMS operators are Zama, Dfns, Figment, Fireblocks, InfStones, Unit410, LayerZero, Ledger, Omakase, Stake Capital, OpenZeppelin, Etherscan and Conduit. Each holds a share of the FHE secret key and a key that signs results for Ethereum. They decrypt an amount only for accounts that the ACL, an onchain access list, allows. Zama states that they run in AWS Nitro enclaves, but Ethereum checks only their signatures. Removing an operatorAn operator is the entity charged with managing a rollup and progressing its state. A rollup operator can be a centralized sequencer, proposer, prover, challenger, pauser of admin that is able to perform upgrades. onchain leaves its key share intact.

    Coprocessors

    Artifact, Blockscape, Luganodes, P2P and Zama run the coprocessors, which compute on ciphertexts and check every encrypted input. Ethereum accepts an input signed by 3 of 5 of them, so they are trusted for validity. Zama stores all ciphertexts in a public bucket. The Zama Gateway, an L3Intuitively, L3s are projects that follow a similar structure to the L2 <> L1 structure but with an L2 underneath. It's not entirely defined yet if this implies that the token escrow must be on the L2, or the proof system. Also, certain cases like projects using aggregation layers make the distinction between L2 and L3 fuzzy as certain components start to look less like a traditional blockchain. How to properly define what is a layer in the first place is still an open question. on Arbitrum, relays decryption requests and publishes who reads which balance and when.

    Compliance

    Each token’s owner, controlled by the multisigs, can blockAn ordered list of transactions and chain-related metadata that gets bundled together and published to the L1/DA layer. Nodes execute the transactions contained within blocks to change the rollup chain’s state. Protocol rules dictate what constitutes a valid block, and invalid blocks are skipped over. users and check them against the underlying token’s denylist, as cUSDC does with USDC’s blacklist. It can also appoint a pauser that halts the token, and observers that decrypt all of its balances and amounts. Today no token has a pauser or an observer. ConfidentialSwap has its own compliance address, set at deployment. Issuers of underlying tokens like USDC can freeze a token’s whole escrow.

    Fees

    Users pay Ethereum gasA virtual fuel used to execute smart contracts on a rollup. The EVM (or other VM within the rollup) uses an accounting mechanism to correspond the consumption of gas to the consumption of computing resources, and to limit the consumption of computing resources.. The Gateway charges 1 ZAMA per encrypted input and 0.1 ZAMA per decryption, paid by the relayer.

    Privacy

    What the protocol promises: Hides balances and transfer amounts. Senders, recipients and every wrap and unwrap amount are public.

    AppsHow we pick the reference
    • Zama appReference

      The ratings assume this app, since 2026-10-09 · Closed source, build dpl_HkkjtLU1mXu9VT5nadJciMGnnY1t, checked 2026-10-30

    • ZerionLeaks more

      Decrypts the user's confidential balances on Zerion's servers, so Zerion sees every amount the user reveals.

      Fix: Decrypt balances on the device under a key only the device holds. · Source

    • BronLeaks more

      Ties the wallet to the user's name and email in a Bron account, which its store listing says Bron shares with other companies.

      Fix: Let users create and use a wallet without giving a name or email. · Source (checked 2026-10-27)

    • cTokenLeaks more

      Reads the user's address through Alchemy and PublicNode straight from the browser, so both see it with the user's IP.

      Fix: Read the chain through the app's own server, as the Zama app does. · Source (checked 2026-10-27)

    • fhevm-walletLeaks more

      Needs the user's own Zama API key on mainnet, which Zama reviews and bills, so Zama ties every request to the user.

      Fix: Relay requests under a key that is not tied to the user. · Source

    Ethereum is public by default. Each protocol is rated on its main privacy promise, like hiding who paid, who received, how much, or which deposit became which withdrawal. Against each adversary, the colour says whether it holds for a careful user with the app's own settings: green yes, yellow only with significant extra work, red no. Fields marked at risk stay private only under the condition in their note.

    Public observerChain analystNetwork observerPrivileged insiderFuture adversary
    Public observer
    At risk

    Wraps, unwraps and vault batch totals publish their amounts, while confidential transfers keep theirs encrypted. Either party to a transfer can disclose its amount onchain at any time. A vault batch with a single depositor publishes that depositor’s amount.

    Advice: Pay and get paid inside the confidential token, and unwrap only what the user needs.

    InsideSenderexposedRecipientexposedAmountprivateAssetexposedLinkexposed
    Sources:Wrap event carries the clear amountUnwrap makes the burned amount publicly decryptableEither party can disclose a transfer amountBatchers log every depositor and unwrap each batch total publicly
    Chain analyst
    At risk

    An account’s balance is bounded by its public wraps and unwraps, and exact if it never took part in a confidential transfer. Transfer partners and timing are public, so a wrap, a transfer and an unwrap in a row pair up by amount. Swap market makers decrypt the amounts of each order and its decoys, and the winner learns which one is real.

    Advice: Transfer often, even zero amounts, and unwrap only after a while. Withdraw common amounts rather than everything at once.

    Compared with a public observer
    InsideAmountat risk
    Sources:ERC-7984: public sender, recipient and encrypted amount per transferExplorer linking unwraps to their wraps: 95% link to a single wrap (October 2026)Market makers decrypt each order and its decoys through a shared delegation
    Network observer
    Private

    No third party sees a transfer amount, since the app encrypts amounts on the device and reads balances under a key only the device holds. A swap quote sends the cleartext amount to Zama’s server, which can pass it to LI.FI.

    Advice: Reject the analytics prompt, so Google Analytics and Sentry receive nothing, and skip swaps for amounts that must stay hidden.

    Compared with a public observer
    InsideAmountat risk
    Sources:Served app, deployment dpl_HkkjtLU1mXu9VT5nadJciMGnnY1t (checked 2026-10-30)Inputs are encrypted on the deviceBalance reads use a device ML-KEM key pair
    Privileged insider
    Exposed

    Any 5 of the 13 KMS operators can combine their key shares and decrypt every balance and transfer ever made. The token owner can instantly appoint an observer that sees all amounts, and the swap’s compliance address decrypts every swap. Zama’s closed-source app can read amounts before encryption, sends every swap amount to Zama in cleartext and shares vault balances with Merkl by default.

    Compared with a public observer
    InsideAmountexposed
    Sources:The key is secret-shared among the operators and holds while at most a third colludeObserver gets a wildcard delegation without expirationThe compliance address decrypts every intent, quote and settlementSharing vault balances with Merkl is on by default
    Future adversary
    Exposed

    Whoever breaks elliptic-curve cryptography recovers a user’s wallet key from any past transaction and can have the KMS decrypt that user’s history. A wallet signature alone authorizes decryption of past balances and transfers, and the KMS encrypts its reply to any key the request names. The ciphertexts themselves rest on lattice assumptions with no known quantum attack.

    Compared with a public observer
    InsideAmountexposed
    Sources:A wallet signature authorizes a user decryption request and names the key the reply is encrypted toPermissions on past ciphertexts have no expiryCoprocessor ciphertext store (public listing)

    Value Locked

    Flows

    Assets Breakdown

    Asset
    Deposits 7D
    Deposits 30D
    Deposits Total
    Value Locked
    fcUSDTfcUSDT
    7
    $8.20 M
    30
    $52.27 M
    52
    $79.30 M
    		$36.39 M
    roxcUSDCroxcUSDC
    6
    $3.07 M
    27
    $25.25 M
    45
    $48.92 M
    		$27.89 M
    steakcUSDCsteakcUSDC
    5
    $3.01 M
    23
    $8.12 M
    131
    $98.51 M
    		$25.68 M
    ZAMAZAMA
    14
    $3.89 K
    49
    $485.47 K
    185
    $47.41 M
    		$10.52 M
    bbqTGBPbbqTGBP
    0
    $0.00
    0
    $0.00
    3
    $5.07 M
    		$5.06 M
    USDTUSDT
    54
    $12.25 M
    388
    $70.77 M
    11.18 K
    $232.26 M
    		$4.76 M
    USDCUSDC
    52
    $10.56 M
    291
    $48.16 M
    3.34 K
    $194.88 M
    		$1.73 M
    bbqUSDCbbqUSDC
    2
    $1.72 M
    2
    $1.72 M
    6
    $1.72 M
    		$1.72 M
    steakUSDTsteakUSDT
    1
    $8.73 K
    17
    $9.74 M
    30
    $11.17 M
    		$1.62 M
    armcWBTCarmcWBTC
    5
    $696.73 K
    17
    $835.19 K
    31
    $1.68 M
    		$1.19 M
    PAPYPAPY
    0
    $0.00
    0
    $0.00
    3
    $348.69 K
    		$348.49 K
    WBTCWBTC
    9
    $695.68 K
    27
    $935.76 K
    54
    $1.91 M
    		$241.20 K
    roxUSDCyroxUSDCy
    4
    $62.42 K
    4
    $62.42 K
    7
    $212.64 K
    		$193.26 K
    pendleUSDCpendleUSDC
    1
    $0.99
    4
    $40.29 K
    14
    $552.37 K
    		$151.94 K
    tGBPtGBP
    0
    $0.00
    1
    $5.83
    12
    $5.19 M
    		$105.74 K
    WETHWETH
    4
    $59.38 K
    19
    $75.24 K
    127
    $324.57 K
    		$53.37 K
    PENDLEPENDLE
    2
    $33.82
    6
    $318.60
    9
    $53.75 K
    		$41.64 K
    armUSDTsarmUSDTs
    0
    $0.00
    1
    $198.53
    5
    $30.20 K
    		$25.14 K
    AUSDAUSD
    0
    $0.00
    5
    $429.85 K
    11
    $975.49 K
    		$15.16 K
    bbqUSDTbbqUSDT
    0
    $0.00
    0
    $0.00
    4
    $10.45 K
    		$10.44 K
    fAUSDefAUSDe
    0
    $0.00
    2
    $189.75 K
    5
    $194.71 K
    		$5.19 K
    armUSDCsarmUSDCs
    1
    $4.88
    2
    $14.67
    6
    $227.67
    		$227.58
    XAUtXAUt
    1
    $24.45
    4
    $176.64
    16
    $70.05 K
    		$106.41
    armUSDTparmUSDTp
    0
    $0.00
    0
    $0.00
    2
    $118.47
    		$68.43
    armUSDCparmUSDCp
    0
    $0.00
    0
    $0.00
    1
    $44.31
    		$44.30
    Total
    168
    $40.36 M
    919
    $219.11 M
    15.28 K
    $730.85 M
    		$117.80 M

    Milestones & Incidents

    Inputs need 3 of 5 coprocessors

    22 Oct 2026

    Encrypted inputs need signatures from 3 of 5 coprocessors instead of one.

    Learn more

    Confidential vaults and swaps launch

    15 Sep 2026

    Confidential deposits expand to 16 Morpho vaults, and swaps between confidential tokens go live.

    Learn more

    Risk summary

    Funds can be stolen if

    1. a governance multisig deploys a malicious upgrade, which takes effect instantly.
    2. a KMS signer set, which either multisig can create instantly, attests an inflated unwrap amount.
    3. 3 of 5 coprocessors accept invalid encrypted inputs that bypass balance checks.

    Funds can be lost if

    1. the coprocessors lose ciphertext data, so balances can no longer be decrypted.

    Funds can be frozen if

    1. an underlying token issuer blacklists a confidential token’s address.
    2. the token owner or an underlying denylist blocksAn ordered list of transactions and chain-related metadata that gets bundled together and published to the L1/DA layer. Nodes execute the transactions contained within blocks to change the rollup chain’s state. Protocol rules dictate what constitutes a valid block, and invalid blocks are skipped over. a user before they unwrap.
    3. an ACL, Gateway or token pauser halts tokens and the owner keeps them paused.
    4. the KMS or the coprocessors stop, which halts every unwrap.

    Privacy can be lost if

    1. 5 of 13 KMS operators combine their key shares (see privileged insider).
    2. the token owner appoints an observer or upgrades the token (see privileged insider).
    3. a user swaps: Zama and the swap’s compliance address see the amount, which can reach LI.FI (see privileged insider and networkA constellation of nodes (peers) that communicate via a peer-to-peer protocol, for example, in propagating transactions and blocks to other nodes. observer).
    4. a user keeps the vault form’s default of sharing their balance with Merkl (see privileged insider).
    5. Zama changes its closed-source app to leak amounts to itself or to third parties (see privileged insider).
    6. public wraps, unwraps and vault batch totals bound a user’s balance (see public observer and chain analyst).
    7. elliptic-curve cryptography is broken, which lets anyone impersonate a user to the KMS and decrypt that user’s history (see future adversary).

    Upgrades & Governance

    ZamaGovMultisigA (9/17) and ZamaGovMultisigB (3/6) each control the protocol through ZamaGovCore, an Aragon governance contract that owns the core contracts. Either multisig can upgrade core contracts, change every compliance setting, manage KMS signer sets and trigger FHE key generation.

    ZamaDeFiGovCore, a second such contract and one member of ZamaGovMultisigA, acts through its own multisig (3/6). It can upgrade ConfidentialSwap instantly, appoint its market makers and pausers, and pause or retune the vault batchers.

    SafeL2 (3/5) owns the Gateway contracts and can change coprocessors and KMS settings there or disconnect Ethereum. Any of 17 pausers can pause the ACL, and any of 17 the Gateway. Either halts every token until its owner unpauses.

    Updates

    High severity
    57changes

    Encrypted inputs now need 3 of 5 coprocessor signatures on Ethereum (was 1 of 1), and the Gateway priority coprocessor is off, so its 3-of-5 majority applies. Discovery now covers ConfidentialSwap, the vault batcher router and 36 vault batchers. ZamaDeFiDAO, a second Aragon DAO contract, and its 3/6 multisig plugin own all of them. The protocol DAO is now named ZamaDAO and clarified as a contract in all refs (so that people do not assume it is decentralized).

    Encrypted inputs now need 3 of 5 coprocessor signatures on Ethereum (was 1 of 1), and the Gateway priority coprocessor is off, so its 3-of-5 majority applies. Discovery now covers ConfidentialSwap, the vault batcher router and 36 vault batchers. ZamaDeFiDAO, a second Aragon DAO contract, and its 3/6 multisig plugin own all of them. The protocol DAO is now named ZamaDAO and clarified as a contract in all refs (so that people do not assume it is decentralized).

    contract InputVerifier (eth:0xCe0FC2e05CFff1B719EFF7169f7D80Af770c8EA2) [zama/ZamaInputVerifier] {
    +++ description: Ethereum host-chain verifier for encrypted input attestations produced by the Zama Gateway InputVerification contract. The FHEVMExecutor calls it before accepting user-provided ciphertext handles.
    +++ description: Coprocessor signers accepted by InputVerifier. The threshold number of these signers must sign encrypted input bundles for the Gateway InputVerification EIP-712 domain before the FHEVMExecutor accepts the resulting ciphertext handles.
    +++ severity: HIGH
    values.getCoprocessorSigners.1:
    + "eth:0x679953d556e71F62673F38EE4775d6E7CCb23E64"
    +++ description: Coprocessor signers accepted by InputVerifier. The threshold number of these signers must sign encrypted input bundles for the Gateway InputVerification EIP-712 domain before the FHEVMExecutor accepts the resulting ciphertext handles.
    +++ severity: HIGH
    values.getCoprocessorSigners.2:
    + "eth:0xF6ee37de6bDaB31597E90ED70448B92073cD9634"
    +++ description: Coprocessor signers accepted by InputVerifier. The threshold number of these signers must sign encrypted input bundles for the Gateway InputVerification EIP-712 domain before the FHEVMExecutor accepts the resulting ciphertext handles.
    +++ severity: HIGH
    values.getCoprocessorSigners.3:
    + "eth:0x2e809E897AA8046Ff6e936502b6275F0B8993456"
    +++ description: Coprocessor signers accepted by InputVerifier. The threshold number of these signers must sign encrypted input bundles for the Gateway InputVerification EIP-712 domain before the FHEVMExecutor accepts the resulting ciphertext handles.
    +++ severity: HIGH
    values.getCoprocessorSigners.4:
    + "eth:0x68EDabe2F16CcC37cB2Bb05F1D1EDad3e1Eecbd7"
    +++ description: Minimum number of configured coprocessor signer signatures required to accept an encrypted input bundle.
    +++ severity: HIGH
    values.getThreshold:
    - 1
    + 3
    }
    EOA (eth:0xD87298Dde09403C68fF5c1FFa2aE02704CF930fe) {
    +++ description: None
    sourceHashes:
    - ["0x1f44812af62d28f019e30e8eb2af596fb36c7db9d34576972c0405e110a6ef45"]
    proxyType:
    - "EIP7702 EOA"
    + "EOA"
    values:
    - {"$implementation":"eth:0x63c0c19a282a1B52b07dD5a65b58948A07DAE32B","delegationManager":"eth:0xdb9B1e94B5b69Df7e401DDbedE43491141047dB3","DOMAIN_VERSION":"1","eip712Domain":{"fields":"0x0f","name":"EIP7702StatelessDeleGator","version":"1","chainId":1,"verifyingContract":"eth:0xD87298Dde09403C68fF5c1FFa2aE02704CF930fe","salt":"0x0000000000000000000000000000000000000000000000000000000000000000","extensions":[]},"entryPoint":"eth:0x0000000071727De22E5E9d8BAf0edAc6f37da032","getDeposit":0,"getDomainHash":"0x453a77b4f2a960fc023491780a7e261b19f544175efb54278e7c77c888c70542","getNonce":0,"NAME":"EIP7702StatelessDeleGator","PACKED_USER_OP_TYPEHASH":"0xbc37962d8bd1d319c95199bdfda6d3f92baa8903a61b32d5f4ec1f4b36a3bc18","VERSION":"1.3.0"}
    }
    EOA (zama:0x0000000000000000000000000000000000000000) {
    +++ description: None
    receivedPermissions.0:
    + {"permission":"interact","from":"zama:0xcB1bB072f38bdAF0F328CdEf1Fc6eDa1DF029287","description":"finalize encrypted input proof verification or rejection in InputVerification alone while priority mode is active.","role":".gatewayPriorityCoprocessorTxSender"}
    receivedPermissions.1:
    + {"permission":"interact","from":"zama:0xd82cF70FC102028cd01acB87D0E107780ae4F41F","description":"commit ciphertext and SNS ciphertext digests to CiphertextCommits alone while priority mode is active.","role":".gatewayPriorityCoprocessorTxSender"}
    receivedPermissions.3:
    + {"permission":"interact","from":"zama:0xDE537Be194777A56f8B19d14079E6a78249390ab","description":"finalize coprocessor consensus alone for encrypted input proofs and ciphertext material commitments while priority mode is active.","role":".getPriorityCoprocessorTxSender"}
    }
    EOA (zama:0x373E36A8684A3344E177C5894179845Cbe57AE44) {
    +++ description: None
    receivedPermissions.1:
    - {"permission":"interact","from":"zama:0xcB1bB072f38bdAF0F328CdEf1Fc6eDa1DF029287","description":"finalize encrypted input proof verification or rejection in InputVerification alone while priority mode is active.","role":".gatewayPriorityCoprocessorTxSender"}
    receivedPermissions.4:
    - {"permission":"interact","from":"zama:0xd82cF70FC102028cd01acB87D0E107780ae4F41F","description":"commit ciphertext and SNS ciphertext digests to CiphertextCommits alone while priority mode is active.","role":".gatewayPriorityCoprocessorTxSender"}
    receivedPermissions.6:
    - {"permission":"interact","from":"zama:0xDE537Be194777A56f8B19d14079E6a78249390ab","description":"finalize coprocessor consensus alone for encrypted input proofs and ciphertext material commitments while priority mode is active.","role":".getPriorityCoprocessorTxSender"}
    }
    contract InputVerification (zama:0xcB1bB072f38bdAF0F328CdEf1Fc6eDa1DF029287) [zama/InputVerification_v0_5_0] {
    +++ description: Gateway contract that receives encrypted input verification requests from registered and enabled host chains, collects coprocessor responses, and emits a threshold-signed attestation once coprocessor consensus is reached. Since v0.5.0, if GatewayConfig designates a priority coprocessor, that coprocessor's single response finalizes verification or rejection and the attestation carries only its signature. Ethereum InputVerifier verifies attestations against this contract's EIP-712 domain.
    +++ description: Priority coprocessor transaction sender configured in GatewayConfig, or zero when disabled. While set, this single coprocessor finalizes encrypted input proof verification and rejection on its own and other coprocessor responses cannot finalize.
    +++ severity: HIGH
    values.gatewayPriorityCoprocessorTxSender:
    - "zama:0x373E36A8684A3344E177C5894179845Cbe57AE44"
    + "zama:0x0000000000000000000000000000000000000000"
    }
    contract CiphertextCommits (zama:0xd82cF70FC102028cd01acB87D0E107780ae4F41F) [zama/CiphertextCommits_v0_5_0] {
    +++ description: Gateway contract that stores ciphertext and SNS ciphertext digests after coprocessor consensus, allowing decryption requests to reference committed ciphertext material. Digests referencing unregistered or disabled host chains are rejected. Since v0.5.0, if GatewayConfig designates a priority coprocessor, that coprocessor's single submission commits the material on its own.
    +++ description: Priority coprocessor transaction sender configured in GatewayConfig, or zero when disabled. While set, this single coprocessor commits ciphertext material on its own and other coprocessor submissions cannot finalize.
    +++ severity: HIGH
    values.gatewayPriorityCoprocessorTxSender:
    - "zama:0x373E36A8684A3344E177C5894179845Cbe57AE44"
    + "zama:0x0000000000000000000000000000000000000000"
    }
    contract GatewayConfig (zama:0xDE537Be194777A56f8B19d14079E6a78249390ab) [zama/GatewayConfig_v0_7_0] {
    +++ description: Central configuration contract for the Zama Gateway. A KMS context snapshots node transaction senders, signers, and workflow thresholds; the owner can create new contexts, retune the thresholds of any live context, and destroy non-current contexts, which immediately invalidates them for decryption. Registered host chains can be disabled, re-enabled, or removed by the owner. Since v0.7.0 the owner can designate a priority coprocessor transaction sender whose single response finalizes coprocessor consensus in InputVerification and CiphertextCommits, making the coprocessor majority threshold inert, and coprocessor set and threshold updates are applied live without pausing InputVerification.
    +++ description: Priority coprocessor transaction sender, or zero when priority mode is disabled. While set, a single response from this registered coprocessor finalizes encrypted input proof verification and rejection in InputVerification and ciphertext material commitments in CiphertextCommits; the coprocessor majority threshold is inert and other coprocessors cannot finalize. The owner can set or remove it live, and updateCoprocessors cannot drop the active priority coprocessor or rotate its signer.
    +++ severity: HIGH
    values.getPriorityCoprocessorTxSender:
    - "zama:0x373E36A8684A3344E177C5894179845Cbe57AE44"
    + "zama:0x0000000000000000000000000000000000000000"
    }

    New and verified contracts

    + Status: CREATED
    contract RoxcUSDCDepositBatcher (eth:0x084fd3a517D6DaE1f8E3E5481b65107fd7e5eEc1) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract VaultBatcherConfidentialRouter (eth:0x11c6Acfd368DDFAB97d15649eB8043C0197fac4C) [zama/VaultBatcherConfidentialRouter]
    +++ description: Ownerless router that splits one confidential deposit or redemption across several vault batchers. It accepts only wrappers listed in the ConfidentialTokenWrappersRegistry.
    + Status: CREATED
    contract PendleUSDCDepositBatcher (eth:0x1B731EC615165094Ec4d695b0a1c8eE31366Cf84) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract ArmUSDCpRedeemBatcher (eth:0x2B5eB25dA24dcd00A825487c60401F9736091006) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract RoxUSDCyDepositBatcher (eth:0x2dEAFB36F3B118d434CDE4708e8350eae918724d) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract BbqTGBPRedeemBatcher (eth:0x2FB51a8fe20D9cc830b9CA5251f8d845eb5BAAa7) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract BbqUSDCDepositBatcher (eth:0x321C9AaB1390100f6e7fE1735a928ec0F16252f0) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract SteakcUSDCDepositBatcherV1 (eth:0x324EA89FD3784036673BfE6Ffee2334A088F40Cc) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract ZamaDeFiMultisig (eth:0x37c8bfa303f173350eefCB6D4a995E68FFbdF3FD) [zama/Multisig]
    +++ description: Aragon multisig plugin for creating proposals and collecting approvals against a configurable threshold.
    + Status: CREATED
    contract SteakcUSDCRedeemBatcher (eth:0x3a906d6509EB4171Ee9fC71D083fb1638BaF083D) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract RoxcUSDCRedeemBatcher (eth:0x43e8f7B280B19637d2A7e3008657282AaF2C0E4b) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract SteakcUSDCRedeemBatcherV2 (eth:0x4Ad6368aD783644F1BB780F0A0F00cD77ca06400) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract ArmUSDCsRedeemBatcher (eth:0x4f555b54842E609bA62843E0Ab4Ff184A436772e) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract PAPYRedeemBatcher (eth:0x52FfC3Aa2372D42d1cB413C0E36659ffF1e58EC1) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract SteakcUSDCDepositBatcherV2 (eth:0x6e05F3bE50c7890Ba10B30e9492b20683d5cC707) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract ArmUSDTsDepositBatcher (eth:0x7320830992a924e6D2f3D3E9A74fbd103E9A20AE) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract SteakUSDTDepositBatcher (eth:0x737F4558c0cC7C29b56dd13c34B68e967C91E399) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract ArmUSDTsRedeemBatcher (eth:0x79e621c35B93329bbB6F06D9635981B9a5f4a255) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract SteakUSDTRedeemBatcher (eth:0x7Afb2CD6D41C379e3d8B46f206346b63A67F4d43) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract BbqUSDCRedeemBatcher (eth:0x807C367dA7B9228643b06390e199E33ccA7Cc533) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract ArmcWBTCRedeemBatcher (eth:0x83540Af3adFc4d3133139D57D4BAB17828902F05) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract ArmUSDCsDepositBatcher (eth:0x87356ade88315aed3aC61B42caCC3a263730B1BD) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract ConfidentialSwap (eth:0x8Fe22dC7e624c02b1805d41E09741490E1018C01) [zama/ConfidentialSwap]
    +++ description: Request-for-quote protocol for swaps between confidential tokens. A maker escrows an encrypted intent that hides the real order among candidate orders, whitelisted market makers quote every candidate in a sealed-bid auction, and the revealed winner settles within the settlement window or the maker reclaims the escrow.
    + Status: CREATED
    contract SteakcUSDCRedeemBatcherV1 (eth:0x96Cd3Faa7483783Ac2Eb715f6333361500F1eec9) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract ArmUSDTpRedeemBatcher (eth:0x99384d982399a9D890873E402EC04DEE7dad8737) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract SteakcUSDCDepositBatcher (eth:0xA07c00A3b955B805B3Ea76b086f95a3e793715D5) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract ArmcWBTCDepositBatcher (eth:0xAC82e75FBA31122c1FEb575ebc371aA2EF78604D) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract FAUSDeDepositBatcher (eth:0xae09d50C6B6E91D9FBE50D168eA6567759e930f8) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract FcUSDTDepositBatcher (eth:0xbEbee65445dAD2F31628ADd14535fd0B3fC915b4) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract ArmUSDCpDepositBatcher (eth:0xd26F1546e7aFD5881F132967637957416802865A) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract FcUSDTRedeemBatcher (eth:0xd2f3f554F995c12e2BfE5E155397cB6272643744) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract PendleUSDCRedeemBatcher (eth:0xD671b562fdecE574da12295D1680F6a7a0af2963) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract BbqUSDTDepositBatcher (eth:0xe1Bc291CF6fD71173dB73D58f1b25fC371B9Aa6D) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract PAPYDepositBatcher (eth:0xe396FD82a7Aa2F89C16505c1AD46e91F3bc7d3b0) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract Safe (eth:0xE53e32a669357Ab0360103d8f294812B914AF9e4) [GnosisSafe]
    +++ description: None
    + Status: CREATED
    contract FAUSDeRedeemBatcher (eth:0xE7761e3864b077728cafE4E18e9c8C23B6F896D0) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract RoxUSDCyRedeemBatcher (eth:0xf18Ad9F94a7EA994FdCbC5fD5C5Da326a341d8a8) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract ArmUSDTpDepositBatcher (eth:0xFb21951F291E742f24aB4F5c0c11e7BC8864142A) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract BbqUSDTRedeemBatcher (eth:0xFc659Fa98AC62970cAe2C594Be32fe4F8b844Ea3) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    + Status: CREATED
    contract BbqTGBPDepositBatcher (eth:0xfD899e481C7349d107005feFb1d19F33923b481A) [zama/VaultBatcherConfidential]
    +++ description: Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.
    High severity
    6changes

    Safe 0x97E1…4e54 upgraded from Safe 1.4.1 to 1.5.0. The Aragon Multisig template now models its members, which changes no resolved permission here.

    Safe 0x97E1…4e54 upgraded from Safe 1.4.1 to 1.5.0. The Aragon Multisig template now models its members, which changes no resolved permission here.

    contract Safe (eth:0x97E18544e156724E4076945F10c288ecBBC94e54) [GnosisSafe] {
    +++ description: None
    sourceHashes.1:
    - "0xe23c519b7324d6dc9132c8567ac55ae72bdf168c914d22825c7614d822364b0f"
    + "0xb66849da6643e8cd188f73efe4edb32704a1540eda5b1aef77a2217ad2d81f78"
    values.$implementation:
    - "eth:0x41675C099F32341bf84BFc5382aF534df5C7461a"
    + "eth:0xFf51A5898e281Db6DfC7855790607438dF2ca44b"
    values.getChainId:
    - 1
    values.VERSION:
    - "1.4.1"
    + "1.5.0"
    implementationNames.eth:0x41675C099F32341bf84BFc5382aF534df5C7461a:
    - "Safe"
    implementationNames.eth:0xFf51A5898e281Db6DfC7855790607438dF2ca44b:
    + "Safe"
    }
    High severity
    28changes

    Gateway coprocessors expanded from one to five, and their majority threshold rose to three. ACL updates now need three responses.

    Gateway coprocessors expanded from one to five, and their majority threshold rose to three. ACL updates now need three responses.

    contract MultichainACL (zama:0x055d9FD50a612A9027716ec8db663E7D68562468) [zama/MultichainACL] {
    +++ description: Gateway-side ACL mirror that records coprocessor consensus for host-chain public decryption permissions, account handle allowances, and delegated user-decryption access. For Ethereum, it mirrors ACL events emitted by the L1 ACL contract registered in GatewayConfig.
    +++ description: Minimum number of matching coprocessor messages required before an ACL update reaches consensus.
    +++ severity: HIGH
    values.gatewayCoprocessorMajorityThreshold:
    - 1
    + 3
    +++ description: Coprocessor transaction-sender addresses configured in GatewayConfig. These accounts may update the gateway ACL mirror once enough coprocessors agree.
    +++ severity: HIGH
    values.gatewayCoprocessorTxSenders.1:
    + "zama:0x679953d556e71F62673F38EE4775d6E7CCb23E64"
    +++ description: Coprocessor transaction-sender addresses configured in GatewayConfig. These accounts may update the gateway ACL mirror once enough coprocessors agree.
    +++ severity: HIGH
    values.gatewayCoprocessorTxSenders.2:
    + "zama:0xF6ee37de6bDaB31597E90ED70448B92073cD9634"
    +++ description: Coprocessor transaction-sender addresses configured in GatewayConfig. These accounts may update the gateway ACL mirror once enough coprocessors agree.
    +++ severity: HIGH
    values.gatewayCoprocessorTxSenders.3:
    + "zama:0x2e809E897AA8046Ff6e936502b6275F0B8993456"
    +++ description: Coprocessor transaction-sender addresses configured in GatewayConfig. These accounts may update the gateway ACL mirror once enough coprocessors agree.
    +++ severity: HIGH
    values.gatewayCoprocessorTxSenders.4:
    + "zama:0x68EDabe2F16CcC37cB2Bb05F1D1EDad3e1Eecbd7"
    }
    contract InputVerification (zama:0xcB1bB072f38bdAF0F328CdEf1Fc6eDa1DF029287) [zama/InputVerification_v0_5_0] {
    +++ description: Gateway contract that receives encrypted input verification requests from registered and enabled host chains, collects coprocessor responses, and emits a threshold-signed attestation once coprocessor consensus is reached. Since v0.5.0, if GatewayConfig designates a priority coprocessor, that coprocessor's single response finalizes verification or rejection and the attestation carries only its signature. Ethereum InputVerifier verifies attestations against this contract's EIP-712 domain.
    +++ description: Minimum number of matching coprocessor responses required for an encrypted input proof to be verified or rejected. Inert while a priority coprocessor is set in GatewayConfig (see gatewayPriorityCoprocessorTxSender).
    +++ severity: HIGH
    values.gatewayCoprocessorMajorityThreshold:
    - 1
    + 3
    +++ description: Coprocessor signer addresses configured in GatewayConfig. Their EIP-712 signatures determine whether encrypted input proofs reach consensus.
    +++ severity: HIGH
    values.gatewayCoprocessorSigners.1:
    + "zama:0x679953d556e71F62673F38EE4775d6E7CCb23E64"
    +++ description: Coprocessor signer addresses configured in GatewayConfig. Their EIP-712 signatures determine whether encrypted input proofs reach consensus.
    +++ severity: HIGH
    values.gatewayCoprocessorSigners.2:
    + "zama:0xF6ee37de6bDaB31597E90ED70448B92073cD9634"
    +++ description: Coprocessor signer addresses configured in GatewayConfig. Their EIP-712 signatures determine whether encrypted input proofs reach consensus.
    +++ severity: HIGH
    values.gatewayCoprocessorSigners.3:
    + "zama:0x2e809E897AA8046Ff6e936502b6275F0B8993456"
    +++ description: Coprocessor signer addresses configured in GatewayConfig. Their EIP-712 signatures determine whether encrypted input proofs reach consensus.
    +++ severity: HIGH
    values.gatewayCoprocessorSigners.4:
    + "zama:0x68EDabe2F16CcC37cB2Bb05F1D1EDad3e1Eecbd7"
    +++ description: Coprocessor transaction-sender addresses configured in GatewayConfig. These accounts may submit signed verification responses and rejection responses.
    +++ severity: HIGH
    values.gatewayCoprocessorTxSenders.1:
    + "zama:0x679953d556e71F62673F38EE4775d6E7CCb23E64"
    +++ description: Coprocessor transaction-sender addresses configured in GatewayConfig. These accounts may submit signed verification responses and rejection responses.
    +++ severity: HIGH
    values.gatewayCoprocessorTxSenders.2:
    + "zama:0xF6ee37de6bDaB31597E90ED70448B92073cD9634"
    +++ description: Coprocessor transaction-sender addresses configured in GatewayConfig. These accounts may submit signed verification responses and rejection responses.
    +++ severity: HIGH
    values.gatewayCoprocessorTxSenders.3:
    + "zama:0x2e809E897AA8046Ff6e936502b6275F0B8993456"
    +++ description: Coprocessor transaction-sender addresses configured in GatewayConfig. These accounts may submit signed verification responses and rejection responses.
    +++ severity: HIGH
    values.gatewayCoprocessorTxSenders.4:
    + "zama:0x68EDabe2F16CcC37cB2Bb05F1D1EDad3e1Eecbd7"
    }
    contract CiphertextCommits (zama:0xd82cF70FC102028cd01acB87D0E107780ae4F41F) [zama/CiphertextCommits_v0_5_0] {
    +++ description: Gateway contract that stores ciphertext and SNS ciphertext digests after coprocessor consensus, allowing decryption requests to reference committed ciphertext material. Digests referencing unregistered or disabled host chains are rejected. Since v0.5.0, if GatewayConfig designates a priority coprocessor, that coprocessor's single submission commits the material on its own.
    +++ description: Minimum number of matching coprocessor submissions required before ciphertext material is committed. Inert while a priority coprocessor is set in GatewayConfig (see gatewayPriorityCoprocessorTxSender).
    +++ severity: HIGH
    values.gatewayCoprocessorMajorityThreshold:
    - 1
    + 3
    +++ description: Coprocessor transaction-sender addresses configured in GatewayConfig. These accounts may submit ciphertext material commitments.
    +++ severity: HIGH
    values.gatewayCoprocessorTxSenders.1:
    + "zama:0x679953d556e71F62673F38EE4775d6E7CCb23E64"
    +++ description: Coprocessor transaction-sender addresses configured in GatewayConfig. These accounts may submit ciphertext material commitments.
    +++ severity: HIGH
    values.gatewayCoprocessorTxSenders.2:
    + "zama:0xF6ee37de6bDaB31597E90ED70448B92073cD9634"
    +++ description: Coprocessor transaction-sender addresses configured in GatewayConfig. These accounts may submit ciphertext material commitments.
    +++ severity: HIGH
    values.gatewayCoprocessorTxSenders.3:
    + "zama:0x2e809E897AA8046Ff6e936502b6275F0B8993456"
    +++ description: Coprocessor transaction-sender addresses configured in GatewayConfig. These accounts may submit ciphertext material commitments.
    +++ severity: HIGH
    values.gatewayCoprocessorTxSenders.4:
    + "zama:0x68EDabe2F16CcC37cB2Bb05F1D1EDad3e1Eecbd7"
    }
    contract GatewayConfig (zama:0xDE537Be194777A56f8B19d14079E6a78249390ab) [zama/GatewayConfig_v0_7_0] {
    +++ description: Central configuration contract for the Zama Gateway. A KMS context snapshots node transaction senders, signers, and workflow thresholds; the owner can create new contexts, retune the thresholds of any live context, and destroy non-current contexts, which immediately invalidates them for decryption. Registered host chains can be disabled, re-enabled, or removed by the owner. Since v0.7.0 the owner can designate a priority coprocessor transaction sender whose single response finalizes coprocessor consensus in InputVerification and CiphertextCommits, making the coprocessor majority threshold inert, and coprocessor set and threshold updates are applied live without pausing InputVerification.
    +++ description: Minimum number of matching coprocessor messages required for gateway coprocessor consensus. Updates are applied live without pausing InputVerification. The threshold is inert while a priority coprocessor is set (see getPriorityCoprocessorTxSender).
    +++ severity: HIGH
    values.getCoprocessorMajorityThreshold:
    - 1
    + 3
    +++ description: Coprocessor signer addresses registered for this gateway. These sign encrypted input proof responses accepted by InputVerification.
    +++ severity: HIGH
    values.getCoprocessorSigners.1:
    + "zama:0x679953d556e71F62673F38EE4775d6E7CCb23E64"
    +++ description: Coprocessor signer addresses registered for this gateway. These sign encrypted input proof responses accepted by InputVerification.
    +++ severity: HIGH
    values.getCoprocessorSigners.2:
    + "zama:0xF6ee37de6bDaB31597E90ED70448B92073cD9634"
    +++ description: Coprocessor signer addresses registered for this gateway. These sign encrypted input proof responses accepted by InputVerification.
    +++ severity: HIGH
    values.getCoprocessorSigners.3:
    + "zama:0x2e809E897AA8046Ff6e936502b6275F0B8993456"
    +++ description: Coprocessor signer addresses registered for this gateway. These sign encrypted input proof responses accepted by InputVerification.
    +++ severity: HIGH
    values.getCoprocessorSigners.4:
    + "zama:0x68EDabe2F16CcC37cB2Bb05F1D1EDad3e1Eecbd7"
    +++ description: Coprocessor transaction-sender addresses registered for this gateway. These accounts submit input-verification, ACL, and ciphertext-material consensus messages.
    +++ severity: HIGH
    values.getCoprocessorTxSenders.1:
    + "zama:0x679953d556e71F62673F38EE4775d6E7CCb23E64"
    +++ description: Coprocessor transaction-sender addresses registered for this gateway. These accounts submit input-verification, ACL, and ciphertext-material consensus messages.
    +++ severity: HIGH
    values.getCoprocessorTxSenders.2:
    + "zama:0xF6ee37de6bDaB31597E90ED70448B92073cD9634"
    +++ description: Coprocessor transaction-sender addresses registered for this gateway. These accounts submit input-verification, ACL, and ciphertext-material consensus messages.
    +++ severity: HIGH
    values.getCoprocessorTxSenders.3:
    + "zama:0x2e809E897AA8046Ff6e936502b6275F0B8993456"
    +++ description: Coprocessor transaction-sender addresses registered for this gateway. These accounts submit input-verification, ACL, and ciphertext-material consensus messages.
    +++ severity: HIGH
    values.getCoprocessorTxSenders.4:
    + "zama:0x68EDabe2F16CcC37cB2Bb05F1D1EDad3e1Eecbd7"
    }
    High severity
    51changes

    Upgraded: - Gateway contracts introduce a priority coprocessor mode, where a single registered coprocessor can ignore the majority threshold and finalize input-proof verification and rejection, and ciphertext commits on its own (GatewayConfig: https://disco.l2beat.com/diff/zama:0x1950aD98e834f6c07553365196d4CddeD179c536/zama:0x94209410f6CAa4A8c6Fd7ED4AB67560eD8A3002C, InputVerification: https://disco.l2beat.com/diff/zama:0xf9f0F5ef8301CF1573EBe0F45E13A4CabB621821/zama:0xa9A3eA1cdD078a79bB31c3a284a4abA80bd0E8d8, CiphertextCommits: https://disco.l2beat.com/diff/zama:0xB373Ae42736E3C266D4A5D090c00c7f0Bda06622/zama:0x81a6CBD6B1bb0296BfFd38AD8584918640F35948). This mode effectively removes coprocessor decentralization. Zama coprocessor is also set as the priority coprocessor. - FHEVMExecutor has new validity checks (https://disco.l2beat.com/diff/eth:0xf444B2B5e45cD07F1E735122F53A2d70A8c81dB5/eth:0x0675c7BFA34aF170C49e6590A2cBf845c3029d7B).

    Upgraded:

    • Gateway contracts introduce a priority coprocessor mode, where a single registered coprocessor can ignore the majority threshold and finalize input-proof verification and rejection, and ciphertext commits on its own (GatewayConfig: https://disco.l2beat.com/diff/zama:0x1950aD98e834f6c07553365196d4CddeD179c536/zama:0x94209410f6CAa4A8c6Fd7ED4AB67560eD8A3002C, InputVerification: https://disco.l2beat.com/diff/zama:0xf9f0F5ef8301CF1573EBe0F45E13A4CabB621821/zama:0xa9A3eA1cdD078a79bB31c3a284a4abA80bd0E8d8, CiphertextCommits: https://disco.l2beat.com/diff/zama:0xB373Ae42736E3C266D4A5D090c00c7f0Bda06622/zama:0x81a6CBD6B1bb0296BfFd38AD8584918640F35948). This mode effectively removes coprocessor decentralization. Zama coprocessor is also set as the priority coprocessor.
    • FHEVMExecutor has new validity checks (https://disco.l2beat.com/diff/eth:0xf444B2B5e45cD07F1E735122F53A2d70A8c81dB5/eth:0x0675c7BFA34aF170C49e6590A2cBf845c3029d7B).
    contract FHEVMExecutor (eth:0xD82385dADa1ae3E969447f20A3164F6213100e75) [zama/ZamaFHEVMExecutor_v0_5_0] {
    +++ description: FHEVM executor that accepts encrypted operation requests, accounts for computation usage, and stores ciphertext handles for operation results. v0.5.0 rejects plaintext scalar operands and trivial-encryption inputs that do not fit their FHE type, checks division by zero in the shared binary-operation path, and adds a checkHandleType view that asserts the type of an initialized handle.
    template:
    - "zama/ZamaFHEVMExecutor_v0_4_0"
    + "zama/ZamaFHEVMExecutor_v0_5_0"
    sourceHashes.1:
    - "0x8521799e0a57218bcbd587c2f46222a266bbcbe2f27780cc0bf6ed66eb9cda1f"
    + "0x270ee2b9f564ae13a2f925f057cc5baca30e031fab0362ab7ce086bdd2cd1a01"
    description:
    - "FHEVM executor that accepts encrypted operation requests, accounts for computation usage, and stores ciphertext handles for operation results. v0.4.0 adds the n-ary encrypted operations fheSum and fheIsIn (encrypted set membership) over bounded ciphertext collections."
    + "FHEVM executor that accepts encrypted operation requests, accounts for computation usage, and stores ciphertext handles for operation results. v0.5.0 rejects plaintext scalar operands and trivial-encryption inputs that do not fit their FHE type, checks division by zero in the shared binary-operation path, and adds a checkHandleType view that asserts the type of an initialized handle."
    values.$implementation:
    - "eth:0xf444B2B5e45cD07F1E735122F53A2d70A8c81dB5"
    + "eth:0x0675c7BFA34aF170C49e6590A2cBf845c3029d7B"
    values.$pastUpgrades.5:
    + ["2026-10-05T16:11:11.000Z","0x63594740e6849980ffeecf14392b8b7f3e1e382c2e1ea023eb7a3df345f61328",["eth:0x0675c7BFA34aF170C49e6590A2cBf845c3029d7B"]]
    values.$upgradeCount:
    - 5
    + 6
    values.getVersion:
    - "FHEVMExecutor v0.4.0"
    + "FHEVMExecutor v0.5.0"
    implementationNames.eth:0xf444B2B5e45cD07F1E735122F53A2d70A8c81dB5:
    - "FHEVMExecutor"
    implementationNames.eth:0x0675c7BFA34aF170C49e6590A2cBf845c3029d7B:
    + "FHEVMExecutor"
    }
    EOA (zama:0x373E36A8684A3344E177C5894179845Cbe57AE44) {
    +++ description: None
    receivedPermissions.1:
    + {"permission":"interact","from":"zama:0xcB1bB072f38bdAF0F328CdEf1Fc6eDa1DF029287","description":"finalize encrypted input proof verification or rejection in InputVerification alone while priority mode is active.","role":".gatewayPriorityCoprocessorTxSender"}
    receivedPermissions.4:
    + {"permission":"interact","from":"zama:0xd82cF70FC102028cd01acB87D0E107780ae4F41F","description":"commit ciphertext and SNS ciphertext digests to CiphertextCommits alone while priority mode is active.","role":".gatewayPriorityCoprocessorTxSender"}
    receivedPermissions.6:
    + {"permission":"interact","from":"zama:0xDE537Be194777A56f8B19d14079E6a78249390ab","description":"finalize coprocessor consensus alone for encrypted input proofs and ciphertext material commitments while priority mode is active.","role":".getPriorityCoprocessorTxSender"}
    }
    contract SafeL2 (zama:0x5f0F86BcEad6976711C9B131bCa5D30E767fe2bE) [GnosisSafe] {
    +++ description: Gateway owner Safe. Its LayerZero governance module is outside the Zama Gateway protocol surface covered here.
    receivedPermissions.4.description:
    - "create KMS contexts that immediately become current, destroy historical KMS contexts, update thresholds of any live context, manage coprocessors, custodians and host chains, transfer ownership, and unpause gateway workflow contracts."
    + "create KMS contexts that immediately become current, destroy historical KMS contexts, update thresholds of any live context, manage coprocessors, custodians and host chains, set or remove the priority coprocessor that alone finalizes coprocessor consensus, transfer ownership, and unpause gateway workflow contracts."
    }
    contract InputVerification (zama:0xcB1bB072f38bdAF0F328CdEf1Fc6eDa1DF029287) [zama/InputVerification_v0_5_0] {
    +++ description: Gateway contract that receives encrypted input verification requests from registered and enabled host chains, collects coprocessor responses, and emits a threshold-signed attestation once coprocessor consensus is reached. Since v0.5.0, if GatewayConfig designates a priority coprocessor, that coprocessor's single response finalizes verification or rejection and the attestation carries only its signature. Ethereum InputVerifier verifies attestations against this contract's EIP-712 domain.
    template:
    - "zama/InputVerification"
    + "zama/InputVerification_v0_5_0"
    sourceHashes.1:
    - "0x58bb055397e294a46ebccbc53c94bb2494bf05acd7ad77f2fb7cc46b3ef1eb92"
    + "0x5018850c43e4cdb57f9d66bfa3b13efd5321f0c3d39a78259aab0c007663a1ef"
    description:
    - "Gateway contract that receives encrypted input verification requests from registered and enabled host chains, collects coprocessor responses, and emits a threshold-signed attestation once coprocessor consensus is reached. Ethereum InputVerifier verifies attestations against this contract's EIP-712 domain."
    + "Gateway contract that receives encrypted input verification requests from registered and enabled host chains, collects coprocessor responses, and emits a threshold-signed attestation once coprocessor consensus is reached. Since v0.5.0, if GatewayConfig designates a priority coprocessor, that coprocessor's single response finalizes verification or rejection and the attestation carries only its signature. Ethereum InputVerifier verifies attestations against this contract's EIP-712 domain."
    values.$implementation:
    - "zama:0xf9f0F5ef8301CF1573EBe0F45E13A4CabB621821"
    + "zama:0xa9A3eA1cdD078a79bB31c3a284a4abA80bd0E8d8"
    values.$pastUpgrades.4:
    + ["2026-10-08T10:05:10.000Z","0x2dc9ffacebc169a90ee746b5818b83d470bf7dbc5855c1ae05268b76caf604aa",["zama:0xa9A3eA1cdD078a79bB31c3a284a4abA80bd0E8d8"]]
    values.$upgradeCount:
    - 4
    + 5
    values.getVersion:
    - "InputVerification v0.4.0"
    + "InputVerification v0.5.0"
    +++ description: Priority coprocessor transaction sender configured in GatewayConfig, or zero when disabled. While set, this single coprocessor finalizes encrypted input proof verification and rejection on its own and other coprocessor responses cannot finalize.
    +++ severity: HIGH
    values.gatewayPriorityCoprocessorTxSender:
    + "zama:0x373E36A8684A3344E177C5894179845Cbe57AE44"
    fieldMeta.gatewayCoprocessorMajorityThreshold.description:
    - "Minimum number of matching coprocessor responses required for an encrypted input proof to be verified or rejected."
    + "Minimum number of matching coprocessor responses required for an encrypted input proof to be verified or rejected. Inert while a priority coprocessor is set in GatewayConfig (see gatewayPriorityCoprocessorTxSender)."
    fieldMeta.gatewayPriorityCoprocessorTxSender:
    + {"severity":"HIGH","description":"Priority coprocessor transaction sender configured in GatewayConfig, or zero when disabled. While set, this single coprocessor finalizes encrypted input proof verification and rejection on its own and other coprocessor responses cannot finalize.","type":"PERMISSION"}
    implementationNames.zama:0xf9f0F5ef8301CF1573EBe0F45E13A4CabB621821:
    - "InputVerification"
    implementationNames.zama:0xa9A3eA1cdD078a79bB31c3a284a4abA80bd0E8d8:
    + "InputVerification"
    }
    contract CiphertextCommits (zama:0xd82cF70FC102028cd01acB87D0E107780ae4F41F) [zama/CiphertextCommits_v0_5_0] {
    +++ description: Gateway contract that stores ciphertext and SNS ciphertext digests after coprocessor consensus, allowing decryption requests to reference committed ciphertext material. Digests referencing unregistered or disabled host chains are rejected. Since v0.5.0, if GatewayConfig designates a priority coprocessor, that coprocessor's single submission commits the material on its own.
    template:
    - "zama/CiphertextCommits"
    + "zama/CiphertextCommits_v0_5_0"
    sourceHashes.1:
    - "0xa3aa22a184258ca16a5d83ce495ae0d307d4c5ec9fda8a7622d4f95728f4af03"
    + "0x2b3db0e0d5ff22923e545ffb64992573f75c3b020179bd81534fb16c054dfa7c"
    description:
    - "Gateway contract that stores ciphertext and SNS ciphertext digests after coprocessor consensus, allowing decryption requests to reference committed ciphertext material. Digests referencing unregistered or disabled host chains are rejected."
    + "Gateway contract that stores ciphertext and SNS ciphertext digests after coprocessor consensus, allowing decryption requests to reference committed ciphertext material. Digests referencing unregistered or disabled host chains are rejected. Since v0.5.0, if GatewayConfig designates a priority coprocessor, that coprocessor's single submission commits the material on its own."
    values.$implementation:
    - "zama:0xB373Ae42736E3C266D4A5D090c00c7f0Bda06622"
    + "zama:0x81a6CBD6B1bb0296BfFd38AD8584918640F35948"
    values.$pastUpgrades.4:
    + ["2026-10-08T10:05:10.000Z","0x2dc9ffacebc169a90ee746b5818b83d470bf7dbc5855c1ae05268b76caf604aa",["zama:0x81a6CBD6B1bb0296BfFd38AD8584918640F35948"]]
    values.$upgradeCount:
    - 4
    + 5
    values.getVersion:
    - "CiphertextCommits v0.4.0"
    + "CiphertextCommits v0.5.0"
    +++ description: Priority coprocessor transaction sender configured in GatewayConfig, or zero when disabled. While set, this single coprocessor commits ciphertext material on its own and other coprocessor submissions cannot finalize.
    +++ severity: HIGH
    values.gatewayPriorityCoprocessorTxSender:
    + "zama:0x373E36A8684A3344E177C5894179845Cbe57AE44"
    fieldMeta.gatewayCoprocessorMajorityThreshold.description:
    - "Minimum number of matching coprocessor submissions required before ciphertext material is committed."
    + "Minimum number of matching coprocessor submissions required before ciphertext material is committed. Inert while a priority coprocessor is set in GatewayConfig (see gatewayPriorityCoprocessorTxSender)."
    fieldMeta.gatewayPriorityCoprocessorTxSender:
    + {"severity":"HIGH","description":"Priority coprocessor transaction sender configured in GatewayConfig, or zero when disabled. While set, this single coprocessor commits ciphertext material on its own and other coprocessor submissions cannot finalize.","type":"PERMISSION"}
    implementationNames.zama:0xB373Ae42736E3C266D4A5D090c00c7f0Bda06622:
    - "CiphertextCommits"
    implementationNames.zama:0x81a6CBD6B1bb0296BfFd38AD8584918640F35948:
    + "CiphertextCommits"
    }
    contract GatewayConfig (zama:0xDE537Be194777A56f8B19d14079E6a78249390ab) [zama/GatewayConfig_v0_7_0] {
    +++ description: Central configuration contract for the Zama Gateway. A KMS context snapshots node transaction senders, signers, and workflow thresholds; the owner can create new contexts, retune the thresholds of any live context, and destroy non-current contexts, which immediately invalidates them for decryption. Registered host chains can be disabled, re-enabled, or removed by the owner. Since v0.7.0 the owner can designate a priority coprocessor transaction sender whose single response finalizes coprocessor consensus in InputVerification and CiphertextCommits, making the coprocessor majority threshold inert, and coprocessor set and threshold updates are applied live without pausing InputVerification.
    template:
    - "zama/GatewayConfig_v0_6_0"
    + "zama/GatewayConfig_v0_7_0"
    sourceHashes.1:
    - "0xe903576aaecdd97c5036c6bc029149a11b44484c78d9c6b0d802a882d4744597"
    + "0x26ff42c37647db207e8c9fa6bbc7ff8e6a15f782d4f85480a5fe711b95f25894"
    description:
    - "Central configuration contract for the Zama Gateway. A KMS context snapshots node transaction senders, signers, and workflow thresholds; the owner can create new contexts, retune the thresholds of any live context, and destroy non-current contexts, which immediately invalidates them for decryption. Registered host chains can be disabled, re-enabled, or removed by the owner."
    + "Central configuration contract for the Zama Gateway. A KMS context snapshots node transaction senders, signers, and workflow thresholds; the owner can create new contexts, retune the thresholds of any live context, and destroy non-current contexts, which immediately invalidates them for decryption. Registered host chains can be disabled, re-enabled, or removed by the owner. Since v0.7.0 the owner can designate a priority coprocessor transaction sender whose single response finalizes coprocessor consensus in InputVerification and CiphertextCommits, making the coprocessor majority threshold inert, and coprocessor set and threshold updates are applied live without pausing InputVerification."
    values.$implementation:
    - "zama:0x1950aD98e834f6c07553365196d4CddeD179c536"
    + "zama:0x94209410f6CAa4A8c6Fd7ED4AB67560eD8A3002C"
    values.$pastUpgrades.5:
    + ["2026-10-08T10:05:10.000Z","0x2dc9ffacebc169a90ee746b5818b83d470bf7dbc5855c1ae05268b76caf604aa",["zama:0x94209410f6CAa4A8c6Fd7ED4AB67560eD8A3002C"]]
    values.$upgradeCount:
    - 5
    + 6
    values.getVersion:
    - "GatewayConfig v0.6.0"
    + "GatewayConfig v0.7.0"
    +++ description: Priority coprocessor transaction sender, or zero when priority mode is disabled. While set, a single response from this registered coprocessor finalizes encrypted input proof verification and rejection in InputVerification and ciphertext material commitments in CiphertextCommits; the coprocessor majority threshold is inert and other coprocessors cannot finalize. The owner can set or remove it live, and updateCoprocessors cannot drop the active priority coprocessor or rotate its signer.
    +++ severity: HIGH
    values.getPriorityCoprocessorTxSender:
    + "zama:0x373E36A8684A3344E177C5894179845Cbe57AE44"
    fieldMeta.owner.description:
    - "Owner of GatewayConfig. This account creates and destroys KMS contexts, changes the thresholds of any live context, manages coprocessors, custodians and host chains (including disabling and removing them), transfers ownership, and unpauses gateway contracts. A newly created context becomes current immediately; older contexts remain selectable by Decryption requests until destroyed."
    + "Owner of GatewayConfig. This account creates and destroys KMS contexts, changes the thresholds of any live context, manages coprocessors, custodians and host chains (including disabling and removing them), sets or removes the priority coprocessor, transfers ownership, and unpauses gateway contracts. A newly created context becomes current immediately; older contexts remain selectable by Decryption requests until destroyed. Coprocessor set, threshold and priority updates are applied live without pausing InputVerification."
    fieldMeta.inputVerification.description:
    - "InputVerification workflow contract paused and unpaused by GatewayConfig. Coprocessor set and threshold updates require this contract to be paused first."
    + "InputVerification workflow contract paused and unpaused by GatewayConfig. Since v0.7.0 coprocessor set, threshold and priority coprocessor updates are applied live without pausing this contract first."
    fieldMeta.getCoprocessorMajorityThreshold.description:
    - "Minimum number of matching coprocessor messages required for gateway coprocessor consensus. Updates require InputVerification to be paused first."
    + "Minimum number of matching coprocessor messages required for gateway coprocessor consensus. Updates are applied live without pausing InputVerification. The threshold is inert while a priority coprocessor is set (see getPriorityCoprocessorTxSender)."
    fieldMeta.getPriorityCoprocessorTxSender:
    + {"severity":"HIGH","description":"Priority coprocessor transaction sender, or zero when priority mode is disabled. While set, a single response from this registered coprocessor finalizes encrypted input proof verification and rejection in InputVerification and ciphertext material commitments in CiphertextCommits; the coprocessor majority threshold is inert and other coprocessors cannot finalize. The owner can set or remove it live, and updateCoprocessors cannot drop the active priority coprocessor or rotate its signer.","type":"PERMISSION"}
    implementationNames.zama:0x1950aD98e834f6c07553365196d4CddeD179c536:
    - "GatewayConfig"
    implementationNames.zama:0x94209410f6CAa4A8c6Fd7ED4AB67560eD8A3002C:
    + "GatewayConfig"
    }
    2changes

    A Safe that is one of the signers of ZamaGovMultisigA (eth:0x69E55790880d0ABa56E48Ee1f7fc3834b0F5c223) lowered its own threshold from 3/5 to 2/5.

    A Safe that is one of the signers of ZamaGovMultisigA (eth:0x69E55790880d0ABa56E48Ee1f7fc3834b0F5c223) lowered its own threshold from 3/5 to 2/5.

    contract Safe (eth:0x69E55790880d0ABa56E48Ee1f7fc3834b0F5c223) [GnosisSafe] {
    +++ description: None
    values.$threshold:
    - 3
    + 2
    values.multisigThreshold:
    - "3 of 5 (60%)"
    + "2 of 5 (40%)"
    }

    Permissions

    A dashboard to explore contracts and permissions
    Go to Disco
    Disco UI Banner
    Disco UI BannerExplore in Disco

    Ethereum

    Actors:

    ZamaGovMultisigB0xBc86…a38F

    A Multisig with 3/6 threshold. Aragon multisig plugin for creating proposals and collecting approvals against a configurable threshold.

    • Can upgrade with no delay
      • ConfidentialSteakUSDTWrapper
      • ConfidentialArmUSDCpWrapper
      • HCULimit
      • ConfidentialRoxUSDCyWrapper
      • ConfidentialBbqUSDCWrapper
      • ConfidentialArmUSDTpWrapper
      • ConfidentialSteakcUSDCWrapper
      • Staking (Coprocessor)
      • ConfidentialXAUTWrapper
      • ConfidentialFAUSDeWrapper
      • KMSVerifier
      • ConfidentialArmUSDCsWrapper
      • ConfidentialBbqUSDTWrapper
      • ConfidentialZAMAWrapper
      • ConfidentialBRONWrapper
      • ConfidentialPENDLEWrapper
      • ConfidentialPAPYWrapper
      • ConfidentialFcUSDTWrapper
      • ConfidentialTGBPWrapper
      • ConfidentialUSDTWrapper
      • ConfidentialRoxcUSDCWrapper
      • ZamaGovCore
      • ConfidentialPendleUSDCWrapper
      • ConfidentialBbqTGBPWrapper
      • ConfidentialArmUSDTsWrapper
      • ACL
      • InputVerifier
      • ProtocolConfig
      • FHEVMExecutor
      • ConfidentialWBTCWrapper
      • ConfidentialWETHWrapper
      • ConfidentialUSDCWrapper
      • Staking (KMS)
      • ConfidentialAUSDWrapper
      • ConfidentialTokenWrappersRegistry
      • KMSGeneration
      • ConfidentialArmcWBTCWrapper
    • Can interact with ConfidentialSteakUSDTWrapper
      • blockAn ordered list of transactions and chain-related metadata that gets bundled together and published to the L1/DA layer. Nodes execute the transactions contained within blocks to change the rollup chain’s state. Protocol rules dictate what constitutes a valid block, and invalid blocks are skipped over. and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialArmUSDCpWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with HCULimit
      • change the per-block and per-transaction HCU limits and manage callers that bypass the per-block limit
    • Can interact with ConfidentialRoxUSDCyWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialBbqUSDCWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialArmUSDTpWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialSteakcUSDCWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with Staking (Coprocessor)
      • grant and revoke manager accounts, transfer or renounce the default admin role, and change the default admin transfer delay
      • set the reward rate, set the unstake cooldown period, and add or remove reward-eligible staking accounts
    • Can interact with ConfidentialXAUTWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialFAUSDeWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialArmUSDCsWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialBbqUSDTWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialZAMAWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialBRONWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialPENDLEWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialPAPYWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialFcUSDTWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialTGBPWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialUSDTWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialRoxcUSDCWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ZamaGovCore
      • change multisig plugin settings
      • change multisig plugin target execution configuration
      • grant and revoke permissions in this contract
    • Can interact with ConfidentialPendleUSDCWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialBbqTGBPWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialArmUSDTsWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with PauserSet
      • add, remove, or swap accounts that can pause the ACL
    • Can interact with ACL
      • transfer ACL ownership, unpause the ACL, block or unblock accounts, and manage PauserSet membership
    • Can interact with InputVerifier
      • set the coprocessor signer set and signature threshold used for encrypted input verification
    • Can interact with ProtocolConfig
      • create KMS contexts with arbitrary nodeA software client that participates in the network. sets and thresholds that immediately become the default verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. authority, destroy non-current contexts, and retune the per-context thresholds (public decryption, user decryption, key generation, MPC) of any live context including the current one. A malicious context or lowered threshold can attest an inflated unwrap amount and drain pooled wrapper backing
    • Can interact with ConfidentialWBTCWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialWETHWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialUSDCWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with Staking (KMS)
      • grant and revoke manager accounts, transfer or renounce the default admin role, and change the default admin transfer delay
      • set the reward rate, set the unstake cooldown period, and add or remove reward-eligible staking accounts
    • Can interact with ConfidentialAUSDWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialTokenWrappersRegistry
      • manage addresses in the registry
    • Can interact with KMSGeneration
      • trigger and abort FHE key and CRS generation rounds executed by the KMS nodes
    • Can interact with ConfidentialArmcWBTCWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership

    Participants (6):

    EOA 7EOA 70EOA 35EOA 37EOA 360x8aA8…9978
    ZamaGovMultisigA0xE43c…e66f

    A Multisig with 9/17 threshold. Aragon multisig plugin for creating proposals and collecting approvals against a configurable threshold.

    • Can upgrade with no delay
      • ConfidentialSteakUSDTWrapper
      • ConfidentialArmUSDCpWrapper
      • HCULimit
      • ConfidentialRoxUSDCyWrapper
      • ConfidentialBbqUSDCWrapper
      • ConfidentialArmUSDTpWrapper
      • ConfidentialSteakcUSDCWrapper
      • Staking (Coprocessor)
      • ConfidentialXAUTWrapper
      • ConfidentialFAUSDeWrapper
      • KMSVerifier
      • ConfidentialArmUSDCsWrapper
      • ConfidentialBbqUSDTWrapper
      • ConfidentialZAMAWrapper
      • ConfidentialBRONWrapper
      • ConfidentialPENDLEWrapper
      • ConfidentialPAPYWrapper
      • ConfidentialFcUSDTWrapper
      • ConfidentialTGBPWrapper
      • ConfidentialUSDTWrapper
      • ConfidentialRoxcUSDCWrapper
      • ZamaGovCore
      • ConfidentialPendleUSDCWrapper
      • ConfidentialBbqTGBPWrapper
      • ConfidentialArmUSDTsWrapper
      • ACL
      • InputVerifier
      • ProtocolConfig
      • FHEVMExecutor
      • ConfidentialWBTCWrapper
      • ConfidentialWETHWrapper
      • ConfidentialUSDCWrapper
      • Staking (KMS)
      • ConfidentialAUSDWrapper
      • ConfidentialTokenWrappersRegistry
      • KMSGeneration
      • ConfidentialArmcWBTCWrapper
    • Can interact with ConfidentialSteakUSDTWrapper
      • blockAn ordered list of transactions and chain-related metadata that gets bundled together and published to the L1/DA layer. Nodes execute the transactions contained within blocks to change the rollup chain’s state. Protocol rules dictate what constitutes a valid block, and invalid blocks are skipped over. and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialArmUSDCpWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with HCULimit
      • change the per-block and per-transaction HCU limits and manage callers that bypass the per-block limit
    • Can interact with ConfidentialRoxUSDCyWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialBbqUSDCWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialArmUSDTpWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialSteakcUSDCWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with Staking (Coprocessor)
      • grant and revoke manager accounts, transfer or renounce the default admin role, and change the default admin transfer delay
      • set the reward rate, set the unstake cooldown period, and add or remove reward-eligible staking accounts
    • Can interact with ConfidentialXAUTWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialFAUSDeWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialArmUSDCsWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialBbqUSDTWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialZAMAWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialBRONWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialPENDLEWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialPAPYWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialFcUSDTWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialTGBPWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialUSDTWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialRoxcUSDCWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ZamaGovCore
      • change multisig plugin settings
      • change multisig plugin target execution configuration
      • grant and revoke permissions in this contract
    • Can interact with ConfidentialPendleUSDCWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialBbqTGBPWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialArmUSDTsWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with PauserSet
      • add, remove, or swap accounts that can pause the ACL
    • Can interact with ACL
      • transfer ACL ownership, unpause the ACL, block or unblock accounts, and manage PauserSet membership
    • Can interact with InputVerifier
      • set the coprocessor signer set and signature threshold used for encrypted input verification
    • Can interact with ProtocolConfig
      • create KMS contexts with arbitrary nodeA software client that participates in the network. sets and thresholds that immediately become the default verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. authority, destroy non-current contexts, and retune the per-context thresholds (public decryption, user decryption, key generation, MPC) of any live context including the current one. A malicious context or lowered threshold can attest an inflated unwrap amount and drain pooled wrapper backing
    • Can interact with ConfidentialWBTCWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialWETHWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialUSDCWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with Staking (KMS)
      • grant and revoke manager accounts, transfer or renounce the default admin role, and change the default admin transfer delay
      • set the reward rate, set the unstake cooldown period, and add or remove reward-eligible staking accounts
    • Can interact with ConfidentialAUSDWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership
    • Can interact with ConfidentialTokenWrappersRegistry
      • manage addresses in the registry
    • Can interact with KMSGeneration
      • trigger and abort FHE key and CRS generation rounds executed by the KMS nodes
    • Can interact with ConfidentialArmcWBTCWrapper
      • block and unblock users, add and remove observers (wildcard decryption access to all balances of this wrapper), set the pauser and the underlying denylist selector, unpause, and transfer ownership

    Participants (17):

    ZamaDeFiGovCore0x644f…8a1e0x0321…E62e0x0f81…4ae60x931F…b0000xc2e5…E709Safe0x23Cd…D96bConduit Multisig 1SafeEOA 37EOA 36Safe0xE9AA…5BdB0xD92e…C8AE0xc493…d0080x27B1…9045
    ZamaDeFiMultisig0x37c8…F3FD

    A Multisig with 3/6 threshold. Aragon multisig plugin for creating proposals and collecting approvals against a configurable threshold.

    • Can upgrade with no delay
      • ZamaDeFiGovCore
      • ConfidentialSwap
    • Can interact with RoxcUSDCDepositBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with PendleUSDCDepositBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with ArmUSDCpRedeemBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with RoxUSDCyDepositBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with BbqTGBPRedeemBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with ZamaDeFiGovCore
      • change multisig plugin settings
      • change multisig plugin target execution configuration
      • grant and revoke permissions in this contract
    • Can interact with BbqUSDCDepositBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with SteakcUSDCDepositBatcherV1
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with SteakcUSDCRedeemBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with RoxcUSDCRedeemBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with SteakcUSDCRedeemBatcherV2
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with ArmUSDCsRedeemBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with PAPYRedeemBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with SteakcUSDCDepositBatcherV2
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with ArmUSDTsDepositBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with SteakUSDTDepositBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with ArmUSDTsRedeemBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with SteakUSDTRedeemBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with BbqUSDCRedeemBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with ArmcWBTCRedeemBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with ArmUSDCsDepositBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with ConfidentialSwap
      • grant and revoke market makers and pausers, curate asset pairs and fees, set the maker gateway, reveal per-asset swap volume and unpause
      • pause intent creation, quoting, settlementThe mechanism with which the execution of rollup blocks and the resultant state is verified and possible disputes are resolved. In the context of rollups or other modular blockchains, it often refers to the proof system used--validity (ZK) or fraud proofs, or a combination thereof. Sometimes it will refer to this mechanism along with where the mechanism's outputs are ultimately published and verified, as in Ethereum being a settlement layer by verifying the proofs and allowing for withdrawals. and reclaims
    • Can interact with SteakcUSDCRedeemBatcherV1
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with ArmUSDTpRedeemBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with SteakcUSDCDepositBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with ArmcWBTCDepositBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with FAUSDeDepositBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with FcUSDTDepositBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with ArmUSDCpDepositBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with FcUSDTRedeemBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with PendleUSDCRedeemBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with BbqUSDTDepositBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with PAPYDepositBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with FAUSDeRedeemBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with RoxUSDCyRedeemBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with ArmUSDTpDepositBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with BbqUSDTRedeemBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit
    • Can interact with BbqTGBPDepositBatcher
      • pause joins and dispatches, and set the minimum batch age, the callback deadline and the slippage limit

    Participants (6):

    EOA 7EOA 70EOA 35EOA 37EOA 360x8aA8…9978
    Safe0xE53e…F9e4

    A Multisig with 1/2 threshold.

    Participants (2):

    EOA 73EOA 72
    EOA 70x9b82…9B71

    Member of ZamaDeFiMultisig, ZamaGovMultisigB.

    • Can interact with ConfidentialSwap
      • decrypt the real order, amounts and minimum output of every swap intent, every quote and every settled amount
      • pause intent creation, quoting, settlementThe mechanism with which the execution of rollup blocks and the resultant state is verified and possible disputes are resolved. In the context of rollups or other modular blockchains, it often refers to the proof system used--validity (ZK) or fraud proofs, or a combination thereof. Sometimes it will refer to this mechanism along with where the mechanism's outputs are ultimately published and verified, as in Ethereum being a settlement layer by verifying the proofs and allowing for withdrawals. and reclaims
    • Can interact with PauserSet
      • pause the ACL
    EOA 350x6dd4…5874

    Member of ZamaDeFiMultisig, ZamaGovMultisigB.

    • Can interact with ConfidentialSwap
      • pause intent creation, quoting, settlementThe mechanism with which the execution of rollup blocks and the resultant state is verified and possible disputes are resolved. In the context of rollups or other modular blockchains, it often refers to the proof system used--validity (ZK) or fraud proofs, or a combination thereof. Sometimes it will refer to this mechanism along with where the mechanism's outputs are ultimately published and verified, as in Ethereum being a settlement layer by verifying the proofs and allowing for withdrawals. and reclaims
    • Can interact with PauserSet
      • pause the ACL
    2 EOAs
    EOA 36EOA 37

    Member of ZamaDeFiMultisig, ZamaGovMultisigB, ZamaGovMultisigA.

    • Can interact with ConfidentialSwap
      • pause intent creation, quoting, settlementThe mechanism with which the execution of rollup blocks and the resultant state is verified and possible disputes are resolved. In the context of rollups or other modular blockchains, it often refers to the proof system used--validity (ZK) or fraud proofs, or a combination thereof. Sometimes it will refer to this mechanism along with where the mechanism's outputs are ultimately published and verified, as in Ethereum being a settlement layer by verifying the proofs and allowing for withdrawals. and reclaims
    • Can interact with PauserSet
      • pause the ACL
    13 EOAs
    EOA 38EOA 42EOA 43EOA 44EOA 45EOA 51EOA 52EOA 57EOA 59EOA 60EOA 62EOA 63EOA 69
    • Can interact with ProtocolConfig
      • submit KMS key- and CRS-generation responses to KMSGeneration
    5 EOAs
    EOA 39EOA 40EOA 48EOA 49EOA 71
    • Can interact with InputVerifier
      • sign encrypted input verification bundles accepted by the InputVerifier
    13 EOAs
    EOA 41EOA 46EOA 47EOA 50EOA 53EOA 54EOA 55EOA 56EOA 58EOA 61EOA 65EOA 66EOA 68
    • Can interact with ProtocolConfig
      • sign public decryption results accepted by the KMSVerifier and key- and CRS-generation responses accepted by KMSGeneration
    EOA 640xD872…30fe
    • Can interact with ConfidentialSwap
      • decrypt the candidate amounts of every new intent, quote on them and settle the intents it wins
    EOA 670xe6Ee…72a8
    • Can interact with ConfidentialSwap
      • pause intent creation, quoting, settlementThe mechanism with which the execution of rollup blocks and the resultant state is verified and possible disputes are resolved. In the context of rollups or other modular blockchains, it often refers to the proof system used--validity (ZK) or fraud proofs, or a combination thereof. Sometimes it will refer to this mechanism along with where the mechanism's outputs are ultimately published and verified, as in Ethereum being a settlement layer by verifying the proofs and allowing for withdrawals. and reclaims
    EOA 700xf299…fBBE

    Member of ZamaDeFiMultisig, ZamaGovMultisigB.

    • Can interact with ConfidentialSwap
      • pause intent creation, quoting, settlementThe mechanism with which the execution of rollup blocks and the resultant state is verified and possible disputes are resolved. In the context of rollups or other modular blockchains, it often refers to the proof system used--validity (ZK) or fraud proofs, or a combination thereof. Sometimes it will refer to this mechanism along with where the mechanism's outputs are ultimately published and verified, as in Ethereum being a settlement layer by verifying the proofs and allowing for withdrawals. and reclaims
    2 EOAs
    EOA 72EOA 73

    Member of Safe.

    • Can interact with PauserSet
      • pause the ACL

    Zama Gateway

    Actors:

    SafeL20x5f0F…e2bE

    A Multisig with 3/5 threshold. Gateway owner Safe. Its LayerZero governance module is outside the Zama Gateway protocol surface covered here.

    • Can upgrade with no delay
      • MultichainACL
      • Decryption
      • KMSGeneration
      • ProtocolPayment
      • InputVerification
      • CiphertextCommits
      • GatewayConfig
    • Can interact with Decryption
      • unpause Decryption
    • Can interact with GatewayPauserSet
      • add, remove, or swap gateway pausers
    • Can interact with ProtocolPayment
      • set gateway fee prices for input verification, public decryption, and user decryption
    • Can interact with InputVerification
      • unpause InputVerification
    • Can interact with GatewayConfig
      • create KMS contexts that immediately become current, destroy historical KMS contexts, update thresholds of any live context, manage coprocessors, custodians and host chains, set or remove the priority coprocessor that alone finalizes coprocessor consensusAn agreement on the latest and correct state of a blockchain. Unlike L1 blockchains which coordinate participating nodes with consensus rules, rollups rely on L1s for reaching consensus by checking the state of the rollup smart contract deployed thereon., transfer ownership, and unpause gateway workflow contracts

    Participants (5):

    EOA 770xf299…fBBEEOA 74EOA 76EOA 75
    EOA 10x0000…0000
    • Can upgrade with no delay
      • MultichainACL
      • Decryption
      • KMSGeneration
      • ProtocolPayment
      • InputVerification
      • CiphertextCommits
    • Can interact with InputVerification
      • finalize encrypted input proof verification or rejection in InputVerification alone while priority mode is active
    • Can interact with CiphertextCommits
      • commit ciphertext and SNS ciphertext digests to CiphertextCommits alone while priority mode is active
    • Can interact with GatewayConfig
      • accept GatewayConfig ownership
      • finalize coprocessor consensusAn agreement on the latest and correct state of a blockchain. Unlike L1 blockchains which coordinate participating nodes with consensus rules, rollups rely on L1s for reaching consensus by checking the state of the rollup smart contract deployed thereon. alone for encrypted input proofs and ciphertext material commitments while priority mode is active
    5 EOAs
    EOA 2EOA 3EOA 4EOA 5EOA 6
    • Can interact with MultichainACL
      • submit public-decryption allowances, account handle allowances, and user-decryption delegation or revocation messages to MultichainACL
    • Can interact with InputVerification
      • sign encrypted input proof verification responses accepted by InputVerification
      • submit coprocessor proof verification and rejection responses to InputVerification
    • Can interact with CiphertextCommits
      • submit ciphertext and SNS ciphertext digests to CiphertextCommits
    • Can interact with GatewayConfig
      • sign encrypted input proof verification responses accepted by the gateway
      • submit coprocessor responses, ACL mirror updates, and ciphertext material commitments to gateway contracts
    EOA 80x0000…0001
    • Can interact with GatewayConfig
      • participate in gateway key custody workflows
      • sign gateway key custody material
    13 EOAs
    EOA 9EOA 11EOA 12EOA 13EOA 14EOA 18EOA 19EOA 24EOA 26EOA 27EOA 29EOA 30EOA 34
    • Can interact with Decryption
      • submit KMS decryption responses to Decryption
    • Can interact with GatewayConfig
      • submit KMS decryption responses to gateway contracts
    13 EOAs
    EOA 10EOA 15EOA 16EOA 17EOA 20EOA 21EOA 22EOA 23EOA 25EOA 28EOA 31EOA 32EOA 33
    • Can interact with Decryption
      • sign public decryption results and user decryption shares accepted by Decryption
    • Can interact with GatewayConfig
      • sign KMS decryption material accepted by gateway contracts
    4 EOAs
    EOA 74EOA 75EOA 76EOA 77

    Member of SafeL2.

    • Can interact with GatewayPauserSet
      • pause GatewayConfig and pausable gateway workflow contracts

    Smart contracts

    A dashboard to explore contracts and permissions
    Go to Disco
    Disco UI Banner
    Disco UI BannerExplore in Disco

    Ethereum

    RoxcUSDCDepositBatcher0x084f…eEc1

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    VaultBatcherConfidentialRouter0x11c6…ac4C

    Ownerless router that splits one confidential deposit or redemption across several vault batchers. It accepts only wrappers listed in the ConfidentialTokenWrappersRegistry.

    PendleUSDCDepositBatcher0x1B73…Cf84

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ConfidentialSteakUSDTWrapper0x1F6A…9e73Implementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ArmUSDCpRedeemBatcher0x2B5e…1006

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    RoxUSDCyDepositBatcher0x2dEA…724d

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ConfidentialArmUSDCpWrapper0x2ebB…853cImplementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    BbqTGBPRedeemBatcher0x2FB5…AAa7

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    BbqUSDCDepositBatcher0x321C…52f0

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    SteakcUSDCDepositBatcherV10x324E…40Cc

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    SteakcUSDCRedeemBatcher0x3a90…083D

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    HCULimit0x3b4d…71E2Implementation (Upgradable)Admin

    Tracks and enforces per-transaction and per-blockAn ordered list of transactions and chain-related metadata that gets bundled together and published to the L1/DA layer. Nodes execute the transactions contained within blocks to change the rollup chain’s state. Protocol rules dictate what constitutes a valid block, and invalid blocks are skipped over. homomorphic computation unit limits for FHEVM operation requests. v0.3.0 adds pricing for the fheSum and fheIsIn operations.

    • Roles:
      • lOwner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    RoxcUSDCRedeemBatcher0x43e8…0E4b

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    SteakcUSDCRedeemBatcherV20x4Ad6…6400

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ArmUSDCsRedeemBatcher0x4f55…772e

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ConfidentialRoxUSDCyWrapper0x4FCC…B88fImplementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ConfidentialBbqUSDCWrapper0x501b…e51BImplementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    PAPYRedeemBatcher0x52Ff…8EC1

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ConfidentialArmUSDTpWrapper0x63a6…d45AImplementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ConfidentialSteakcUSDCWrapper0x66Bf…C458Implementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    SteakcUSDCDepositBatcherV20x6e05…C707

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ArmUSDTsDepositBatcher0x7320…20AE

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    SteakUSDTDepositBatcher0x737F…E399

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ConfidentialXAUTWrapper0x73cc…EEf1Implementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ConfidentialFAUSDeWrapper0x76A3…D5a6Implementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    KMSVerifier0x7762…BB03Implementation (Upgradable)Admin

    Ethereum host-chain verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. for public decryption results produced through the Zama Gateway Decryption contract. Since v0.3.0 it is a stateless proof checker: KMS signer sets and thresholds are read from the ProtocolConfig contract, and confidential token wrappers accept a decrypted value when it is signed by the threshold of the current or any explicitly selected non-destroyed KMS context.

    • Roles:
      • lOwner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ConfidentialArmUSDCsWrapper0x77F8…D8DBImplementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ArmUSDTsRedeemBatcher0x79e6…a255

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    SteakUSDTRedeemBatcher0x7Afb…4d43

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    BbqUSDCRedeemBatcher0x807C…c533

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ConfidentialBbqUSDTWrapper0x80Ae…2273Implementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ConfidentialZAMAWrapper0x80CB…8071Implementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ArmcWBTCRedeemBatcher0x8354…2F05

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ConfidentialBRONWrapper0x85dE…26bcImplementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ArmUSDCsDepositBatcher0x8735…B1BD

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ConfidentialPENDLEWrapper0x8900…B3dfImplementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ConfidentialSwap0x8Fe2…8C01Implementation (Upgradable)Admin

    Request-for-quote protocol for swaps between confidential tokens. A maker escrows an encrypted intent that hides the real order among candidate orders, whitelisted market makers quote every candidate in a sealed-bid auction, and the revealed winner settles within the settlementThe mechanism with which the execution of rollup blocks and the resultant state is verified and possible disputes are resolved. In the context of rollups or other modular blockchains, it often refers to the proof system used--validity (ZK) or fraud proofs, or a combination thereof. Sometimes it will refer to this mechanism along with where the mechanism's outputs are ultimately published and verified, as in Ethereum being a settlement layer by verifying the proofs and allowing for withdrawals. window or the maker reclaims the escrow.

    • Roles:
      • complianceAddress: EOA 7
      • defaultAdmin: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
      • marketMaker: EOA 64
      • pauser: EOA 35, EOA 36, EOA 37, EOA 67, EOA 7, EOA 70, ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    Can be upgraded by:
    ZamaDeFiMultisig with no delay
    SteakcUSDCRedeemBatcherV10x96Cd…eec9

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ArmUSDTpRedeemBatcher0x9938…8737

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ConfidentialPAPYWrapper0x9ABb…2A8cImplementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    SteakcUSDCDepositBatcher0xA07c…15D5

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ConfidentialFcUSDTWrapper0xA28A…7D7FImplementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ConfidentialTGBPWrapper0xa873…eDD9Implementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ArmcWBTCDepositBatcher0xAC82…604D

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ConfidentialUSDTWrapper0xAe02…0c50Implementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    FAUSDeDepositBatcher0xae09…30f8

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ConfidentialRoxcUSDCWrapper0xB1B1…EB30Implementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ConfidentialPendleUSDCWrapper0xb6e5…edbCImplementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ConfidentialBbqTGBPWrapper0xBA4c…6762Implementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ConfidentialArmUSDTsWrapper0xbaC6…f50BImplementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    FcUSDTDepositBatcher0xbEbe…15b4

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ACL0xcA2E…ffb6Implementation (Upgradable)Admin

    Ethereum host-chain access-control registry for encrypted handles, storing handle allowances and delegation state for ciphertext references. Its public-decryption and user-delegation events are mirrored into the Gateway MultichainACL by coprocessor consensusAn agreement on the latest and correct state of a blockchain. Unlike L1 blockchains which coordinate participating nodes with consensus rules, rollups rely on L1s for reaching consensus by checking the state of the rollup smart contract deployed thereon.. Since v0.4.0 users can delegate user decryption of their handles across all app contracts at once via a wildcard delegation.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    InputVerifier0xCe0F…8EA2Implementation (Upgradable)Admin

    Ethereum host-chain verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. for encrypted input attestations produced by the Zama Gateway InputVerification contract. The FHEVMExecutor calls it before accepting user-provided ciphertext handles.

    • Roles:
      • getCoprocessorSigners: EOA 39, EOA 40, EOA 48, EOA 49, EOA 71
      • lOwner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ArmUSDCpDepositBatcher0xd26F…865A

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    FcUSDTRedeemBatcher0xd2f3…3744

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    PendleUSDCRedeemBatcher0xD671…2963

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ProtocolConfig0xD823…a7C4Implementation (Upgradable)Admin

    Ethereum host-chain registry of KMS nodeA software client that participates in the network. sets, per-context thresholds, and context lifecycle, introduced in the v0.3.0 KMSVerifier upgrade. A KMS context snapshots node transaction senders and signers; the four per-context thresholds (public decryption, user decryption, key generation, MPC) can be retuned by the ACL owner for any live context, including the current one. A newly created context becomes current immediately; older contexts remain selectable for public decryption proofs until destroyed.

    • Roles:
      • currentKmsTxSenders: EOA 38, EOA 42, EOA 43, EOA 44, EOA 45, EOA 51, EOA 52, EOA 57, EOA 59, EOA 60, EOA 62, EOA 63, EOA 69
      • getKmsSigners: EOA 41, EOA 46, EOA 47, EOA 50, EOA 53, EOA 54, EOA 55, EOA 56, EOA 58, EOA 61, EOA 65, EOA 66, EOA 68
      • lOwner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    FHEVMExecutor0xD823…0e75Implementation (Upgradable)Admin

    FHEVM executor that accepts encrypted operation requests, accounts for computation usage, and stores ciphertext handles for operation results. v0.5.0 rejects plaintext scalar operands and trivial-encryption inputs that do not fit their FHE type, checks division by zero in the shared binary-operation path, and adds a checkHandleType view that asserts the type of an initialized handle.

    • Roles:
      • lOwner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ConfidentialWBTCWrapper0xd86a…Bb3dImplementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ConfidentialWETHWrapper0xda93…4893Implementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    BbqUSDTDepositBatcher0xe1Bc…Aa6D

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    PAPYDepositBatcher0xe396…d3b0

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    FAUSDeRedeemBatcher0xE776…96D0

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ConfidentialUSDCWrapper0xe978…72B2Implementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ConfidentialAUSDWrapper0xEa9A…fDB2Implementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ConfidentialTokenWrappersRegistry0xeb50…bBA0Implementation (Upgradable)Admin

    Registry for Zama confidential token wrappers.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    KMSGeneration0xf102…8daaImplementation (Upgradable)Admin

    Orchestrates FHE key and CRS generation on the Ethereum host chain, taking over the workflows removed from the Gateway KMSGeneration in v0.5.0. The ACL owner triggers and aborts generations; KMS nodeA software client that participates in the network. transaction senders registered in ProtocolConfig submit EIP-712-signed responses that activate a key or CRS once the ProtocolConfig key-generation threshold is reached.

    • Roles:
      • lOwner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    RoxUSDCyRedeemBatcher0xf18A…d8a8

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ConfidentialArmcWBTCWrapper0xF921…6B6fImplementation (Upgradable)Admin

    ERC-20 wrapper that escrows an underlying token and issues confidential balances. It supports encrypted transfers, wrapping, unwrapping, local blocking, optional underlying-token denylist checks, owner-managed observers with wildcard decryption access, and pausing.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • owner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    ArmUSDTpDepositBatcher0xFb21…142A

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    BbqUSDTRedeemBatcher0xFc65…4Ea3

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    BbqTGBPDepositBatcher0xfD89…481A

    Batches confidential deposits into, or redemptions from, an ERC-4626 vault. Users join the current batch with an encrypted amount. A dispatched batch unwraps its total publicly, routes it through the vault and wraps the result, and each user claims an encrypted share of it.

    • Roles:
      • owner: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
    ZamaDeFiGovCore0x31bB…382CImplementation (Upgradable)Admin

    Aragon governance contract that stores permissions and executes action batches for whoever holds its execute permission. Member of ZamaGovMultisigA.

    • Roles:
      • daoExecutors: ZamaDeFiMultisig
      • daoRootHolders: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
      • daoUpgraders: ZamaDeFiGovCore; ultimately ZamaDeFiMultisig
      • multisigSettingsAdmins: ZamaDeFiGovCore, ZamaDeFiMultisig; ultimately ZamaDeFiMultisig
      • multisigTargetConfigAdmins: ZamaDeFiGovCore, ZamaDeFiMultisig; ultimately ZamaDeFiMultisig
    Can be upgraded by:
    ZamaDeFiMultisig with no delay
    Implementation used in:
    Interfold CRISP logo
    ZamaGovCore0xB6D6…1Ef3Implementation (Upgradable)Admin

    Aragon governance contract that stores permissions and executes action batches for whoever holds its execute permission.

    • Roles:
      • daoExecutors: ZamaGovMultisigA, ZamaGovMultisigB
      • daoRootHolders: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • daoUpgraders: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • multisigSettingsAdmins: ZamaGovCore, ZamaGovMultisigA, ZamaGovMultisigB; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • multisigTargetConfigAdmins: ZamaGovCore, ZamaGovMultisigA, ZamaGovMultisigB; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    Implementation used in:
    Interfold CRISP logo
    PauserSet0xbBfE…586C

    Maintains the pauser account set used in pause-control checks.

    • Roles:
      • lOwner: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • pausers: EOA 35, EOA 36, EOA 37, EOA 7, Safe; ultimately EOA 72, EOA 73
    Staking (Coprocessor)0x7147…6AE8Implementation (Upgradable)Admin

    Staking contract that escrows ZAMA, issues non-transferable staked voting tokens, and mints protocol rewards to eligible stakers at a configurable reward rate.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • defaultAdmin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • managerRoleMembers: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay
    Staking (KMS)0xe9b1…F4AbImplementation (Upgradable)Admin

    Staking contract that escrows ZAMA, issues non-transferable staked voting tokens, and mints protocol rewards to eligible stakers at a configurable reward rate.

    • Roles:
      • admin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • defaultAdmin: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
      • managerRoleMembers: ZamaGovCore; ultimately ZamaGovMultisigA, ZamaGovMultisigB
    Can be upgraded by:
    ZamaGovMultisigB with no delayZamaGovMultisigA with no delay

    Zama Gateway

    MultichainACL0x055d…2468Implementation (Upgradable)Admin

    Gateway-side ACL mirror that records coprocessor consensusAn agreement on the latest and correct state of a blockchain. Unlike L1 blockchains which coordinate participating nodes with consensus rules, rollups rely on L1s for reaching consensus by checking the state of the rollup smart contract deployed thereon. for host-chain public decryption permissions, account handle allowances, and delegated user-decryption access. For Ethereum, it mirrors ACL events emitted by the L1Layer 1 (L1) is a blockchain that is self-reliant on its validator set for its security and consensus properties. Ethereum is an example of a layer 1. Blockchains started receiving the moniker of layer 1 once layer 2 became a meaningful area of development. ACL contract registered in GatewayConfig.

    • Roles:
      • admin: EOA 1
      • gatewayCoprocessorTxSenders: EOA 2, EOA 3, EOA 4, EOA 5, EOA 6
      • gatewayOwner: SafeL2
    Can be upgraded by:
    EOA 1 with no delaySafeL2 with no delay
    Decryption0x0f60…8D24Implementation (Upgradable)Admin

    Gateway contract that orchestrates public and user decryption requests and checks committed ciphertext material. Each request pins a KMS context at request time (explicitly through extraData or the then-current context) and rejects unknown or destroyed contexts; responses must reference the pinned context. Requests recorded before v0.5.0 fall back to the context declared by each response. KMS nodes enforce host-chain ACL state offchain, and Ethereum KMSVerifier verifies public results against this contract’s EIP-712 domain.

    • Roles:
      • admin: EOA 1
      • gatewayKmsSigners: EOA 10, EOA 15, EOA 16, EOA 17, EOA 20, EOA 21, EOA 22, EOA 23, EOA 25, EOA 28, EOA 31, EOA 32, EOA 33
      • gatewayKmsTxSenders: EOA 11, EOA 12, EOA 13, EOA 14, EOA 18, EOA 19, EOA 24, EOA 26, EOA 27, EOA 29, EOA 30, EOA 34, EOA 9
      • gatewayOwner: SafeL2
    Can be upgraded by:
    EOA 1 with no delaySafeL2 with no delay
    KMSGeneration0x2909…aEe3Implementation (Upgradable)Admin

    View-only gateway contract retaining historical queries for previously generated FHE keys and CRS materials. All state-changing key-generation, CRS-generation, PRSS, and key-resharing workflows were removed in v0.5.0 after their move to Ethereum.

    • Roles:
      • admin: EOA 1
      • gatewayOwner: SafeL2
    Can be upgraded by:
    EOA 1 with no delaySafeL2 with no delay
    ProtocolPayment0x7E17…7e89Implementation (Upgradable)Admin

    Gateway fee contract that charges ZAMA fees for encrypted input verification, public decryption, and user decryption requests, then forwards the collected fees to the configured fee burner sender.

    • Roles:
      • admin: EOA 1
      • gatewayOwner: SafeL2
    Can be upgraded by:
    EOA 1 with no delaySafeL2 with no delay
    InputVerification0xcB1b…9287Implementation (Upgradable)Admin

    Gateway contract that receives encrypted input verification requests from registered and enabled host chains, collects coprocessor responses, and emits a threshold-signed attestation once coprocessor consensusAn agreement on the latest and correct state of a blockchain. Unlike L1 blockchains which coordinate participating nodes with consensus rules, rollups rely on L1s for reaching consensus by checking the state of the rollup smart contract deployed thereon. is reached. Since v0.5.0, if GatewayConfig designates a priority coprocessor, that coprocessor’s single response finalizes verification or rejection and the attestation carries only its signature. Ethereum InputVerifier verifies attestations against this contract’s EIP-712 domain.

    • Roles:
      • admin: EOA 1
      • gatewayCoprocessorSigners: EOA 2, EOA 3, EOA 4, EOA 5, EOA 6
      • gatewayCoprocessorTxSenders: EOA 2, EOA 3, EOA 4, EOA 5, EOA 6
      • gatewayOwner: SafeL2
      • gatewayPriorityCoprocessorTxSender: EOA 1
    Can be upgraded by:
    EOA 1 with no delaySafeL2 with no delay
    CiphertextCommits0xd82c…F41FImplementation (Upgradable)Admin

    Gateway contract that stores ciphertext and SNS ciphertext digests after coprocessor consensusAn agreement on the latest and correct state of a blockchain. Unlike L1 blockchains which coordinate participating nodes with consensus rules, rollups rely on L1s for reaching consensus by checking the state of the rollup smart contract deployed thereon., allowing decryption requests to reference committed ciphertext material. Digests referencing unregistered or disabled host chains are rejected. Since v0.5.0, if GatewayConfig designates a priority coprocessor, that coprocessor’s single submission commits the material on its own.

    • Roles:
      • admin: EOA 1
      • gatewayCoprocessorTxSenders: EOA 2, EOA 3, EOA 4, EOA 5, EOA 6
      • gatewayOwner: SafeL2
      • gatewayPriorityCoprocessorTxSender: EOA 1
    Can be upgraded by:
    EOA 1 with no delaySafeL2 with no delay
    GatewayConfig0xDE53…90abImplementation (Upgradable)Admin

    Central configuration contract for the Zama Gateway. A KMS context snapshots nodeA software client that participates in the network. transaction senders, signers, and workflow thresholds; the owner can create new contexts, retune the thresholds of any live context, and destroy non-current contexts, which immediately invalidates them for decryption. Registered host chains can be disabled, re-enabled, or removed by the owner. Since v0.7.0 the owner can designate a priority coprocessor transaction sender whose single response finalizes coprocessor consensusAn agreement on the latest and correct state of a blockchain. Unlike L1 blockchains which coordinate participating nodes with consensus rules, rollups rely on L1s for reaching consensus by checking the state of the rollup smart contract deployed thereon. in InputVerification and CiphertextCommits, making the coprocessor majority threshold inert, and coprocessor set and threshold updates are applied live without pausing InputVerification.

    • Roles:
      • admin: SafeL2
      • getCoprocessorSigners: EOA 2, EOA 3, EOA 4, EOA 5, EOA 6
      • getCoprocessorTxSenders: EOA 2, EOA 3, EOA 4, EOA 5, EOA 6
      • getCustodianSigners: EOA 8
      • getCustodianTxSenders: EOA 8
      • getKmsSigners: EOA 10, EOA 15, EOA 16, EOA 17, EOA 20, EOA 21, EOA 22, EOA 23, EOA 25, EOA 28, EOA 31, EOA 32, EOA 33
      • getKmsTxSenders: EOA 11, EOA 12, EOA 13, EOA 14, EOA 18, EOA 19, EOA 24, EOA 26, EOA 27, EOA 29, EOA 30, EOA 34, EOA 9
      • getPriorityCoprocessorTxSender: EOA 1
      • owner: SafeL2
      • pendingOwner: EOA 1
    Can be upgraded by:
    SafeL2 with no delay
    GatewayPauserSet0x571e…ac1b

    Maintains the set of accounts allowed to pause gateway contracts. The set is managed by the GatewayConfig owner.

    • Roles:
      • gatewayOwner: SafeL2
      • pausers: EOA 74, EOA 75, EOA 76, EOA 77