# zk.money v5 Markdown version of https://ethbeat.org/privacy/projects/zkmoney ## Summary **Warning:** Both portals are frozen since Aztec made its v6 rollup canonical, and deposits revert. Balances leave only through refunds. The current zk.money wallet refunds them into zk.money on Aztec v6 or to Ethereum. - Total Value Locked: $33.65 K (-3.32% compared to seven days ago) - Assets tracked: 1 - Buckets tracked: 1 - Deposits 7D: 0 (0.00% compared to the previous seven days) - Deposits 30D: 400 - Deposits Total: 1.12 K - Active Relayers 30D: 6 - Tracked on: Ethereum - Runs on: Aztec Network v5 - Attributes: ZK, TEE, Transfers, Any amount - Reference app: zk.money Desktop v0.5.0 ### Risks - Privacy: Link privacy. Public observer: Link private (sentiment: good); Chain analyst: Link at risk (sentiment: warning); Network observer: Link at risk (sentiment: warning); Privileged insider: Link at risk (sentiment: warning); Future adversary: Link exposed (sentiment: bad). - Trusted setup: 176 participants (sentiment: good). Aztec Ignition: Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation. - Exit window: Infinite (sentiment: good). The escrow and the approved enclave image are immutable. This protocol fails the walkaway test: users cannot fully use it if every centralized participant disappears. Withdrawals and refunds need a live AWS Nitro enclave running the approved image. The approved sUSDS image is absent from the documented public downloads. The assessed wallet requires modification to replace zk.money services. - Reproducibility: Partially reproducible (sentiment: warning). The Ethereum contracts, desktop wallet, DAI enclave and circuit sources are public. The refund and resolver verifiers match the published circuits. The complete enclave image build, resolver service and frozen-chain snapshot service are unpublished, and so are the sUSDS enclave image and its source. The hosted wallet runs a build absent from the public source. Verification instructions cover the refund and resolver circuits and the DAI and sUSDS tokens pinned by their Ethereum portals. ### About A shielded ledger on Aztec v5 for DAI payments and sUSDS savings, frozen since Aztec made v6 canonical. ### Links - Website: https://zk.money - Docs: https://docs.zk.money/docs - Explorer: https://aztecscan.xyz/contracts/instances/0x015ca4a43f83d08a038c36c06ca92527f120dc1f9176ea85d1ea347decaf444d - Repository: https://github.com/aztec-labs-eng/zkmoney-public - Contracts explorer (Disco): https://disco.ethbeat.org/ui/p/zkmoney ## Protocol description zk.money on Aztec v5 let users send DAI privately and move it into sUSDS savings. Funds are escrowed on Ethereum. Names, deposits and withdrawals are public. Every withdrawal and refund needs a zk proof and a signature from a live AWS Nitro enclave (TEE). Each pool's enclave decrypts and reads the operations it handles. Aztec Labs controls names and the contract lists the released wallets use. The portal releases funds only after Aztec proves the withdrawal message and one registered enclave signer co-signs it. Stealing escrowed funds requires both layers to fail, while a failure of either breaks privacy. ### Flow 1. **Deposit.** You fund an L1 deposit address called a SIPA, and anyone can sweep it into the portal. USDC and USDT are swapped to DAI through Curve. After fees, an Inbox message credits private notes on Aztec. Reusing a SIPA links its deposits. 2. **Pay.** You add a name as a contact, and the wallet reads its Aztec address from the onchain registry and sends a private transfer. 3. **Withdraw.** Aztec proves the withdrawal message, an enclave co-signs it and the portal pays out DAI on Ethereum. A swap escrow can instead pay out USDC, USDT or ETH, and give a fresh recipient ETH for gas. ### Keys Accounts sign with a passkey. The released wallet requires a registered name to access an account on a new device. ### App The ratings cover DAI payments and sUSDS savings. The Desktop release runs local code. Its endpoint settings accept the user's own Aztec node, Ethereum endpoint and DAI enclave. The sUSDS enclave address is always fetched from Aztec Labs among other addresses in two unsigned contract lists. Replacing them can redirect future deposits and payments. The hosted wallet reloads code on every visit. Its owner can read viewing keys and request harmful passkey signatures through misleading prompts. Independent operation remains untested. It requires a modified Desktop build without screening, pointed at self-hosted contract lists. Users would submit Ethereum transactions themselves and register an approved enclave on AWS. New names still require Aztec Labs' signature. The [enclave guide](https://docs.zk.money/docs/run-an-enclave) describes image downloads and registration. ### Savings Savings hold sUSDS in a second portal with its own L2 token and enclave. A move in withdraws DAI to a deterministic SkyEscrow, which converts it through USDS into sUSDS shares and deposits them into the sUSDS portal. A move out reverses both legs into the DAI portal. Each move publishes its DAI and share amounts, tied by the escrow. The wallet moves sUSDS only to and from the user's own DAI balance. ### Names Tags such as l2beat.zk.money publish Aztec addresses and keys on Ethereum. - **L1 deposits:** ENS-compatible wallets resolve a tag to a deposit address through the recipient's chosen resolver operator. The default is a centralized resolver who can link deposits to their tag. - **L2 transfers:** wallets read the registered Aztec address when a tag is added as a contact. Name claims need the domain owner's signature. XMTP, an encrypted offchain messaging network, powers QR-code or link contacts and carries payment requests. ### Resolver For ENS lookups, the resolver operator derives each deposit address from a secret shared with the recipient and announces it to them on L2. The assessed wallet can derive its own deposit addresses privately. The onchain Resolver checks a zk proof on every lookup, which stops the operator from redirecting payments. Users can choose a custom operator for name payments. ### Exits **Refund.** If Aztec Network governance changes its canonical rollup, anyone can freeze the portal, see [upgrades and governance](https://ethbeat.org/privacy/projects/zkmoney#upgrades-and-governance). Refunds then publish note or deposit amounts on Ethereum and use proofs without zero knowledge. ### Compliance The assessed wallet sends Ethereum addresses to Predicate through zk.money for screening, which funding a deposit SIPA directly avoids. The relayer screens token movements against OFAC and optionally Predicate, and self-submitted sweeps and withdrawals skip it. The name resolver screens deposit addresses and funders against OFAC before notifying the recipient on L2. A blocked payment leaves funds at an address unknown to the wallet. Recovery requires the recipient's own tooling to re-derive it and authorization from their L1 account. Screening happens only in these offchain services. ### Fees and limits A DAI sweep pays 0.25 DAI, or 0.5 DAI when claiming a name. Registration costs 5 DAI by default, including its sweep fee. The DAI portal takes 0.1 DAI from deposits and ordinary withdrawals to sponsor Aztec fees. The sUSDS portal takes 0 sUSDS. Gas sponsorship needs a registered name or a voucher from a registered account. An empty fee-paying contract, or fees above its allowance, stall the assessed wallet. Modified code can pay with the account's own Fee Juice. DAI deposits share 50,000 DAI of capacity, refilling over 1 day. sUSDS deposits share 50,000 sUSDS, refilling over 1 day. DAI deposits, payments and withdrawals are capped at 2,583 DAI each. sUSDS deposits and withdrawals are capped at 2,583 sUSDS each. ### Source verification The [token verification steps](https://github.com/l2beat/l2beat/blob/main/packages/config/src/projects/zkmoney/verificationSteps-token.md) compare a fresh source build with the DAI and sUSDS L2 contracts pinned by their Ethereum portals. The [verifier steps](https://ethbeat.org/zk-catalog/barretenberg#verifiers) regenerate the keys and Solidity verifiers of the refund and resolver circuits. ## Privacy **What the protocol promises:** Hides senders, amounts and the link between deposits and withdrawals inside the ledger. Names, deposits and withdrawals are public. **Apps** - **[zk.money Desktop](https://github.com/aztec-labs-eng/zkmoney-public/releases/tag/desktop-v0.5.0)** v0.5.0 (Reference): The ratings assume this app, since 2026-10-05 · Source [00e5408](https://github.com/aztec-labs-eng/zkmoney-public/tree/00e54087526d6d89f1755958eb027e077184cd9a) [How we pick the reference](https://ethbeat.org/publications/privacy-methodology#reference-app) Ethereum is public by default. Each protocol is rated on its main privacy promise, like hiding who paid, who received, how much, or which deposit became which withdrawal. Against each adversary, the colour says whether it holds for a careful user with the app's own settings: green yes, yellow only with significant extra work, red no. Fields marked at risk stay private only under the condition in their note. ### Public observer Link private (sentiment: good) **Who:** Everyone with a block explorer and some basic tools. Sees every public onchain event, but does no correlation beyond following links. Examples: A curious counterparty, an employer, a journalist. Private payments publish encrypted notes. Claiming a name ties it and its Aztec address to the wallet that funds the registration. The first payment to a new contact reveals the recipient through a handshake, and L2 logs mark every transaction of the shared token smart contract. The user's first sponsored transaction after registration is tied to their account, with the payment, deposit address or withdrawal it carries. **Advice:** Claim the user's name from a wallet without a public link to them, then make the first transaction after registration a deposit from that wallet. Fund each deposit address once and let it be swept/relayed. **Inside** - Sender: at risk. Public for the user's first sponsored transaction after registration. - Recipient: exposed. Revealed by the first payment to each new contact. - Amount: private - Asset: exposed. DAI and sUSDS use separate portals and token contracts. - Link: at risk. Exposed when the user's first sponsored transaction after registration withdraws or pays a new contact. **Sources** - [Fixed log tags on every token transaction](https://github.com/aztec-labs-eng/zkmoney-public/blob/00e54087526d6d89f1755958eb027e077184cd9a/vendor/oxide/noir-projects/oxide_lib/src/constants.nr#L82-L86) - [First delivery to a new contact opens a handshake](https://github.com/aztec-labs-eng/zkmoney-public/blob/00e54087526d6d89f1755958eb027e077184cd9a/packages/sdk/src/feePaymentMethod/claimFpcGasModel.ts#L232-L237) - [First sponsored transaction nullifies the L1 account](https://github.com/aztec-labs-eng/zkmoney-public/blob/00e54087526d6d89f1755958eb027e077184cd9a/packages/contracts/contracts/fee_paying/claim_fpc/src/main.nr#L205-L217) - [Names map to Aztec addresses](https://ethbeat.org/privacy/projects/zkmoney#AccountMetadataRegistry) ### Chain analyst Link at risk (sentiment: warning) **Who:** Scrapes all public data and correlates it: timing, amounts, gas and wallet fingerprints, address clusters. Examples: Chain analytics firms, ZachXBT, data brokers. In practice the anonymity set is zk.money's users on Aztec, although the L2 contract is permissionless. The first payment to a name from outside zk.money is publicly tied to that name. A payee can tell which payments come from the same payer, since each pair shares one secret for tagging notes. Moving a whole savings position out republishes the share amount it went in with. **Advice:** Give outside payers a deposit address the user's wallet created. Withdraw common amounts rather than everything at once. Wait before exiting and pick a different time of day than the deposit. Exit to a fresh address every time and spend from it with a different wallet than the one that deposited. **Inside, compared with a public observer** - Amount: at risk. Inferable when a payment sits between a matching public deposit and withdrawal. - Link: at risk. Registration deposits are publicly tied to their name. **Sources** - [RegistrationSIPA](https://ethbeat.org/privacy/projects/zkmoney#RegistrationSIPA) - [Resolver notifies the recipient of each deposit address](https://github.com/aztec-labs-eng/zkmoney-public/blob/00e54087526d6d89f1755958eb027e077184cd9a/vendor/oxide/noir-projects/oxide_token_contract/src/main.nr#L236-L251) - [The notification and the sweep request share one Aztec transaction](https://github.com/aztec-labs-eng/zkmoney-public/blob/00e54087526d6d89f1755958eb027e077184cd9a/packages/sdk/src/services/sipaIntents.ts#L174-L189) - [Handshake announcements are tagged with the recipient address](https://github.com/AztecProtocol/aztec-packages/blob/v5.2.0/noir-projects/noir-contracts/contracts/standard/handshake_registry_contract/src/main.nr#L82-L96) ### Network observer Link at risk (sentiment: warning) **Who:** Sits between the user and the services and sees traffic only: ISPs, VPNs, Tor exits, public RPCs and relayers. Ties requests to a user by content, session or timing: what they name, a shared IP or login, and when they arrive. Services the operator runs count as the insider. Examples: Infura or Alchemy, a Tornado relayer, a wallet vendor selling telemetry, Google captcha or analytics in the dapp frontend. Alchemy, called under Aztec Labs' key, sees an account's deposit addresses and withdrawals in one session unless the user sets their own Ethereum node. Desktop has no Tor setting. Routing all of the computer's traffic through Tor works, but Chrome's QUIC traffic to WalletConnect bypasses Tor unless UDP is blocked. **Advice:** Set the user's own Ethereum node as the L1 endpoint, and run Desktop on a system that sends all traffic through Tor and blocks UDP, such as Whonix. **Inside, compared with a public observer** - Sender: at risk. XMTP shows who asks whom for payment. - Link: at risk. Private only with the user's own Ethereum node and all traffic through Tor. **Sources** - [Endpoint settings: Aztec node, L1 RPC and enclave only](https://github.com/aztec-labs-eng/zkmoney-public/blob/00e54087526d6d89f1755958eb027e077184cd9a/packages/web-wallet/src/config/endpointOverrides.ts#L1-L16) - [XMTP identity is the account bootstrap address](https://github.com/aztec-labs-eng/zkmoney-public/blob/00e54087526d6d89f1755958eb027e077184cd9a/packages/web-wallet/src/platform/xmtp/WebXmtpClient.ts#L95-L109) ### Privileged insider Link at risk (sentiment: warning) **Who:** Holds an operator role, custodies funds, receives keys or plaintext by design, or delivers the app: upgrade admin, custodian, view key holder, enclave operator, association set provider, hosted prover, registry, frontend host. Examples: A compliance backdoor key, a DAO with an upgrade key, a KMS committee, an ASP operator, a custodial bridge. An AWS Nitro enclave reads payments, withdrawals and deposit claims inside. The portal admits only enclaves whose attestation it verifies onchain and approved enclave images are immutable. The sUSDS portal's approved image is unpublished, as is its source. Aztec Labs' default Aztec node, like Alchemy under its key, sees an account's deposit addresses and withdrawals in one session. The resolver operator, Aztec Labs today, derives each deposit address paid through a name, so it knows the recipient. **Advice:** Set your own Aztec node and Ethereum node in the endpoint settings, and keep funds out of savings. **Inside, compared with a public observer** - Sender: at risk. Private only after the first sponsored transaction, and while the attested enclave keeps what it reads. - Amount: at risk. Private only while the attested enclave keeps what it reads. - Link: at risk. Private only with the user's own nodes, and while the attested enclave keeps what it reads. **Sources** - [Saved endpoints replace the default Aztec node and L1 RPC](https://github.com/aztec-labs-eng/zkmoney-public/blob/00e54087526d6d89f1755958eb027e077184cd9a/packages/web-wallet/src/config/env.ts#L407-L412) - [The resolver derives addresses paid through a name](https://github.com/aztec-labs-eng/zkmoney-public/blob/00e54087526d6d89f1755958eb027e077184cd9a/packages/sdk/src/services/sipaStealth.ts#L88-L109) - [Wallets encrypt to the enclave key registered in the portal](https://github.com/aztec-labs-eng/zkmoney-public/blob/00e54087526d6d89f1755958eb027e077184cd9a/vendor/oxide/yarn-project/oxide-client/src/fleet_signer.ts#L172-L202) - [The image list has no download for the sUSDS image](https://docs.zk.money/docs/run-an-enclave) ### Future adversary Link exposed (sentiment: bad) **Who:** Harvest now, decrypt later. Holds every byte ever published and runs the known quantum attacks: elliptic curves, pairings and RSA fall. Hashes, symmetric ciphers and post-quantum schemes stand until an attack on them is known. Examples: An intelligence agency archiving chain data today, then anyone once a break is public. Whoever breaks elliptic-curve cryptography can decrypt historical notes and payment events published to Ethereum. Registered Aztec addresses identify the accounts. Deposit addresses paid through a name and enclave communication use the same class of cryptography. **Inside, compared with a public observer** - Sender: exposed - Recipient: exposed - Amount: exposed - Asset: exposed - Link: exposed **Sources** - [Registered Aztec addresses](https://ethbeat.org/privacy/projects/zkmoney#AccountMetadataRegistry) - [Addresses paid through a name use secp256k1 key exchange](https://github.com/aztec-labs-eng/zkmoney-public/blob/00e54087526d6d89f1755958eb027e077184cd9a/packages/sdk/src/services/sipaStealth.ts#L88-L109) - [Enclave channel uses P-256 HPKE](https://github.com/aztec-labs-eng/zkmoney-public/blob/00e54087526d6d89f1755958eb027e077184cd9a/vendor/oxide/yarn-project/oxide-lib/src/encryption.ts#L1-L5) ## Value Locked The interactive value chart is shown on [the HTML page](https://ethbeat.org/privacy/projects/zkmoney#privacy-tvl). ## Anonymity sets ### 30 day historic anonymity set How many unique depositors you could have blended in with if you withdrew on a particular day after depositing during the previous 30 days. This metric is a proxy for the historic anonymity set and shows how it developed over time. The metric looks backwards: it counts deposits that already happened, including from addresses that have since withdrawn. Your real anonymity also depends on deposits made after yours, which cannot be known in advance. ### Estimated anonymity set by holding duration An estimate of how many unique depositors you blend in with, depending on how long you leave your deposit in the pool. It is based on historic data of past deposits: each point counts depositors from the preceding period, so holding for up to 30 days effectively means blending in with everyone who deposited during the last 30 days. The interactive charts are shown on [the HTML page](https://ethbeat.org/privacy/projects/zkmoney#privacy-anonymity-set). ## Flows The interactive flows chart is shown on [the HTML page](https://ethbeat.org/privacy/projects/zkmoney#privacy-flows). ## Assets Breakdown | Asset | Deposits 7D | Deposits 30D | Deposits Total | Value Locked | | --- | --- | --- | --- | --- | | DAI | 0 ($0.00) | 400 ($141.50 K) | 1.12 K ($188.88 K) | $32.43 K | | Total | 0 ($0.00) | 400 ($141.50 K) | 1.12 K ($188.88 K) | $32.43 K | ## Milestones & Incidents - 2026-10-26: [Portals freeze as Aztec v6 becomes canonical](https://etherscan.io/tx/0x5b0143724130c6e28fe751fd0f3146cb224d936f2070b033c2fc84fab26b1249). Deposits stop for good, and balances leave only through refunds. - 2026-09-29: [zk.money relaunches on Aztec](https://decrypt.co/379621/ethereum-privacy-aztec-brings-back-zk-money). Aztec Labs relaunches zk.money as a private DAI wallet on the Aztec network. ## Risk summary ### Funds can be stolen if 1. Aztec's private execution or refund proof is unsound and the enclave layer also fails. 2. malicious wallet code obtains a harmful signature, or substituted unsigned contract lists redirect future deposits and payments. 3. the NameRegistry owner or owner of zk.money in ENS redirects future payments to names. 4. a malicious sUSDS token upgrade confiscates escrowed shares (see [upgrades and governance](https://ethbeat.org/privacy/projects/zkmoney#upgrades-and-governance)). ### Funds can be lost if 1. a user loses their passkey. 2. all registered signers stop serving and users cannot obtain or run the portal's approved enclave image, which for sUSDS is unpublished. 3. resolver screening blocks an external payment and the recipient lacks the tooling to re-derive its deposit address. ### Privacy can be lost if 1. a user pays a new contact, whose handshake reveals the recipient (see public observer). 2. a user's payments hide only among zk.money's users on Aztec (see chain analyst). 3. the resolver operator links deposits paid through a name to their recipients, or an enclave or AWS Nitro is compromised (see privileged insider). 4. the unpublished sUSDS enclave image is malicious (see privileged insider). 5. the default endpoints, Alchemy and Aztec Labs' Aztec node, see deposit addresses and withdrawals in one session (see network observer and privileged insider). 6. a user refunds, the only exit after the freeze, and the refund publishes its amount on Ethereum. 7. elliptic-curve cryptography is broken, which decrypts data published to Ethereum (see future adversary). ## Upgrades & Governance Aztec Network's rollup and zk.money's portals and payout contracts are immutable. ### Enclave signers and freeze Anyone can register a signer with an AWS Nitro attestation up to 1 hour old. DAI has 2 registered signers, and sUSDS has 3. Both portals are frozen permanently, and no party can undo the freeze. ### Names and services Two Aztec Labs EOAs control *.zk.money names. The deployer owns the NameRegistry and can replace its registration, metadata and resolver contracts, which lets it reassign names and redirect future payments. It also owns zk.money in ENS, which the DNS holder can reclaim. The domain owner can refuse claims, sign custom fees and add permanent fee beneficiaries, which users pick from in their registration intent. Aztec Labs also controls the hosted wallet, the desktop releases and the two unsigned contract lists both wallets currently use. ### Savings asset Sky governance can upgrade sUSDS, changing balances and transfer rules. Its authorized rate controller can change the savings rate. ## Trusted setup Risk levels follow the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381). Yellow (medium risk): all contributions are published and the final output can be verified, the ceremony client is open source, there were at least 30 contributions, participation was open to the public and announced, and participants are publicly identified. Green (lowest risk): everything required for yellow, with at least 150 contributions. Red (highest risk): at least one requirement for yellow is not met. N/A: the proof system needs no trusted setup. ### Aztec Ignition - Risk: green (lowest risk) - Proof systems: UltraHonk (Plonk) - Phase 1: 176 participants Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation. - Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification). - Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup). - Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition). ## Ossification & Updates Each date links the update on the HTML page, which also shows its contract diffs. ### [2026-10-30 13:35 UTC](https://ethbeat.org/privacy/projects/zkmoney?update=e175eec5) (high severity, 8 changes) zk.money names move to Aztec v6: the NameRegistry, the ENS record and the resolver operator now point to zkmoneyv6 contracts, which this discovery no longer follows. The v5 Resolver and RegistrationController stay as seeds. ### [2026-10-26 10:53 UTC](https://ethbeat.org/privacy/projects/zkmoney?update=fd9d3a8d) (8 changes) Both portals were frozen right after Aztec made its v6 rollup canonical, at proven v5 checkpoint 118925. Deposits revert, and only withdrawals proven by then still pay out. Funds leave through refunds that prove notes or deposits against the frozen state, need a registered enclave signature and publish their total. Payments on Aztec v5 after the freeze do not change who can refund a note. No zk.money deployment on Aztec v6 exists yet. ### [2026-10-23 09:33 UTC](https://ethbeat.org/privacy/projects/zkmoney?update=4f297957) (2 changes) Add SwapEscrowFactoryV2 and its SwapEscrowV2 implementation, which zk.money Desktop v0.5.0 uses for swap and fresh-address withdrawals. ### [2026-10-13 09:10 UTC](https://ethbeat.org/privacy/projects/zkmoney?update=f11e13f1) (high severity, 38 changes) Track verifier key hashes and linked proof-verification libraries, add sUSDS escrow. Move ENS handlers and refund-library criticality into templates. ### [2026-10-01 07:48 UTC](https://ethbeat.org/privacy/projects/zkmoney?update=1225e8f9) (21 changes) Initial full discovery of zk.money. ## Permissions Explore these contracts and permissions in Disco, ETHBEAT's contract explorer: https://disco.ethbeat.org/ui/p/zkmoney ### Ethereum #### Actors ##### EOA 1 Addresses: [0x8c5EE3f90cA6D24eD2e2c1817f0caEE89e521601](https://etherscan.io/address/0x8c5EE3f90cA6D24eD2e2c1817f0caEE89e521601) - Can interact with Resolver - replace this Resolver as the ENS resolver of zk.money names, which decides the addresses that payments to these names resolve to - Can interact with NameRegistry - replace the RegistrationController and the AccountMetadataRegistry, and change the domainOwner. A new RegistrationController can reassign names and rewrite any user record, and a new AccountMetadataRegistry decides where future payments to zk.money names resolve to - Can interact with SIPAFactory - bless the deposit address implementation for any portal and intent that has none yet. This decides the code of all deposit addresses for that portal and intent Used in: [zk.money](https://ethbeat.org/privacy/projects/zkmoneyv6#EOA%201) ##### 3 EOAs Addresses: [0x05406F53174EC1bFE5C94aF253CdD62A4adF2F29](https://etherscan.io/address/0x05406F53174EC1bFE5C94aF253CdD62A4adF2F29) (EOA 2), [0x367eD02480809f5020234181B61D9069a08974dD](https://etherscan.io/address/0x367eD02480809f5020234181B61D9069a08974dD) (EOA 3), [0x5F03984126AdFDb72B2823b553988Ccebe1F781e](https://etherscan.io/address/0x5F03984126AdFDb72B2823b553988Ccebe1F781e) (EOA 4) - Can interact with ZkMoneyPortal_sUSDS - co-sign withdrawals and refunds. Without a signature from a registered TEE signer, no funds can leave the portal ##### EOA 5 Addresses: [0x768001056E4d89fd45Bf74Df3d91809F9BEb1ee1](https://etherscan.io/address/0x768001056E4d89fd45Bf74Df3d91809F9BEb1ee1) - Can interact with NameRegistry - authorize or refuse every name claim and sign custom registration fees Used in: [zk.money](https://ethbeat.org/privacy/projects/zkmoneyv6#EOA%203) ##### 2 EOAs Addresses: [0xdFd008642F54aCD44A2a03438A86A25f55c4D3Bc](https://etherscan.io/address/0xdFd008642F54aCD44A2a03438A86A25f55c4D3Bc) (EOA 6), [0xefc45B71e9432a6149a7d52f11a125A19E3A11DC](https://etherscan.io/address/0xefc45B71e9432a6149a7d52f11a125A19E3A11DC) (EOA 7) - Can interact with ZkMoneyPortal - co-sign withdrawals and refunds. Without a signature from a registered TEE signer, no funds can leave the portal ## Smart contracts Explore these contracts and permissions in Disco, ETHBEAT's contract explorer: https://disco.ethbeat.org/ui/p/zkmoney ### Ethereum #### NitroValidator Addresses: [0x0119bC52a09Ac6e7998378BadC16D0e9A866Be56](https://etherscan.io/address/0x0119bC52a09Ac6e7998378BadC16D0e9A866Be56#code) Validates AWS Nitro enclave attestations against the certificate chain verified by the CertManager. #### RelationsLib (0x0235…9070) Addresses: [0x02353dB283087CD51b13eE088A615Dad03949070](https://etherscan.io/address/0x02353dB283087CD51b13eE088A615Dad03949070#code) Runtime library immutably linked into the zk.money resolver verifier. It evaluates circuit constraints or derives Fiat-Shamir challenges for zero-knowledge UltraHonk proofs. #### SwapEscrowFactory Addresses: [0x03b21BBa8e75A1BD0354c5ECbEC078cF59C85343](https://etherscan.io/address/0x03b21BBa8e75A1BD0354c5ECbEC078cF59C85343#code) Swap-on-withdraw: a withdrawal can pay DAI to a SwapEscrow clone whose route, recipient and tip are fixed in its address. Anyone can deploy and execute a funded clone to swap the DAI for USDC, USDT or ETH to the recipient. #### FrozenNotesRefundVerifier Addresses: [0x0694fF404DDA586C73EfCe21f34fe084541BB877](https://etherscan.io/address/0x0694fF404DDA586C73EfCe21f34fe084541BB877#code) UltraHonk verifier for refunds of notes that were unspent when the zk.money portal froze. Its verification key is immutable. #### RegistrationSIPA Addresses: [0x0934F010d59b552949DBe44AcBE5AFf0e32C8C34](https://etherscan.io/address/0x0934F010d59b552949DBe44AcBE5AFf0e32C8C34#code) Implementation of zk.money registration addresses. Sweeping a funded clone registers the name through the current RegistrationController of the NameRegistry, pays the committed fees and deposits the rest into the PORTAL. The recipient's account can recover any funds from the clone. #### RegistrationController Addresses: [0x10EB6fecD2DCE6DA55d25C355374c970D5D11E23](https://etherscan.io/address/0x10EB6fecD2DCE6DA55d25C355374c970D5D11E23#code) Completes paid name registrations: deploys the user's L1 account, claims the name and writes the user record. Fees above the relayer fee go to an allowlisted beneficiary. #### OxideAccountFactory Addresses: [0x187d19EccBf2909AD3d71B798A8704D950b9C3ee](https://etherscan.io/address/0x187d19EccBf2909AD3d71B798A8704D950b9C3ee#code) Permissionless factory for deterministic L1 accounts. The implementation is immutable and there is no administrator. Implementation used in: [zk.money](https://ethbeat.org/privacy/projects/zkmoneyv6#OxideAccountFactory) #### RelationsLib (0x1ab8…0241, 6 instances) Addresses: [0x1ab8c7439B47B474d72963076aB1C8C944750241](https://etherscan.io/address/0x1ab8c7439B47B474d72963076aB1C8C944750241#code), [0x41F721e09a9C8027165C6Bf1B3771848f6a43D29](https://etherscan.io/address/0x41F721e09a9C8027165C6Bf1B3771848f6a43D29#code), [0x567771A39903323B81E18b388372897FdAd6338C](https://etherscan.io/address/0x567771A39903323B81E18b388372897FdAd6338C#code), [0x871Af018DeD698d9753766D41Dbc80B777944263](https://etherscan.io/address/0x871Af018DeD698d9753766D41Dbc80B777944263#code), [0x9e2131C7B89D070a6b27f29c2b8e066399ECA5b7](https://etherscan.io/address/0x9e2131C7B89D070a6b27f29c2b8e066399ECA5b7#code), [0xb66C441BbeFe703E423dbcAa515d32F50e507C2b](https://etherscan.io/address/0xb66C441BbeFe703E423dbcAa515d32F50e507C2b#code) Library immutably linked into a zk.money refund verifier. It evaluates the UltraHonk circuit constraints during proof verification. #### FrozenDepositRefundVerifier_sUSDS Addresses: [0x2E0C30821b9fcCf1CDB47F4e3a3A993593344522](https://etherscan.io/address/0x2E0C30821b9fcCf1CDB47F4e3a3A993593344522#code) UltraHonk verifier for refunds of deposits included in Aztec's frozen message tree but still unclaimed. Its verification key is immutable. #### SwapEscrowFactoryV2 Addresses: [0x3B5D8c731364902eAFa46Be327AFB044C10c5952](https://etherscan.io/address/0x3B5D8c731364902eAFa46Be327AFB044C10c5952#code) Swap-on-withdraw: a withdrawal can pay DAI to a SwapEscrowV2 clone whose route, recipient, gas share and tip are fixed in its address. Anyone can deploy and execute a funded clone to pay USDC, USDT, ETH or DAI to the recipient. #### Resolver Addresses: [0x3e9BcF7cCA4b94885aBEB9Bbf0005aA99DC6307F](https://etherscan.io/address/0x3e9BcF7cCA4b94885aBEB9Bbf0005aA99DC6307F#code) ENS resolver for zk.money names. It returns a deposit address derived from a resolver operator's answer, which must come with a zk proof that it matches the user's registered keys and L2 address in the AccountMetadataRegistry. - Roles: - **ensNodeOwner**: EOA 1 #### SkyEscrow Addresses: [0x5C412Ba5B338F3e5E2a1332069bdd3Aae6ae6b8a](https://etherscan.io/address/0x5C412Ba5B338F3e5E2a1332069bdd3Aae6ae6b8a#code) Implementation for savings conversion escrows. Each clone fixes the route, deposit commitment, relayer tip and recovery commitment in its address. It converts DAI into sUSDS or redeposits DAI after a savings withdrawal. The recovery account can reclaim stranded tokens, including shares taken without redemption. **References** - [Source Code](https://etherscan.io/address/0x9c4A7d65AFDC2b4eF1164264D9585ED64c869054#code) #### UnprocessedDepositRefundVerifier Addresses: [0x5C487AEb500BD0fE65fe52Be7e55a150c3220FA5](https://etherscan.io/address/0x5C487AEb500BD0fE65fe52Be7e55a150c3220FA5#code) UltraHonk verifier for refunds of deposits not absorbed into Aztec before the zk.money portal froze. Its verification key is immutable. #### SkyWithdrawalExecutor Addresses: [0x63e6cD9Ff886cFF198Eaaab01CeC2b707E7F5475](https://etherscan.io/address/0x63e6cD9Ff886cFF198Eaaab01CeC2b707E7F5475#code) Payout contract for sUSDS withdrawals and refunds. Only the PORTAL can execute a payout. It normally redeems sUSDS into USDS and converts USDS to DAI before paying the committed recipient and relayer tip. The recipient can complete an ordinary withdrawal in sUSDS shares through withdrawInShares, bypassing redemption. #### UnprocessedDepositRefundVerifier_sUSDS Addresses: [0x8ACcBa3958cEF8E30b255c70A4C16CD2D14fb787](https://etherscan.io/address/0x8ACcBa3958cEF8E30b255c70A4C16CD2D14fb787#code) UltraHonk verifier for refunds of deposits not absorbed into Aztec before the zk.money portal froze. Its verification key is immutable. #### SkyEscrowFactory Addresses: [0x9c4A7d65AFDC2b4eF1164264D9585ED64c869054](https://etherscan.io/address/0x9c4A7d65AFDC2b4eF1164264D9585ED64c869054#code) Deploys deterministic escrows for moving funds between the DAI and sUSDS portals. Anyone can execute a funded escrow. Its implementation and routes are immutable. #### FrozenDepositRefundVerifier Addresses: [0xa2fd594dCA2d598aF231d615E5D34903154C3cCe](https://etherscan.io/address/0xa2fd594dCA2d598aF231d615E5D34903154C3cCe#code) UltraHonk verifier for refunds of deposits included in Aztec's frozen message tree but still unclaimed. Its verification key is immutable. #### NameRegistry Addresses: [0xa9863B8F573D62377d987ccb9AF6e0000f99D14a](https://etherscan.io/address/0xa9863B8F573D62377d987ccb9AF6e0000f99D14a#code) Registry of zk.money names. It points to the RegistrationController and the AccountMetadataRegistry, which together decide where payments to a zk.money name resolve to. - Roles: - **domainOwner**: EOA 5 - **owner**: EOA 1 Implementation used in: [zk.money](https://ethbeat.org/privacy/projects/zkmoneyv6#NameRegistry) #### ResolverVerifier Addresses: [0xbF058D54c5033F4cB45c6E1Eba103CaeF232E451](https://etherscan.io/address/0xbF058D54c5033F4cB45c6E1Eba103CaeF232E451#code) UltraHonk verifier for the zk.money resolver circuit with a hardcoded verification key. The Resolver uses it to check that a resolver operator's answer matches the user's registered keys and L2 address. #### PlainWithdrawalExecutor Addresses: [0xC2363b7155EE8391C5395B72C46a6d22BF49151c](https://etherscan.io/address/0xC2363b7155EE8391C5395B72C46a6d22BF49151c#code) Default payout contract for withdrawals and refunds. Only the PORTAL can call it. It pays the recipient and relayer tip committed on Aztec. #### SIPAFactory Addresses: [0xc357E34D4C7520a83C9Ec0a242Ba52b4ecABa1Fc](https://etherscan.io/address/0xc357E34D4C7520a83C9Ec0a242Ba52b4ecABa1Fc#code) Deploys zk.money deposit addresses (SIPAs) as deterministic clones. The implementation per portal and intent is blessed once by the owner and cannot be changed afterwards. - Roles: - **owner**: EOA 1 #### SwapEscrowV2 Addresses: [0xcfAf1DFc22CE92cf3F2b534b3b5C1F116028FB95](https://etherscan.io/address/0xcfAf1DFc22CE92cf3F2b534b3b5C1F116028FB95#code) SwapEscrowV2 implementation. A clone swaps via the Curve 3pool (and Uniswap for ETH) with a slippage bound of 100 bps for stablecoins and 200 bps against the Chainlink ETH/USD price for ETH. It can first swap a capped share of the DAI to ETH for the recipient's gas. If the swap cannot execute, only the recovery key committed in the clone's address can move the funds. #### FrozenNotesRefundVerifier_sUSDS Addresses: [0xd24a49321878AB82E46992ab853A11903882abf2](https://etherscan.io/address/0xd24a49321878AB82E46992ab853A11903882abf2#code) UltraHonk verifier for refunds of notes that were unspent when the zk.money portal froze. Its verification key is immutable. #### ZkMoneyPortal_sUSDS Addresses: [0xD7Ae00b91ba0B8e0240B22Cd75fE447d177C260f](https://etherscan.io/address/0xD7Ae00b91ba0B8e0240B22Cd75fE447d177C260f#code) Escrow of zk.money on the Aztec Network. A withdrawal needs both a proven Aztec L2->L1 message from the zk.money L2 contract and a signature from a registered TEE signer. Anyone can register a TEE signer with a fresh AWS Nitro attestation of an approved enclave image. Once the Aztec Registry's canonical rollup is no longer ROLLUP, anyone can permanently freeze the portal, stopping deposits and fixing the refund snapshot at the last proven checkpoint. - Roles: - **teeSigners**: EOA 2, EOA 3, EOA 4 #### OxideAccount Addresses: [0xdA0D7cD0f49cE7b1D04bf03eE56374a8981c2844](https://etherscan.io/address/0xdA0D7cD0f49cE7b1D04bf03eE56374a8981c2844#code) Immutable implementation of users' L1 accounts. The bootstrap key authorizes the first passkey. Once a passkey is installed, only the user's passkeys can authorize operations and manage keys. The last passkey cannot be removed. Deposit recovery checks signatures against this account. Implementation used in: [zk.money](https://ethbeat.org/privacy/projects/zkmoneyv6#OxideAccount) #### AccountMetadataRegistry Addresses: [0xDA79Bae4485c40291363D885Aae5B543d2D0Efa9](https://etherscan.io/address/0xDA79Bae4485c40291363D885Aae5B543d2D0Efa9#code) Stores user records (Aztec L2 address, keys, chosen resolver operator) and resolver operator entries. User records can be written by the user or by the RegistrationController. Anyone can register as a resolver operator. Implementation used in: [zk.money](https://ethbeat.org/privacy/projects/zkmoneyv6#AccountMetadataRegistry) #### ZkMoneyPortal Addresses: [0xdf410ad448A0f7165181FBdB32f8896f4a0d9449](https://etherscan.io/address/0xdf410ad448A0f7165181FBdB32f8896f4a0d9449#code) Escrow of zk.money on the Aztec Network. A withdrawal needs both a proven Aztec L2->L1 message from the zk.money L2 contract and a signature from a registered TEE signer. Anyone can register a TEE signer with a fresh AWS Nitro attestation of an approved enclave image. Once the Aztec Registry's canonical rollup is no longer ROLLUP, anyone can permanently freeze the portal, stopping deposits and fixing the refund snapshot at the last proven checkpoint. - Roles: - **teeSigners**: EOA 6, EOA 7 #### CertManager Addresses: [0xdfe52FD98aa0Cc8Ce7778a2b00ac7B7Dc9595875](https://etherscan.io/address/0xdfe52FD98aa0Cc8Ce7778a2b00ac7B7Dc9595875#code) Verifies and caches AWS Nitro attestation certificates. The only trust anchor is the hardcoded AWS Nitro root certificate. #### OperationExecutor Addresses: [0xe883686d9EC4E0430f2233A6BF12B2D226a39e19](https://etherscan.io/address/0xe883686d9EC4E0430f2233A6BF12B2D226a39e19#code) Permissionless helper that executes a call and forwards the resulting token payout to the caller. Used by finalizers to collect fees and subsidies. #### SwapEscrow Addresses: [0xf16Fd140036925e3a0630d0F743204a4c7d8ccaf](https://etherscan.io/address/0xf16Fd140036925e3a0630d0F743204a4c7d8ccaf#code) SwapEscrow implementation. A clone swaps via the Curve 3pool (and Uniswap for ETH) with a slippage bound of 100 bps for stablecoins and 200 bps against the Chainlink ETH/USD price for ETH. If the swap cannot execute, only the recovery key committed in the clone's address can move the funds. #### ZKTranscriptLib Addresses: [0xf3E445E6E292dE756bD66011c23717DAb9e12DBD](https://etherscan.io/address/0xf3E445E6E292dE756bD66011c23717DAb9e12DBD#code) Runtime library immutably linked into the zk.money resolver verifier. It evaluates circuit constraints or derives Fiat-Shamir challenges for zero-knowledge UltraHonk proofs. #### DepositSIPA Addresses: [0xF714D8Cf287F4A410b018514074A9371BC45461b](https://etherscan.io/address/0xF714D8Cf287F4A410b018514074A9371BC45461b#code) Implementation of zk.money deposit addresses. Anyone can sweep a funded clone, which swaps USDC or USDT to DAI, pays DEPOSIT_FEE to the relayer and deposits the rest into the PORTAL for the recipient fixed in the clone's address. The recipient's account can recover any funds from the clone. #### FPCFunderDAI Addresses: [0x37cD81C39Bf276ea7e1c6a416A254f688c70eAFb](https://etherscan.io/address/0x37cD81C39Bf276ea7e1c6a416A254f688c70eAFb#code) Collects the portal's funding cut. Anyone can swap it to AZTEC and bridge it as Fee Juice to the zk.money fee-paying contract on Aztec (L2_BENEFICIARY), which pays L2 fees for users.