# Tacit Pay Markdown version of https://ethbeat.org/zk-catalog/tacit-pay ## Summary - Creator: Tacit - Total Value Secured: $17.52 K (-3.59% compared to seven days ago) - Trusted setups for Snarkjs (Groth16): - Transact circuit ceremony, risk red (highest risk) per the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381): Circuit-specific trusted setup for the Groth16 transact circuit over BN254. Phase 1 used 54 participant contributions and a public randomness beacon. Phase 2 counts 176 contributions under self-made keys with repeats allowed, so the number of participants is unknown. Proving system could be broken if either phase 1 or 2 is compromised. - Used in: [Tacit Pay](https://ethbeat.org/privacy/projects/tacit-pay) - Verifiers: 1 successful (verified by [ETHBEAT](https://ethbeat.org)) - zkVM: BN254 (curve), Snarkjs (Groth16) ### About A shielded ledger for ETH with private transfers, proven in the browser, with immutable contracts and an app stored on Ethereum. ### Links - Website: https://tacit.finance - Docs: https://github.com/src-company/tacit/blob/main/docs/EVM-POOL.md - Repository: https://github.com/src-company/tacit, https://github.com/ERC8244/dapps ## Value Secured The interactive TVS chart is shown on [the HTML page](https://ethbeat.org/zk-catalog/tacit-pay#tvs). ## Milestones & Incidents - 2026-10-03: [anon.wei app stored onchain](https://github.com/ERC8244/dapps/blob/bf39cc0b4d8c5eabdcd76f8b0672ec97b645a986/tacit-pay/deploy/TACIT-PAY-8244.deployed.md). The reference app is published as contract code on Ethereum, each version immutable. - 2026-09-27: [Tacit Pay pool launch](https://github.com/src-company/tacit/blob/389dd680cf18541eca1c0de922368fde2f5596f5/contracts/deployments/evm-pool.json). The ETH pool, router and verifier go live with the ceremony key and no owner. ## Trusted Setups Risk levels follow the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381). Yellow (medium risk): all contributions are published and the final output can be verified, the ceremony client is open source, there were at least 30 contributions, participation was open to the public and announced, and participants are publicly identified. Green (lowest risk): everything required for yellow, with at least 150 contributions. Red (highest risk): at least one requirement for yellow is not met. N/A: the proof system needs no trusted setup. ### Transact circuit ceremony - Risk: red (highest risk) - Proof systems: Snarkjs (Groth16) - Phase 1: 54 contributions - Phase 2: 176 contributions (Under self-made keys, 171 named "anonymous" and 5 operator test entries. One key could contribute any number of times.) Circuit-specific Phase 2 trusted setup for the single Groth16 circuit, `transact.circom` (2 inputs, 2 outputs, 44,414 constraints), over the BN254 curve. It builds on the Hermez ceremony as Phase 1, using `powersOfTau28_hez_final_16.ptau`, which contains 54 Perpetual Powers of Tau participant contributions and one public randomness beacon. Tacit's own server coordinated Phase 2 from its website. It opened to everyone on 26 September 2026 at 18:21 UTC and closed 18 hours later. The hash of Bitcoin block 968840 sealed it as a beacon. The transcript lists 176 contributions. 171 are named "anonymous" and 5 are Tacit test entries. A contributor proves only a key they generate themselves. The coordinator accepts any number of contributions from one key, so the contributions identify no participants. We found no public announcement of the ceremony. The final key verifies against the circuit and the Phase 1 file with snarkjs, and its contribution hashes equal the transcript's. - Phase 1 file description (54 contributions and a beacon): . - Ceremony bundle with transcript, keys and verifier: [IPFS bafybeia4yvn…ypfy](https://ipfs.filebase.io/ipfs/bafybeia4yvn2zoggvgpjwg5vpwpt6aivjbcm6tgzxoxsukao2nm5yyypfy) - Transcript, 171 contributions named "anonymous": [transcript.json](https://ipfs.filebase.io/ipfs/bafybeia4yvn2zoggvgpjwg5vpwpt6aivjbcm6tgzxoxsukao2nm5yyypfy/transcript.json) - Open ceremony without an eligibility proof: [worker/src/index.js#L9747-L9751](https://github.com/src-company/tacit/blob/389dd680cf18541eca1c0de922368fde2f5596f5/worker/src/index.js#L9747-L9751) - Repeat contributions from one key: [worker/src/index.js#L11231-L11234](https://github.com/src-company/tacit/blob/389dd680cf18541eca1c0de922368fde2f5596f5/worker/src/index.js#L11231-L11234) - Ceremony opened: [27b575a4](https://github.com/src-company/tacit/commit/27b575a43a37ccbb91e812b378f5e108248cb14e), closed and sealed: [ed2ffbf0](https://github.com/src-company/tacit/commit/ed2ffbf0a0947a0d54a5424b03b95134ddaad847) - Rebuild and check instructions: [docs/EVM-POOL.md#rebuild-and-check-it](https://github.com/src-company/tacit/blob/389dd680cf18541eca1c0de922368fde2f5596f5/docs/EVM-POOL.md#rebuild-and-check-it) ## Verifier IDs List of different onchain verifiers for this proving system. Unique ID distinguishes different deployments of the same verifier from different verifiers (e.g. different versions). ### Groth16: Snarkjs Circom / iden3 implementation of Groth16 proving system written in JS. #### Transact verifier - Verifier ID: `Tacit Pay transact verifier 27.09.2026` - Source: https://github.com/src-company/tacit/tree/389dd680cf18541eca1c0de922368fde2f5596f5/dapp/circuits/evm-pool - Verification: successful (verified by [ETHBEAT](https://ethbeat.org)) - Used in: [Tacit Pay](https://ethbeat.org/privacy/projects/tacit-pay) **Known deployments** - [0x000000b1c0e84CEc8AdF8278B90c4d6400DfB153](https://etherscan.io/address/0x000000b1c0e84CEc8AdF8278B90c4d6400DfB153#code) on Ethereum, used in: [Tacit Pay](https://ethbeat.org/privacy/projects/tacit-pay) ##### Verification steps Tacit Pay uses one Groth16 circuit, `transact.circom` (2 inputs, 2 outputs, 44,414 constraints). The TacitEvmPool names the TransactVerifier, which hard-codes the circuit's verification key. The steps below tie the deployed bytecode to the published circuit and ceremony key. Steps, all on `src-company/tacit` commit `389dd680cf18541eca1c0de922368fde2f5596f5`: 1. In `dapp/circuits`, install the locked dependencies (circomlib 2.0.5, snarkjs 0.7.6) and compile `evm-pool/transact.circom` with circom 2.2.3 and `--O2`. The sha256 of `transact.r1cs` is `b0a246d1790151c722e42ccfa89450cb96c7f5a9f4b70a2162b7d9fc79b6ddb3` and of `transact_js/transact.wasm` is `02dd5e84970e5bc629a7a3cd4d7eae5fc9ca05579fa22c9b39b5ea70c8d8a6c1`, as `dapp/evm-pool/pin.json` records. 2. Download the phase 1 file `powersOfTau28_hez_final_16.ptau`, BLAKE2b `6a6277a2f74e1073601b4f9fed6e1e55226917efb0f0db8a07d98ab01df1ccf43eb0e8c3159432acd4960e2f29fe84a4198501fa54c8dad9e43297453efec125` as the snarkjs README lists it. Tacit pins a copy at IPFS `bafybeie73kd3suqjeshnitj6pmr3qxf6ckjbwxxuqyaaixk77ezeoohtau`. 3. The committed `dapp/evm-pool/transact_final.zkey` has sha256 `40758061a0786fb0bdc5e5dec4c354bbf85fc106f7412716e25e781af4e79c4b`, like the copy in the ceremony bundle `bafybeia4yvn2zoggvgpjwg5vpwpt6aivjbcm6tgzxoxsukao2nm5yyypfy`. 4. Run `snarkjs zkey verify transact.r1cs powersOfTau28_hez_final_16.ptau transact_final.zkey`. The key verifies with 176 contributions and a beacon from the hash of Bitcoin block 968840, and the contribution hashes equal those in the bundle's `transcript.json`. 5. Run `snarkjs zkey export verificationkey transact_final.zkey`. It equals the committed `dapp/evm-pool/transact_vk.json`, and every coordinate of `vk_alpha_1`, `vk_beta_2`, `vk_gamma_2`, `vk_delta_2` and the 12 `IC` points equals a constant of `contracts/src/TransactVerifier.sol`. 6. The source of the verifier at `0x000000b1c0e84CEc8AdF8278B90c4d6400DfB153`, verified on Etherscan and Sourcify, equals `contracts/src/TransactVerifier.sol`, and `VERIFIER()` of the pool returns that address.