Accountable Anonymity for Public Money (DRAFT v2)

Seven contributions, in the order the paper builds them:

• The non-deniable-receipt invariant (Def. def:ndr): a security definition for payment systems whose new clause is collusion resistance: even a willing payer and payee cannot construct an accepted payment with no receipt. Accountability is bilateral, held by the counterparties; there is no system-wide opener.
• The compulsion calculus (Sec. #sec:compulsion): the invariant, composed with issuer-blindness (the KYC issuer cannot trace even its own certified clients; Thm. thm:issuer-blind), yields three properties we believe are jointly new for a payment system: evidence exists for every payment; only the direct participants hold it; and it is refusable: without a participant's keys, surrendered or compelled, the ledger is computationally silent, under DDH, for as long as that assumption stands. We argue this is the right cryptographic substrate for due process, and the right failure mode under unjust process.
• Identity-M binding (Sec. #sec:identity-m): the inversion that makes the rest practical. One gadget (prove an encryption of a registered Identity under a target key) instantiated three ways covers the whole realisable design space. Note spend authorization keys on identity, so a lost account key is recoverable with no custodian, and the binding survives the time gap between an anonymous payer and an anonymous payee.
• A complete, shipped construction of all three realisable flavours – addressed/public (A1), addressed/private (A2), bearer/public (B1) – on Ethereum: Groth16 batch mint, shared flavour-bound spend, and spend-time composition of a deposit sigma, a bound set-membership proof, and a note-to-ciphertext tie, every verifier real and measured (Sec. #sec:eval).
• The forced taxonomy (Thm. thm:b2): the fourth flavour—a bearer note from a hidden issuer—is impossible, by an information-theoretic argument.
• The cost of anonymity, located (Sec. #sec:cost): the receipt is nearly free when one party is named at the binding moment. When both are anonymous, the obvious cheap coupling is vacuous (Lem. lem:vacuous), and a collusion-resistant receipt requires zero-knowledge registry set-membership under a single-binding-step restriction (Prop. prop:necessity). The shipped system takes exactly the branch the proposition permits, and we measure it.
• A reproducible artifact: contracts, circuits, and verifiers, open and test-covered—over 400 Foundry tests, 330 wallet tests, an end-to-end suite where every verifier is the real Groth16 artifact —and the paper's own claims carry executable witnesses (Appendix #sec:appendix) that re-run on each build.

The model's three properties: no one can reconstruct who paid whom from the chain; nothing on chain reveals either party's Identity to outsiders; and the two parties can always identify each other. The first two must hold against the strongest adversary available: the issuer itself, which knows every identity it ever certified.

One definition carries the accountability half of the paper. Its first two clauses are standard: receipts can always be produced, and never forged. The third is the new one: even a payer and payee working together cannot make an accepted payment that leaves no receipt.

Completeness alone protects a self-interested recipient; the third clause is what forbids a willing pair. Symmetric statements bind the recipient's identity toward the payer (Theorem thm:mutual gives the per-flavour content).

The KYC issuer is the system's only trust anchor, and the natural objection to any accountable privacy claim is that the issuer is a bulk-deanonymisation backdoor. It is not. Issuance is address-blind: the issuer signs the identity scalar \( m = H(\mathrm{id}) \) once (a PS credential over \( m \) alone) and is thereafter done. The client derives each on-chain account offline (a fresh key pair \( (sk, pk) \), a self-formed ElGamal credential \( E_{\mathrm{addr}} = (rG,\ M + r\,pk) \), and a blinded presentation \( (A, B) \) of the credential with its proof \( \pi \)), without the issuer ever seeing \( pk \). The issuer's view is therefore, per certified client \( i \), the tuple \( (\mathrm{id}_i, m_i, M_i, \sigma_i) \) (the plaintext identity) plus public chain state. It holds no chain addresses.

This is what no trusted opener means here, with the A' presentation in place: the closest thing to an authority cannot open transactions in bulk, even against itself. Under compulsion it can only verify a link some party surrenders – map a receipt-disclosed \( M \) to the real person – never produce one. Two caveats bound the theorem:

• Computational, not information-theoretic. The plaintext lock is DDH; only the credential lock is information-theoretic (and its argument is pending independent review). A discrete-log break – in particular a quantum computer running Shor against \( \mathbb{G}_1 \) – turns the harvested \( \{M_i\} \) plus the archived chain into a wholesale, retroactive deanonymisation of past identity-bound traffic. The breached or compelled issuer's KYC records are precisely that harvest corpus. Migration of the identity substrate ahead of cryptanalytic risk is a deployment obligation, not an afterthought (Sec. #sec:discussion).
• Retroactive, not prospective. Address-blind issuance protects past registrations, under DDH, against future issuer compromise; but a coerced issuer can change the protocol going forward (demand \( pk \) at KYC, record addresses, backdoor credentials). Issuer-blindness is a statement about issuances already performed under the honest protocol.

The invariant and issuer-blindness, composed, induce a precise answer to the question who can a court reach, and what happens when they refuse? We state it as three properties. Call a party's opening material for a payment the secrets from which an accepting receipt can be computed: the note opening (its randomness \( \rho \) and identity payload) together with, per flavour, the holder's identity scalar or account key needed to decrypt the counterparty ciphertext.

Propositions prop:exist–prop:refusal follow from the privacy theorems (Sec. #sec:security) plus issuer-blindness. Their content is the composition – constitutional design more than cryptography:

• Due process is fully served. Evidence exists for every payment (no colluding pair can prevent it), it convicts only the guilty (non-frameability: a receipt cannot be forged against an innocent party; Corollary cor:noframe), and a court always has a specific person to direct an order at. Investigation proceeds the way warrants are supposed to work: from a known participant, one named counterparty at a time, each step producing sound evidence.
• Bulk surveillance is not for sale. There is no database to subpoena, breach, or buy. The marginal cost of surveilling one more citizen is coercing one more citizen: publicly, individually, through legal process directed at a person who can see it happening. The system makes population-scale financial monitoring not illegal but unimplementable – a claim that rests on Theorem thm:issuer-blind, hence on the A' presentation and on DDH.
• The last word belongs to the citizen. Refusal has personal legal cost (contempt, adverse inference), as it should, under legitimate process. But it is effective: a citizen facing an unjust order, or a population facing a judiciary that has begun criminalising beliefs, can withhold or destroy keys, and the archived ledger stays dark regardless of what any institution is later compelled to do. The privacy floor survives institutional capture because no institution was ever load-bearing.

Two honest edges. First, receipts are bilateral: your counterparty's copy is beyond your control, by design. A criminal cannot silence their victim's receipt by destroying their own. Refusal protects a payment only when every participant elects it; exactly the case the property is for: consensual acts the regime of the day has criminalised. Second, destroying your keys also destroys your evidence: the standing ability to prove what you paid and to whom. Refusal-resilience is an option with a price, chosen by its holder – not a default that degrades accountability for anyone else (Def. def:ndr holds for every accepted payment regardless).

The pool is a Tornado-style¹⁴ Merkle tree of note commitments, hashed with Poseidon (a hash designed to be cheap inside proof circuits), keeping a rolling window of recent roots and a set of spent nullifiers¹⁵—one-way serial numbers, revealed only at spend, that make a double-spend detectable without linking the spend to its note. with Poseidon (a hash designed to be cheap inside proof circuits), keeping a rolling window of recent roots and a set of spent nullifiers – one-way serial numbers, revealed only at spend, that make a double-spend detectable without linking the spend to its note. A note is the opening tuple; its on-chain commitment is

\[ cm = \mathrm{Poseidon}_6(T_{CM},\ \mathrm{flavor},\ v,\ \rho,\ idHash,\ \mathrm{predicate}), \]

where \( \rho \) is the note's secret randomness and \( idHash \) is a Poseidon hash of the flavour's identity payload – the commitment to everything the note says about its parties. Each note hash leads with its own domain tag (\( T_{CM} \), \( T_{ID} \), \( T_{NF} \)), a fixed field word that keeps it disjoint from every other hash in the protocol. Batch mints are proven by a Groth16 SNARK (proofs a few hundred bytes, constant gas to verify; one circuit per pinned batch size \( N \)) that opens every commitment, range-checks the values, sums them to the public escrowed total, and folds the leaves into the attested new root. The contract escrows exactly the proven total in the same atomic call.

Spends are proven by a single shared, flavour-bound circuit: the prover shows knowledge of an opening of some tree leaf under a recent root, with public \( (\mathsf{root},\ nf,\ \mathrm{face},\ \mathrm{recipient},\ \mathrm{chainid},\ \mathrm{flavor},\ \mathrm{issuanceCommitment}) \). The entrypoint supplies its flavor, the circuit requires it to match the committed opening, and the current predicate is constrained to zero. For B1 only, \(\mathrm{issuanceCommitment}=cm\); A1/A2 expose zero. The nullifier

\[ nf = \mathrm{Poseidon}_3(T_{NF},\ \rho,\ idHash) \]

is one derivation for every flavour (the tag keeps nullifier preimages distinct from commitment preimages). Double-spends are rejected by set membership. No account key enters the hash: spend authorization is layered per flavour on top of the nullifier. That is what makes key-loss recovery and account-agnostic deposit possible (Sec. #sec:identity-m) – and what creates the binding obligation the rest of this section meets.

What \( idHash \) commits, and which direction of the gadget runs at which moment, defines the flavour:

with the per-flavour ciphertexts, all ElGamal. Addressed notes are encrypted to the recipient's receiving key \( pk_{\mathrm{recv}} = kG \), derived from wallet seed material and independent of the Identity: the identity scalar is disclosed to every counterparty by design, so nothing may be encrypted under \( M \). The registry certifies the pair in one salted accumulator leaf, \( \mathrm{Poseidon}(\tau_R, m, k, salt) \).

• A2 (addressed, private issuer). The issuer encrypts its own registered identity under the recipient's receiving key: \( eIss = (r'G,\ M_{I} + r'\,pk_{\mathrm{recv}}) \), decryptable by \( k \) alone; the note value rides in \( eNote = (r_n G,\ vG + r_n\,pk_{\mathrm{recv}}) \). At mint, a blinded re-encryption sigma (verifyIssuerReenc) proves \( eIss \) carries the minting account's registered identity – the anti-framing anchor – without revealing it, and publishes \( T = r'\,pk_{\mathrm{recv}} + \gamma H \) on a generator \( H \) hashed to the curve. Each leaf's \( eIss \) and \( T \) are public inputs of the A2 mint SNARK (the leaf-tie), which recomputes \( idHash \) over them: no leaf can lack a binding, and no binding can float to another leaf. \( \gamma \) reaches the recipient in the delivery.
• A1 (addressed, public issuer). The issuer is named openly (a Schnorr signature over the batch under their registered key, checked at mint), and the recipient's identity is encrypted under the same key: \( eRec = (r'G,\ M_{\mathrm{rec}} + r'\,pk_{\mathrm{recv}}) \).
• B1 (bearer, public issuer). No recipient exists at mint (Theorem thm:b2 makes this the only coherent bearer cell); at spend the depositor encrypts their own identity under the public issuer's key, \( eDepForIss = (rG,\ M_{\mathrm{dep}} + r\,pk_{\mathrm{iss}}) \), and proves it carries the same identity their payout account is bound to. The public-mint batch Schnorr authenticates the issuer and Notes records every exact commitment under that issuer. At spend the circuit-revealed B1 commitment must map to the issuer used by this depositor-binding proof, so an otherwise-valid substitute issuer cannot compose with the note.

Every addressed deposit (spendCoupledA1, spendCoupledA2) verifies, in one transaction, the shared flavour-bound note proof plus ONE folded gate (deposit_fold_a1, deposit_fold_a2, Groth16) carrying every relation over a single witness:

1. The receiving secret \( k \) decrypts the note's ciphertext to a point, and the supplied \( eEnc \) re-encrypts that same point under the same \( k \).
2. The depositing account msg.sender is registered, and its credential decrypts under its own key to the Identity \( M = mG \).
3. A registered accumulator leaf commits the PAIR \( (m, k) \) under the holder's salt.
4. That leaf's path folds to the posted root \( \mathsf{rt_{id}} \).
5. For A2 only: the decrypted ISSUER Identity is itself registered, under the salt the note shipped.
6. For A2 only: the committed \( T \) opens as \( (r'k)G + \gamma H \) – the key the mint binding proved about is the key the recipient holds (the key tie).

The posted root is one the registry retains in its ring and accepts for the Notes consumer (posted within seven days); a membership path is 32 levels, a registry's subtree and then the aggregator. The composition is one proof and not three because the two facts an addressed spend must establish rest on two DIFFERENT secrets – the receiving key reads the note, the Identity scalar owns the account. Three gates sharing a public point would let a thief with a stolen payload answer the reading half with the stolen key and the Identity half with its own registered Identity: both halves true, nothing joining them. An equality inferred from two proofs that merely share a point is not an equality, and relation (3) is what states it.

// inside Notes._spendCoupled (abridged; A2 passes a1Layout=false, A1 true):
require(spendVerifier.verifySpend(proof, root, nullifier, face, recipient, chainid));
require(identityRegistry.acceptsRoot(identityRoot, NOTES_MEMBERSHIP_CONSUMER));
require(a1Layout
    ? depositFoldVerifier.verifyFoldA1(foldProof, nullifier, face, identityRoot, eEnc, msg.sender)
    : depositFoldVerifier.verifyFoldA2(foldProof, nullifier,       identityRoot, eEnc, msg.sender),
    "bad folded deposit gate");

The composition discipline – every public input derived on chain from the same objects (msg.sender's registered key and credential read from the registry, \( eEnc \), the nullifier, the face, the posted root), never taken from the prover's bytes – is what makes the relations impossible to decouple. We commend the pattern to designers beyond this system, together with its sharper form: where two facts rest on two secrets, do not compose proofs – fold them. For B1 a depositor-binding sigma (an Okamoto-style proof coupling the payout account, \( eDepForIss \), and \( P_{\mathrm{dep}} = M_{\mathrm{dep}} + bH \)) composes with a bound membership proof instead, and that IS sound: B1's two facts rest on one secret, so the sigma's shared challenge is a genuine tie, and the blind sits on a generator whose logarithm is unknown.

For A2, \( eEnc \) is a fresh re-encryption of the committed \( eIss \) (same plaintext, new randomness): re-using the mint-time ciphertext – a public input of Notes.mint – would link spend to mint and destroy the flavour's anonymity. Hence the tie proves re-encryption equivalence, never equality. For A1, the committed payload has no second ciphertext, so the tie runs through the note's own value ciphertext with the face public; the next subsection explains why that public face is not incidental but the soundness linchpin.

ElGamal ciphertexts are not key-committing: given the randomness \( r_n \) (which travels with the opening), the key of \( eNote = (r_n G,\ C_n) \) can be re-explained as any \( k' \) by absorbing the difference into a free plaintext, \( V' = C_n - (r_n k')G \). A binding circuit that witnesses the plaintext freely therefore proves nothing about the addressed mailbox. The A1 tie pins the plaintext publicly: its statement fixes \( eNote.C = (v + r_n k)G \) with \( v \) a public input that the contract sets to the spend's face – itself bound to the note's committed value by the spend SNARK over the same nullifier. With \( v \) and \( r_n = \log_G eNote.R \) determined,

\[ k = (\log_G eNote.C - v)\cdot r_n^{-1} \]

is unique: only the mailbox the note was addressed to satisfies the relation, and relation (3) then says whose Identity that mailbox is (Theorem thm:tie, A1 clause; executable witness in Appendix #sec:appendix). The observation generalises: when a binding must travel through a non-committing encryption, publishing the plaintext's already-public component is the cheapest commitment.

A receipt is a four-link proof chain, every link checkable by a third party from public state plus the holder's disclosed material: (a) opening – the disclosed tuple re-hashes to a commitment; (b) minted – that commitment is a leaf under a historical root; (c) issuer – the flavour's issuer binding (Schnorr in the clear, or the decrypted-and-membership-certified \( eIss \)); (d) paid – the nullifier consumed and face transferred. The recipient-naming direction is the spend-side composition above. Link (c) is where the invariant lives or dies; Sec. #sec:cost is about keeping it alive when the issuer is anonymous.

Because the material behind the chain is held by both parties – the issuer created the identity payload at mint, the recipient was handed it with the note, and the spend event publishes the rest – either party can assemble the receipt: the depositor's copy and the issuer's "I paid X" copy differ only in who proves their own account-to-identity tie. The addressed legs are proven by whoever holds the evidence – the recipient by verifiable decryption under its receiving key, the issuer by disclosing the mint randomness, which re-encrypts to the committed ciphertexts – and never by decrypting under a scalar a verifier could derive from a disclosed record, which would let anyone who ever saw a receipt read the payee's mail. Both copies check the same committed payload, which is what makes them verify identically. The end-user serialization of this chain – a printable, re-scannable slip – is Sec. #sec:receipt-artifact.

A direct transfer between registered accounts gets collusion-resistance free: the mandatory approve handshake reads both parties' registered records in a single call – both anchors co-present, both named. A2 splits the anchors in time by demand of its privacy goal: the issuer's anchor is live only at mint, the recipient's only at spend, and unlinkability forbids any public value from bridging them. The A2 mint binding is, line for line, the approve handshake with one change: the recipient's identity is blinded. That one change is the entire gap – it surrenders the phrase "under the recipient's registered key" – and everything that follows is the price of buying the phrase back without un-blinding anything.

The lemma is the formal autopsy of an entire class of cheap designs, and the second motivation (after key loss) for the Identity-M inversion: binding to a key is worthless, because keys are free and ElGamal does not commit to them. The binding must reach a registered identity ; the issuer, holding no recipient secret, can assert registration only as a set-membership statement.

Proposition prop:necessity permits exactly two homes for the membership proof, and the system's own history visited both. An earlier design (retained in the retired drafting skeleton of this paper) placed it at mint: a per-leaf circuit opening the issuer's credential, proving the recipient's account-keyed credential a member of an account registry, and coupling the payload under the recipient's account key – at roughly \( 10^6 \) R1CS per leaf, on top of the account-pinning brittleness of Sec. #sec:identity-m. The shipped system takes the spend branch, and the Identity-M inversion is what makes the branch practical:

• The membership moves to where its prover is. At spend the depositor is live, holds \( m_{\mathrm{rec}} \) and \( k \), and can prove membership of the relevant point – the issuer's decrypted identity for A2 (closing the clause exactly as the proposition demands), the recipient's own for A1. The proof is per-spend, not per-minted-leaf, and proving cost lands on the interested party's own hardware; the chain only ever verifies.
• The statement does not split, because the secrets do. Reading the note and owning the account rest on two different secrets, the receiving key and the identity scalar, and two proofs that share a public point cannot say they belong to one person. So the account relation, the decryption, the certified pair, the membership and the note tie are one folded Groth16 proof (Theorem thm:gate), with every public input derived on chain – the discipline of Sec. #sec:construction. Only B1, whose two facts rest on one secret, keeps a sigma beside its membership proof.
• Relocation creates one new obligation, and it is dischargeable. Binding at spend means the verified ciphertext is the depositor's submission, so it must be tied to the note being spent – otherwise a stolen opening redeems with a self-addressed ciphertext, and a coalition substitutes a nameable one for an un-nameable commitment. That obligation is Theorem thm:tie, relations of the same folded proof, including the A1 face-pinning trick – and, for A2, the key tie of Theorem thm:keytie, since a binding proven at mint must be joined to the key opened at spend through the one channel between them, \( idHash \).

The result: the doubly-anonymous flavour, predicted expensive, costs a measured \( \sim\!70\mathrm{K} \) gas more per spend than the bearer flavour (Sec. #sec:eval) and seconds of off-chain proving – practical today. Whether restriction (iii) can be dropped – whether a binding amortised across steps, a two-party mint with a blinded recipient contribution, or a witness-encryption construction evades set-membership entirely – remains the paper's central open problem (Sec. #sec:discussion): an unconditional impossibility would prove the SNARK necessary; a loophole would be a cheaper design.

Before the tie relations shipped, the design contemplated an economic backstop: an honest A2 recipient verifies the binding at delivery (decrypt \( eIss \), check the registered identity) before accepting. An audit regime with penalty \( L \) and probability \( q \) then makes verify-then-accept dominant whenever \( qL \) exceeds the collusion benefit – and, by Corollary cor:noframe, the residual off-equilibrium outcome is only ever an un-nameable note held by an always-identifiable depositor, never a framed third party. With the tie enforced on chain the mechanism no longer carries weight, but we record it: delivery-time verification remains good wallet practice, and the analysis explains why even a deployment that lags the verifier rollout degrades to a bounded, recipient-borne risk rather than an open hole.

The invariant's deliverable is not a theorem but an artifact a citizen can hold. The wallet serializes the verified proof chain as AB-RCPT/2: a canonical, bit-reproducible byte string, wrapped into a plain-text payload sized for an 80mm thermal printer – a literal cash-register slip whose face names both parties in the clear and whose payload re-verifies offline from its own re-scanned text (albertabuck verify -), or anchors to any node for the chain facts.

Two design points carry the civic claims. First, the slip names persons, not keys: it embeds each party's full canonical_identity_data preimage, and verification recomputes \( M = \mathrm{keccak}(\text{data}) \cdot G \) against the named identity point – so "my counterparty is who they say they are" is a hash check, not a promise, and the accounts printed beside the names are pinned by the same proofs (the issuer bindings fold the minting account into their transcripts; the spend event anchors the payout account). Second, for Notes the receipt is bilateral by construction: the payload behind the leaf's idHash is held by both parties, so the depositor prints their copy and the issuer prints an "I paid X" copy – for B1, naming the depositor by verifiably decrypting the spend event's eDepForIss – and both verify identically, because each proves its addressed legs from evidence only it holds, against the same committed payload. Eight golden renders (the five kinds plus the three issuer-side Note receipts) are pinned byte-for-byte in the test suite; the recipient's copy for an A2 note – a payment whose issuer no observer, subpoena, or breached KYC issuer could name – reads:

                 ALBERTA  BUCK
         P A Y M E N T   R E C E I P T
------------------------------------------------
  Receipt  fo6idsp2dmel
------------------------------------------------
FROM (payer) (PRIVATE IDENTITY)
 Bob Smith
Corporate Registration - Alberta, Canada
 acct 0x0b0b000000000000000000000000000000000b0b
 idpt 0x0cef52e77ea5..0ae1f916d96b
------------------------------------------------
TO (payee - you) (PRIVATE IDENTITY)
 Alice Johnson
Alberta Identity Card - Alberta, Canada
 acct 0x0a11ce00000000000000000000000000000a11ce
 idpt 0x07a0b762be40..d418d7bf5e7c
------------------------------------------------
TRANSACTION
 Type    Note spend - A2 addressed, private issuer
 Amount              0.000250  BUCK
 When        2026-05-28 20:10  UTC
 Chain 1    Block 1234599    Log 1
 Tx      0xa2a2a2a2a2a2..a2a2a2a2a2a2
 Mint    0xaaaaaaaaaaaa..aaaaaaaaaaaa
------------------------------------------------
VERIFICATION
 status @ issue: VALID
 receipt  fo6idsp2dmel
------------------------------------------------
      a record, not a bearer instrument

This is the compulsion calculus (Sec. #sec:compulsion) made tangible: standing, court-grade provenance for every payment a citizen was party to – against fraud, theft, or commerce conducted with their stolen credentials – produced from their own records, without anyone's permission, forgeable by no one; while the same payment remains noise to every non-party, from the chain-analytics firm to the compelled issuer. That pairing is the shift the system exists to make: the capability to prove moves to the individuals who transacted, and the capability to watch is withdrawn from everyone else. The slip itself is a record, not a bearer instrument: it moves no funds, and discloses only what its holder chooses to disclose, one payment at a time.

Full-call gas for one mint (batch of one) and one coupled spend, per flavour, from the end-to-end suite (chain id 1, Cancun):

Isolated per-phase verification gas:

The cost structure tells the paper's story in numbers. Both addressed flavours pay one folded gate – the price of "only \( M_{\mathrm{rec}} \) can spend", within about 70K of the bearer flavour's sigma and membership – while issuer anonymity costs only the mint-side delta (~116K, the blinded re-encryption binding and its \( T \) outputs): A2's spend is within two percent of A1's. Set-membership, the provably necessary ingredient, costs the same whatever the registry's size: a 32-level path inside the fold, or one 253K Groth16 verify for B1. Prover side: the folds are 3.31M (A1) and 3.83M (A2) R1CS constraints, dominated by fixed-base scalar multiplications (the A1 fold performs no curve addition at all, since every point it touches is a known multiple of \( G \); A2's key tie adds one multiplication on \( H \)). They prove in 15–18 seconds under rapidsnark on commodity Apple-silicon hardware, witness generation via the circom C++ calculator. Distribution cost concentrates the same way: the fold proving keys are 1.9 GB (A1) and 2.1 GB (A2) one-time wallet downloads, B1's membership key 272 MB, while every other prover artifact (mint, spend keys and witness generators) is a few megabytes to a few hundred – and the trusted-setup transcript never ships to wallets at all. All verification is constant-gas on chain; no participant ever waits on another's prover.

The same vectors flow through three independent implementations – the Python wallet reference (py_ecc-style BN254 arithmetic), the circom witness generators, and the Solidity verifiers – and the test suites assert byte-for-byte agreement: over 600 Foundry tests (among them the 12-run all-real-verifier end-to-end lifecycle) and over 450 Python tests (among them byte-pinned golden renders of all eight receipt kinds, from both Note parties' sides), with the Rust and JavaScript kernels replaying the same vectors. The companion documents are executable: the walkthrough document runs every cryptographic step of all three flavours in one seeded session, and this paper's appendix witnesses re-run on each build. Honesty items: Groth16 needs a one-time trusted setup whose secret randomness must be destroyed, and ours currently uses development entropy – a production Powers-of-Tau ceremony is a deployment prerequisite. Formal verification of the circuits (beyond witness/constraint testing) is planned, not performed.

import random
from alberta_buck.wallet import backend
from alberta_buck.wallet.bn254 import G1, ORDER, mul, add, neg, eq, rand_scalar
from alberta_buck.wallet.elgamal import elgamal_encrypt, elgamal_decrypt
from alberta_buck.wallet.unilateral_a2 import (
    IdentityTree, mint_unilateral_a2, make_receipt, verify_receipt,
)

assert backend() == "kernel", "must run the production kernel: evaluate in the repo venv"
print(f"wallet crypto backend    = {backend()} (buck_core.buck_identity)")

_seed = random.Random(0xACC0)                # one deterministic transcript
rng   = lambda: _seed.getrandbits(256)
CHAINID = 1

def account(m):                    # a registered account bound to identity m
    sk = rand_scalar(rng); pk = mul(G1, sk)
    return dict(m=m, M=mul(G1, m), sk=sk, pk=pk,
                E=elgamal_encrypt(mul(G1, m), pk, rand_scalar(rng)))
def pt(P):
    return f"({int(P[0]) % 10**8:>8d}..., {int(P[1]) % 10**8:>8d}...)"
def dec(R, C, sk):                 # ElGamal decrypt on raw points
    return add(C, neg(mul(R, sk)))

m_iss, m_rec = rand_scalar(rng), rand_scalar(rng)
issuer, rec  = account(m_iss), account(m_rec)
M_rec = rec["M"]
k_recv  = rand_scalar(rng)         # the MAILBOX secret: independent of m_rec
pk_recv = mul(G1, k_recv)          # what a payer addresses a note to
tree = IdentityTree()
for a in (issuer, rec):
    tree.insert(a["M"])
print(f"issuer Identity    M_I   = {pt(issuer['M'])}")
print(f"recipient Identity M_rec = {pt(M_rec)}")
print(f"recipient mailbox pk_recv = {pt(pk_recv)}")
print(f"registry root            = {hex(tree.root())[:20]}...")

wallet crypto backend    = kernel (buck_core.buck_identity)
issuer Identity    M_I   = (24518486..., 10011201...)
recipient Identity M_rec = (48294773..., 86086204...)
recipient mailbox pk_recv = (20585238..., 51153208...)
registry root            = 0x274588453a4dd89ec4...

The attack object the lemma constructs: a note spendable by \( D \) whose issuer payload is keyed to a bogus key, satisfying the naive same-key constraint via the free witness.

sk_D, pk_D = rec["sk"], rec["pk"]
M_D        = rec["M"]
pk_bogus   = mul(G1, rand_scalar(rng))
r_n, r_p   = rand_scalar(rng), rand_scalar(rng)

# Free witness absorbs the constraint:  M_rec' = M_D + r_n*(pk_D - pk_bogus)
M_rec_free = add(M_D, mul(add(pk_D, neg(pk_bogus)), r_n))
E_note = (mul(G1, r_n), add(M_rec_free, mul(pk_bogus, r_n)))   # "same key" pk_bogus
eIss   = (mul(G1, r_p), add(issuer["M"], mul(pk_bogus, r_p)))  # also under pk_bogus

assert eq(dec(*E_note, sk_D), M_D)            # note still decrypts for D: spendable
assert not eq(dec(*eIss, sk_D), issuer["M"])  # compelled sk_D cannot name the issuer
print("naive key-equality coupling: SATISFIED by the adversary, yet")
print(f"  E_note decrypts under sk_D to M_D : True   (note spendable by D)")
print(f"  eIss   decrypts under sk_D to M_I : False  (receipt destroyed)")
print("-> binding to 'a key' is vacuous; the binding must reach a REGISTERED identity")

naive key-equality coupling: SATISFIED by the adversary, yet
  E_note decrypts under sk_D to M_D : True   (note spendable by D)
  eIss   decrypts under sk_D to M_I : False  (receipt destroyed)
-> binding to 'a key' is vacuous; the binding must reach a REGISTERED identity

The honest A2 path: the recipient alone produces a receipt naming both parties. The colluding path: an \( eIss \) keyed to a throwaway point decrypts to garbage that is not a registry member – the membership gate has no witness, so the note cannot be spent.

note = mint_unilateral_a2(issuer["sk"], issuer["E"], pk_recv,
                          v=1000, rho=rand_scalar(rng),
                          issuer=0xA11CE, chainid=CHAINID, rng=rng)
receipt = make_receipt(k_recv, M_rec, note, issuer=0xA11CE, chainid=CHAINID,
                       tree=tree, rng=rng)
res = verify_receipt(receipt, issuer["pk"], issuer["E"], tree.root(), tree)
assert res.valid and eq(res.issuer_M, issuer["M"]) and eq(res.recipient_M, M_rec)
print(f"A2 receipt: {res.reason} -- names issuer {pt(res.issuer_M)}")
print(f"            and recipient {pt(res.recipient_M)}, value {res.value}")

# Collusion: key eIss to a throwaway point.
pk_throw  = mul(G1, rand_scalar(rng))
eIss_bad  = elgamal_encrypt(issuer["M"], pk_throw, rand_scalar(rng))
M_garbage = elgamal_decrypt(eIss_bad, k_recv)
print(f"colluding eIss decrypts under k_recv to {pt(M_garbage)}")
print(f"  registered identity? {tree.contains(M_garbage)} -> membership unprovable;"
      f" deposit gate reverts: un-nameable => un-spendable")

A2 receipt: VALID -- names issuer (24518486..., 10011201...)
            and recipient (48294773..., 86086204...), value 1000
colluding eIss decrypts under k_recv to (53767239..., 63884266...)
  registered identity? False -> membership unprovable; deposit gate reverts: un-nameable => un-spendable

The colluders can open a bogus ciphertext of their own (they know its randomness) – but the gate does not take the ciphertext as a public input. It opens the \( idHash \) and recomputes the nullifier from it, and the chain compares that against the nullifier the spend proof consumed. A substituted ciphertext is a different \( idHash \), hence a different nullifier, hence a different note.

from alberta_buck.wallet.notes import id_hash_a2, nullifier

nf_spent = nullifier(note.opening.rho, note.opening.id_hash)

r_bad    = rand_scalar(rng)
eIss_sub = elgamal_encrypt(issuer["M"], pk_recv, r_bad)     # nameable substitute
idh_sub  = id_hash_a2(note.eNote, eIss_sub, note.binding.T)
nf_sub   = nullifier(note.opening.rho, idh_sub)

print(f"spent note's nullifier      = {hex(nf_spent)[:20]}...")
print(f"substituted-note nullifier  = {hex(nf_sub)[:20]}...")
assert nf_sub != nf_spent
print("-> the fold recomputes the nullifier from the idHash it opens, so a")
print("   substituted ciphertext cannot bind THIS spend")

spent note's nullifier      = 0x2df2ed5819b3373096...
substituted-note nullifier  = 0x21d7c61b44d2216b85...
-> the fold recomputes the nullifier from the idHash it opens, so a
   substituted ciphertext cannot bind THIS spend

The minter keeps its binding true of its own identity but aims the key so that the recipient's \( k \) opens the same \( eIss \) to a registered puppet \( M_B \). The committed \( T \) then opens under the minter's key, not the recipient's: the fold's relation (6) would need \( M_B - M_{\mathrm{iss}} \) as a known multiple of \( H \), and the receipt's check names the minter, not the puppet.

from alberta_buck.wallet.nums import H_PEDERSEN as H

M_B     = mul(G1, rand_scalar(rng))                  # the minter's registered puppet
tree.insert(M_B)
r_s, gamma = rand_scalar(rng), rand_scalar(rng)
pk_Q    = add(pk_recv, mul(add(M_B, neg(issuer["M"])), pow(r_s, -1, ORDER)))
eIss_s  = elgamal_encrypt(issuer["M"], pk_Q, r_s)    # the binding speaks of pk_Q
T_s     = add(mul(pk_Q, r_s), mul(H, gamma))         # L3, as the minter proves it
print(f"k opens the split eIss to the puppet:   {eq(elgamal_decrypt(eIss_s, k_recv), M_B)}")
print(f"  and the puppet is registered:         {tree.contains(M_B)}")
tie = add(mul(G1, r_s * k_recv % ORDER), mul(H, gamma))
print(f"fold relation (6) T == r'k*G + gamma*H: {eq(T_s, tie)}")
print(f"  the gap is exactly M_B - M_iss:       {eq(add(T_s, neg(tie)), add(M_B, neg(issuer['M'])))}")
named = add(add(eIss_s.C, neg(T_s)), mul(H, gamma))
print(f"receipt: C_i - T + gamma*H is the minter: {eq(named, issuer['M'])}, "
      f"the puppet: {eq(named, M_B)}")

k opens the split eIss to the puppet:   True
  and the puppet is registered:         True
fold relation (6) T == r'k*G + gamma*H: False
  the gap is exactly M_B - M_iss:       True
receipt: C_i - T + gamma*H is the minter: True, the puppet: False

A1's gate pins the note through its VALUE ciphertext with the face public: \( eNote = (r_n G,\ (v + r_n k) G) \). The face leaves no free plaintext to absorb a re-keying, so a thief holding the WHOLE opening – including \( r_n \) – still cannot produce the witness, because the relation determines \( k \) and the thief does not have it.

from alberta_buck.wallet.unilateral_a1 import mint_unilateral_a1

note_a1 = mint_unilateral_a1(M_rec, pk_recv, v=100, rho=rand_scalar(rng),
                             m_issuer=m_iss, rng=rng)

# The relation the circuit enforces, with v PUBLIC.
u_honest = (note_a1.opening.v + note_a1.r_note * k_recv) % ORDER
print(f"addressed: eNote.C == (v + rn*k)*G ->",
      eq(note_a1.eNote.C, mul(G1, u_honest)))

k_thief = rand_scalar(rng)        # thief holds the whole opening, incl. r_note
u_thief = (note_a1.opening.v + note_a1.r_note * k_thief) % ORDER
print(f"thief:     eNote.C == (v + rn*k')*G ->",
      eq(note_a1.eNote.C, mul(G1, u_thief)))
print("-> the public face pins the plaintext, so only the addressed mailbox key")
print("   closes the relation; relation (3) then pins whose Identity that key is")

addressed: eNote.C == (v + rn*k)*G -> True
thief:     eNote.C == (v + rn*k')*G -> False
-> the public face pins the plaintext, so only the addressed mailbox key
   closes the relation; relation (3) then pins whose Identity that key is

The on-chain halves of every claim are exercised by the repository's suites; the end-to-end lifecycle (real batch mint, real spend, and the real deposit gate, per flavour) reproduces with:

$ make nix-snark-deposit-fold-a1 nix-snark-deposit-fold-a2  # the addressed gates
$ make nix-snark-b1-membership                              # the bearer one
$ make nix-snark-e2e-fixtures                               # all-real-verifier fixtures
$ make nix-match-NotesE2E
[PASS] ... 12 tests: lifecycle, double-spend revert, per-phase gas, x3 flavours