feat(shielded-pool-extension): PIR + epoch-nullifier extension (PoC) by Meyanis95 · Pull Request #74 · ethsystems/pocs

Meyanis95 · 2026-06-02T14:54:37Z

Implements the (already-reviewed) SPEC.

Here: extended circuits (deposit, chain_update IVC, transfer/withdraw, insertion), ShieldedPoolExt.sol two-proof spend path, the Rust off-chain stack (state replica, bb-prover, alloy adapter, SimplePIR commitment-path client), and a self-contained on-chain e2e (deposit → rollover → two-proof transfer with real proofs, ~50 s).

Test:

cd pocs/private-payment/shielded-pool-extension
forge test && nargo test --workspace && cargo test
cargo test --test integration -- --ignored   # on-chain e2e (~50 s)

Shortcuts (see README): SimplePIR stands in for InsPIRe (no portable Rust impl; not silent-preprocessing); KYC attestation relaxed in the deposit circuit; light-client root verification (Slice 3) and withdraw's k=1 insertion verifier are follow-ups. Research prototype, not production.

… attestation relaxed)

…Ext)

…ier tree

…cursion

…ilder

flow)

…fetch)

oskarth · 2026-06-03T10:34:56Z

+        address withdrawV = address(new WithdrawVerifier());
+        address insertionV = address(new InsertionVerifier());
+        MockERC20 token = new MockERC20("USD Coin", "USDC", 6);
+        // withdrawInsertionVerifier (k=1) has no circuit yet; reuse the k=2


This wires the k=2 InsertionVerifier into the withdrawInsertionVerifier slot. withdraw() supplies only one nullifier to _verifyInsertionAndAdvance, so the verifier receives 4 public inputs, but the generated k=2 insertion verifier expects 5 (NUMBER_OF_PUBLIC_INPUTS - PAIRING_POINTS_SIZE). With this deployment, any real withdraw path will revert inside the verifier before returning false.

Since the README/contract describe withdraw as part of the spend path, this should either deploy a real k=1 insertion verifier or keep withdraw out of the real-verifier deployment until that circuit exists.

rymnc

general pass; didn't inspect logic too deeply, focused on minor things

will do a bigger review a little later today or tomorrow

rymnc · 2026-06-03T13:30:04Z

+/// by feeding it directly into the commitment preimage, so a deposit always
+/// mints a note tagged with the live epoch.
+///
+/// Implementation shortcut: the parent's KYC attestation-membership check is


why is this a shortcut, seems simple enough to add here

rymnc · 2026-06-03T13:31:34Z

+///      Forge auto-deploys + links the contract libraries (ZKTranscriptLib in the
+///      verifiers; PoseidonT3 + LeanIMT in the pool). Writes `deployments.toml`
+///      for the test to read.
+contract Deploy is Script {


this is not how the deployments.toml is generated, this deploy script should inherit Config, see https://github.com/ethereum/iptf-pocs/blob/b2d47a1a33b6086b853beec844f8dce693b94d48/pocs/civic-participation/resilient-civic-participation/contracts/script/Deploy.s.sol#L18

rymnc · 2026-06-03T13:33:41Z

do we need this file?

rymnc · 2026-06-03T13:36:44Z

+        IShieldedPoolExt::new(self.pool, &self.provider)
+    }
+
+    fn convert_receipt(receipt: &alloy::rpc::types::TransactionReceipt) -> TxReceipt {


maybe replace with

impl From<alloy::rpc::types::TransactionReceipt> for TxReceipt { fn from(alloy_receipt: alloy::rpc::types::TransactionReceipt) -> Self { /// whatever code u have here } }

rymnc · 2026-06-03T13:37:31Z

+//! PoC note: `root()` and `merkle_path()` recompute the occupied levels on each
+//! call (O(occupied) hashing); fine at PoC scale, not optimized for Visa-scale
+//! epochs.
+//!


what is the suggested solution for this? would be nice to include it with the comment

rymnc · 2026-06-03T13:45:35Z

+/// PoC: the cleartext adapter sends the leaf index to the server, which learns
+/// it. Slice 2 swaps in a real PIR backend that computes the sibling-node offsets


what is slice 2? probably not best to send leaf index to the server

rymnc · 2026-06-03T13:45:40Z

rymnc · 2026-06-03T13:47:12Z

+pub trait RootVerifier {
+    /// Verify `proof` (an `eth_getProof` result for one slot) and return the
+    /// verified storage value.
+    fn verify_storage(&self, proof: &EIP1186AccountProofResponse) -> Result<alloy::primitives::B256, RootVerifierError>;
+}


just an engineering note: ports should rely on types declared in the same file, or in the domains module. here we are depending on an external crate in the args and return type; and here you are creating a contract that the adapter has to use this crate too - fine for poc, but something to note

rymnc · 2026-06-03T13:48:29Z

@@ -0,0 +1,82 @@
+//! Light-client root-verification integration test (Slice 3).


can we remove comments with "Slice *", confusing to read

rymnc · 2026-06-03T13:48:44Z

+const DEV_KEY: &str = "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80";
+
+#[tokio::test]
+#[ignore = "spawns anvil; run with --ignored"]


we should remove this #ignore attribute

…om impl, zeroize, Config deploy

…on-chain e2e

Meyanis95 · 2026-06-03T20:38:15Z

Thanks for the pass! Pushed 2 commits (e403c07, 4a75622) addressing this round.

@oskarth (withdraw insertion verifier): Fixed. Pulled the insertion loop into a shared insertion_core lib generic over the insertion count, instantiated at k=2 (insertion) and k=1 (insertion_withdraw), generated the real WithdrawInsertionVerifier, and wired it into the withdraw slot. Added a withdraw_flow_verifies_on_chain e2e: a real on-chain withdraw through the k=1 verifier now passes (it reverted inside the k=2 verifier before).

@rymnc (resolved in code): deleted the 5 unused stub files; removed the "Slice N" comments; convert_receipt became impl From<TransactionReceipt>; zeroize on SpendingKey; Deploy.s.sol now inherits the forge-std Config base; added the production fix to the indexed_merkle_tree note.

@rymnc (answers to the questions/notes):

KYC shortcut: this extension composes with (doesn't replace) the parent. Attestation is orthogonal to the PIR/epoch-nullifier work and stays fully enforced in the parent's deposit circuit. Sharpened the comment + README.
salt [5..]: impl choice. 27 random bytes stay < BN254 without rejection sampling; the SPEC only requires a random Field. Comment clarified.
ciphertext size: the encrypted note rides in the event log (not storage); mitigations are a compact format / off-chain note log + FMD-OMR. Comment added.
Commitment/Epoch pub fields: kept as transparent domain newtypes (the pub field is the construction + .0 access used throughout). Happy to add accessors if you'd prefer.
root_verifier external type: agreed a domain proof type is cleaner; kept the alloy type for PoC pragmatism for now.
#[ignore] on the light-client test: kept. It spawns Anvil like the proving/e2e tests, and CI runs no cargo tests so it wouldn't run there regardless (--ignored to run it locally).

Meyanis95 added 20 commits June 1, 2026 14:50

feat(shielded-pool-extension): scaffold + epoch-bound primitives

8192142

feat(shielded-pool-extension): extended deposit circuit (epoch-bound,…

9457329

… attestation relaxed)

feat(shielded-pool-extension): minimal deposit contract (ShieldedPool…

5298d35

…Ext)

feat(shielded-pool-extension): epoch rollover + indexed Merkle nullif…

733c149

…ier tree

feat(shielded-pool-extension): state-replica core + cleartext PIR seam

e26c636

feat(shielded-pool-extension): IVC chain-update circuit + Noir 1.0 re…

c4add26

…cursion

feat(shielded-pool-extension): spend circuits (transfer + withdraw)

85cadbf

feat(shielded-pool-extension): insertion circuit + relayer witness bu…

2c098f5

…ilder

feat(shielded-pool-extension): two-proof transfer spend path

df64972

feat(shielded-pool-extension): withdraw two-proof spend path

0d083b5

feat(shielded-pool-extension): generate real on-chain verifiers

d64197c

feat(shielded-pool-extension): domain proof + witness types

e6b9aee

feat(shielded-pool-extension): recursive EVM transfer proving

8edb017

feat(shielded-pool-extension): EVM deposit + insertion proving

efdb4e4

feat(shielded-pool-extension): in-process e2e (rpc + deploy + transfer

98068be

flow)

feat(shielded-pool-extension): SimplePIR primitive (oblivious record …

82fda4c

…fetch)

feat(shielded-pool-extension): tree-pir commitment-tree flattening

9710c98

feat(shielded-pool-extension): SimplePIR commitment-path client

80c186d

test(shielded-pool-extension): PIR no-index-leakage test

0606e53

feat(shielded-pool-extension): Light client mockup

3d3bcfb

Meyanis95 requested review from oskarth and rymnc June 2, 2026 16:18

oskarth reviewed Jun 3, 2026

View reviewed changes

rymnc reviewed Jun 3, 2026

View reviewed changes

Meyanis95 added 2 commits June 3, 2026 15:48

chore(shielded-pool-extension): address review comments — cleanup, Fr…

e403c07

…om impl, zeroize, Config deploy

fix(shielded-pool-extension): real k=1 withdraw insertion verifier + …

4a75622

…on-chain e2e

Meyanis95 requested review from oskarth and rymnc June 4, 2026 13:03

rymnc approved these changes Jun 4, 2026

View reviewed changes

Meyanis95 merged commit 00130c8 into master Jun 5, 2026
2 checks passed

Meyanis95 mentioned this pull request Jun 25, 2026

feat(pir_shielded_pool): PoC proposal, PIR for shielded pools (path retrieval & note discovery) #68

Closed

		/// PoC: the cleartext adapter sends the leaf index to the server, which learns
		/// it. Slice 2 swaps in a real PIR backend that computes the sibling-node offsets

		@@ -0,0 +1,82 @@
		//! Light-client root-verification integration test (Slice 3).

Uh oh!

Conversation

Meyanis95 commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rymnc left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rymnc Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Meyanis95 commented Jun 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Meyanis95 commented Jun 2, 2026 •

edited

Loading

rymnc Jun 3, 2026 •

edited

Loading