Project Summary
Wake-v1 is a custom Halo 2 circuit for note lineage: it lets the user who receives a layer two zcash shielded asset check, from the chain, that the note in their hand descends from the issuer’s original note. It needs no trusted setup and no consensus change. The proofs travel inside the transfer itself, so no server stands between the sender and receiver. Wake-v1 ships in Zecboat 0.7.1-beta today; this grant takes it through an independent review to a wallet that can say “verified”.
Proposed Solution
Wake answers the receiver’s question with a zero-knowledge proof for each transfer, and reveals no key and no amount.
In Orchard, every output note carries a value ρ. It equals the nullifier, the public mark a spent note leaves, of the note spent in the same action. For each hop, Wake proves that the previous holder knew a note whose commitment is in the note commitment tree at a stated anchor. It also proves that the nullifier derived from that note’s own keys equals the ρ of the next note. Chained back to the genesis outputs named in the issuer’s closed registry, the proofs show the note in hand descends from an original unit.
The chain of proofs is the unit’s “lading”. It travels inside the transfer itself. The Knotline writes one knot per transfer: the newest proof, sealed to the receiver, in the memos of the same transaction. The transfer memo commits to the lading’s hash. A sealed file moved by hand is the only fallback.
The receiver’s wallet reads the line back from the chain and verifies it. It checks that the anchors exist at the stated heights, that the nullifiers are on chain, and that the first note is a registered genesis output. It checks that the last ρ matches the note in hand, and that every proof verifies under a pinned key. The proofs are checked on the receiver’s machine. The chain’s answers come from their own node, or from their light server when they run none.
Design choices a reviewer will care about:
Wake-v1 is a Halo 2, so there is no trusted setup. It uses the same proof system and curves as Orchard.
The circuit is derived by deletion: orchard’s Action circuit with 247 code lines removed, one constraint added and one made unconditional. There are two circuits (WAKE_HOP, WAKE_GENESIS) at K = 11, differing in that one constraint. The diff is in the repository. Every constraint has a failing test. Ten attacks are each caught by exactly one named constraint, shown by building the circuit with that constraint removed. The verifying keys are pinned. The wallet refuses proofs under any other key. The status is stated honestly. Until an external review is published, the wallet shows lineage in amber as “Lineage checks out · your own node awaiting external review”, never as “Verified”. Checked through a light server it says “your provider” instead, and the specification (WAKE §8.1) forbids presenting a provider’s word as more.
Budget: $61 400
