Circuits & proofs

Every private action carries a zero‑knowledge proof that it's valid, and the Solana program verifies that proof on‑chain. There is no trusted off‑chain verifier — what can be proven is what can happen.

The building blocks

• Groth16 over BN254 — compact proofs (a few hundred bytes) that are cheap to verify, checked on Solana with the groth16-solana verifier.
• Poseidon — a hash function designed for zero‑knowledge circuits; used for note commitments and nullifiers.
• BabyJubJub + Poseidon‑ElGamal — the in‑circuit encryption that seals each note's contents to the owner's viewing key.

The same math is implemented three times — in the circuits, in the on‑chain program, and in the wallet — and pinned together by shared test vectors so all three compute byte‑identical results.

What a proof actually shows

Each private action proves, in zero knowledge:

• You own the inputs — the notes you're spending exist in the pool and are yours.
• Value is conserved — outputs plus fee equal inputs; nothing is created or destroyed.
• No double‑spend — each spent note reveals a unique nullifier that can't be linked back to it.
• Clean origin — the funds descend from an approved source (Compliant privacy).

The amounts, the owners, and which notes are involved are all private inputs — used inside the proof, never published.

Murk uses classical cryptography (Groth16 / BN254 / Poseidon / BabyJubJub). It is not post‑quantum, which is a deliberate scope choice.