Zero-knowledge proofs

Zero-knowledge proofs are what let Murk verify a private action is valid without revealing its details.

What's proven

Every private spend generates a proof asserting, in one shot:

• Ownership — you know the secret behind the note's owner key.
• Membership — the note's commitment really is in the on-chain Merkle tree (proven against a recent root).
• Conservation — inputs equal outputs plus fee; no value is created, and amounts fit in range (no overflow tricks).
• Correct nullifier — the revealed nullifier is the right one-time tag for that note, so it can't be double-spent.
• Correct encryption — the delivered ciphertexts really encrypt the stated output notes.

The proof reveals none of the amounts, mints, or parties — only that all of the above hold.

The system

Murk uses Groth16 proofs over the BN254 curve — compact (a few hundred bytes) and cheap to verify. Verification runs entirely on the Solana program (via groth16-solana), so there are no external verifier nodes to trust. Note commitments and nullifiers use the Poseidon hash (ZK-friendly), and note encryption is Poseidon-ElGamal over BabyJubJub, computed inside the circuit so the ciphertext is bound to the proof.

Where proving happens

Proofs are generated in your browser, in a Web Worker so the UI stays responsive. The proving artifacts (a few MB each) are cached after first use. Nothing about your notes leaves the device during proving.

Trusted setup

Groth16 requires a one-time trusted setup per circuit. The security of the whole system depends on that ceremony being run honestly (no one keeping the "toxic waste"). See Trusted setup & audits for the current status and why it matters.