Skip to content

Contract Analysis

DISCLAIMER // NFA // DYOR

This analysis is based on observations of the contract behavior. We are not smart contract security experts. This document aims to explain what the contract appears to do based on the code. It should not be considered a comprehensive security audit or financial advice. Always verify critical information independently and consult with blockchain security professionals for important decisions.

⊙ generated by robots | curated by humans

Analysis Date: 2026-07-03

Metadata

Primary Contract

PROPERTY VALUE
Contract Address 0x00000000...1da8dB (etherscan)
Network Ethereum Mainnet
Contract Type Standalone, immutable (no proxy)
Deployment Date 2026-07-03 10:25:47 UTC
Deployment Block 25451377 (etherscan)
Contract Creator 0x68575b07...6267c7 (etherscan)
Creation TX 0xb7c84623...5d8c78 (tx)
Compiler Version Solidity v0.8.34+commit.80d5c536 (viaIR, optimizer runs=1, EVM prague)
Total Functions 30 external/public (14 state-changing, 16 view); 0 admin
External Contract Dependencies 4 immutable (SP1 verifier, canonical factory, Bitcoin relay, collateral engine) + N pluggable Collateralized Debt Position (CDP) controllers
Upgrade Mechanism ☒ None — Not Upgradable (no proxy, no admin, all config immutable)
Verification Status ☑ Verified (ConfidentialPool, exact match)
Audit Status ☒ No public audit found at analysis date
TYPE ADDRESS NOTES
SP1 Verifier 0xb69f2584...a6f4e2 (etherscan) Succinct SP1Verifier (verified). Checks every settle + reflection proof.
Canonical Factory 0x00000000...f3bf64 (etherscan) CanonicalAssetFactory (verified). CREATE2-deploys pool-minted ERC-20s (tacBTC, tacUSD, bridged tokens).
Bitcoin Light Relay 0x1677a5a3...2e9094 (etherscan) BitcoinLightRelay (verified). Anchors reflection proofs to canonical Bitcoin.
Collateral Engine 0x00000000...30c97c (etherscan) CollateralEngine (verified). Mutable, DAO-governed cUSD/cBTC CDP policy contract.
tacBTC (cBTC.tac) 0x92987ddc...0FD047 (etherscan) Pool-minted canonical ERC-20; public form of confidential Bitcoin.
tacUSD (cUSD.tac) 0x5Db7f31e...75333C (etherscan) Pool-minted canonical ERC-20; cBTC-collateralized CDP dollar.
Deployer funder 0x1C0Aa8cC...855A20 (etherscan) z0r0z's canonical primary EOA; funded the deployer with 0.0333 ETH.
Deploy factory 0xbfc04675...2b836f (etherscan) CREATE2 vanity factory used to deploy the pool to its 0x0000… address.

Executive Summary

ConfidentialPool is the Ethereum-side of Tacit, z0r0z's confidential-token meta-protocol. Where the earlier Tacit Bridge Mixer was a single-purpose Tornado-style ETH mixer, this contract is the full Phase-1 system: a multi-asset shielded pool that hides amounts on secp256k1 notes (C = v·H + r·G — the same note object as Tacit's Bitcoin layer), plus a confidential Automated Market Maker (AMM), a CDP/stablecoin engine (cUSD), a confidential-Bitcoin representation (cBTC), and a trustless ETH ⇄ Bitcoin bridge.

The central architectural difference from the mixer is that validity is proven by SP1 — Succinct's general-purpose zkVM — rather than by a bespoke Groth16 circuit. The off-chain "guest" program does all the elliptic-curve work (note-commitment membership against the on-chain root, Bulletproofs+ range proofs, per-asset conservation, deposit openings), produces a succinct proof, and this contract verifies it against an immutable program key (PROGRAM_VKEY). The contract itself maintains the note-commitment tree (a 32-level Keccak incremental Merkle tree), the nullifier set, per-asset escrow, and pays the public boundary effects (withdrawals + settler fees). Because SP1's verifier is universal, there is no per-application trusted setup — a departure from the mixer's per-app Groth16 ceremony.

Users wrap ERC-20s or native ETH (or burn a pool-minted canonical token) into pending deposits, which a proof later folds into shielded notes. A single settle(publicValues, proof, memos) entrypoint applies every kind of effect: spend nullifiers, append leaves, pay withdrawals, run AMM swaps and LP moves, open/close/liquidate CDP positions, mint cBTC against reflected Bitcoin locks, and record cross-chain burns. Bitcoin state (which authorizes bridge mints and the cross-lane spent set) is imported trustlessly via attestBitcoinStateProven — an SP1 "reflection" proof re-derived from relayed Bitcoin headers, anchored to canonical Bitcoin through the BitcoinLightRelay and matured six confirmations deep.

There is no owner, admin, pause, fee switch, or upgrade path — every configuration value is fixed in the constructor. That does not mean trust is eliminated; it is relocated to two SP1 guest programs (pinned only by their verification keys — the source is off-chain), the Succinct verifier and its own STARK→SNARK setup, and four external contracts, one of which (CollateralEngine) is explicitly a mutable, DAO-governed policy contract. The contract is one day old and unaudited at analysis; every one of the 23 on-chain transactions is the deployer's own end-to-end self-test. The deployer is funded by, and deploys alongside, z0r0z's canonical EOA — a firmer attribution than the Bridge Mixer's, whose deployer was unlinked.

Architecture

%%{init: {'theme': 'base'}}%%
graph TB
    subgraph users["Participants (all permissionless)"]
        U["User / dapp"]
        S["Settler / relayer"]
        W["Reflection worker"]
    end

    subgraph pool["ConfidentialPool (immutable)"]
        WRAP["wrap / shieldShares<br/>pending deposits"]
        SETTLE["settle<br/>(the one proof entrypoint)"]
        ATTEST["attestBitcoinStateProven<br/>(Bitcoin reflection)"]
        PUB["public AMM periphery<br/>swapPublic / add / remove"]
        REG["asset registry"]
        TREE["note tree + nullifiers<br/>+ lock tree + CDP tree"]
        ESC["per-asset escrow"]
        POOLS["AMM pools (reserves)"]
        BTCST["reflected Bitcoin roots<br/>+ cBTC locks"]
    end

    subgraph ext["External dependencies"]
        SP1["SP1Verifier (Succinct)"]
        FAC["CanonicalAssetFactory"]
        RELAY["BitcoinLightRelay"]
        ENG["CollateralEngine (mutable / DAO)"]
        CTRL["ICdpController(s)"]
        ERC["Canonical ERC-20s<br/>tacBTC / tacUSD / bridged"]
    end

    U --> WRAP --> TREE
    U --> PUB --> POOLS
    U --> REG
    S --> SETTLE
    W --> ATTEST
    SETTLE --> SP1
    ATTEST --> SP1
    SETTLE --> TREE
    SETTLE --> ESC
    SETTLE --> POOLS
    SETTLE --> CTRL
    ATTEST --> RELAY
    ATTEST --> BTCST
    REG --> FAC
    ENG -. reads .-> BTCST
    SETTLE --> ERC
    FAC --> ERC

System Overview

The contract is a set of tightly-coupled subsystems sharing one shielded-note substrate and one proof entrypoint.

  • Maintains a shielded pool of hidden-amount notes: a 32-level Keccak incremental Merkle tree of note commitments plus a nullifier set. Amounts are never revealed on-chain; only a note's later spend nullifier and the public boundary effects (deposits, withdrawals, fees) touch the chain.
  • Runs a confidential constant-product AMM (hidden per-trade amounts cleared at a uniform batch price) alongside a fully public AMM periphery (swapPublic, createPairAndAddLiquidityPublic, removeLiquidityPublicFrom) that shares the same reserves.
  • Operates a CDP engine: confidential positions in a separate accumulator, with all pricing/ratio policy delegated to a pluggable ICdpController (the CollateralEngine), minting the cUSD (tacUSD) stablecoin.
  • Bridges to Bitcoin two ways — bridge_mint (a Bitcoin burn becomes an Ethereum note) and crossOut (an Ethereum note burns for Bitcoin) — with Bitcoin state imported by SP1 reflection proofs, not a trusted oracle.
  • Does not have any owner, admin, pause, upgrade, or fee-extraction path. No privileged key can turn it off or drain it — but it also cannot be patched if an off-chain guest program is found to be buggy.

Design Patterns Used

  • SP1 zkVM validity proofs: rather than a hand-written SNARK circuit, the contract trusts a general-purpose zkVM proof pinned by an immutable PROGRAM_VKEY. Removes per-app trusted setup; shifts trust to the off-chain guest source + Succinct's verifier.
  • Incremental Merkle trees (append-only): three disjoint, domain-separated Keccak trees (notes, adaptor locks, CDP positions) share one zeros[] table and one insert routine, each with its own root and leaf counter.
  • Commit-reveal deposits: wrap records only keccak(Cx‖Cy‖owner) and a public amount; the note is inserted only when a later proof reproduces the commitment and proves it opens to the escrowed value — the wrap-side no-inflation gate.
  • Escrow == supply invariant + reserve floors: every circulating note is backed by escrow touched only at the wrap boundary; defense-in-depth floors (evmNullifiersSpent ≤ nextLeafIndex, AMM MINIMUM_LIQUIDITY, per-pool k-non-decrease) bound a hypothetical guest/vkey compromise to real deposits.
  • Reflection (trustless cross-chain state import): Bitcoin roots are advanced only by an SP1 proof anchored to the BitcoinLightRelay and matured REFLECTION_CONFIRMATIONS deep, forming an append-only digest chain — the on-chain analog of the mixer's confirmation depth.
  • Transient-storage reentrancy guard (Solady ReentrancyGuardTransient, EIP-1153) on every state-changing external entrypoint, with strict checks-effects-interactions ordering around payouts.

Access Control

Roles & Permissions

ROLE ASSIGNED BY REVOKABLE CALL COUNT
Anyone (user / settler / worker) Permissionless N/A Unlimited
Settler (msg.sender in settle) Self-selected per tx N/A Unlimited — receives pv.fees
LP operator approveLpOperator by a share owner Yes — set to address(0) Unlimited while approved
CDP controller Named per-position inside a proof; must be a contract minting only its own derived debt asset N/A Per proof
Collateral engine Immutable pointer set in constructor (the engine itself is mutable/DAO-governed off-pool) No (pointer); engine internals governed externally Read on cBTC mint

There is no owner, admin, minter-admin, pauser, or upgrader role. The only "privileged" position is the immutable engine pointer and the two immutable SP1 verification keys — none held by an EOA.

Permission Matrix

FUNCTION OWNER/ADMIN SETTLER USER ANYONE
wrap / shieldShares ☒ (none) ☑ ☑ ☑
settle / createPairAndSettle ☒ ☑ ☑ ☑
attestBitcoinStateProven ☒ ☑ ☑ ☑
swapPublic / public add/remove ☒ ☑ ☑ ☑
registerWrapped(Auto) / registerMinted ☒ ☑ ☑ ☑
farmEscrow (fund/recover) ☒ ☑ ☑ ☑ (recover gated to funding controller)
Pause / upgrade / withdraw admin ☒ ☒ ☒ ☒ (do not exist)

Time Locks & Delays

ACTION TIME LOCK CAN CANCEL PURPOSE
Bridge mint (Bitcoin burn → ETH note) Yes — burn must be REFLECTION_CONFIRMATIONS (6) Bitcoin blocks deep before it can authorize a mint N/A ◇ Reorg maturity: prevents a shallow Bitcoin reorg from stranding a mint (value duplication)
Adaptor claim vs refund Yes — claim settles at/before the lock deadline, refund strictly after (disjoint windows) N/A ◇ Atomic-swap conditional spend; removes boundary ambiguity
settle / public-AMM ops Optional deadline — proof/op cannot be relayed past its unix expiry N/A ◇ Stops a stale pending tx from executing much later
Owner/admin timelocks None N/A ☒ No admin actions exist to gate

Economic Model

The contract custodies value on behalf of shielded notes and enforces a strict escrow-equals-supply discipline. It collects no protocol fee of its own; the only value transfers to a caller are settler fees the prover explicitly writes into the proof.

Funding Sources & Sinks

  • Inflows: wrap escrows an external ERC-20 or native ETH (or burns a pool-minted canonical ERC-20); public LP adds and swaps escrow their input; farmEscrow funds a controller's reward budget.
  • Outflows: settle withdrawals and settler fees pay out value · unitScale in the note's underlying asset (mint for pool-minted assets, escrow release for escrow-backed assets); public LP removes and swaps pay proportional/curve amounts; farmEscrow recover returns an unspent budget.
  • The guest speaks only in-system value units v (a u64, kept inside the Bulletproofs+ range); the contract multiplies by the asset's trusted unitScale on payout, so the guest — which never sees unitScale — cannot inflate a payout.

Fee Structure

FEE TYPE AMOUNT RECIPIENT PURPOSE
Settler fee Prover-chosen pv.fees (in-system units) msg.sender of settle Pays a third-party relayer to submit the proof; a self-prover sets none
AMM swap fee feeBps ≤ 1000 (10% cap) LPs (accrues in reserves) Standard constant-product LP fee
Protocol/creator fee protocolFeeBps (< 10000) on distinct fee-switch pools A stealth-note recipient set at pool creation Optional Uniswap-style fee-switch; permissionless creator-fee primitive
Protocol take by the contract ☒ None — The contract itself skims nothing

Economic Invariants (enforced on-chain)

  • No-inflation floor: cumulative EVM-homed note-spends (evmNullifiersSpent) can never exceed total EVM leaves created (nextLeafIndex) — a compromised proof cannot spend more notes than were deposited (ReserveFloorBreach).
  • Escrow sufficiency: an escrow-backed withdrawal reverts InsufficientEscrow if escrow[asset] < amount — the contract is fail-closed on any shortfall.
  • AMM floors: MINIMUM_LIQUIDITY (1000 shares) is permanently locked on first add so a pool can never be emptied to an unusable state; every swap must keep the constant product k from decreasing; reserves are bounded to u64.
  • One-shot gates: one bridge mint per burned-note nullifier; one cBTC mint per lock; deposit ids and CDP position leaves are single-use.

Current State (as of analysis)

  • Native ETH balance: 0 (the deployer's 0.0001 ETH test wrap was later unwrapped).
  • escrow[USDC]: 2.0 USDC — a live residual escrow from the self-test.
  • nextLeafIndex: 10 notes created; cbtcBackingSats: 0 (no live cBTC locks reflected).
  • Registered assets: tETH (native), tacBTC, tacUSD (pool-minted), USDC, USDT, wstETH (escrow).

Summary of Observations

ConfidentialPool is the largest and most feature-dense contract in the Tacit line DNZN has analyzed: a single immutable contract that folds a shielded pool, a confidential AMM, a CDP stablecoin engine, a confidential-Bitcoin token, and a two-way Bitcoin bridge into one settle entrypoint gated by an SP1 zkVM proof. The code is heavily commented with the exact invariants it relies on, orders storage slots so off-chain provers can hardcode them, and layers multiple defense-in-depth floors under the proof system (reserve floors, k-non-decrease, escrow-fail-closed, one-shot nullifier gates). The absence of any admin, pause, fee, or upgrade authority removes the usual centralization surface.

The trust does not disappear, though — it moves. Soundness rests on two off-chain SP1 guest programs whose only on-chain fingerprint is an immutable verification key; the contract faithfully checks whatever those programs assert, and if a guest contains a value-conservation bug there is no upgrade path to fix it. Four external contracts are load-bearing, and one of them — the CollateralEngine that prices cUSD/cBTC CDPs — is explicitly a mutable, DAO-governed policy contract, so the CDP subsystem's economics can change under a live position. The Groth16 trusted-setup risk of the mixer is replaced by trust in Succinct's SP1 verifier and its own proving-system setup. On top of all of that, the contract is one day old, carries no public audit, and has been exercised only by its own deployer.

Unlike the Bridge Mixer (whose deployer was not linked to z0r0z), this deployer was funded by z0r0z's canonical EOA and deployed the supporting factory and collateral engine in the same footprint — so the ConfidentialPool sits squarely inside z0r0z's on-chain identity.

This analysis was performed for educational purposes. This is a reading of the verified source and on-chain state — not a security audit or financial advice. The contract's size, novelty, unaudited status, and dependence on off-chain proving programs mean the real risk surface can only be established by professional review of both the Solidity and the SP1 guests. Distrust, and verify.

References

RESOURCE NOTES
Etherscan — ConfidentialPool source Verified source used for the whole analysis
Tacit Project Overview Protocol context — notes, Pedersen commitments, the mixer, Bitcoin layer
Tacit Bridge Mixer Contract Analysis The narrower ETH↔Tacit mixer; contrast in scope and trusted setup
z0r0z entity profile Deployer attribution and modus operandi
SP1 (Succinct) documentation The zkVM whose verifier gates every proof
tacit repository (z0r0z) Upstream meta-protocol source referenced by the pool's comments

Change Log

DATE AUTHOR NOTES
2026-07-03 Artificial. Generated by robots. Gas: 165 tok
2026-07-04 Denizen. Reviewed, edited, and curated by humans.