Hi,
We are building a ZK shielded pool protocol natively on the Internet Computer. The protocol is in late development with a working implementation, a passing integration test suite, and a documented public signal binding specification ready for external review.
What we need
A focused circuit security review of a single spend circuit written in circom 2.x. The circuit uses Groth16 over BN254 and Poseidon hashing (circomlib-compatible instantiation). It is approximately 8,800 constraints.
The review scope is:
- Constraint completeness — are all signals fully constrained, or does the prover have underdetermined degrees of freedom?
- Nullifier derivation soundness — can the same note produce distinct nullifiers?
- Public signal binding — do the public inputs cryptographically anchor what they claim to?
- Range check enforcement — are all necessary range checks present as R1CS constraints, not just assignments?
- Poseidon parameter consistency with the on-chain Rust verifier
This is the vulnerability class that surfaced in the Zcash Orchard disclosure (June 2026) — a missing copy constraint that broke base point binding and enabled undetectable double-spend. We want independent expert eyes on the same class of issue before launch.
What we provide
- Full circuit source
- Public signals specification document
- Proof encoding documentation (snarkjs → Candid)
- Poseidon parameter audit document
- Adversarial test suite for reference
What we’re looking for
Someone with hands-on experience reviewing circom circuits or equivalent R1CS/PLONKish constraint systems. Familiarity with under-constraint classes and ZK soundness properties is the core requirement.
Compensation
Token allocation from protocol reserves. This is a pre-launch project; we are transparent that cash compensation is not available at this stage. The allocation terms are negotiable and will be documented formally. We are happy to discuss scope and fair compensation before any commitment.
Contact
Reply here or DM with a brief note on your background. We will share the circuit and supporting documentation under NDA ahead of any formal engagement.