Privacy Rings
Independent on-chain verification of the deployed program: who can change it, what each privileged role can do to user funds, and whether the mainnet program matches the released binary. No fork run, no score.
Three findings
| Upgrade authority | A program-derived address, not a single key. It is off the ed25519 curve, holds no account and has never signed. The last upgrade and the last authority change both went through a 2-of-6 Squads multisig with no time lock. |
|---|---|
| Other authorities | Protocol, tree creation, ring creation and fee rights sit in one program-derived address, a Squads vault of the same multisig; forester rights sit in another program-derived address. None of them can move deposited funds, but they can pause a tree or stall withdrawals. |
| Build | The program deployed on mainnet is byte-for-byte the binary published in the project release, apart from trailing zero padding. |
Program
| Program ID | ring1GaLCuJnkUMVkX2JeZLTTX17wKsV4fZmPVzXANW |
|---|---|
| Loader | BPFLoaderUpgradeab1e11111111111111111111111 |
| ProgramData | CMV9fRyA66cwi1ce4bynyXR9zDU7f99gXZWCUNesp8xr |
| Data length | 641,949 bytes |
| Last deployed | Slot 467,127,839 |
| Read at | Slot 469,218,692 |
Authority history
| Slot | Event | Executed by | Approval |
|---|---|---|---|
| 467,127,839 | Program upgraded | Squads v4 program, multisig BCurTwuv…axXQR, vault Dhf62Dbdd…if7Tr, signer HwSzxkvm…EQPyg. The authority at that slot was the vault, not the current address. | 2-of-6, no time lock |
| 467,408,467 | Authority set to CuZ42…z1FB | Squads v4 program, multisig BCurTwuv…axXQR, vault Dhf62Dbdd…if7Tr, signer HwSzxkvm…EQPyg. | 2-of-6, no time lock |
Multisig BCurTwuvnYmGdRQYwomHBVz8VUuk2BBVirXpaGvaxXQR has six members and needs two signatures; time lock 0. The current authority CuZ42BsoBcLaNTUboJpGhekGmrYMZ7sRhwVki4frz1FB is off the ed25519 curve, holds no account and is not a vault of that multisig, so the program that controls it directly is being identified.
Privileged roles and what they can do
| Role | Holder | Type | Effect on user funds |
|---|---|---|---|
| Upgrade authority | CuZ42BsoBcLaNTUboJpGhekGmrYMZ7sRhwVki4frz1FB | program-derived | Can replace the whole program. No single key can sign for it; the last two changes went through a 2-of-6 Squads multisig. The program that controls it directly is being identified. |
| Protocol authority | Dhf62DbddAc2uDNqnz13W8Z1MpF5MVJ8dvh3Uvhif7Tr | Squads vault | Updates config and can pause deposits or withdrawals on one tree; cannot move user funds. Changes need 2 of 6 signatures. |
| Tree creation | Dhf62DbddAc2uDNqnz13W8Z1MpF5MVJ8dvh3Uvhif7Tr | Squads vault | Creates trees; no path to user balances. |
| Ring creation | Dhf62DbddAc2uDNqnz13W8Z1MpF5MVJ8dvh3Uvhif7Tr | Squads vault | Creates and activates ring configs; no path to user balances. |
| Fee authority | Dhf62DbddAc2uDNqnz13W8Z1MpF5MVJ8dvh3Uvhif7Tr | Squads vault | Sets tree fees; changes what a user pays, cannot move deposits. |
| Forester | B5df3kMmMxwqRUwWPffiECeqAL1ht27G1ES8guKHKi5K | program-derived | Updates the nullifier tree, claims rent and closes nullifier accounts; can stall the withdrawal path, cannot transfer assets. |
Config account EienwBSpsbAetT3RAAMzVA9rB5RHgCF7yTH7FFST6AK5. Flags read: tree creation not permissionless, ring activation not permissionless, SPL interface creation permissionless, next tree id 1.
Build verification
| Release | shielded-pool-v1.0.0 |
|---|---|
| Asset | shielded_pool_program.so, 634,120 bytes |
| SHA-256 | dc68dd2793403f3aa23102cfbaba580eb612def73c05685a7ef99787d08030a2 |
| Published checksum | Matches the asset |
| Deployed prefix | Identical to the asset; remaining 7,799 bytes are zero padding |
What can still change
- The upgrade authority can replace the program at any time. It is a program-derived address, so any change has to pass through the controlling program; no single key can sign for it.
- The protocol authority can pause deposits and withdrawals on a tree.
- The forester can stall the withdrawal path by not updating the nullifier tree.
- The fee authority can change what a user pays.
Evidence
- Phase 1 result JSON
- Build verification JSON
- Test object configuration
- Re-run script
- Program on Solana explorer
This page covers the program and its authorities only. Deposit and withdrawal flows, prover and indexer checks were not run. It is not an audit and not investment advice.