Deployed Contracts

Network

The app talks to Coston2 through flare-testnet.drpc.org rather than the official coston2-api.flare.network endpoint, because the official RPC caps eth_getLogs to a 30-block range — which breaks the note wallet’s history scan outright.

Contracts

ShieldedVault was redeployed (2026-08-17) for an admin-timelock + permissionless-checkpoint-relay redesign: setTrustedVerifier/ setExternalDepositToken now require a queue step, a public 48h delay, then a separate execute step (ADMIN_TIMELOCK_DELAY); setCheckpoint is gone, replaced by a one-time timelocked genesis plus a permissionless, proof-gated extendCheckpoint for every update after — see Bitcoin Bridge. DEFAULT_ADMIN_ROLE on this vault is held by a real, deployed 2-of-3 Safe, not a single EOA — see docs/LIMITATIONS.md #6. Current status: all three one-time bridge-config actions have executed — executeSetTrustedVerifier/executeSetExternalDepositToken (2026-09-01) and the checkpoint genesis bootstrap at signet height 320241 (2026-09-08) — confirmed on-chain. BTC deposits/withdrawals are live on this vault. See the root README’s Status section  if anything here looks stale by the time you’re reading it. Before that, ShieldedVault was separately redeployed (2026-08-11) to add real Bitcoin bridging — depositExternal mints public WrappedBTC directly instead of a hidden note. Every other contract above is unchanged and reused across both redeployments.

ShieldedVault holds the funds, the Merkle tree, and the nullifier set, and calls the per-circuit verifiers. OwnerKeyRegistry, PrivacyKeyRegistry, and StealthAnnouncer are standalone helpers read and written entirely off-chain by clients, and ComplianceRegistry is only consulted by the vault on withdraw.

PrivacyKeyRegistry publishes the secp256k1 key StealthAnnouncer announcements are encrypted to (see Stealth Addresses). A wallet that hasn’t registered here yet falls back to the legacy plaintext/real-address announcement form automatically — nothing else on this page depends on it.

BatchWithdrawer is a permissionless call-forwarder: “Unshield All” proves every selected note locally (no signature needed for that), then submits them all through this contract in one transaction instead of one withdraw() signature per note. It holds no funds — each withdraw() still pays its own recipient directly — and needs no constructor wiring, since it takes the vault address as a call-time parameter. A failing item (a stale root, an already-spent nullifier) doesn’t block the rest of the batch; see BatchWithdrawer.sol.

Assets

The asset ID is what appears inside note commitments — not the token address, which would be a needlessly large field element to hash. BTC is the one asset that doesn’t arrive via shield() — see Bitcoin Bridge for how it mints instead.

Verifiers

One generated Solidity verifier per circuit, all called by ShieldedVault:

• WithdrawVerifier
• PayVerifier
• PlaceOrderVerifier
• CancelOrderVerifier
• MatchOrdersVerifier
• BtcDepositHonkVerifier — checked by depositExternal, not part of the note/commitment scheme the other five belong to; see Bitcoin Bridge
• CheckpointRelayHonkVerifier — checked by the permissionless extendCheckpoint, proving a real 6-header extension of the BTC checkpoint; see Bitcoin Bridge

See Noir Circuits for each one’s public inputs and the order they must be passed in.