Search
Search for projects by name or address
Payy
Badges
About
Payy is a payments-focused ZK network for private stablecoin transfers, settled on Ethereum with aggregated validity proofs and validator signatures, while transaction data is kept offchain.
Badges
About
Payy is a payments-focused ZK network for private stablecoin transfers, settled on Ethereum with aggregated validity proofs and validator signatures, while transaction data is kept offchain.
Payy is a payments-focused ZK network, designed around private stablecoin transfers. Ethereum receives only state roots and the public deposit and withdrawal messages of each state update. Balances live offchain as UTXO-style notes whose commitments form a sparse Merkle tree maintained by the Payy validators.
Privacy considerations
To spend notes, the user’s client generates a Noir utxo proof that demonstrates ownership of the input notes and conservation of value; the public inputs of that proof are the commitments of the two notes consumed and the two notes created. Transfers therefore hide who paid whom and how much, but they do not hide which commitments were consumed: the deployed circuits do not use nullifiers, and a spend names its input commitments directly, which the node then marks as spent. Anyone with Payy block data can follow the resulting spend graph.
Because only commitments are stored in the tree, a recipient cannot reconstruct a received note from chain data alone: the sender must transmit the note contents out of band. In practice it is done by an encrypted registry operated by Payy, which stores the recipient’s public key in the clear and serves each client the entries addressed to it. Thus it learns the delivery metadata even though it cannot read note contents.
Fees
The protocol charges no transfer or withdrawal fee.
Compliance
The deployed protocol enforces no compliance measures and contains no auditor key, view key or other mechanism that could retroactively decrypt past activity. Identity data is collected at the application layer: KYC is required for the Payy card and fiat ramps, but it is not necessary for using Payy L2.
Anonymity set
Payy hides the contents of each note but not the links between notes, so its anonymity set should not be read as the set of all users. An observer of Payy block data sees a graph of opaque commitments; privacy rests on not knowing which address, asset or amount each node in that graph carries.
What the protocol promises: Promises private stablecoin transfers. Delivers hidden amounts and note owners over a public spend graph: which notes fund which, and every deposit and withdrawal, is public.
On public blockchains like Ethereum, all actions transparent by default. A privacy protocol can at best cut the link between addresses or offer privacy while deposited. The colour says whether a careful user can keep the link, amount or recipient private against that adversary: green yes, yellow only outside supported options or by accepting another leak, red no. Fields marked at risk stay private only under the condition in their note.
Every transaction names the notes it spends and creates, so which notes fund which is public by design; only the amount and owner of a note are hidden. Empty padding notes have a zero commitment, so single-input and single-output transactions are recognizable. All blocks and proofs are served openly, and each deposit or withdrawal shows address and amount and points at one node of that graph. The per-transaction proofs use a flavor whose authors document that it is not zero-knowledge; how much of a note it leaks is not established.
Advice: Withdraw to an address that cannot be tied to you, and never an amount that matches a deposit.
Along a path without splits or merges the public deposit and withdrawal amounts fix every amount in between, and the graph shows who paid whom end to end. Each wallet has one fixed deposit address, so all its deposits link to each other and to whoever funded them.
Advice: Keep funds in the network across many transfers; only a split or merge stops amounts from being inferred. Fund the deposit address from a wallet that is not yours to keep.
Proofs are built on your device and the app talks only to the operator's servers. The payment-link website is different: it loads a third-party analytics script that records the page URL, which holds the redeem secret of the link, and reports a device fingerprint to the backend.
Advice: Redeem payment links in the app, not in a browser.
One company runs the only validator and prover, the node, the note registry, the deposit relayer and the KYC checks. Its backend ties each session to a wallet address and keeps, per wallet, the deposit address, KYC record, country, IP country and the commitment and owner of every note the app reports; its diagnostics table has a field for the recovery phrase. For payment links and fiat ramps it holds the notes' private keys and can read and spend them. It can drop your withdrawals, and its owner can rewrite the state root with no delay.
Advice: Use only ordinary transfers for anything you want to keep private. Links, ramps and the card hand the operator the note keys.
Every per-transaction proof is public forever and not zero-knowledge, so whatever it leaks stays available to future compute, and a discrete-log break opens the commitments inside it. Registry ciphertexts use elliptic-curve key exchange; if the operator retains them, a quantum computer opens every note delivered through it.
Advice: Receive notes in person rather than through the registry where the app allows it.
Funds can be stolen if
- the proof system is broken and a malicious validator is registered, allowing forged spends or withdrawals.
- the PayyMultisig upgrades the Rollup contract or directly overwrites the state root to a malicious version.
Funds can be lost if
- a user loses the note data or the keys required to spend their notes.
- the offchain transaction data becomes unavailable, as data availability is not verified on Ethereum.
- the operators stop including withdrawals in proven state updates, as there is no forced exit mechanism.
Privacy can be lost if
- the Payy-operated note registry, note lookup or wallet backup services are compromised or their records are disclosed, revealing which addresses receive and hold which notes and who transacted with whom.
All privileged functions are ultimately controlled by the PayyMultisig (2/4). It owns the ProxyAdmin, which can instantly upgrade the Rollup proxy, and it is the owner of the Rollup contract, allowing it to manage provers, validators, ZK verifiers, supported tokens and burn substitutors, and to directly overwrite the state root via setRoot(). There is no timelock or exit window on any of these actions.
Aztec Ignition
Detailed description
Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.
- Github repo to download and verify the ceremony artifacts: https://github.com/AztecProtocol/ignition-verification.
- Github repo with instructions for ceremony participants: https://github.com/AztecProtocol/Setup.
- Ceremony announcement with a call to participate: https://aztec.network/blog/announcing-ignition.
2026 August 25, 10:47 UTC4changesDiscovery rerun on the same block number with only config-related changes.
Discovery rerun on the same block number with only config-related changes.
Initial discovery
| + | Status: CREATED |
| contract HonkVerifier (eth:0x14DACD534ddc676601B27f41Eb541a7951524a2F) [payy/HonkVerifier] | |
| +++ description: UltraHonk proof verifier generated with Aztec's Barretenberg from Payy's final aggregation Noir circuit. It verifies the aggregated validity proof of each state update submitted to the Rollup contract. | |
| + | Status: CREATED |
| contract PayyMultisig (eth:0x230Dfb03F078B0d5E705F4624fCC915f3126B40f) [GnosisSafe] | |
| +++ description: None | |
| + | Status: CREATED |
| contract RollupV1 (eth:0x367C1eAF14AA06b78ce76bd0243297de79d85270) [payy/Rollup] | |
| +++ description: Main contract of the Payy ZK rollup. It stores the state root, escrows USDC backing the notes on the rollup, processes deposits (mints) and withdrawals (burns), and accepts state updates that must include an aggregated ZK proof and signatures from more than 2/3 of the current validator set. | |
| + | Status: CREATED |
| contract ProxyAdmin (eth:0xfE455baCAF1968F1Ae6a322b8Ffbe56840e2f590) [global/ProxyAdmin] | |
| +++ description: None | |
Ethereum
Actors:
A Multisig with 2/4 threshold.
- Can upgrade with no delay
- RollupV1 ProxyAdmin
- Can interact with RollupV1
- can manage provers, validators, ZK verifiers, supported tokens and burn substitutors, and can overwrite the current state root via setRoot()
- Can interact with RollupV1
- can submit state updates (new state roots) via verifyRollup(), providing an aggregated ZK proof and validator signatures
Ethereum
UltraHonk proof verifier generated with Aztec’s Barretenberg from Payy’s final aggregation Noir circuit. It verifies the aggregated validity proof of each state update submitted to the Rollup contract.
Main contract of the Payy ZK rollup. It stores the state root, escrows USDC backing the notes on the rollup, processes deposits (mints) and withdrawals (burns), and accepts state updates that must include an aggregated ZK proof and signatures from more than 2/3 of the current validator set.
- Roles:
- admin: ProxyAdmin; ultimately PayyMultisig
- getValidatorSets: EOA 1
- initialProver: EOA 2
- owner: PayyMultisig
All supported tokens in this escrow are included in the value secured calculation.
- Roles:
- owner: PayyMultisig
The current deployment carries some associated risks:
Funds can be stolen if a contract receives a malicious code upgrade. There is no delay on code upgrades (CRITICAL).