# Railgun Markdown version of https://l2beat.com/privacy/projects/railgun ## Summary - Total Value Locked: $109.97 M (+1.86% compared to seven days ago) - Assets tracked: 8 - Buckets tracked: 8 - Deposits 7D: 1.02 K (+1.88% compared to the previous seven days) - Deposits 30D: 4.11 K - Deposits Total: 70.14 K - Avg. Relayers 30D: 79 - Tracked on: Ethereum - Attributes: ZK, Transfers, DeFi, Any amount ### Risks - Privacy: Link privacy. Public observer: Link private (sentiment: good); Chain analyst: Link private (sentiment: good); Network observer: Link private (sentiment: good); Privileged insider: Link private (sentiment: good); Future adversary: Link at risk (sentiment: warning). - Trusted setup: 55 participants (sentiment: warning). Railgun: Circuit-specific trusted setup for 54 Groth16 Railgun circuits over BN254. It was built on top of 55 phase 1 contributions, with 304 phase 2 participants. Proving system could be broken if either phase 1 or 2 is compromised. - Exit window: 7d (sentiment: warning). DAO-approved upgrades wait 7d before execution, so users can unshield before a change they reject. This protocol passes the walkaway test: users can still fully use it if every centralized participant disappears. - Reproducibility: Reproducible (sentiment: good). The contracts, circuits, and supporting software needed to participate in the protocol are publicly available and can be run locally. ### About A shielded ledger on Ethereum for ERC-20 tokens, with private transfers and DeFi calls, run by no operator and governed by RAIL stakers. ### Links - Website: https://railgun.org - Contracts explorer (Disco): https://disco.l2beat.com/ui/p/railgun ## Protocol description Railgun lets the user shield tokens on Ethereum, send them privately to other Railgun users, use them in DeFi and unshield them to any address. Sender, recipient, token and amount stay hidden inside the pool, including which shield funds which unshield. Shields and unshields are public. No operator holds a key into the pool. RAIL stakers govern the core contract through a DAO, whose upgrades wait 7 days. Leaving is permissionless: the user can submit their own unshield at any time. ### Architecture Balances are encrypted notes in a public tree of commitments. Spending a note publishes its nullifier, and a zk-SNARK proves the spend without revealing which note it was. Each note is encrypted to the recipient's 0zk address. ### Flow 1. **Shield.** You send tokens to the pool, which creates a note for your 0zk address. Your address, token and amount are public. 2. **Transfer.** Your wallet proves the spend locally. A [broadcaster](https://docs.railgun.org/developer-guide/wallet/transactions/unshielding), reached over the [Waku network](https://blog.waku.org/2024-04-26-railgun-case-study/), submits it and pays the gas for a fee paid in a private note. 3. **DeFi.** The RelayAdapt contract unshields tokens, runs the calls and shields the results back in one transaction. Tokens and amounts of the calls are public. 4. **Unshield.** The pool pays out to any address. Recipient, token and amount are public. ### Keys The user's wallet derives spending and viewing keys from a recovery phrase. The user can share a read-only viewing key, which discloses all their private transactions. ### App Railgun names no reference wallet, so the ratings assume [RailOxide](https://github.com/triamazikamno/railoxide). It routes all traffic through built-in Tor and builds Private Proofs of Innocence (PPoI) from a local copy of the lists. Other wallets likely leak significantly more. ### Compliance Screening happens offchain. A [PPoI](https://docs.railgun.org/wiki/assurance/private-proofs-of-innocence) proves that a note descends only from shields a list provider accepted. The default list screens shields with Chainalysis's sanctions API. Broadcasters on Ethereum require a PPoI, and a transaction the user submits directly skips the check. ### Fees Shields pay a protocol fee of 0.25% and unshields 0.25%, both to the Railgun Treasury. The NFT fee is 0. Broadcasters charge their own fee per transaction. ### Anonymity set Each token has its own anonymity set. Private transfers between users mix their notes within it. ## Privacy **What the protocol promises:** Hides everything inside the pool, including which shield funds which unshield. Shields and unshields are public. Ethereum is public by default. Each protocol is rated on its main privacy promise, like hiding who paid, who received, how much, or which deposit became which withdrawal. Against each adversary, the colour says whether it holds for a careful user with the app's own settings: green yes, yellow only with significant extra work, red no. Fields marked at risk stay private only under the condition in their note. ### Public observer Link private (sentiment: good) **Who:** Everyone with a block explorer and some basic tools. Sees every public onchain event, but does no correlation beyond following links. Examples: A curious counterparty, an employer, a journalist. Everything inside the pool is hidden, including which shield funds which unshield. Shields and unshields show address, token and amount. DeFi bundles unshield to the adapter in cleartext. **Advice:** Exit through a broadcaster, so none of the user's wallets pay gas for the receiving address. **Inside** - Sender: private - Recipient: private - Amount: at risk. Public in DeFi bundles. - Asset: at risk. Public in DeFi bundles. - Link: private **Sources** - [Shield and unshield](https://l2beat.com/privacy/projects/railgun#RailgunSmartWallet) - [DeFi bundles](https://l2beat.com/privacy/projects/railgun#RelayAdapt) ### Chain analyst Link private (sentiment: good) **Who:** Scrapes all public data and correlates it: timing, amounts, gas and wallet fingerprints, address clusters. Examples: Chain analytics firms, ZachXBT, data brokers. The candidates for an unshield are the shields of the same token. In-pool transfers break a one-to-one match, while timing and exact amounts narrow it. **Advice:** Withdraw common amounts rather than everything at once. Wait before exiting and pick a different time of day than the deposit. Exit to a fresh address every time and spend from it with a different wallet than the one that deposited. Inside, the same as for a public observer. **Sources** - [A Tattered Cloak of Invisibility (arXiv:2606.25926)](https://arxiv.org/abs/2606.25926) - [The Anonymity Gap (arXiv:2608.22987)](https://arxiv.org/abs/2608.22987) ### Network observer Link private (sentiment: good) **Who:** Sits between the user and the services and sees traffic only: ISPs, VPNs, Tor exits, public RPCs and relayers. Learns IP addresses, timing, fingerprints and ciphertext. Services the operator runs count as the insider. Examples: Infura or Alchemy, a Tornado relayer, a wallet vendor selling telemetry, Google captcha or analytics in the dapp frontend. RailOxide sends all traffic over built-in Tor, broadcaster messages included, and finds the user's notes by decrypting every note locally. All traffic shares one Tor session, so the public RPCs it picks at random see the user's public addresses, shields and the gas estimate of each private transaction from one exit. The user's own node as its RPC keeps these from third parties. **Advice:** Use RailOxide, the wallet these ratings assume, and set the user's own node as its Ethereum RPC. **Inside, compared with a public observer** - Link: at risk. Private only with the user's own node as RPC, over the default Tor. **Sources** - [Built-in Tor is the default](https://github.com/triamazikamno/railoxide/blob/8773f4ecb00c6ac7cf164ba1f989eb77dd4b0ec5/crates/wallet-ops/src/settings/network_chains.rs#L10-L15) - [Every stream uses one Tor session](https://github.com/triamazikamno/railoxide/blob/8773f4ecb00c6ac7cf164ba1f989eb77dd4b0ec5/crates/wallet-ops/src/http.rs#L1549-L1559) - [A custom RPC list replaces the public pool](https://github.com/triamazikamno/railoxide/blob/8773f4ecb00c6ac7cf164ba1f989eb77dd4b0ec5/crates/wallet-ops/src/settings/effective.rs#L263-L277) ### Privileged insider Link private (sentiment: good) **Who:** Holds an operator role, custodies funds, receives keys or plaintext by design, or delivers the client: upgrade admin, custodian, view key holder, enclave operator, association set provider, hosted prover, registry, frontend host. Examples: A compliance backdoor key, a DAO with an upgrade key, a KMS committee, an ASP operator, a custodial bridge. Only the user holds viewing keys, and DAO upgrades wait 7 days. PPoI list providers can refuse a shield, which leaves a self-broadcast exit. RailOxide builds PPoIs from a local copy of the lists. After each transaction it sends the PPoI node only that transaction's new notes with their proofs. **Advice:** Watch governance proposals and unshield before an upgrade the user rejects executes. **Inside, compared with a public observer** - Link: at risk. Private only with a wallet that builds PPoIs locally, like RailOxide. **Sources** - [Upgrades & Governance](https://l2beat.com/privacy/projects/railgun#upgrades-and-governance) - [RailOxide builds PPoIs locally](https://github.com/triamazikamno/railoxide/blob/8773f4ecb00c6ac7cf164ba1f989eb77dd4b0ec5/crates/wallet-ops/src/poi_contexts.rs#L116-L150) ### Future adversary Link at risk (sentiment: warning) **Who:** Harvest now, decrypt later. Holds every byte ever published and runs the known quantum attacks: elliptic curves, pairings and RSA fall. Hashes, symmetric ciphers and post-quantum schemes stand until an attack on them is known. Examples: An intelligence agency archiving chain data today, then anyone once a break is public. Notes are encrypted with elliptic-curve key exchange. Whoever breaks elliptic-curve cryptography decrypts every note sent to a 0zk address that was ever shared, broadcaster fee notes included. **Advice:** Share the user's 0zk address privately, with a fresh one per counterparty where possible. **Inside, compared with a public observer** - Sender: at risk - Recipient: at risk - Amount: at risk - Asset: at risk - Link: at risk. Private only while the user's 0zk address stays unshared. **Sources** - [Shared key derivation (Ed25519 ECDH)](https://github.com/Railgun-Community/engine/blob/6e2614d53a106dd62abad91e7ce03ee4a3956138/src/utils/keys-utils.ts#L186-L224) - [AES-GCM note encryption](https://github.com/Railgun-Community/engine/blob/6e2614d53a106dd62abad91e7ce03ee4a3956138/src/utils/encryption/aes.ts#L24-L40) ## Value Locked The interactive value chart is shown on [the HTML page](https://l2beat.com/privacy/projects/railgun#privacy-tvl). ## Anonymity sets ### 30 day historic anonymity set How many unique depositors you could have blended in with if you withdrew on a particular day after depositing during the previous 30 days. This metric is a proxy for the historic anonymity set and shows how it developed over time. The metric looks backwards: it counts deposits that already happened, including from addresses that have since withdrawn. Your real anonymity also depends on deposits made after yours, which cannot be known in advance. ### Estimated anonymity set by holding duration An estimate of how many unique depositors you blend in with, depending on how long you leave your deposit in the pool. It is based on historic data of past deposits: each point counts depositors from the preceding period, so holding for up to 30 days effectively means blending in with everyone who deposited during the last 30 days. The interactive charts are shown on [the HTML page](https://l2beat.com/privacy/projects/railgun#privacy-anonymity-set). ## Flows The interactive flows chart is shown on [the HTML page](https://l2beat.com/privacy/projects/railgun#privacy-flows). ## Assets Breakdown | Asset | Deposits 7D | Deposits 30D | Deposits Total | Value Locked | | --- | --- | --- | --- | --- | | WETH | 473 ($3.56 M) | 1.95 K ($14.97 M) | 44.98 K ($1.52 B) | $49.70 M | | USDT | 380 ($6.27 M) | 1.53 K ($41.86 M) | 12.35 K ($420.05 M) | $30.65 M | | USDC | 157 ($2.37 M) | 542 ($12.26 M) | 9.60 K ($305.39 M) | $16.81 M | | DAI | 11 ($41.28 K) | 46 ($1.03 M) | 2.17 K ($197.05 M) | $4.99 M | | NEAR | 0 ($0.00) | 0 ($0.00) | 0 ($0.00) | $4.35 M | | WBTC | 3 ($360.69 K) | 15 ($410.12 K) | 668 ($41.84 M) | $2.69 M | | RAIL | 4 ($382.20) | 22 ($5.36 K) | 349 ($3.69 M) | $741.29 K | | FLUID | 0 ($0.00) | 0 ($0.00) | 2 ($1.55 M) | $219.82 K | | Total | 1.02 K ($12.62 M) | 4.11 K ($70.55 M) | 70.14 K ($2.49 B) | $110.19 M | ## Milestones & Incidents - 2022-05-08: [Current pool goes live on Ethereum](https://etherscan.io/tx/0x2bd98cd135e2eaf7b7239bb4951a043f655629b5d0f0ca12334ce05718512361). The proxy that holds today's pool is unpaused with the RailgunLogic implementation. ## Risk summary ### Funds can be stolen if 1. the zk proof system is broken, allowing invalid spends or withdrawals. 2. all [trusted setup](https://l2beat.com/privacy/projects/railgun#trusted-setups) participants collude or leak their secrets, allowing forged proofs. 3. the DAO passes a malicious [upgrade](https://l2beat.com/privacy/projects/railgun#upgrades-and-governance) and users stay in the pool past its 7 days execution delay. ### Funds can be lost if 1. a user loses the keys of their private balance. ### Privacy can be lost if 1. a user sends transactions from their own public address (see public observer). 2. elliptic-curve cryptography is broken, which decrypts every note sent to a 0zk address that was ever shared (see future adversary). ## Upgrades & Governance RAIL stakers govern Railgun through a DAO. It can upgrade the core contract and its circuits, which changes the rules for every shielded token. It can also block tokens from new shields, mint RAIL and manage governance rewards. [Governance docs](https://docs.railgun.org/wiki/rail-token/protocol-governance). ### Governance profile #### Upgrades | Property | Value | | --- | --- | | Normal upgrade path | Create a proposal with an IPFS link and onchain calldata in the [Voting contract](https://etherscan.io/address/0xc480F68A3dcC3EdD82134FAB45C14A0FcF1dA3CC) → collect **500.00 K RAIL** sponsorship within 1mo → wait 2d → cast Yay votes within 5d and Nay votes within 6d → pass with a simple majority and **2.00 M RAIL** quorum → wait 7d → permissionless execution through the Delegator within 14d. | | Exit window | **7d** — a passed proposal must wait this long before it can be executed, giving users time to unshield funds. | #### Token governance | Property | Value | | --- | --- | | Governance token | `RAIL` 1 token = 1 vote, delegated. Total supply: **60.00 M RAIL**, DAO-owned treasury (unavailable for voting): **2.30 M RAIL**, staked for voting: **41.61 M RAIL**, the rest is circulating supply. | | Stake lock | Unstaking has **1mo** delay. | | Voting venue | [Voting contract](https://etherscan.io/address/0xc480F68A3dcC3EdD82134FAB45C14A0FcF1dA3CC) on Ethereum. Proposal text is distributed over IPFS, its CID is available as a parameter of `createPropsal()` call on the voting contract. | | Proposal threshold | **No threshold to create a proposal.** A proposal must receive sponsorship from **500.00 K RAIL** stake within 1mo. | | Quorum | **2.00 M RAIL**, with a simple majority required for acceptance. | | Execution model | **Onchain calldata · Permissionless execution through the Delegator.** A passed proposal waits 7d, after which anyone can execute it through the [Delegator contract](https://etherscan.io/address/0xB6d513f6222Ee92Fff975E901bd792E2513fB53B) within 14d. | ## Trusted setup Risk levels follow the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381). Yellow (medium risk): all contributions are published and the final output can be verified, the ceremony client is open source, there were at least 30 contributions, participation was open to the public and announced, and participants are publicly identified. Green (lowest risk): everything required for yellow, with at least 150 contributions. Red (highest risk): at least one requirement for yellow is not met. N/A: the proof system needs no trusted setup. ### Railgun - Risk: yellow (medium risk) - Proof systems: Snarkjs (Groth16) Circuit-specific Phase 2 trusted setup for Railgun's 54 Groth16 circuits (parameterised by transaction input/output counts) over the BN254 curve. It [builds on the Polygon zkEVM ceremony](https://github.com/Railgun-Privacy/circuits-v2/blob/d0ec02dea0cbc8cd02a3b727b28de16e51f9a741/prepare_for_ceremony.sh#L13) as phase 1, which contains 55 participants. A separate Phase 2 ceremony was publicly announced, open to anonymous and identified participants, and wrapped up in late December 2022. Verified against the ceremony artifact IPFS hash `QmWAySHYhaZqioKi1ufrPJC1n1ZVtHP2w4hLA9XqqJCFne`: the `/contributors` directory contains 328 sequentially-numbered attestation files with GitHub or Twitter handles, and the `/zkeys` directory contains 54 final zkey files (one per circuit). Parsing the final zkey binary for the 1x1 circuit shows 304 Phase 2 contributions on that circuit. - Phase 1 ceremony: . - Ceremony artifacts on IPFS: [https://ipfs.io/ipfs/QmWAySHYhaZqioKi1ufrPJC1n1ZVtHP2w4hLA9XqqJCFne](https://ipfs.io/ipfs/QmWAySHYhaZqioKi1ufrPJC1n1ZVtHP2w4hLA9XqqJCFne) - Ceremony announcement: [https://medium.com/@Railgun_Project/railgun-project-begins-setup-ceremony-with-an-emphasis-on-security-d1c63117c312](https://medium.com/@Railgun_Project/railgun-project-begins-setup-ceremony-with-an-emphasis-on-security-d1c63117c312) - Advanced Circuit ceremony user guide: [https://medium.com/@Railgun_Project/railgun-advanced-circuit-setup-ceremony-user-guide-32361c54242](https://medium.com/@Railgun_Project/railgun-advanced-circuit-setup-ceremony-user-guide-32361c54242) - Docs overview of the trusted setup: [https://docs.railgun.org/wiki/learn/privacy-system/trusted-setup-ceremony](https://docs.railgun.org/wiki/learn/privacy-system/trusted-setup-ceremony) - Railgun circuits repository with ceremony scripts: [https://github.com/Railgun-Privacy/circuits-v2](https://github.com/Railgun-Privacy/circuits-v2) ## Verifier IDs ### Railgun verifier - Verifier ID: `Railgun 91 circuit verifier 03.07.2026` - Source: https://github.com/Railgun-Privacy/circuits-v2/tree/0aa2d13763a9fcfbb7b7ea9c02e004e71f1394bb/src/library - Verification: successful (verified by [L2BEAT](https://l2beat.com)) - Used in: [Railgun](https://l2beat.com/privacy/projects/railgun) **Known deployments** - [0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9](https://etherscan.io/address/0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9#code) on Ethereum, used in: [Railgun](https://l2beat.com/privacy/projects/railgun) #### Verification steps Railgun smart contract acts as a verifier for ZK proofs for all 91 Railgun circuits. 91 different verification keys for these circuits are stored onchain in the verifier smart contract. This regeneration attests that the verification keys stored onchain correspond to circuits published in Railgun repo. Generally, to regenerate all Railgun verification keys, the following has to be done: 1. Checkout the `main` branch of the [Railgun circuits-v2 repo](https://github.com/Railgun-Privacy/circuits-v2) (commit hash `0aa2d13763a9fcfbb7b7ea9c02e004e71f1394bb`). 2. Download Railgun trusted setup artifacts, which could be found at IPFS CID `QmUsmnK4PFc7zDp2cmC4wBZxYLjNyRgWfs5GNcJJ2uLcpU` or [on L2BEAT trusted setup hosting](https://trusted-setup-hosting.l2beat.com/privacy/railgun/trusted_setup_railgun.zip). It contains the proving keys for all 91 circuits, which contain circuit information and Groth16 phase 2 trusted setup information. 3. Build required version of circom and compile circuit sources into `.r1cs` binaries. 4. Download the phase 1 trusted setup files and use it to verify that all published prover keys correspond to the compiled circuits. This step will implicitly check the integrity of phase 2 contributions. 5. Generate all 91 verification keys from all prover keys, and make sure that it is identical to the ones in the onchain smart contract. Helper scripts that implement the flow above and more detailed explanations could be found in this [script .zip archive](https://trusted-setup-hosting.l2beat.com/privacy/railgun/verification_railgun.zip). This .zip must be extracted in `circuits-v2` dir checked out on commit `0aa2d13763a9fcfbb7b7ea9c02e004e71f1394bb` before the execution. ## Ossification & Updates Each date links the update on the HTML page, which also shows its contract diffs. ### [2026-09-11 11:11 UTC](https://l2beat.com/privacy/projects/railgun?update=eed67565) (high severity, 2 changes) Both VerificationKeySetters were moved into SETTING state by their EOA owners, thus preventing the possibility of changing Railgun contract verification keys to an older version by a single EOA without DAO participation. ### [2026-09-07 15:06 UTC](https://l2beat.com/privacy/projects/railgun?update=8eedb3fd) (high severity, 1 change) Four new proposals (IDs 29-32) created 2026-09-06 by the same proposer (0x5964ed1e...), all byte-identical, so effectively one proposal submitted four times. Title: "Add USDC and USDT to AGR Rewards". Single action: Delegator calls `addTokens([USDT, USDC])` on GovernorRewards, adding both stablecoins to the Active Governor Rewards distribution set (4.2% of Treasury balance per 2-week interval streamed to stakers). No other parameter changes. Only ID 32 has sponsorship (~90.7k of the 500k RAIL threshold), 29-31 have none. None has gone to vote or been executed. Proposal 28 (swap ~15.1k Treasury USDC to DAI via Curve 3pool, all DAI returned to Treasury) is still open with zero sponsorship. Governance UI: https://governance.railgun.org/proposals/v2/32 (proposal document on IPFS: bafkreia5rfx3x4phxl3tyscjc55eaac5sd7dnfjpsk4nywlgq55viy4e5e). ### [2026-09-01 12:17 UTC](https://l2beat.com/privacy/projects/railgun?update=c5d5795f) (high severity, 4 changes) Swap USDC to DAI proposal: https://tools.l2beat.com/decoder-new/?hash=0x83963ddea866aa6d77200fd5f6633d59aa6d4dc9a807496277f6910cc76a0369&data=AwA Actions: 1. Treasury → Delegator: 15109.211424 USDC 2. Delegator: USDC.approve(Curve3pool, 15109.211424) 3. Curve3pool: exchange USDC→DAI (min_dy = 15031.466111962828487747 DAI, 0.5% slippage) 4. Delegator → Treasury: 15031.466111962828487747 DAI (floor) 5. Delegator → Treasury: 75.535005587752906974 DAI (expected bonus) ### [2026-08-21 11:18 UTC](https://l2beat.com/privacy/projects/railgun?update=ebe8672f) (high severity, 1 change) New proposal on Railgun DAO: "Base deployment of RAILGUN Privacy System". Onchain execution of this proposal sends tasks to OPStackSender contract: https://tools.l2beat.com/decoder-new/?hash=0xfd5860b22fad6d5bf81cd4e9c809b2016ed08971b0fbf96aaf033fdbf87b52ec&data=AwA. These tasks initialize verification keys for all railgun circuits on the main Railgun contract on Base (`base:0x0047d1F97674614189E80566575FB615788AcF25`). Railgun smart contracts on Base are already deployed, with bytecode matching the deployment on Ethereum. The proposal doesn't look malicious. ### [2026-08-19 10:25 UTC](https://l2beat.com/privacy/projects/railgun?update=63068031) (high severity, 1 change) New railgun proposal created: https://tools.l2beat.com/decoder-new/?hash=0xb0f02fe28a805756fbd58c90a0704c26be69882460b1bd8885ca9fe93dd77718&data=AwA. It sweeps most tokens from railgun treasury (excluding WETH, RAIL which have most value) to 0xA4f2eA0a81179362558eBC1d2Bc817c9a0134ee3. Also triggers an action on arbitrum deployment. IPFS-published proposal description: "This proposal will gather tokens that are not part of the biweekly security staker rewards and use them to issue a research grant. The previous research funding ended earlier this year, so this would be a new and separate funding. All slightly significant tokens on Arbitrum will be collected. Most tokens not related to RAIL Security Rewards on Ethereum treasury will be collected.\n\nThe sum for this will be to fund the further development on the following (but not limited to): \n\n- RAILGUN-reloaded SDK, \n- RAILGUN v3,\n- Hardware Support \n- Post-Quantum Research \n- Multisig Support \n- and incentivise researchers and ecosystem.\n\nPlease do your own security review & vote YES to support this grant." Looks legit. ### [2026-08-17 10:12 UTC](https://l2beat.com/privacy/projects/railgun?update=276685e8) (high severity, 4 changes) The RailgunSmartWallet implementation upgrade proposed and reviewed in the entry below (2026-07-30) has now been executed by governance. The new implementation (https://disco.l2beat.com/diff/eth:0xB4F2d77bD12c6b548Ae398244d7FAD4ABCE4D89b/eth:0xd662c4b1f22aceb0beacdf3a493de6f478686a0c): - adds an `Action` event (caller + per-transaction nullifier/commitment counts, unshield flag, and boundParamsHash) emitted in `shield()` and `transact()` as an anchoring point for wallets/indexers to decode batched and nested Railgun transactions, - changes `Verifier.verify()` and `validateTransaction()` return signatures to also return the boundParamsHash for the new event (validation logic unchanged), - moves the token blocklist check from `validateCommitmentPreimage()` (now pure) directly into `shield()` (same effective behavior: blocked tokens still cannot be shielded). No permission, fee, or escrow logic changes. ### [2026-07-30 09:44 UTC](https://l2beat.com/privacy/projects/railgun?update=ebc35776) (high severity, 1 change) New railgun proposal created. It is evaluated as not malicious. The trx: https://tools.l2beat.com/decoder-new/?hash=0x818c219e6081d0b650f6be93fb19e1829c154c299f2dae0c7e2f6a6dcd3f2a71&data=AwA. Proposed upgrade of the main Railgun contract: https://disco.l2beat.com/diff/eth:0xB4F2d77bD12c6b548Ae398244d7FAD4ABCE4D89b/eth:0xd662c4b1f22aceb0beacdf3a493de6f478686a0c. Changes: - Added Action event that has overview of trxs in the action. This event is now emitted in transact() - verify() and validateTransaction() now also return hashBoundParams to be included in the new event - minor refactoring. Proposal also executes task 6 on Arbitrum Executor, which is this one: https://tools.l2beat.com/decoder-new/?hash=0xa2403ae37d69e9b92b5934bfb13779176d8484402b211ed8f55cd3d415ef0d66&data=AwA. It makes the same railgun contract upgrade on Arbitrum. The newly deployed railgun contracts have poseidon hash libraries not verified, it is confirmed that the EVM byte code of these libraries is equivalent to the previous deployment (no vulnerabilities introduced) on Ethereum and Arbitrum. ### [2026-07-20 10:27 UTC](https://l2beat.com/privacy/projects/railgun?update=492590d7) (high severity, 7 changes) Executed a railgun proposal. It: - Upgraded Governor rewards (https://disco.l2beat.com/diff/eth:0xaF51CD5f71Ed88D6d1F65b575f1a8Ce3a78eC42b/eth:0xaC76eB94703b16e704f76ECFFDADF36b6A53ECDB). Diff mostly a solidity & lib version upgrades + minimal refactoring around changing interval BP parameter. - Minted 2.5M RAIL (currently ~$4M) for Treasury (staker rewards). - Increased staker rewards from 200 bp of treasury per 2 weeks to 420 bp of treasury (4.2%). ### [2026-05-21 15:54 UTC](https://l2beat.com/privacy/projects/railgun?update=9fbdda0e) (1 change) Added Relay adapter to discovery. ### [2026-04-30 12:09 UTC](https://l2beat.com/privacy/projects/railgun?update=faa0799c) (19 changes) Discovery rerun on the same block number with only config-related changes. ## Permissions Explore these contracts and permissions in Disco, L2BEAT's contract explorer: https://disco.l2beat.com/ui/p/railgun ### Ethereum #### Actors ##### Voting Addresses: [0xc480F68A3dcC3EdD82134FAB45C14A0FcF1dA3CC](https://etherscan.io/address/0xc480F68A3dcC3EdD82134FAB45C14A0FcF1dA3CC) Token-weighted Railgun governance contract. Proposals must be sponsored, voted through quorum, and then executed through the Delegator. - Can upgrade **with no delay** - GovernorRewards [via: Delegator → ProxyAdmin] - LegacySweeper [via: Delegator] - Treasury [via: Delegator → ProxyAdmin] - RailgunSmartWallet [via: Delegator → ProxyAdmin] - Can interact with VerificationKeySetter_64DA - switch the VKeySetter into COMMITTING so its owner can push stored verification keys to the verifier [via: Delegator] - Can interact with VerificationKeySetter_9086 - switch the VKeySetter into COMMITTING so its owner can push stored verification keys to the verifier [via: Delegator] - Can interact with GovernorRewards - add or remove allowed reward safety vectors [via: Delegator] - add or remove reward tokens from the distribution set [via: Delegator] - change the per-interval reward rate [via: Delegator] - pause, unpause, transfer proxy ownership, or upgrade the GovernorRewards implementation [via: Delegator → ProxyAdmin] - Can interact with LegacySweeper - pause, unpause, transfer proxy ownership, or upgrade the legacy Sweeper implementation [via: Delegator] - Can interact with Delegator - grant or revoke delegated caller permissions and transfer ownership of the Delegator - Can interact with Rail Token - mint additional RAIL up to the hard cap and transfer token ownership [via: Delegator] - Can interact with Treasury - grant or revoke treasury roles, including who can move ETH and ERC20s out of the treasury [via: Delegator] - pause, unpause, transfer proxy ownership, or upgrade the treasury implementation [via: Delegator → ProxyAdmin] - transfer ETH or ERC20s out of the treasury [via: Delegator → ProxyAdmin → GovernorRewards - or Delegator → LegacySweeper - or Delegator] - Can interact with RailgunSmartWallet - add or remove allowed SNARK safety vectors [via: Delegator] - add or remove tokens from the shielding blocklist [via: Delegator] - change the shield, unshield, and NFT fee schedule [via: Delegator] - change the treasury that receives protocol fees [via: Delegator] - pause, unpause, transfer proxy ownership, or upgrade the Railgun smart wallet implementation [via: Delegator → ProxyAdmin] ##### EOA 1 Addresses: [0x76EB574EFF49FB64DE6f7F2854952B05B5E24624](https://etherscan.io/address/0x76EB574EFF49FB64DE6f7F2854952B05B5E24624) - Can interact with VerificationKeySetter_9086 - stage replacement verification keys and manage the helper's local SETTING and WAITING states ##### EOA 2 Addresses: [0xbbc2fB58643235AFfBF1f0CDd27Bc6E6CFBBa4e2](https://etherscan.io/address/0xbbc2fB58643235AFfBF1f0CDd27Bc6E6CFBBa4e2) - Can interact with VerificationKeySetter_64DA - stage replacement verification keys and manage the helper's local SETTING and WAITING states ## Smart contracts ![A diagram of the smart contract architecture](https://l2beat.com/static/images/architecture/railgun.ccc2c8d3.png) Explore these contracts and permissions in Disco, L2BEAT's contract explorer: https://disco.l2beat.com/ui/p/railgun ### Ethereum #### Treasury Addresses: [0xE8A8B458BcD1Ececc6b6b58F80929b29cCecFF40](https://etherscan.io/address/0xE8A8B458BcD1Ececc6b6b58F80929b29cCecFF40#code), [0xA092c7577354EA82a6c7e55B423c3DD80f0dF255](https://etherscan.io/address/0xA092c7577354EA82a6c7e55B423c3DD80f0dF255#code) (Implementation (Upgradable)), [0x4F8E20f55f879beE7Bc010Bd6bD2138B34aC65c8](https://etherscan.io/address/0x4F8E20f55f879beE7Bc010Bd6bD2138B34aC65c8#code) (Admin) **Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A) - 2022-07-14 05:21 UTC, deployment of [Treasury](https://etherscan.io/address/0xE8A8B458BcD1Ececc6b6b58F80929b29cCecFF40#code): transaction [0x271cb0bfab8dfeeda44381b22e6f93adc955002d387a96c0f8cd5719fb6a9504](https://etherscan.io/tx/0x271cb0bfab8dfeeda44381b22e6f93adc955002d387a96c0f8cd5719fb6a9504), implementations: [0xA092c7577354EA82a6c7e55B423c3DD80f0dF255](https://etherscan.io/address/0xA092c7577354EA82a6c7e55B423c3DD80f0dF255#code) Collects Railgun fees. Managed through access control roles. - Roles: - **admin**: ProxyAdmin; ultimately Voting - **defaultAdminRoleMembers**: Delegator; ultimately Voting - **transferRoleMembers**: Delegator, GovernorRewards, IntervalPayouts, LegacySweeper; ultimately Voting Can be upgraded by: Voting with no delay #### RailgunSmartWallet Addresses: [0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9](https://etherscan.io/address/0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9#code), [0xD662C4B1F22AcEb0BEaCdf3A493De6f478686A0C](https://etherscan.io/address/0xD662C4B1F22AcEb0BEaCdf3A493De6f478686A0C#code) (Implementation (Upgradable)), [0x4F8E20f55f879beE7Bc010Bd6bD2138B34aC65c8](https://etherscan.io/address/0x4F8E20f55f879beE7Bc010Bd6bD2138B34aC65c8#code) (Admin) **Past upgrades** (Count of upgrades: 4, Last upgrade: 2mo 3d ago, Avg upgrade interval: 10mo 24d) - 2026-08-14 13:50 UTC, upgrade of [RailgunSmartWallet](https://etherscan.io/address/0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9#code): transaction [0x7ac142845ccd9f156d992099a7ca8d6cb52655f4153cc49c48c38c8966a6b3ad](https://etherscan.io/tx/0x7ac142845ccd9f156d992099a7ca8d6cb52655f4153cc49c48c38c8966a6b3ad), implementations: [0xD662C4B1F22AcEb0BEaCdf3A493De6f478686A0C](https://etherscan.io/address/0xD662C4B1F22AcEb0BEaCdf3A493De6f478686A0C#code) ([diff](https://disco.l2beat.com/diff/eth:0xB4F2d77bD12c6b548Ae398244d7FAD4ABCE4D89b/eth:0xD662C4B1F22AcEb0BEaCdf3A493De6f478686A0C)) - 2025-07-28 15:48 UTC, upgrade of [RailgunSmartWallet](https://etherscan.io/address/0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9#code): transaction [0xfc6cda4a6e9b8e2d055a50212551e6daa8ec180ad7aced11d00ae71e1d0eab6e](https://etherscan.io/tx/0xfc6cda4a6e9b8e2d055a50212551e6daa8ec180ad7aced11d00ae71e1d0eab6e), implementations: [0xB4F2d77bD12c6b548Ae398244d7FAD4ABCE4D89b](https://etherscan.io/address/0xB4F2d77bD12c6b548Ae398244d7FAD4ABCE4D89b#code) ([diff](https://disco.l2beat.com/diff/eth:0xc0BEF2D373A1EfaDE8B952f33c1370E486f209Cc/eth:0xB4F2d77bD12c6b548Ae398244d7FAD4ABCE4D89b)) - 2023-03-09 11:09 UTC, upgrade of [RailgunSmartWallet](https://etherscan.io/address/0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9#code): transaction [0xe001ac69697083957933db13ff27c56769ce8826d4ab676b3965d7a44b9f0668](https://etherscan.io/tx/0xe001ac69697083957933db13ff27c56769ce8826d4ab676b3965d7a44b9f0668), implementations: [0xc0BEF2D373A1EfaDE8B952f33c1370E486f209Cc](https://etherscan.io/address/0xc0BEF2D373A1EfaDE8B952f33c1370E486f209Cc#code) ([diff](https://disco.l2beat.com/diff/eth:0x321617E18bE9EC7CFE5ab8856DE2aAbAA478E13B/eth:0xc0BEF2D373A1EfaDE8B952f33c1370E486f209Cc)) - 2022-11-29 16:10 UTC, upgrade of [RailgunSmartWallet](https://etherscan.io/address/0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9#code): transaction [0xab0625746a64ed88fd040a39bdbe9ed930328d9b09245b36cd1d9a64444dad95](https://etherscan.io/tx/0xab0625746a64ed88fd040a39bdbe9ed930328d9b09245b36cd1d9a64444dad95), implementations: [0x321617E18bE9EC7CFE5ab8856DE2aAbAA478E13B](https://etherscan.io/address/0x321617E18bE9EC7CFE5ab8856DE2aAbAA478E13B#code) ([diff](https://disco.l2beat.com/diff/eth:0xBCFA4De73afb071C9FF18a20A22F818e657C541a/eth:0x321617E18bE9EC7CFE5ab8856DE2aAbAA478E13B)) - 2022-05-08 18:32 UTC, deployment of [RailgunSmartWallet](https://etherscan.io/address/0xFA7093CDD9EE6932B4eb2c9e1cde7CE00B1FA4b9#code): transaction [0x2bd98cd135e2eaf7b7239bb4951a043f655629b5d0f0ca12334ce05718512361](https://etherscan.io/tx/0x2bd98cd135e2eaf7b7239bb4951a043f655629b5d0f0ca12334ce05718512361), implementations: [0xBCFA4De73afb071C9FF18a20A22F818e657C541a](https://etherscan.io/address/0xBCFA4De73afb071C9FF18a20A22F818e657C541a#code) Main system contract and escrow that accepts shielded deposits, verifies private transactions and unshields, and maintains the commitment tree. - Roles: - **admin**: ProxyAdmin; ultimately Voting - **owner**: Delegator; ultimately Voting Can be upgraded by: Voting with no delay #### ProxyAdmin Addresses: [0x4F8E20f55f879beE7Bc010Bd6bD2138B34aC65c8](https://etherscan.io/address/0x4F8E20f55f879beE7Bc010Bd6bD2138B34aC65c8#code) Admin interface for Railgun's pausable upgradeable proxies. It does not hold funds, but its controller can operate every proxy attached to it. - Roles: - **owner**: Delegator #### VerificationKeySetter_64DA Addresses: [0x64DA0892E8E24fECa6Eb5E3D8cbf2D9b6Fbe7598](https://etherscan.io/address/0x64DA0892E8E24fECa6Eb5E3D8cbf2D9b6Fbe7598#code) Auxiliary verifier-key staging contract. Its owner stores replacement verification keys locally and, if Railgun governance switches the contract into COMMITTING state, can register the new keys in the Railgun smart wallet verifier. - Roles: - **delegator**: Delegator; ultimately Voting - **owner**: EOA 2 #### VerificationKeySetter_9086 Addresses: [0x9086aFC6FC88667d4031Cabd556AfDD0E3903B46](https://etherscan.io/address/0x9086aFC6FC88667d4031Cabd556AfDD0E3903B46#code) Auxiliary verifier-key staging contract. Its owner stores replacement verification keys locally and, if Railgun governance switches the contract into COMMITTING state, can register the new keys in the Railgun smart wallet verifier. - Roles: - **delegator**: Delegator; ultimately Voting - **owner**: EOA 1 #### GovernorRewards Addresses: [0xA02782CE1bF85f56f8cC7C0E66e61299Ac75c86f](https://etherscan.io/address/0xA02782CE1bF85f56f8cC7C0E66e61299Ac75c86f#code), [0xaC76eB94703b16e704f76ECFFDADF36b6A53ECDB](https://etherscan.io/address/0xaC76eB94703b16e704f76ECFFDADF36b6A53ECDB#code) (Implementation (Upgradable)), [0x4F8E20f55f879beE7Bc010Bd6bD2138B34aC65c8](https://etherscan.io/address/0x4F8E20f55f879beE7Bc010Bd6bD2138B34aC65c8#code) (Admin) **Past upgrades** (Count of upgrades: 3, Last upgrade: 2mo 29d ago, Avg upgrade interval: 11mo 11d) - 2026-07-18 18:15 UTC, upgrade of [GovernorRewards](https://etherscan.io/address/0xA02782CE1bF85f56f8cC7C0E66e61299Ac75c86f#code): transaction [0x01b125307242dcb57f77aa1c925ac1b0af56dc29616631336bb15f25fdca1778](https://etherscan.io/tx/0x01b125307242dcb57f77aa1c925ac1b0af56dc29616631336bb15f25fdca1778), implementations: [0xaC76eB94703b16e704f76ECFFDADF36b6A53ECDB](https://etherscan.io/address/0xaC76eB94703b16e704f76ECFFDADF36b6A53ECDB#code) ([diff](https://disco.l2beat.com/diff/eth:0xaF51CD5f71Ed88D6d1F65b575f1a8Ce3a78eC42b/eth:0xaC76eB94703b16e704f76ECFFDADF36b6A53ECDB)) - 2023-01-20 05:59 UTC, upgrade of [GovernorRewards](https://etherscan.io/address/0xA02782CE1bF85f56f8cC7C0E66e61299Ac75c86f#code): transaction [0x948534918749a94532adcbc0b5fbf6248e2cdb1ac905c688fc30b8eef649260b](https://etherscan.io/tx/0x948534918749a94532adcbc0b5fbf6248e2cdb1ac905c688fc30b8eef649260b), implementations: [0xaF51CD5f71Ed88D6d1F65b575f1a8Ce3a78eC42b](https://etherscan.io/address/0xaF51CD5f71Ed88D6d1F65b575f1a8Ce3a78eC42b#code) ([diff](https://disco.l2beat.com/diff/eth:0x3db1c53366Fff57001fF6a9DaaCdA1FCFBaB56A9/eth:0xaF51CD5f71Ed88D6d1F65b575f1a8Ce3a78eC42b)) - 2023-01-20 05:40 UTC, upgrade of [GovernorRewards](https://etherscan.io/address/0xA02782CE1bF85f56f8cC7C0E66e61299Ac75c86f#code): transaction [0x14b883f710dbcdc1be58c03cedc447a7af82c843bfb2259c194eea7aef19d972](https://etherscan.io/tx/0x14b883f710dbcdc1be58c03cedc447a7af82c843bfb2259c194eea7aef19d972), implementations: [0x3db1c53366Fff57001fF6a9DaaCdA1FCFBaB56A9](https://etherscan.io/address/0x3db1c53366Fff57001fF6a9DaaCdA1FCFBaB56A9#code) ([diff](https://disco.l2beat.com/diff/eth:0xF035cEBa76C0C1f2c15457775745B1F5DC42CA2c/eth:0x3db1c53366Fff57001fF6a9DaaCdA1FCFBaB56A9)) - 2023-01-20 05:37 UTC, deployment of [GovernorRewards](https://etherscan.io/address/0xA02782CE1bF85f56f8cC7C0E66e61299Ac75c86f#code): transaction [0x2a5967e08e872f7bd998842cbd9224ee81a39ddd16f7f40452fc3ba47c01c783](https://etherscan.io/tx/0x2a5967e08e872f7bd998842cbd9224ee81a39ddd16f7f40452fc3ba47c01c783), implementations: [0xF035cEBa76C0C1f2c15457775745B1F5DC42CA2c](https://etherscan.io/address/0xF035cEBa76C0C1f2c15457775745B1F5DC42CA2c#code) Reward distributor that pulls assets from the Railgun treasury and allocates them to stakers via token voting. - Roles: - **admin**: ProxyAdmin; ultimately Voting - **owner**: Delegator; ultimately Voting Can be upgraded by: Voting with no delay #### LegacySweeper Addresses: [0xa353bC0454931Ac46fd90c8EF27f908Ab9E34686](https://etherscan.io/address/0xa353bC0454931Ac46fd90c8EF27f908Ab9E34686#code), [0x9b1310BdCC19D172D0092240e33209a9156c8EE2](https://etherscan.io/address/0x9b1310BdCC19D172D0092240e33209a9156c8EE2#code) (Implementation (Upgradable)), [0xB6d513f6222Ee92Fff975E901bd792E2513fB53B](https://etherscan.io/address/0xB6d513f6222Ee92Fff975E901bd792E2513fB53B#code) (Admin) **Past upgrades** (Count of upgrades: 1, Last upgrade: 3y 10mo ago, Avg upgrade interval: 2y) - 2022-12-02 04:09 UTC, upgrade of [LegacySweeper](https://etherscan.io/address/0xa353bC0454931Ac46fd90c8EF27f908Ab9E34686#code): transaction [0xa61b7db4ff3ca6d8a4b44f396b019ee3bea1f9a8616ef8a35d0511bf03c2b7e1](https://etherscan.io/tx/0xa61b7db4ff3ca6d8a4b44f396b019ee3bea1f9a8616ef8a35d0511bf03c2b7e1), implementations: [0x9b1310BdCC19D172D0092240e33209a9156c8EE2](https://etherscan.io/address/0x9b1310BdCC19D172D0092240e33209a9156c8EE2#code) ([diff](https://disco.l2beat.com/diff/eth:0x27d30E803A0EC079DAA3A2e6c3590Cca9f63C9D8/eth:0x9b1310BdCC19D172D0092240e33209a9156c8EE2)) - 2022-09-10 00:32 UTC, deployment of [LegacySweeper](https://etherscan.io/address/0xa353bC0454931Ac46fd90c8EF27f908Ab9E34686#code): transaction [0x1413ff21c2423fcb8cf10812ada82f33fe76a34f18368277ce5f1cd51e5750a5](https://etherscan.io/tx/0x1413ff21c2423fcb8cf10812ada82f33fe76a34f18368277ce5f1cd51e5750a5), implementations: [0x27d30E803A0EC079DAA3A2e6c3590Cca9f63C9D8](https://etherscan.io/address/0x27d30E803A0EC079DAA3A2e6c3590Cca9f63C9D8#code) Older Railgun sweeper generation that still holds Treasury transfer rights. It is upgradeable and forwards balances to an immutable receiver. - Roles: - **admin**: Delegator; ultimately Voting Can be upgraded by: Voting with no delay #### Delegator Addresses: [0xB6d513f6222Ee92Fff975E901bd792E2513fB53B](https://etherscan.io/address/0xB6d513f6222Ee92Fff975E901bd792E2513fB53B#code) Permission router proxy owned by Railgun governance. - Roles: - **owner**: Voting - **verificationKeyDelegates**: VerificationKeySetter_64DA, VerificationKeySetter_9086 #### Rail Token Addresses: [0xe76C6c83af64e4C60245D8C7dE953DF673a7A33D](https://etherscan.io/address/0xe76C6c83af64e4C60245D8C7dE953DF673a7A33D#code) RAIL governance token contract with a capped (100,000,000 RAIL total supply) mint schedule and an early anti-bot transfer override. - Roles: - **owner**: Delegator; ultimately Voting #### Staking Addresses: [0xEE6A649Aa3766bD117e12C161726b693A1B2Ee20](https://etherscan.io/address/0xEE6A649Aa3766bD117e12C161726b693A1B2Ee20#code) RAIL staking contract that tracks delegated voting power, enforces a 1mo unstake delay, and snapshots staking balances for governance every 1d. Its parameters define the governance voting system. #### IntervalPayouts (6 instances) Addresses: [0x29905A43aA3865D0D7F2743dDE63754B4aa9CA11](https://etherscan.io/address/0x29905A43aA3865D0D7F2743dDE63754B4aa9CA11#code), [0x7673e2E62435D25EDBcb58fD0d88c4C95806b10F](https://etherscan.io/address/0x7673e2E62435D25EDBcb58fD0d88c4C95806b10F#code), [0x859E0C1790b8a721F4943742603cDB685A73BA5D](https://etherscan.io/address/0x859E0C1790b8a721F4943742603cDB685A73BA5D#code), [0xa863262Bf5E97e8CFeC47a71402aC360C0983060](https://etherscan.io/address/0xa863262Bf5E97e8CFeC47a71402aC360C0983060#code), [0xCA9A2894e814305fAfc2BA83a70B34295b1DdE9D](https://etherscan.io/address/0xCA9A2894e814305fAfc2BA83a70B34295b1DdE9D#code), [0xf5F9d74FbFd04801DFf83425ff6C2002f60B921A](https://etherscan.io/address/0xf5F9d74FbFd04801DFf83425ff6C2002f60B921A#code) Immutable payout stream that can pull a fixed amount of a configured asset from the Railgun treasury to a fixed beneficiary whenever the next interval is due. #### RelayAdapt Addresses: [0xAc9f360Ae85469B27aEDdEaFC579Ef2d052aD405](https://etherscan.io/address/0xAc9f360Ae85469B27aEDdEaFC579Ef2d052aD405#code) Execution adapter contract for Railgun. To interact with public contracts from shielded pools, tokens are unshielded to RelayAdapter, which performs specified calls and shields tokens back to the same user.