Search

Search for projects by name or address

Privacy
SummaryProtocol descriptionPrivacyValue LockedAnonymity setsFlowsAssets BreakdownMilestones & IncidentsRisk summaryUpgrades & GovernanceTrusted setupVerifier IDsOssification & UpdatesPermissionsSmart contracts

Tornado Cash logo
Tornado Cash

About

An unconditional privacy pool of fixed amounts with immutable contracts, and an app pinned on ENS by token governance.

  • Total Value Locked
    $633.63 M2.15%
    across 6 assets and 19 buckets
  • TVL
    $633.63 M2.15%
  • Assets tracked
    6
  • Buckets tracked
    19
  • Deposits 7D
    2.25 K7.49%
  • Deposits 30D
    9.70 K
  • Deposits Total
    313.57 K
  • Active Relayers 30D
    29
  • Privacy
    Link privacy
  • Trusted setup
  • Exit window
  • Reproducibility
  • Tracked on
    Ethereum logo
  • Attributes
    ZKFixed amounts
    • Public observerChain analystNetwork observerPrivileged insiderFuture adversary

    About

    An unconditional privacy pool of fixed amounts with immutable contracts, and an app pinned on ENS by token governance.

    Protocol description

    Tornado Cash lets the user withdraw a deposit of ETH or a token to an address with no visible link to it. Each pool takes one amount, like 0.1 ETH, so amounts reveal nothing within a pool. Depositors, recipients and timing stay public.

    No one can pause, upgrade or blockAn ordered list of transactions and chain-related metadata that gets bundled together and published to the L1/DA layer. Nodes execute the transactions contained within blocks to change the rollup chain’s state. Protocol rules dictate what constitutes a valid block, and invalid blocks are skipped over. the pools. TORN token holders govern the app pinned on tornadocash.eth, the router’s list of pools and the relayer registry. Leaving needs no one: anyone can prove a withdrawal directly to a pool.

    Flow

    1. Deposit. The app creates a secret note and sends its commitment to the pool through the router. Your address is public.
    2. Withdraw. You paste the note into the app, which proves that it belongs to an unspent deposit without revealing which. A relayer submits the proof and pays the gasA virtual fuel used to execute smart contracts on a rollup. The EVM (or other VM within the rollup) uses an accounting mechanism to correspond the consumption of gas to the consumption of computing resources, and to limit the consumption of computing resources. for a fee from the withdrawal.

    Keys

    Each deposit has its own note, which the app shows once for the user to save. Whoever holds the note can withdraw, and losing it loses the funds. An optional note account backs notes up onchain, encrypted to a key from the user’s wallet.

    App

    The ratings assume the classic app pinned on tornadocash.eth. Each proposal that changes it names the source commit and a build recipe that recomputes its IPFS hashA fixed-length fingerprint of variable-size input, produced by a hash function., currently bafybeigduniojgqrz7e4vntsgmovdli3oi7a2pnzzvz2gfxlvj3yqwk75a. Gateways like eth.limo serve it, and the user’s own IPFS nodeA software client that participates in the network. takes the gateway out of the trust path. The app lists relayers from the registry, accepts the user’s own RPC endpoint and withdraws through a relayer without a wallet. In 2024 a pinned version sent users’ notes to an attacker (code analysis here).

    Compliance

    Tornado Cash has no screening or approval list. The app’s compliance page builds a report that links one of the user’s withdrawals to its deposit, for the user to share. The US sanctions on the pools were lifted in March 2025.

    Fees

    The pools charge no fee. Relayers take their fee from the withdrawal. Registered relayers also burn part of their TORN stake on each withdrawal, at a rate governance sets.

    Anonymity setIn privacy protocols, anonymity set denotes all users, to which a particular withdrawal could be plausibly attributed. Anonymity set depends on a particular withdrawal, the size of the anonymity set is a metric for level of user's privacy.

    Each pool has its own set: the deposits of that token and amount not yet withdrawn. Pools differ widely in size, and the ETH pools on Ethereum are by far the largest.

    Privacy

    What the protocol promises: Hides which deposit funds which withdrawal. Everything else is public.

    Ethereum is public by default. Each protocol is rated on its main privacy promise, like hiding who paid, who received, how much, or which deposit became which withdrawal. Against each adversary, the colour says whether it holds for a careful user with the app's own settings: green yes, yellow only with significant extra work, red no. Fields marked at risk stay private only under the condition in their note.

    Public observerChain analystNetwork observerPrivileged insiderFuture adversary
    Public observer
    Private

    Each pool has one fixed amount and no in-pool transfers, so every withdrawal spends exactly one deposit.

    Advice: Exit through a relayer, so none of the user's wallets pay gas for the receiving address.

    Sources:1 ETH poolWithdrawal circuit
    Chain analyst
    Private

    A relayed withdrawal hides among all unspent deposits of its pool, the anonymity setIn privacy protocols, anonymity set denotes all users, to which a particular withdrawal could be plausibly attributed. Anonymity set depends on a particular withdrawal, the size of the anonymity set is a metric for level of user's privacy., which differs sharply between pools. Timing, address reuse and relayer choice narrow it further. Paying gasA virtual fuel used to execute smart contracts on a rollup. The EVM (or other VM within the rollup) uses an accounting mechanism to correspond the consumption of gas to the consumption of computing resources, and to limit the consumption of computing resources. from the user’s wallet instead of a relayer exposes its fingerprint, account implementation and fee habits, even from a fresh address.

    Advice: Use a pool with a large anonymity set. Deposit and withdraw several notes at different times, not in batches. Wait before exiting and pick a different time of day than the deposit. Exit to a fresh address every time and spend from it with a different wallet than the one that deposited.

    Sources:withdraw: any relayer, paid from the withdrawn amountTutela (arXiv:2201.06811)Blockchain is Watching You (arXiv:2005.14051)
    Network observer
    Private

    The app works in Tor Browser and downloads every deposit of a pool, so its services learn the pool but never the user’s note. Every listed relayer gets a status request, and the chosen one receives the finished withdrawal.

    Advice: Read the chain from the user's own node, send through a public RPC over Tor, and use a popular relayer. If using a VPN instead of Tor, choose a trusted provider: it hides the user's IP from the relayer but sees it itself. Withdraw without connecting a wallet.

    Sources:Deposits fetched per pool and matched locallyThe relayer receives only the finished withdrawalCustom RPC settingOnly withdrawals without a relayer need a wallet
    Privileged insider
    Private

    The pools cannot be paused, upgraded or made to reveal anything. Token governance controls the app pinned on tornadocash.eth, the router’s pool list and the relayer list. Every change waits at least 7 days from proposal to execution.

    Advice: Load the app from the IPFS hash on tornadocash.eth through the user's own IPFS node. Run an inspected local build of the client instead of the hosted frontend.

    Sources:0.1 ETH pool (no operator)Upgrades & GovernanceBuild recipe that recomputes the pinned app's IPFS hash
    Future adversary
    At risk

    Commitments use a Pedersen hashA fixed-length fingerprint of variable-size input, produced by a hash function. on an elliptic curve. Whoever breaks elliptic-curve cryptography could test whether a given deposit can fund a withdrawal, shrinking the candidate set without singling out one deposit. Notes backed up onchain are encrypted with elliptic-curve keys and become readable.

    Advice: Keep the note on the user's device and leave the onchain backup off.

    Sources:Pedersen hash circuit (pinned circomlib fork)Commitment and nullifier hashingOnchain note backups

    Value Locked

    Anonymity sets

    30 day historic anonymity set

    How many unique depositors you could have blended in with if you withdrew on a particular day after depositing during the previous 30 days. This metric is a proxy for the historic anonymity set and shows how it developed over time.

    The metric looks backwards: it counts deposits that already happened, including from addresses that have since withdrawn. Your real anonymity also depends on deposits made after yours, which cannot be known in advance.

    Estimated anonymity set by holding duration

    An estimate of how many unique depositors you blend in with, depending on how long you leave your deposit in the pool. It is based on historic data of past deposits: each point counts depositors from the preceding period, so holding for up to 30 days effectively means blending in with everyone who deposited during the last 30 days.

    Flows

    Assets Breakdown

    Asset
    Buckets
    Deposits 7D
    Deposits 30D
    Deposits Total
    Value Locked
    4
    2.21 K
    $72.29 M
    9.47 K
    $157.59 M
    296.74 K
    $13.48 B
    		$618.87 M
    4
    21
    $22.79 K
    54
    $914.39 K
    9.67 K
    $474.84 M
    		$7.83 M
    3
    0
    $0.00
    2
    $17.06 K
    2.40 K
    $535.43 M
    		$6.82 M
    2
    11
    $9.19 K
    169
    $149.18 K
    3.09 K
    $2.21 M
    		$45.26 K
    2
    3
    $299.90
    9
    $5.39 K
    1.32 K
    $974.01 K
    		$30.59 K
    4
    0
    $0.00
    0
    $0.00
    324
    $13.31 M
    		$25.32 K
    Total
    2.25 K
    $72.32 M
    9.70 K
    $158.68 M
    313.57 K
    $14.50 B
    		$633.63 M

    Milestones & Incidents

    Removed from the OFAC sanctions list

    2025 Mar 21st

    OFAC removes Tornado Cash and the pools’ addresses from its sanctions list.

    Learn more

    Pinned app leaks deposit notes

    2024 Jan 2nd

    The app pinned by proposal 44 sends deposit notes to an outside server until proposal 52.

    Learn more

    Risk summary

    Funds can be stolen if

    1. the zk proof systemThe infrastructure that allows projects to verify their state transitions. It is composed by onchain verifiers and offchain provers. The main two flavors are optimistic and ZK proof systems, but they can be combined in a hybrid model. In general though, if a system is able to accept state roots optimistically, even if it has a ZK component, it is considered an optimistic proof system. is broken, allowing invalid withdrawals.
    2. the trusted setup is compromised or all ceremony participants collude, allowing invalid withdrawals.
    3. governance pins a malicious app on tornadocash.eth, which can steal the notes, and with them the funds, of users who load it (see privileged insider).

    Funds can be lost if

    1. a user loses the note required to withdraw.

    Privacy can be lost if

    1. elliptic-curve cryptography is broken, which lets an attacker test candidate deposits for each withdrawal and read notes backed up onchain (see future adversary).

    Upgrades & Governance

    TORN holders govern through the Governance contract, after a vote and a timelock. They cannot change the pools. They control the InstanceRegistry the router reads its pool list from, the RelayerRegistry, the FeeManager, the TORN token and the IPFS hashA fixed-length fingerprint of variable-size input, produced by a hash function. of the app on tornadocash.eth. A malicious registry upgrade could steal tokens users approved to the router. A malicious app could steal the notes of users who load it. Removing relayers from the registry hides them from the app, while the pools still accept any relayer.

    Governance profile

    Upgrades

    Normal upgrade path

    Lock and optionally delegate TORN in the Governance contract → submit a proposal with at least 1.00 K TORN → wait 1m 15s → vote for 5d (extended by 6h if the outcome changes during the last 1h) → pass with a simple majority and 100.00 K TORN quorum → wait 2d → permissionlessAnyone willing should be able to join and leave the network at any time, without causing significant disturbance to the network or being detrimental to the party in question. No single entity should have the power to allowlist or blocklist participants. execution within 3d. The DAO controls protocol and periphery components, but cannot upgrade or modify existing pools.

    Exit window

    2d for DAO-controlled changes — an accepted proposal remains timelocked for this period before it can be executed. Existing Tornado Cash pools are immutable and cannot be upgraded by the DAO.

    Token governance

    Governance token

    TORN, 1 token = 1 vote, delegated. Total supply: 9.99 M TORN, DAO-owned TORN (unavailable for voting): 4.73 M TORN, staked for voting: 2.57 M TORN, the rest is circulating supply.

    Stake lock

    After voting or proposing, staked tokens are locked for 5d 6h after proposal ends, preventing governance hopping.

    Voting venue

    Governance contract on Ethereum. Proposals are viewable on the governance page of the app, see the App section above.

    Proposal threshold

    1.00 K TORN locked in governance.

    Quorum

    100.00 K TORN, with a simple majority required for acceptance.

    Execution model

    PermissionlessAnyone willing should be able to join and leave the network at any time, without causing significant disturbance to the network or being detrimental to the party in question. No single entity should have the power to allowlist or blocklist participants. execution after an onchain vote and timelock. An accepted proposal waits 2d and can then be executed by anyone within 3d. Proposal executable payload is committed in the propose() transaction.

    Trusted setup

    Tornado Cash

    websnark

    Detailed description

    CircuitA program written for the purpose of being proven within a proving system. A circuit is a mathematical representation of the computation to be executed, arithmetic circuits and zkVM execution trace are examples of circuits. Circuits can be written in different languages, ranging from low-level to high-level.-specific trusted setupGeneration of a piece of data that must then be used for some cryptographic protocol to run. Generating this data requires some secret information. The "trust" comes from the fact the secret must be destroyed after the ceremony, otherwise cryptographic properties of the protocol could be broken. Once the data is generated, and the secrets are forgotten, no further participation from the creators of the ceremony is required. There are two types of trusted setups for SNARKs: (i) trusted setup per circuit where it is generated from scratch for each circuit, (ii) trusted universal setup per proving system where it can be used for several circuits. for Groth16A zk-SNARK proving system introduced by Groth in 2016 that proves arithmetic circuits and requires a separate trusted setup for each circuit. It allows extremely efficient proof verification. Tornado Cash circuits. It was publicly announced as a Phase 2For Groth16 trusted setup, phase 2 represents circuit-dependent part of the trusted setup. It generates a part of the secret cryptographic data required for Groth16 ZK protocol to work. If the outcome of phase 2 trusted setup ceremony is known, arbitrary proofs could be forged. ceremony built on top of the 30th contribution to the Perpetual Powers of Tau ceremony, and completed in May 2020. It collected 1114 contributions over 10 days, with 450 identified contributors and 664 anonymous ones. Tornado Cash published the participant list, archive of contributions and artifacts, and the generated verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. contract.

    Verifier IDs

    Verifier
    Verification
    Used in
    Known deployments
    Tornado Cash verifier v2.1
    by
    Tornado Cash logo
    Verifier ID:Tornado Cash verifier 03.07.2026
    Source:https://github.com/tornadocash/tornado-core/tree/v2.1/circuits
    Known deployments

    Deployment #1

    Address:0xce17…557A
    Used in:
    Tornado Cash logo
    Verification steps

    This regeneration attests that the verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. smart contract verification keys correspond to circuits published in Tornado Cash release.

    Generally, to regenerate Tornado Cash verifier, the following has to be done:

    1. Checkout the correct branch of the sources: https://github.com/tornadocash/tornado-core/tree/v2.1.
    2. Compile the .circom circuitA program written for the purpose of being proven within a proving system. A circuit is a mathematical representation of the computation to be executed, arithmetic circuits and zkVM execution trace are examples of circuits. Circuits can be written in different languages, ranging from low-level to high-level. sources into .json.
    3. Fetch published proverAn entity that generates the cryptographic proof to convince the verifier that the statement is true. In a ZK-Rollup, the prover generates the ZK (validity) proof to submit to the verifier contract. keys for tornado.params. This file contains the circuit information and Groth16A zk-SNARK proving system introduced by Groth in 2016 that proves arithmetic circuits and requires a separate trusted setup for each circuit. It allows extremely efficient proof verification. phase 2For Groth16 trusted setup, phase 2 represents circuit-dependent part of the trusted setup. It generates a part of the secret cryptographic data required for Groth16 ZK protocol to work. If the outcome of phase 2 trusted setup ceremony is known, arbitrary proofs could be forged. trusted setupGeneration of a piece of data that must then be used for some cryptographic protocol to run. Generating this data requires some secret information. The "trust" comes from the fact the secret must be destroyed after the ceremony, otherwise cryptographic properties of the protocol could be broken. Once the data is generated, and the secrets are forgotten, no further participation from the creators of the ceremony is required. There are two types of trusted setups for SNARKs: (i) trusted setup per circuit where it is generated from scratch for each circuit, (ii) trusted universal setup per proving system where it can be used for several circuits. information (final evaluation keys for all 1114 contributions). It does not contain phase 1For Groth16 trusted setup, phase 1 represents circuit-independent part of the trusted setup (e.g. Perpetual Powers of Tau), which could be reused across different circuits. It generates a part of the secret cryptographic data required for Groth16 ZK protocol to work. If the outcome of phase 1 trusted setup ceremony is known, arbitrary proofs could be forged. trusted setup data, which must be fetched separately.
    4. Check that tornado.params was generated with the same compiled circuit as was obtained in step 2. This step will implicitly check the integrity of phase 2 trusted setup, and it will rely on the separately fetched phase 1 trusted setup files.
    5. Generate verification keys from the prover key and make sure that it is identical to the one in the solidity smart contract.

    Helper scripts that implement the flow above and more detailed explanations could be found in this script .zip archive. This .zip must be extracted in tornado-core dir checked out on tag v2.1 (commit hashA fixed-length fingerprint of variable-size input, produced by a hash function. a533ad9ffb62163a42d4fa9a09984c5dd4e5c41d) before the execution.

    Ossification & Updates

    Ossification

    Contracts our research team classifies as critical form the project's critical perimeter. Its clock starts at the ossification genesis, and every critical change resets it (changes within 24 hours count as one). The ossification score is the share of recorded code-bug exploits whose exploited code was younger than this perimeter is today. Battle-tested exposure is the value secured, summed over that unchanged period.

    Ossification %
    99since 2020 May 18
    TVS & changes (1Y)
    Battle-tested exposure
    $2.65 B·years
    Critical changes / year
    0across 21 contracts
    Exit window

    Discovery updates

    2026 October 08, 10:12 UTC
    High severity
    22changes

    Created two new proposals. Both deploy new pools. - Proposal 71: deploy five new classic ETH pools (0.01, 0.03, 0.3, 3, 30 ETH) with protocol fee 0 for the three small pools and 0.3% for 3 and 30 ETH. - Proposal 72: deploy one 0.01 ETH pool of a new type, FeeEnforcedTornado eth (https://github.com/frogheadtornado/tc-new-pool-design-proposal). It has a 0.3% withdrawal fee. Direct withdrwals (not by registered routers) pay additional fee, governance can raise withdrawal fees up to 5% total. Also, several anonymity mining legacy contract sources are verified now, they were templatized.

    Created two new proposals. Both deploy new pools.

    • Proposal 71: deploy five new classic ETH pools (0.01, 0.03, 0.3, 3, 30 ETH) with protocol fee 0 for the three small pools and 0.3% for 3 and 30 ETH.
    • Proposal 72: deploy one 0.01 ETH pool of a new type, FeeEnforcedTornado_eth (https://github.com/frogheadtornado/tc-new-pool-design-proposal). It has a 0.3% withdrawal fee. Direct withdrwals (not by registered routers) pay additional fee, governance can raise withdrawal fees up to 5% total.

    Also, several anonymity mining legacy contract sources are verified now, they were templatized.

    contract GovernanceProposalStateUpgrade (eth:0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce) [tornado-cash/GovernanceProposalStateUpgrade] {
    +++ description: Upgradeable Tornado Cash governance contract that manages proposals, voting, execution, and treasury-connected governance modules. If you trust this contract, you trust its upgrade path and proposal rules to change protocol governance behavior.
    values.proposalCount:
    - 70
    + 72
    }

    New and verified contracts

    contract DepositTree (eth:0x6234c4C2734D2B246AE074492F402D8f58ff3226) [tornado-cash/OwnableMerkleTree] {
    +++ description: Anonymity Mining - Legacy Poseidon merkle tree that stores deposit or withdrawal leaves for TornadoTreesV1. Only its owner can insert leaves.
    unverified:
    - true
    description:
    - "Unverified merkle tree instance that stores legacy Tornado deposit leaves for TornadoTreesV1."
    + "Anonymity Mining - Legacy Poseidon merkle tree that stores deposit or withdrawal leaves for TornadoTreesV1. Only its owner can insert leaves."
    +++ description: Poseidon hasher used to compute the tree nodes.
    values.hasher:
    + "eth:0x94C92F096437ab9958fC0A37F09348f30389Ae79"
    +++ description: Height of the merkle tree.
    +++ severity: LOW
    values.levels:
    + 20
    +++ description: Only this address can insert leaves into the tree.
    +++ severity: HIGH
    values.owner:
    + "eth:0x43a3bE4Ae954d9869836702AFd10393D3a7Ea417"
    implementationNames.eth:0x6234c4C2734D2B246AE074492F402D8f58ff3226:
    - ""
    + "OwnableMerkleTree"
    template:
    + "tornado-cash/OwnableMerkleTree"
    sourceHashes:
    + ["0x218d9a152ab9d469cf4baf2591677b19bb64e6885452ccc071bfbf6eca60c9aa"]
    fieldMeta:
    + {"owner":{"severity":"HIGH","description":"Only this address can insert leaves into the tree."},"hasher":{"description":"Poseidon hasher used to compute the tree nodes."},"levels":{"severity":"LOW","description":"Height of the merkle tree."}}
    category:
    + {"name":"External Bridges","priority":1}
    }
    contract WithdrawalTree (eth:0xbFA347D89Ac54F7C2De2433458cb98A85fc03CEd) [tornado-cash/OwnableMerkleTree] {
    +++ description: Anonymity Mining - Legacy Poseidon merkle tree that stores deposit or withdrawal leaves for TornadoTreesV1. Only its owner can insert leaves.
    unverified:
    - true
    description:
    - "Unverified merkle tree instance that stores legacy Tornado withdrawal leaves for TornadoTreesV1."
    + "Anonymity Mining - Legacy Poseidon merkle tree that stores deposit or withdrawal leaves for TornadoTreesV1. Only its owner can insert leaves."
    +++ description: Poseidon hasher used to compute the tree nodes.
    values.hasher:
    + "eth:0x94C92F096437ab9958fC0A37F09348f30389Ae79"
    +++ description: Height of the merkle tree.
    +++ severity: LOW
    values.levels:
    + 20
    +++ description: Only this address can insert leaves into the tree.
    +++ severity: HIGH
    values.owner:
    + "eth:0x43a3bE4Ae954d9869836702AFd10393D3a7Ea417"
    implementationNames.eth:0xbFA347D89Ac54F7C2De2433458cb98A85fc03CEd:
    - ""
    + "OwnableMerkleTree"
    template:
    + "tornado-cash/OwnableMerkleTree"
    sourceHashes:
    + ["0x218d9a152ab9d469cf4baf2591677b19bb64e6885452ccc071bfbf6eca60c9aa"]
    fieldMeta:
    + {"owner":{"severity":"HIGH","description":"Only this address can insert leaves into the tree."},"hasher":{"description":"Poseidon hasher used to compute the tree nodes."},"levels":{"severity":"LOW","description":"Height of the merkle tree."}}
    category:
    + {"name":"External Bridges","priority":1}
    }
    + Status: CREATED
    contract PoseidonHasher2 (eth:0x94C92F096437ab9958fC0A37F09348f30389Ae79) [N/A]
    +++ description: Anonymity Mining - Unverified Poseidon hasher used by the legacy DepositTree and WithdrawalTree to hash tree nodes.
    2026 October 01, 10:49 UTC
    1change

    Proposal 69 (1,000 TORN to Mr Anon) was defeated (~163k for vs ~458k TORN against). The same proposer resubmitted it as proposal 70 (voting active, ends 2026-10-06) with a new verified Proposal contract (eth:0x04C2eb6Df3bF6032b8e07a03Fc9a5Ca424414483): 1,000 TORN split into 500 TORN to abusedotch and 500 TORN to JJ (Mr Anon's share, redirected as repayment). It only transfers TORN from governance, no protocol parameters or contracts are changed.

    Proposal 69 (1,000 TORN to Mr Anon) was defeated (~163k for vs ~458k TORN against). The same proposer resubmitted it as proposal 70 (voting active, ends 2026-10-06) with a new verified Proposal contract (eth:0x04C2eb6Df3bF6032b8e07a03Fc9a5Ca424414483): 1,000 TORN split into 500 TORN to abusedotch and 500 TORN to JJ (Mr Anon’s share, redirected as repayment). It only transfers TORN from governance, no protocol parameters or contracts are changed.

    contract GovernanceProposalStateUpgrade (eth:0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce) [tornado-cash/GovernanceProposalStateUpgrade] {
    +++ description: Upgradeable Tornado Cash governance contract that manages proposals, voting, execution, and treasury-connected governance modules. If you trust this contract, you trust its upgrade path and proposal rules to change protocol governance behavior.
    values.proposalCount:
    - 69
    + 70
    }
    2026 September 28, 10:54 UTC
    1change

    New proposal on DAO to reward Mr Anon with 1000 TORN for taking down fradulent tornado.cash frontend. This is a legit proposal that originates from Tornado Cash DAO tg channel.

    New proposal on DAO to reward Mr Anon with 1000 TORN for taking down fradulent tornado.cash frontend. This is a legit proposal that originates from Tornado Cash DAO tg channel.

    contract GovernanceProposalStateUpgrade (eth:0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce) [tornado-cash/GovernanceProposalStateUpgrade] {
    +++ description: Upgradeable Tornado Cash governance contract that manages proposals, voting, execution, and treasury-connected governance modules. If you trust this contract, you trust its upgrade path and proposal rules to change protocol governance behavior.
    values.proposalCount:
    - 68
    + 69
    }
    2026 August 21, 10:25 UTC
    1change

    New proposal to update DAO-controled tornado cash frontend: https://github.com/tornado-dao/classic-ui/compare/e312df5a4f6caaa7e93f1b5960c603d8dd7ec67a...17c54dae9ad91bb3c6d62a7860df6cd365ab76d4. It replaces RPC queries with Graph queries, sources proposal states from the onchain data, changes source link from Codeberg to GitHub and adds a phishing website notice board for tornado.cash. Sol verified that the published CID matches the changes.

    New proposal to update DAO-controled tornado cash frontend: https://github.com/tornado-dao/classic-ui/compare/e312df5a4f6caaa7e93f1b5960c603d8dd7ec67a…17c54dae9ad91bb3c6d62a7860df6cd365ab76d4. It replaces RPC queries with Graph queries, sources proposal states from the onchain data, changes source link from Codeberg to GitHub and adds a phishing website notice board for tornado.cash.

    Sol verified that the published CID matches the changes.

    contract GovernanceProposalStateUpgrade (eth:0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce) [tornado-cash/GovernanceProposalStateUpgrade] {
    +++ description: Upgradeable Tornado Cash governance contract that manages proposals, voting, execution, and treasury-connected governance modules. If you trust this contract, you trust its upgrade path and proposal rules to change protocol governance behavior.
    values.proposalCount:
    - 67
    + 68
    }
    2026 July 03, 08:56 UTC
    4changes

    Manually verified the Tornado Cash MiMC hasher against the pinned Tornado circomlib MiMC sponge generator and deployment bytecode.

    Manually verified the Tornado Cash MiMC hasher against the pinned Tornado circomlib MiMC sponge generator and deployment bytecode.

    New and verified contracts

    contract MiMCHasher (eth:0x83584f83f26aF4eDDA9CBe8C730bc87C364b28fe) [N/A] {
    +++ description: MiMC hasher used by newer Tornado pool generations for commitment-tree operations, manually verified against the pinned Tornado circomlib generator.
    unverified:
    - true
    description:
    - "Unverified MiMC hasher used by newer Tornado pool generations for commitment-tree operations. If this contract were malicious or had a backdoor, all pools using it would be compromised."
    + "MiMC hasher used by newer Tornado pool generations for commitment-tree operations, manually verified against the pinned Tornado circomlib generator."
    sourceHashes:
    + ["0x96acbaf2288d4cc44cf8e9634da42d922960c005a6982e0b54a84823be2776f2"]
    references:
    + [{"text":"Tornado Cash hasher build script","href":"https://github.com/tornadocash/tornado-core/blob/master/scripts/compileHasher.js"},{"text":"Source Code","href":"https://github.com/tornadocash/circomlib/blob/c372f14d324d57339c88451834bf2824e73bbdbc/src/mimcsponge_gencontract.js"}]
    }

    Permissions

    A dashboard to explore contracts and permissions
    Go to Disco
    Disco UI Banner
    Disco UI BannerExplore in Disco

    Ethereum

    Actors:

    GovernanceProposalStateUpgrade0x5efd…A1Ce

    Upgradeable Tornado Cash governance contract that manages proposals, voting, execution, and treasury-connected governance modules. If you trust this contract, you trust its upgrade path and proposal rules to change protocol governance behavior. Member of GnosisSafe.

    • Can upgrade with no delay
      • TornadoTreesV2
      • RelayerRegistry
      • TornadoStakingRewards
      • GovernanceProposalStateUpgrade
      • FeeManager
      • InstanceRegistry
    • Can interact with TornadoTreesV2
      • replace the proxy allowed to enqueue deposit and withdrawal leaves
      • replace the verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. used for batched tree updates
    • Can interact with RelayerRegistry
      • change the router address allowed to burn relayer stake during withdrawals
      • nullify a registered relayer’s staked balance
      • set the minimum TORN stake required to become a relayer
    • Can interact with TornadoStakingRewards
      • update user reward accounting when locked balances change
      • withdraw TORN held by the staking rewards contract
    • Can interact with FeeManager
      • change how long cached per-instance fees remain valid before they must be recomputed
      • change the TWAP lookback period used to price Tornado instances
      • change the Uniswap fee tier used for the TORN price source
    • Can interact with TornadoProxyV2
      • add or update supported pool instances
      • replace the connected Tornado Trees contract
      • rescue tokens sent to the proxy
    • Can interact with Miner
      • change the reward-swap pool weight used when distributing TORN rewards
      • replace the connected Tornado Trees contract
      • replace the reward, withdrawal, and tree-update verifiers
      • set mining reward rates
    • Can interact with TORN
      • manage the allowlist of addresses that can transfer while TORN is paused
      • pause or unpause TORN transfers after the initial pause period expires
      • rescue arbitrary tokens held by the TORN contract
    • Can interact with TornadoProxyV1
      • enable or disable supported pool instances
      • rescue tokens sent to the proxy
    • Can interact with InstanceRegistry
      • add or update supported Tornado instances and their enabled/disabled state
      • change the router contract allowed to interact with registered instances
      • remove supported instances from the registry
      • set per-instance protocol fees charged to relayers
    • Can interact with TornadoRouter
      • rescue tokens sent to the router
    GnosisSafe0xb04E…a7B4

    A Multisig with 1/1 threshold.

    Participants (1):

    GovernanceProposalStateUpgrade

    Smart contracts

    A dashboard to explore contracts and permissions
    Go to Disco
    Disco UI Banner
    Disco UI BannerExplore in Disco
    A diagram of the smart contract architecture
    A diagram of the smart contract architecture

    Ethereum

    Pool_50K_cDAI0x0389…6003

    Fixed-denomination Tornado Cash pool for 50K cDAI deposits.

    Pool_10K_DAI0x0768…2730

    Fixed-denomination Tornado Cash pool for 10K DAI deposits.

    Pool_1000_USDT0x0836…872f

    Fixed-denomination Tornado Cash pool for 1000 USDT deposits.

    Pool_0.1_ETH0x12D6…B8Fc

    Fixed-denomination Tornado Cash pool for 0.1 ETH deposits.

    Pool_100_USDT0x169A…D52B

    Fixed-denomination Tornado Cash pool for 100 USDT deposits.

    Pool_0.1_WBTC0x1781…D0F1

    Fixed-denomination Tornado Cash pool for 0.1 WBTC deposits.

    Pool_5K_cDAI0x22aa…849b

    Fixed-denomination Tornado Cash pool for 5K cDAI deposits.

    Pool_100K_DAI0x2377…5334

    Fixed-denomination Tornado Cash pool for 100K DAI deposits.

    Pool_500K_cDAI0x2717…B701

    Fixed-denomination Tornado Cash pool for 500K cDAI deposits.

    Pool_1000_USDC0x4736…Ba9D

    Fixed-denomination Tornado Cash pool for 1000 USDC deposits.

    Pool_1_ETH0x47CE…2936

    Fixed-denomination Tornado Cash pool for 1 ETH deposits.

    RelayerRegistry0x58E8…3dF2Implementation (Upgradable)Admin

    Upgradeable registry of relayers, their worker addresses and their staked TORN. The app lists the relayers registered here, while the pools pay any relayer a withdrawal names.

    • Roles:
      • admin: GovernanceProposalStateUpgrade
      • governance: GovernanceProposalStateUpgrade
    Can be upgraded by:
    GovernanceProposalStateUpgrade with no delay
    FeeManager0x5f6c…D4D7Implementation (Upgradable)Admin

    Upgradeable fee manager that derives relayer burn fees for each Tornado instance from registry settings and Uniswap TWAP data.

    • Roles:
      • admin: GovernanceProposalStateUpgrade
      • governance: GovernanceProposalStateUpgrade
    Can be upgraded by:
    GovernanceProposalStateUpgrade with no delay
    Pool_1_WBTC0x610B…eaB4

    Fixed-denomination Tornado Cash pool for 1 WBTC deposits.

    MiMCHasher0x8358…28fe

    MiMC hasher used by every Tornado pool for commitment-tree operations (linked library in the 2019 pools, constructor argument in the 2021 pools), manually verified against the pinned Tornado circomlib generator.

    1. Tornado Cash hasher build script
    2. Source Code
    Pool_10_ETH0x910C…9DbF

    Fixed-denomination Tornado Cash pool for 10 ETH deposits.

    Pool_100_ETH0xA160…f291

    Fixed-denomination Tornado Cash pool for 100 ETH deposits.

    InstanceRegistry0xB20c…A911Implementation (Upgradable)Admin

    Upgradeable registry of supported Tornado Cash pool instances and their mutable per-instance fee and routing configuration.

    • Roles:
      • admin: GovernanceProposalStateUpgrade
      • governance: GovernanceProposalStateUpgrade
    Can be upgraded by:
    GovernanceProposalStateUpgrade with no delay
    Pool_10_WBTC0xbB93…F498

    Fixed-denomination Tornado Cash pool for 10 WBTC deposits.

    Pool_5M_cDAI0xD21b…20Af

    Fixed-denomination Tornado Cash pool for 5M cDAI deposits.

    Pool_100_DAI0xD4B8…Cfa3

    Fixed-denomination Tornado Cash pool for 100 DAI deposits.

    TornadoRouter0xd90e…F31b

    Router contract that validates supported instances, forwards deposits and withdrawals, and subtracts from relayer stake through the relayer registry during withdrawals.

    • Roles:
      • governance: GovernanceProposalStateUpgrade
    Pool_100_USDC0xd96f…4307

    Fixed-denomination Tornado Cash pool for 100 USDC deposits.

    Pool_1000_DAI0xFD86…7144

    Fixed-denomination Tornado Cash pool for 1000 DAI deposits.

    TornadoStakingRewards0x5B3f…8c29Implementation (Upgradable)Admin

    Staking contract that escrows TORN staked by relayers. With time, their stake is subtracted from for being officially registered as relayers and receiving fees from each withdrawal, and is redirected as TORN rewards for governance participants who are locking their TORN for voting/staking.

    • Roles:
      • admin: GovernanceProposalStateUpgrade
      • governance: GovernanceProposalStateUpgrade
    Can be upgraded by:
    GovernanceProposalStateUpgrade with no delay
    TORN0x7777…116C

    TORN governance token contract. Transfers start paused and can later be toggled by governance, which also controls the paused-transfer allowlist and token rescue functions.

    • Roles:
      • governance: GovernanceProposalStateUpgrade
    WithdrawVerifier0x0919…875E

    Anonymity Mining - VerifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. contract for Tornado anonymity-mining withdrawal proofs.

    TornadoTreesV10x43a3…a417

    Anonymity Mining - Legacy Tornado Trees contract that records deposit and withdrawal leaves from TornadoProxyV1 and maintains the roots later consumed by migration and mining logic.

    TornadoTreesV20x5276…31ceImplementation (Upgradable)Admin

    Anonymity Mining - Upgradeable batch-based Tornado Trees contract that reuses legacy tree state, queues new leaves from the newer proxy, and accepts batched root updates proven by a verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover..

    • Roles:
      • admin: GovernanceProposalStateUpgrade
      • governance: GovernanceProposalStateUpgrade
    Can be upgraded by:
    GovernanceProposalStateUpgrade with no delay
    RewardSwap0x5cab…ed2A

    Anonymity Mining - Liquidity schedule that pays out TORN rewards for anonymity mining. Only the Miner contract can draw from it or adjust the reward weight.

    DepositTree0x6234…3226

    Anonymity Mining - Legacy Poseidon merkle treeA hash-based data structure in which each leaf node is a hash of a block of data, and each non-leaf node is a hash of its children. The root of the tree is a cryptographic fingerprint of the entire data structure. Merkle trees (Merkle Patricia Tries) are used in Ethereum to efficiently store key-value pairs. that stores deposit or withdrawal leaves for TornadoTreesV1. Only its owner can insert leaves.

    TreeUpdateVerifier0x6534…0c32

    Anonymity Mining - VerifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. contract for Tornado mining account-tree update proofs.

    TornadoProxyV20x7221…6967

    Anonymity Mining - Newer immutable Tornado proxy that routes deposits and withdrawals to supported pool instances and records them in the upgraded Tornado Trees contract.

    • Roles:
      • governance: GovernanceProposalStateUpgrade
    Miner0x746A…78E9

    Anonymity Mining - Mining and reward-distribution contract for Tornado anonymity mining. It verifies reward and withdrawal proofs, maintains account roots, and routes TORN rewards through the swap contract.

    • Roles:
      • governance: GovernanceProposalStateUpgrade
    RewardVerifier0x88fd…C307

    Anonymity Mining - VerifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. contract for Tornado anonymity-mining reward proofs.

    TornadoProxyV10x905b…7601

    Anonymity Mining - Legacy immutable Tornado proxy that routes deposits and withdrawals to pool instances and records them in the legacy Tornado Trees contract.

    • Roles:
      • governance: GovernanceProposalStateUpgrade
    PoseidonHasher20x94C9…Ae79

    Anonymity Mining - Unverified Poseidon hasher used by the legacy DepositTree and WithdrawalTree to hashA fixed-length fingerprint of variable-size input, produced by a hash function. tree nodes. The source code of this contract is not verified on Etherscan.

    WithdrawalTree0xbFA3…3CEd

    Anonymity Mining - Legacy Poseidon merkle treeA hash-based data structure in which each leaf node is a hash of a block of data, and each non-leaf node is a hash of its children. The root of the tree is a cryptographic fingerprint of the entire data structure. Merkle trees (Merkle Patricia Tries) are used in Ethereum to efficiently store key-value pairs. that stores deposit or withdrawal leaves for TornadoTreesV1. Only its owner can insert leaves.

    PoseidonHasher0xD82e…73d2

    Anonymity Mining - Unverified Poseidon hasher used by TornadoTreesV1 to hashA fixed-length fingerprint of variable-size input, produced by a hash function. deposit and withdrawal leaves. The source code of this contract is not verified on Etherscan.

    BatchTreeUpdateVerifier0xEd3B…07C6

    Anonymity Mining - VerifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. contract for batched Tornado Trees root updates.

    TornadoVault0x2F50…2185

    Vault that escrows locked TORN of governance participants who wish to receive voting rights.

    Verifier0xce17…557A

    Groth16A zk-SNARK proving system introduced by Groth in 2016 that proves arithmetic circuits and requires a separate trusted setup for each circuit. It allows extremely efficient proof verification. verifierAn entity in a ZK-Rollup, often a smart contract, that verifies zero-knowledge proofs submitted by a prover. contract used by Tornado Cash pool withdrawal proofs.

    GasCompensationVault0xFA4C…59ef

    Vault that escrows ETH for governance gasA virtual fuel used to execute smart contracts on a rollup. The EVM (or other VM within the rollup) uses an accounting mechanism to correspond the consumption of gas to the consumption of computing resources, and to limit the consumption of computing resources.-compensation payouts and can return unused funds to governance.

    The current deployment carries some associated risks:

    • Funds can be stolen if the source code of unverified contracts contains malicious code (CRITICAL).