# Tornado Cash

Markdown version of https://l2beat.com/privacy/projects/tornado-cash

## Summary

- Total Value Locked: $673.70 M (-5.08% compared to seven days ago)
- Assets tracked: 6
- Buckets tracked: 19
- Deposits 7D: 1.92 K (+3.43% compared to the previous seven days)
- Deposits 30D: 8.91 K
- Deposits Total: 310.89 K
- Active Relayers 30D: 28
- Tracked on: Ethereum
- Attributes: ZK, Fixed amounts

### Risks

- Trusted setup: 30 participants (sentiment: warning). Tornado Cash: Circuit-specific trusted setup for Groth16 Tornado Cash circuits. It was built on top of 30 phase 1 contributions, and reached 1114 phase 2 participants. Proving system could be broken if either phase 1 or 2 is compromised.
- Exit window: Infinite (sentiment: good). The core Tornado Cash contracts are immutable and have no admin upgrade path, so users can always withdraw with a valid note and proof. This protocol passes the walkaway test: users can fully use it if all centralized protocol participants disappear.
- Privacy: Link privacy. Public observer: Link private (sentiment: good); Chain analyst: Link private (sentiment: good); Network observer: Link private (sentiment: good); Privileged insider: Link private (sentiment: good); Future adversary: Link at risk (sentiment: warning).
- Reproducibility: Reproducible (sentiment: good). There is at least one practical way to participate in Tornado Cash using published source code that can be audited and run locally.

### About

A classic Ethereum mixer design based on fixed-denomination pools and zk withdrawals.

### Links

- Website: https://app.ens.domains/tornadocash.eth?tab=records
- Social: https://t.me/TornadoCashOfficialDAO
- Contracts explorer (Disco): https://disco.l2beat.com/ui/p/tornado-cash

## Protocol description

Tornado Cash is a non-custodial mixer on Ethereum built around separate fixed-denomination pools, which prevents linking deposits and withdrawals via the amount. A deposit publishes a commitment into a Merkle tree producing a secret note, and a later withdrawal uses a zk-SNARK proof and the note to send the same denomination to a different address, breaking the deposit-withdrawal link. The note represents ownership of tokens in a Tornado cash pool, and losing it will effectively mean losing the tokens.

The core mixer contracts are immutable and have no admin, pause, or upgrade path, so funds can only move out with a valid proof. However Tornado cash features TORN token governance, which controls peripheral smart contracts: official pool registry, relayer registration requirement and TORN tokenomics.

### Privacy considerations

Tornado cash introduces a permissionless relayer network, which is essential for practical privacy. Relayers process withdrawals from Tornado cash pools on user's behalf for a fee, which enables withdrawals to fresh addresses without funding them before the withdrawal. Without an active relayer network, practical privacy of Tornado cash deteriorates significantly.

Practical privacy also depends on the timing of deposits and withdrawals, underlying network and browser used to interact with Tornado cash frontend (if used), RPC providers used to send transactions and query public blockchain state. Users are advised to research [OPSEC best practice](https://l2beat.com/publications/privacy-best-practices).

### Fees

The immutable Tornado Cash pools do not charge a protocol-level deposit or withdrawal fee. Withdrawals can include a relayer fee chosen offchain between the user and the relayer and passed to the pool withdrawal call.

### Compliance

Tornado cash does not have any protocol-level compliance features. However, it provides an optional [Compliance Tool](https://docs.tornado.cash/tornado-cash-classic/compliance-tool), which allows users to generate a proof linking a withdrawal to a specific deposit without revealing this information publicly onchain. This enables users to selectively disclose the origin of funds to third parties, such as exchanges or regulators.

Protocol pools were [sanctioned by OFAC in August 2022](https://home.treasury.gov/news/press-releases/jy0916), flagging funds moved through these smart contracts as illicit and resulting in broad censorship (mainly by block builders) of transactions touching the contracts. Sanctions were lifted on March 21, 2025.

### Anonymity set

A user's anonymity set consists of all previous deposits into the same bucket (i.e. deposits of the same token and amount). Deposits can be mixed only with other deposits of the same token and denomination. To maximize the anonymity set, users are advised to deposit into the buckets with the most usage.

### Secure frontend

For average users, the Tornado Cash frontend must be recognized as a critical part of the privacy protocol. If compromised, it can steal user assets and violate user privacy, which [was exploited in 2024](https://www.coindesk.com/business/2024/02/26/tornado-cash-reportedly-suffers-backend-exploit-user-deposits-at-risk).

The frontend's root of trust is the IPFS content hash registered for [tornadocash.eth](https://app.ens.domains/tornadocash.eth?tab=records) in the ENS smart contract on Ethereum.
The latest hash can be fetched from a trusted ethereum node (e.g. your own or trusted light node rpc).
There were incidents of malicious frontend hash updates passing onchain governance proposals before, so using a publicly audited or self-audited IPFS hash is advised.
An example of an audit process with useful links can be found [here](https://gist.github.com/pcaversaccio/ea7f62fd21b6e22f301980007f7c767e) or [here](https://notes.ethereum.org/@GW1ZUbNKR5iRjjKYx6_dJQ/Bk8zsJ9xj).
The frontend can then be accessed by running a local IPFS node that automatically fetches the verified frontend hash (e.g. [dapp3.eth](https://github.com/apoorvlathey/dapp3) or [kubo](https://github.com/ipfs/kubo) + [ipfs-companion](https://github.com/ipfs/ipfs-companion) and serves it in the browser locally.

## Privacy

**What the protocol promises:** Hides which deposit funds which withdrawal. Everything else is public.

On public blockchains like Ethereum, all actions transparent by default. A privacy protocol can at best cut the link between addresses or offer privacy while deposited. The colour says whether a careful user can keep the link, amount or recipient private against that adversary: green yes, yellow only outside supported options or by accepting another leak, red no. Fields marked at risk stay private only under the condition in their note.

### Public observer

Link private (sentiment: good)

**Who:** Everyone with a block explorer and some basic tools. Sees every public onchain event, but does no correlation beyond following links. Examples: A curious counterparty, an employer, a journalist.

Each pool has one fixed amount and no in-pool transfers, so every withdrawal spends exactly one deposit.

**Advice:** Exit through a relayer, so no wallet of yours pays gas for the receiving address.

**Sources**

- [1 ETH pool](https://l2beat.com/privacy/projects/tornado-cash#Pool_1_ETH)
- [Withdrawal circuit](https://github.com/tornadocash/tornado-core/blob/master/circuits/withdraw.circom)

### Chain analyst

Link private (sentiment: good)

**Who:** Scrapes all public data and correlates it: timing, amounts, gas and wallet fingerprints, address clusters. Examples: Chain analytics firms, ZachXBT, data brokers.

The candidates for a withdrawal are the unspent deposits of the same pool, the anonymity set, which differs sharply between pools. Timing, address reuse and relayer choice narrow it further. Paying gas from your own wallet instead of a relayer exposes that wallet's fingerprint, its account implementation and fee habits, even from a fresh address.

**Advice:** Use a pool with a large anonymity set. Deposit a large sum as one note. Wait before exiting and pick a different time of day than the deposit. Exit to a fresh address every time and spend from it with a different wallet than the one that deposited.

**Sources**

- [Tutela (arXiv:2201.06811)](https://arxiv.org/abs/2201.06811)
- [Blockchain is Watching You (arXiv:2005.14051)](https://arxiv.org/abs/2005.14051)

### Network observer

Link private (sentiment: good)

**Who:** Sits between the user and the chain and sees web2 traffic only: RPC providers, relayers and broadcasters, indexers, ISPs. Learns IP addresses, timing, browser fingerprints, ciphertext and what becomes public. Assumes Tor to send transactions and, where the client has an RPC setting, an own node to read the blockchain. Examples: Infura or Alchemy, a Tornado relayer, a wallet vendor selling telemetry, Google captcha or analytics in the dapp frontend.

The app downloads all deposits and matches locally, so a node learns only which pool you looked at. The relayer receives only the finished withdrawal.

**Advice:** Read the chain from your own node, send through a public RPC over Tor, and use a popular relayer. If you settle for a VPN instead of Tor, pick one you trust: it hides your IP from the relayer but sees it itself.

**Sources**

- [Event sync (classic UI)](https://github.com/tornadocash/tornado-classic-ui/blob/master/services/events.js)
- [Relayer endpoint](https://github.com/tornadocash/tornado-relayer/blob/master/src/contollers/controller.js)

### Privileged insider

Link private (sentiment: good)

**Who:** Holds a protocol operator role or receives keys or plaintext by design: upgrade admin, sequencer, decryption or view key holder, TEE vendor, association set provider, hosted prover, note registry. Examples: A compliance backdoor key, a DAO with an upgrade key, a KMS committee, an ASP operator.

The pools cannot be paused, upgraded or made to reveal anything. Governance controls only the website, the router and the relayer list.

**Advice:** Run an inspected local build of the client instead of the hosted frontend. Otherwise load it from its ENS name or IPFS hash.

**Sources**

- [0.1 ETH pool (no operator)](https://l2beat.com/privacy/projects/tornado-cash#Pool_0.1_ETH)
- [InstanceRegistry](https://l2beat.com/privacy/projects/tornado-cash#InstanceRegistry)
- [Permissions](https://l2beat.com/privacy/projects/tornado-cash#permissions)

### Future adversary

Link at risk (sentiment: warning)

**Who:** Harvest now, decrypt later. Holds every byte ever written onchain plus any retained logs, and future cryptanalysis such as a large quantum computer that breaks elliptic-curve key exchange and pairings, but not hashes, symmetric ciphers or lattices. Examples: First well-funded insiders, then everyone in a potential post-quantum future.

Commitments use a Pedersen hash on an elliptic curve. A quantum computer could test whether a given deposit can fund a withdrawal, shrinking the candidate set without singling out one deposit. Notes backed up onchain are encrypted with elliptic-curve keys and become readable.

**Advice:** Use a pool with a large anonymity set. Keep the note on your device and skip the onchain backup.

**Sources**

- [Pedersen hash circuit (pinned circomlib fork)](https://github.com/tornadocash/circomlib/blob/c372f14d324d57339c88451834bf2824e73bbdbc/circuits/pedersen.circom)
- [Commitment and nullifier hashing](https://github.com/tornadocash/tornado-core/blob/v2.1/circuits/withdraw.circom)
- [Onchain note backups](https://l2beat.com/privacy/projects/tornado-cash#TornadoRouter)

## Value Locked

The interactive value chart is shown on [the HTML page](https://l2beat.com/privacy/projects/tornado-cash#privacy-tvl).

## Anonymity sets

### 30 day historic anonymity set

How many unique addresses you could have blended in with if you withdrew on a particular day after depositing during the previous 30 days. This metric is a proxy for the historic anonymity set and shows how it developed over time.

The metric looks backwards: it counts deposits that already happened, including from addresses that have since withdrawn. Your real anonymity also depends on deposits made after yours, which cannot be known in advance.

### Estimated anonymity set by holding duration

An estimate of how many unique addresses you blend in with, depending on how long you leave your deposit in the pool. It is based on historic data of past deposits: each point counts depositors from the preceding period, so holding for up to 30 days effectively means blending in with everyone who deposited during the last 30 days.

The interactive charts are shown on [the HTML page](https://l2beat.com/privacy/projects/tornado-cash#privacy-anonymity-set).

## Flows

The interactive flows chart is shown on [the HTML page](https://l2beat.com/privacy/projects/tornado-cash#privacy-flows).

## Assets Breakdown

| Asset | Buckets | Deposits 7D | Deposits 30D | Deposits Total | Value Locked |
| --- | --- | --- | --- | --- | --- |
| ETH | 4 | 1.77 K ($13.75 M) | 8.63 K ($100.23 M) | 294.11 K ($13.40 B) | $658.81 M |
| ETH: ETH 0.1 bucket |  | 1.16 K ($310.81 K) | 5.21 K ($1.34 M) | 73.34 K ($16.61 M) | — |
| ETH: ETH 1 bucket |  | 417 ($1.11 M) | 2.20 K ($5.75 M) | 94.76 K ($225.41 M) | — |
| ETH: ETH 10 bucket |  | 170 ($4.58 M) | 950 ($24.80 M) | 77.44 K ($1.85 B) | — |
| ETH: ETH 100 bucket |  | 29 ($7.74 M) | 262 ($68.32 M) | 48.55 K ($11.30 B) | — |
| DAI | 4 | 5 ($3.19 K) | 75 ($2.45 M) | 9.64 K ($474.78 M) | $7.87 M |
| DAI: DAI 100 bucket |  | 2 ($199.98) | 14 ($1.39 K) | 462 ($46.26 K) | — |
| DAI: DAI 1000 bucket |  | 3 ($2.99 K) | 25 ($24.99 K) | 1.36 K ($1.36 M) | — |
| DAI: DAI 10000 bucket |  | 0 ($0.00) | 13 ($129.97 K) | 3.43 K ($34.43 M) | — |
| DAI: DAI 100000 bucket |  | 0 ($0.00) | 23 ($2.29 M) | 4.38 K ($438.94 M) | — |
| WBTC | 3 | 0 ($0.00) | 2 ($17.06 K) | 2.40 K ($535.43 M) | $6.91 M |
| WBTC: WBTC 0.1 bucket |  | 0 ($0.00) | 2 ($17.06 K) | 156 ($712.38 K) | — |
| WBTC: WBTC 1 bucket |  | 0 ($0.00) | 0 ($0.00) | 1.04 K ($40.85 M) | — |
| WBTC: WBTC 10 bucket |  | 0 ($0.00) | 0 ($0.00) | 1.20 K ($493.86 M) | — |
| USDT | 2 | 142 ($132.99 K) | 192 ($166.78 K) | 3.08 K ($2.21 M) | $40.18 K |
| USDT: USDT 100 bucket |  | 10 ($999.87) | 28 ($2.79 K) | 975 ($97.51 K) | — |
| USDT: USDT 1000 bucket |  | 132 ($131.99 K) | 164 ($163.98 K) | 2.11 K ($2.11 M) | — |
| USDC | 2 | 1 ($999.96) | 11 ($7.39 K) | 1.32 K ($973.71 K) | $31.58 K |
| USDC: USDC 100 bucket |  | 0 ($0.00) | 4 ($399.92) | 392 ($39.20 K) | — |
| USDC: USDC 1000 bucket |  | 1 ($999.96) | 7 ($6.99 K) | 934 ($934.50 K) | — |
| cDAI | 4 | 0 ($0.00) | 0 ($0.00) | 324 ($13.31 M) | $25.31 K |
| cDAI: cDAI 5000 bucket |  | 0 ($0.00) | 0 ($0.00) | 5 ($505.50) | — |
| cDAI: cDAI 50000 bucket |  | 0 ($0.00) | 0 ($0.00) | 118 ($126.17 K) | — |
| cDAI: cDAI 500000 bucket |  | 0 ($0.00) | 0 ($0.00) | 87 ($934.26 K) | — |
| cDAI: cDAI 5000000 bucket |  | 0 ($0.00) | 0 ($0.00) | 114 ($12.25 M) | — |
| Total |  | 1.92 K ($13.89 M) | 8.91 K ($102.88 M) | 310.89 K ($14.43 B) | $673.70 M |

## Risk summary

### Funds can be stolen if
1. the zk proof system is broken, allowing invalid withdrawals.
2. the [trusted setup](https://l2beat.com/privacy/projects/tornado-cash#trusted-setups) is compromised or all ceremony participants collude, allowing invalid withdrawals.

### Funds can be lost if
1. a user loses the note secrets required to withdraw.

### Privacy can be lost if
1. no relayer is available and the withdrawal must be submitted from an address that can be linked to the user (see [best practice page](https://l2beat.com/publications/privacy-best-practices) for more info).

## Upgrades & Governance

Tornado cash has a TORN DAO, which does not have the authority to upgrade or modify existing pools in any way. However it controls a significant portion of the Tornado cash protocol and periphery, including:

1. **Default router for deposits and withdrawals and the official registry of supported pools**. Malicious upgrades of these components could lead to users losing deposited tokens.
2. **Standard UI IPFS hash registered on ENS** ([link](https://app.ens.domains/tornadocash.eth)). Malicious upgrades of these components could lead to users losing deposited tokens.
3. **TORN token itself**. Malicious upgrades of the token could lead to token transfers being frozen.
4. **Registered relayers**. Malicious upgrades of these components could remove all registered relayers, disrupting user-relayer coordination and complicating private withdrawals.

### Governance profile

#### Upgrades

| Property | Value |
| --- | --- |
| Normal upgrade path | Lock and optionally delegate TORN in the [Governance contract](https://etherscan.io/address/0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce) → submit a proposal with at least **1.00 K TORN** → wait 1m 15s → vote for 5d (extended by 6h if the outcome changes during the last 1h) → pass with a simple majority and **100.00 K TORN** quorum → wait 2d → permissionless execution within 3d. The DAO controls protocol and periphery components, but cannot upgrade or modify existing pools. |
| Exit window | **2d** for DAO-controlled changes — an accepted proposal remains timelocked for this period before it can be executed. Existing Tornado Cash pools are immutable and cannot be upgraded by the DAO. |

#### Token governance

| Property | Value |
| --- | --- |
| Governance token | `TORN`, 1 token = 1 vote, delegated. Total supply: **9.99 M TORN**, DAO-owned TORN (unavailable for voting): **4.73 M TORN**, staked for voting: **2.57 M TORN**, the rest is circulating supply. |
| Stake lock | After voting or proposing, staked tokens are locked for **5d 6h** after proposal ends, preventing governance hopping. |
| Voting venue | [Governance contract](https://etherscan.io/address/0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce) on Ethereum. Proposals are viewable on the voting tab of the frontend, see the note on secure frontend above. |
| Proposal threshold | **1.00 K TORN** locked in governance. |
| Quorum | **100.00 K TORN**, with a simple majority required for acceptance. |
| Execution model | **Permissionless execution after an onchain vote and timelock.** An accepted proposal waits 2d and can then be executed by anyone within 3d. Proposal executable payload is committed in the `propose()` transaction. |

## Trusted setup

Risk levels follow the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381). Yellow (medium risk): all contributions are published and the final output can be verified, the ceremony client is open source, there were at least 30 contributions, participation was open to the public and announced, and participants are publicly identified. Green (lowest risk): everything required for yellow, with at least 150 contributions. Red (highest risk): at least one requirement for yellow is not met. N/A: the proof system needs no trusted setup.

### Tornado Cash

- Risk: yellow (medium risk)
- Proof systems: websnark (Groth16)

Circuit-specific trusted setup for Groth16 Tornado Cash circuits. It was publicly announced as a Phase 2 ceremony
built on top of the [30th contribution to the Perpetual Powers of Tau ceremony](https://tornado-cash.medium.com/tornado-cash-trusted-setup-ceremony-b846e1e00be1), and completed in May 2020. It
collected 1114 contributions over 10 days, with 450 identified contributors and 664 anonymous ones. Tornado Cash
published the participant list, archive of contributions and artifacts, and the generated verifier contract.

- Phase 1 ceremony (first 30 contributions are used): <https://github.com/privacy-ethereum/perpetualpowersoftau>.
- Ceremony completion announcement: [https://tornado-cash.medium.com/the-biggest-trusted-setup-ceremony-in-the-world-3c6ab9c8fffa](https://tornado-cash.medium.com/the-biggest-trusted-setup-ceremony-in-the-world-3c6ab9c8fffa)
- Ceremony page with participant list and archive download: [https://ceremony.tornado.cash/](https://ceremony.tornado.cash/)
- Initial ceremony announcement: [https://tornado-cash.medium.com/tornado-cash-trusted-setup-ceremony-b846e1e00be1](https://tornado-cash.medium.com/tornado-cash-trusted-setup-ceremony-b846e1e00be1)
- Ceremony code repository: [https://github.com/tornadocash/phase2-bn254](https://github.com/tornadocash/phase2-bn254)

## Verifier IDs

### Tornado Cash verifier v2.1

- Verifier ID: `Tornado Cash verifier 03.07.2026`
- Source: https://github.com/tornadocash/tornado-core/tree/v2.1/circuits
- Verification: successful (verified by [L2BEAT](https://l2beat.com))
- Used in: [Tornado Cash](https://l2beat.com/privacy/projects/tornado-cash)

**Known deployments**

- [0xce172ce1F20EC0B3728c9965470eaf994A03557A](https://etherscan.io/address/0xce172ce1F20EC0B3728c9965470eaf994A03557A#code) on Ethereum, used in: [Tornado Cash](https://l2beat.com/privacy/projects/tornado-cash)

#### Verification steps

This regeneration attests that the verifier smart contract verification keys correspond to circuits published in Tornado Cash release.

Generally, to regenerate Tornado Cash verifier, the following has to be done:

1. Checkout the correct branch of the sources: `https://github.com/tornadocash/tornado-core/tree/v2.1`.
2. Compile the `.circom` circuit sources into `.json`.
3. Fetch published prover keys for `tornado.params`. This file contains the circuit information and Groth16 phase 2 trusted setup information (final evaluation keys for all 1114 contributions). It does not contain phase 1 trusted setup data, which must be fetched separately.
4. Check that `tornado.params` was generated with the same compiled circuit as was obtained in step 2. This step will implicitly check the integrity of phase 2 trusted setup, and it will rely on the separately fetched phase 1 trusted setup files.
5. Generate verification keys from the prover key and make sure that it is identical to the one in the solidity smart contract.

Helper scripts that implement the flow above and more detailed explanations could be found in this [script .zip archive](https://trusted-setup-hosting.l2beat.com/privacy/tornado-cash/verification_tornado_cash.zip). This .zip must be extracted in `tornado-core` dir checked out on tag `v2.1` (commit hash `a533ad9ffb62163a42d4fa9a09984c5dd4e5c41d`) before the execution.

## Ossification & Updates

Each date links the update on the HTML page, which also shows its contract diffs.

### [2026-10-01 10:49 UTC](https://l2beat.com/privacy/projects/tornado-cash?update=6b9ec1ab) (1 change)

Proposal 69 (1,000 TORN to Mr Anon) was defeated (~163k for vs ~458k TORN against). The same proposer resubmitted it as proposal 70 (voting active, ends 2026-10-06) with a new verified Proposal contract (eth:0x04C2eb6Df3bF6032b8e07a03Fc9a5Ca424414483): 1,000 TORN split into 500 TORN to abusedotch and 500 TORN to JJ (Mr Anon's share, redirected as repayment). It only transfers TORN from governance, no protocol parameters or contracts are changed.

### [2026-09-28 10:54 UTC](https://l2beat.com/privacy/projects/tornado-cash?update=8e20f4e4) (1 change)

New proposal on DAO to reward Mr Anon with 1000 TORN for taking down fradulent `tornado.cash` frontend. This is a legit proposal that originates from Tornado Cash DAO tg channel.

### [2026-08-21 10:25 UTC](https://l2beat.com/privacy/projects/tornado-cash?update=24f9ce54) (1 change)

New proposal to update DAO-controled tornado cash frontend: https://github.com/tornado-dao/classic-ui/compare/e312df5a4f6caaa7e93f1b5960c603d8dd7ec67a...17c54dae9ad91bb3c6d62a7860df6cd365ab76d4. It replaces RPC queries with Graph queries, sources proposal states from the onchain data, changes source link from Codeberg to GitHub and adds a phishing website notice board for tornado.cash.

Sol verified that the published CID matches the changes.

### [2026-07-03 08:56 UTC](https://l2beat.com/privacy/projects/tornado-cash?update=e912d5f9) (4 changes)

Manually verified the Tornado Cash MiMC hasher against the pinned Tornado circomlib MiMC sponge generator and deployment bytecode.

### [2026-06-25 12:44 UTC](https://l2beat.com/privacy/projects/tornado-cash?update=36401cab) (1 change)

New proposal, (yet) unverified and malicious, see https://x.com/pcaversaccio/status/2070125180261896246 .

### [2026-04-30 11:24 UTC](https://l2beat.com/privacy/projects/tornado-cash?update=901152f6) (45 changes)

Config: use the new flattener implementation. Also cleaned up spammy disco

## Permissions

Explore these contracts and permissions in Disco, L2BEAT's contract explorer: https://disco.l2beat.com/ui/p/tornado-cash

### Ethereum

#### Actors

##### GovernanceProposalStateUpgrade

Addresses: [0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce](https://etherscan.io/address/0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce)

Upgradeable Tornado Cash governance contract that manages proposals, voting, execution, and treasury-connected governance modules. If you trust this contract, you trust its upgrade path and proposal rules to change protocol governance behavior.
Member of GnosisSafe.
- Can upgrade **with no delay**
  - TornadoTreesV2
  - RelayerRegistry
  - TornadoStakingRewards
  - GovernanceProposalStateUpgrade
  - FeeManager
  - InstanceRegistry
- Can interact with TornadoTreesV2
  - replace the proxy allowed to enqueue deposit and withdrawal leaves
  - replace the verifier used for batched tree updates
- Can interact with RelayerRegistry
  - change the router address allowed to burn relayer stake during withdrawals
  - nullify a registered relayer's staked balance
  - set the minimum TORN stake required to become a relayer
- Can interact with TornadoStakingRewards
  - update user reward accounting when locked balances change
  - withdraw TORN held by the staking rewards contract
- Can interact with FeeManager
  - change how long cached per-instance fees remain valid before they must be recomputed
  - change the TWAP lookback period used to price Tornado instances
  - change the Uniswap fee tier used for the TORN price source
- Can interact with TornadoProxyV2
  - add or update supported pool instances
  - replace the connected Tornado Trees contract
  - rescue tokens sent to the proxy
- Can interact with Miner
  - change the reward-swap pool weight used when distributing TORN rewards
  - replace the connected Tornado Trees contract
  - replace the reward, withdrawal, and tree-update verifiers
  - set mining reward rates
- Can interact with TORN
  - manage the allowlist of addresses that can transfer while TORN is paused
  - pause or unpause TORN transfers after the initial pause period expires
  - rescue arbitrary tokens held by the TORN contract
- Can interact with TornadoProxyV1
  - enable or disable supported pool instances
  - rescue tokens sent to the proxy
- Can interact with InstanceRegistry
  - add or update supported Tornado instances and their enabled/disabled state
  - change the router contract allowed to interact with registered instances
  - remove supported instances from the registry
  - set per-instance protocol fees charged to relayers
- Can interact with TornadoRouter
  - rescue tokens sent to the router

##### GnosisSafe

Addresses: [0xb04E030140b30C27bcdfaafFFA98C57d80eDa7B4](https://etherscan.io/address/0xb04E030140b30C27bcdfaafFFA98C57d80eDa7B4)

A Multisig with 1/1 threshold.

Participants (1): [0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce](https://l2beat.com/privacy/projects/tornado-cash#GovernanceProposalStateUpgrade) (GovernanceProposalStateUpgrade)

## Smart contracts

![A diagram of the smart contract architecture](https://l2beat.com/static/images/architecture/tornado-cash.0f3217b0.png)

Explore these contracts and permissions in Disco, L2BEAT's contract explorer: https://disco.l2beat.com/ui/p/tornado-cash

### Ethereum

#### Pool_50K_cDAI

Addresses: [0x03893a7c7463AE47D46bc7f091665f1893656003](https://etherscan.io/address/0x03893a7c7463AE47D46bc7f091665f1893656003#code)

Fixed-denomination Tornado Cash pool for 50K cDAI deposits.

#### Pool_10K_DAI

Addresses: [0x07687e702b410Fa43f4cB4Af7FA097918ffD2730](https://etherscan.io/address/0x07687e702b410Fa43f4cB4Af7FA097918ffD2730#code)

Fixed-denomination Tornado Cash pool for 10K DAI deposits.

#### Pool_1000_USDT

Addresses: [0x0836222F2B2B24A3F36f98668Ed8F0B38D1a872f](https://etherscan.io/address/0x0836222F2B2B24A3F36f98668Ed8F0B38D1a872f#code)

Fixed-denomination Tornado Cash pool for 1000 USDT deposits.

#### Pool_0.1_ETH

Addresses: [0x12D66f87A04A9E220743712cE6d9bB1B5616B8Fc](https://etherscan.io/address/0x12D66f87A04A9E220743712cE6d9bB1B5616B8Fc#code)

Fixed-denomination Tornado Cash pool for 0.1 ETH deposits.

#### Pool_100_USDT

Addresses: [0x169AD27A470D064DEDE56a2D3ff727986b15D52B](https://etherscan.io/address/0x169AD27A470D064DEDE56a2D3ff727986b15D52B#code)

Fixed-denomination Tornado Cash pool for 100 USDT deposits.

#### Pool_0.1_WBTC

Addresses: [0x178169B423a011fff22B9e3F3abeA13414dDD0F1](https://etherscan.io/address/0x178169B423a011fff22B9e3F3abeA13414dDD0F1#code)

Fixed-denomination Tornado Cash pool for 0.1 WBTC deposits.

#### Pool_5K_cDAI

Addresses: [0x22aaA7720ddd5388A3c0A3333430953C68f1849b](https://etherscan.io/address/0x22aaA7720ddd5388A3c0A3333430953C68f1849b#code)

Fixed-denomination Tornado Cash pool for 5K cDAI deposits.

#### Pool_100K_DAI

Addresses: [0x23773E65ed146A459791799d01336DB287f25334](https://etherscan.io/address/0x23773E65ed146A459791799d01336DB287f25334#code)

Fixed-denomination Tornado Cash pool for 100K DAI deposits.

#### Pool_500K_cDAI

Addresses: [0x2717c5e28cf931547B621a5dddb772Ab6A35B701](https://etherscan.io/address/0x2717c5e28cf931547B621a5dddb772Ab6A35B701#code)

Fixed-denomination Tornado Cash pool for 500K cDAI deposits.

#### Pool_1000_USDC

Addresses: [0x4736dCf1b7A3d580672CcE6E7c65cd5cc9cFBa9D](https://etherscan.io/address/0x4736dCf1b7A3d580672CcE6E7c65cd5cc9cFBa9D#code)

Fixed-denomination Tornado Cash pool for 1000 USDC deposits.

#### Pool_1_ETH

Addresses: [0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936](https://etherscan.io/address/0x47CE0C6eD5B0Ce3d3A51fdb1C52DC66a7c3c2936#code)

Fixed-denomination Tornado Cash pool for 1 ETH deposits.

#### RelayerRegistry

Addresses: [0x58E8dCC13BE9780fC42E8723D8EaD4CF46943dF2](https://etherscan.io/address/0x58E8dCC13BE9780fC42E8723D8EaD4CF46943dF2#code), [0x84b0c75c1F6211450FEC7289c32D717AdaDD702A](https://etherscan.io/address/0x84b0c75c1F6211450FEC7289c32D717AdaDD702A#code) (Implementation (Upgradable)), [0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce](https://etherscan.io/address/0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce#code) (Admin)

**Past upgrades** (Count of upgrades: 2, Last upgrade: 2y 10mo ago, Avg upgrade interval: 1y 1mo)

- 2023-11-18 14:09 UTC, upgrade of [RelayerRegistry](https://etherscan.io/address/0x58E8dCC13BE9780fC42E8723D8EaD4CF46943dF2#code): transaction [0x9b8cc0ca7bf2019b408eead6d2db8046957134183dd882007be41822082ab319](https://etherscan.io/tx/0x9b8cc0ca7bf2019b408eead6d2db8046957134183dd882007be41822082ab319), implementations: [0x84b0c75c1F6211450FEC7289c32D717AdaDD702A](https://etherscan.io/address/0x84b0c75c1F6211450FEC7289c32D717AdaDD702A#code) ([diff](https://disco.l2beat.com/diff/eth:0xA3b821A2C6C9a52533178a1f2B9Ff4AedbA880e6/eth:0x84b0c75c1F6211450FEC7289c32D717AdaDD702A))
- 2023-11-02 13:58 UTC, upgrade of [RelayerRegistry](https://etherscan.io/address/0x58E8dCC13BE9780fC42E8723D8EaD4CF46943dF2#code): transaction [0x3d11319e48b756e50c873bebe3a34d2e8f536436d70f99bfd6da03e4ea5642e4](https://etherscan.io/tx/0x3d11319e48b756e50c873bebe3a34d2e8f536436d70f99bfd6da03e4ea5642e4), implementations: [0xA3b821A2C6C9a52533178a1f2B9Ff4AedbA880e6](https://etherscan.io/address/0xA3b821A2C6C9a52533178a1f2B9Ff4AedbA880e6#code) ([diff](https://disco.l2beat.com/diff/eth:0xe27B91724C55E950F68b394f33FA3B86693179C0/eth:0xA3b821A2C6C9a52533178a1f2B9Ff4AedbA880e6))
- 2023-06-04 13:50 UTC, deployment of [RelayerRegistry](https://etherscan.io/address/0x58E8dCC13BE9780fC42E8723D8EaD4CF46943dF2#code): transaction [0x98125b78ef0dc7fd040764f37ee24e40ae5352b8551ba671aa7bd8e8320dcef9](https://etherscan.io/tx/0x98125b78ef0dc7fd040764f37ee24e40ae5352b8551ba671aa7bd8e8320dcef9), implementations: [0xe27B91724C55E950F68b394f33FA3B86693179C0](https://etherscan.io/address/0xe27B91724C55E950F68b394f33FA3B86693179C0#code)

Upgradeable registry that tracks registered relayers, their worker addresses, and their staked TORN balances used to service withdrawals. Relayers registered here could be queried by a tornadocash frontend to facilitate discovery for users, but users are free to use any (unregistered) relayer at withdrawal time.
- Roles:
  - **admin**: GovernanceProposalStateUpgrade
  - **governance**: GovernanceProposalStateUpgrade

Can be upgraded by: GovernanceProposalStateUpgrade with no delay

#### FeeManager

Addresses: [0x5f6c97C6AD7bdd0AE7E0Dd4ca33A4ED3fDabD4D7](https://etherscan.io/address/0x5f6c97C6AD7bdd0AE7E0Dd4ca33A4ED3fDabD4D7#code), [0xf4B067dD14e95Bab89Be928c07Cb22E3c94E0DAA](https://etherscan.io/address/0xf4B067dD14e95Bab89Be928c07Cb22E3c94E0DAA#code) (Implementation (Upgradable)), [0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce](https://etherscan.io/address/0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce#code) (Admin)

Upgradeable fee manager that derives relayer burn fees for each Tornado instance from registry settings and Uniswap TWAP data.
- Roles:
  - **admin**: GovernanceProposalStateUpgrade
  - **governance**: GovernanceProposalStateUpgrade

Can be upgraded by: GovernanceProposalStateUpgrade with no delay

#### Pool_1_WBTC

Addresses: [0x610B717796ad172B316836AC95a2ffad065CeaB4](https://etherscan.io/address/0x610B717796ad172B316836AC95a2ffad065CeaB4#code)

Fixed-denomination Tornado Cash pool for 1 WBTC deposits.

#### MiMCHasher

Addresses: [0x83584f83f26aF4eDDA9CBe8C730bc87C364b28fe](https://etherscan.io/address/0x83584f83f26aF4eDDA9CBe8C730bc87C364b28fe#code)

MiMC hasher used by every Tornado pool for commitment-tree operations (linked library in the 2019 pools, constructor argument in the 2021 pools), manually verified against the pinned Tornado circomlib generator.

**References**

- [Tornado Cash hasher build script](https://github.com/tornadocash/tornado-core/blob/master/scripts/compileHasher.js)
- [Source Code](https://github.com/tornadocash/circomlib/blob/c372f14d324d57339c88451834bf2824e73bbdbc/src/mimcsponge_gencontract.js)

#### Pool_10_ETH

Addresses: [0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbF](https://etherscan.io/address/0x910Cbd523D972eb0a6f4cAe4618aD62622b39DbF#code)

Fixed-denomination Tornado Cash pool for 10 ETH deposits.

#### Pool_100_ETH

Addresses: [0xA160cdAB225685dA1d56aa342Ad8841c3b53f291](https://etherscan.io/address/0xA160cdAB225685dA1d56aa342Ad8841c3b53f291#code)

Fixed-denomination Tornado Cash pool for 100 ETH deposits.

#### InstanceRegistry

Addresses: [0xB20c66C4DE72433F3cE747b58B86830c459CA911](https://etherscan.io/address/0xB20c66C4DE72433F3cE747b58B86830c459CA911#code), [0x2573BAc39EBe2901B4389CD468F2872cF7767FAF](https://etherscan.io/address/0x2573BAc39EBe2901B4389CD468F2872cF7767FAF#code) (Implementation (Upgradable)), [0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce](https://etherscan.io/address/0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce#code) (Admin)

Upgradeable registry of supported Tornado Cash pool instances and their mutable per-instance fee and routing configuration.
- Roles:
  - **admin**: GovernanceProposalStateUpgrade
  - **governance**: GovernanceProposalStateUpgrade

Can be upgraded by: GovernanceProposalStateUpgrade with no delay

#### Pool_10_WBTC

Addresses: [0xbB93e510BbCD0B7beb5A853875f9eC60275CF498](https://etherscan.io/address/0xbB93e510BbCD0B7beb5A853875f9eC60275CF498#code)

Fixed-denomination Tornado Cash pool for 10 WBTC deposits.

#### Pool_5M_cDAI

Addresses: [0xD21be7248e0197Ee08E0c20D4a96DEBdaC3D20Af](https://etherscan.io/address/0xD21be7248e0197Ee08E0c20D4a96DEBdaC3D20Af#code)

Fixed-denomination Tornado Cash pool for 5M cDAI deposits.

#### Pool_100_DAI

Addresses: [0xD4B88Df4D29F5CedD6857912842cff3b20C8Cfa3](https://etherscan.io/address/0xD4B88Df4D29F5CedD6857912842cff3b20C8Cfa3#code)

Fixed-denomination Tornado Cash pool for 100 DAI deposits.

#### TornadoRouter

Addresses: [0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b](https://etherscan.io/address/0xd90e2f925DA726b50C4Ed8D0Fb90Ad053324F31b#code)

Router contract that validates supported instances, forwards deposits and withdrawals, and subtracts from relayer stake through the relayer registry during withdrawals.
- Roles:
  - **governance**: GovernanceProposalStateUpgrade

#### Pool_100_USDC

Addresses: [0xd96f2B1c14Db8458374d9Aca76E26c3D18364307](https://etherscan.io/address/0xd96f2B1c14Db8458374d9Aca76E26c3D18364307#code)

Fixed-denomination Tornado Cash pool for 100 USDC deposits.

#### Pool_1000_DAI

Addresses: [0xFD8610d20aA15b7B2E3Be39B396a1bC3516c7144](https://etherscan.io/address/0xFD8610d20aA15b7B2E3Be39B396a1bC3516c7144#code)

Fixed-denomination Tornado Cash pool for 1000 DAI deposits.

#### TornadoStakingRewards

Addresses: [0x5B3f656C80E8ddb9ec01Dd9018815576E9238c29](https://etherscan.io/address/0x5B3f656C80E8ddb9ec01Dd9018815576E9238c29#code), [0x9c97be37840f0e754bb7aDB1b16fD0954A2BA248](https://etherscan.io/address/0x9c97be37840f0e754bb7aDB1b16fD0954A2BA248#code) (Implementation (Upgradable)), [0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce](https://etherscan.io/address/0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce#code) (Admin)

**Past upgrades** (Count of upgrades: No upgrades, Last upgrade: N/A, Avg upgrade interval: N/A)

- 2023-06-24 01:32 UTC, deployment of [TornadoStakingRewards](https://etherscan.io/address/0x5B3f656C80E8ddb9ec01Dd9018815576E9238c29#code): transaction [0xf89acb4c80df2c46d8907bcd4152fb044ae0ffb398fc13a6213b49b3135047eb](https://etherscan.io/tx/0xf89acb4c80df2c46d8907bcd4152fb044ae0ffb398fc13a6213b49b3135047eb), implementations: [0x9c97be37840f0e754bb7aDB1b16fD0954A2BA248](https://etherscan.io/address/0x9c97be37840f0e754bb7aDB1b16fD0954A2BA248#code)

Staking contract that escrows TORN staked by relayers. With time, their stake is subtracted from for being officially registered as relayers and receiving fees from each withdrawal, and is redirected as TORN rewards for governance participants who are locking their TORN for voting/staking.
- Roles:
  - **admin**: GovernanceProposalStateUpgrade
  - **governance**: GovernanceProposalStateUpgrade

Can be upgraded by: GovernanceProposalStateUpgrade with no delay

#### TORN

Addresses: [0x77777FeDdddFfC19Ff86DB637967013e6C6A116C](https://etherscan.io/address/0x77777FeDdddFfC19Ff86DB637967013e6C6A116C#code)

TORN governance token contract. Transfers start paused and can later be toggled by governance, which also controls the paused-transfer allowlist and token rescue functions.
- Roles:
  - **governance**: GovernanceProposalStateUpgrade

#### WithdrawVerifier

Addresses: [0x09193888b3f38C82dEdfda55259A82C0E7De875E](https://etherscan.io/address/0x09193888b3f38C82dEdfda55259A82C0E7De875E#code)

Anonymity Mining - Verifier contract for Tornado anonymity-mining withdrawal proofs.

#### TornadoTreesV1

Addresses: [0x43a3bE4Ae954d9869836702AFd10393D3a7Ea417](https://etherscan.io/address/0x43a3bE4Ae954d9869836702AFd10393D3a7Ea417#code)

Anonymity Mining - Legacy Tornado Trees contract that records deposit and withdrawal leaves from TornadoProxyV1 and maintains the roots later consumed by migration and mining logic.

#### TornadoTreesV2

Addresses: [0x527653eA119F3E6a1F5BD18fbF4714081D7B31ce](https://etherscan.io/address/0x527653eA119F3E6a1F5BD18fbF4714081D7B31ce#code), [0x200a79068d8141924B511bC78CB55Dca89cF5C2E](https://etherscan.io/address/0x200a79068d8141924B511bC78CB55Dca89cF5C2E#code) (Implementation (Upgradable)), [0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce](https://etherscan.io/address/0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce#code) (Admin)

Anonymity Mining - Upgradeable batch-based Tornado Trees contract that reuses legacy tree state, queues new leaves from the newer proxy, and accepts batched root updates proven by a verifier.
- Roles:
  - **admin**: GovernanceProposalStateUpgrade
  - **governance**: GovernanceProposalStateUpgrade

Can be upgraded by: GovernanceProposalStateUpgrade with no delay

#### RewardSwap

Addresses: [0x5cab7692D4E94096462119ab7bF57319726Eed2A](https://etherscan.io/address/0x5cab7692D4E94096462119ab7bF57319726Eed2A#code)

Anonymity Mining - Liquidity schedule that pays out TORN rewards for anonymity mining. Only the Miner contract can draw from it or adjust the reward weight.

#### TreeUpdateVerifier

Addresses: [0x653477c392c16b0765603074f157314Cc4f40c32](https://etherscan.io/address/0x653477c392c16b0765603074f157314Cc4f40c32#code)

Anonymity Mining - Verifier contract for Tornado mining account-tree update proofs.

#### TornadoProxyV2

Addresses: [0x722122dF12D4e14e13Ac3b6895a86e84145b6967](https://etherscan.io/address/0x722122dF12D4e14e13Ac3b6895a86e84145b6967#code)

Anonymity Mining - Newer immutable Tornado proxy that routes deposits and withdrawals to supported pool instances and records them in the upgraded Tornado Trees contract.
- Roles:
  - **governance**: GovernanceProposalStateUpgrade

#### Miner

Addresses: [0x746Aebc06D2aE31B71ac51429A19D54E797878E9](https://etherscan.io/address/0x746Aebc06D2aE31B71ac51429A19D54E797878E9#code)

Anonymity Mining - Mining and reward-distribution contract for Tornado anonymity mining. It verifies reward and withdrawal proofs, maintains account roots, and routes TORN rewards through the swap contract.
- Roles:
  - **governance**: GovernanceProposalStateUpgrade

#### RewardVerifier

Addresses: [0x88fd245fEdeC4A936e700f9173454D1931B4C307](https://etherscan.io/address/0x88fd245fEdeC4A936e700f9173454D1931B4C307#code)

Anonymity Mining - Verifier contract for Tornado anonymity-mining reward proofs.

#### TornadoProxyV1

Addresses: [0x905b63Fff465B9fFBF41DeA908CEb12478ec7601](https://etherscan.io/address/0x905b63Fff465B9fFBF41DeA908CEb12478ec7601#code)

Anonymity Mining - Legacy immutable Tornado proxy that routes deposits and withdrawals to pool instances and records them in the legacy Tornado Trees contract.
- Roles:
  - **governance**: GovernanceProposalStateUpgrade

#### PoseidonHasher

Addresses: [0xD82ed8786D7c69DC7e052F7A542AB047971E73d2](https://etherscan.io/address/0xD82ed8786D7c69DC7e052F7A542AB047971E73d2#code) (unverified)

Anonymity Mining - Unverified Poseidon hasher used by the legacy Tornado Trees merkle trees.
The source code of this contract is not verified on Etherscan.

#### BatchTreeUpdateVerifier

Addresses: [0xEd3B00B651c4c7AF77c2fDdce4a388de84b507C6](https://etherscan.io/address/0xEd3B00B651c4c7AF77c2fDdce4a388de84b507C6#code)

Anonymity Mining - Verifier contract for batched Tornado Trees root updates.

#### TornadoVault

Addresses: [0x2F50508a8a3D323B91336FA3eA6ae50E55f32185](https://etherscan.io/address/0x2F50508a8a3D323B91336FA3eA6ae50E55f32185#code)

Vault that escrows locked TORN of governance participants who wish to receive voting rights.

#### DepositTree

Addresses: [0x6234c4C2734D2B246AE074492F402D8f58ff3226](https://etherscan.io/address/0x6234c4C2734D2B246AE074492F402D8f58ff3226#code) (unverified)

Unverified merkle tree instance that stores legacy Tornado deposit leaves for TornadoTreesV1.
The source code of this contract is not verified on Etherscan.

#### WithdrawalTree

Addresses: [0xbFA347D89Ac54F7C2De2433458cb98A85fc03CEd](https://etherscan.io/address/0xbFA347D89Ac54F7C2De2433458cb98A85fc03CEd#code) (unverified)

Unverified merkle tree instance that stores legacy Tornado withdrawal leaves for TornadoTreesV1.
The source code of this contract is not verified on Etherscan.

#### Verifier

Addresses: [0xce172ce1F20EC0B3728c9965470eaf994A03557A](https://etherscan.io/address/0xce172ce1F20EC0B3728c9965470eaf994A03557A#code)

Groth16 verifier contract used by Tornado Cash pool withdrawal proofs.

#### GasCompensationVault

Addresses: [0xFA4C1f3f7D5dd7c12a9Adb82Cd7dDA542E3d59ef](https://etherscan.io/address/0xFA4C1f3f7D5dd7c12a9Adb82Cd7dDA542E3d59ef#code)

Vault that escrows ETH for governance gas-compensation payouts and can return unused funds to governance.

The current deployment carries some associated risks:

- Funds can be stolen if the source code of unverified contracts contains malicious code (CRITICAL).