# zk.money

Markdown version of https://l2beat.com/privacy/projects/zkmoneyv6

## Summary

- Total Value Locked: N/A
- Assets tracked: 1
- Buckets tracked: 1
- Deposits 7D: 260 (0.00% compared to the previous seven days)
- Deposits 30D: 260
- Deposits Total: 266
- Active Relayers 30D: 3
- Tracked on: Ethereum
- Attributes: ZK, TEE, Transfers, Any amount
- Reference app: zk.money Desktop v0.8.0 (most private of 2 checked)

### Risks

- Privacy: Link privacy. Public observer: Link private (sentiment: good); Chain analyst: Link at risk (sentiment: warning); Network observer: Link at risk (sentiment: warning); Privileged insider: Link exposed (sentiment: bad); Future adversary: Link exposed (sentiment: bad).
- Trusted setup: 176 participants (sentiment: good). Aztec Ignition: Aztec Ignition is a trusted setup ceremony that was run by Aztec for KZG commitment over BN254 curve in 2019. It included 176 participants and was publicly open for participation.
- Exit window: Infinite (sentiment: good). The escrow and the approved enclave image are immutable. This protocol fails the walkaway test: users cannot fully use it if every centralized participant disappears. Withdrawals and refunds need a live AWS Nitro enclave running the approved image, which is absent from the public downloads.
- Reproducibility: Partially reproducible (sentiment: warning). The Ethereum contracts, the wallet, the enclave software and the circuit sources are public. The refund and resolver verifiers, the L2 contracts and the Desktop app reproduce from them. The approved enclave image and its build files are unpublished.

### About

A shielded ledger on Aztec Network for DAI payments and sUSDS savings, with funds escrowed on Ethereum.

### Links

- Website: https://zk.money
- Docs: https://docs.zk.money/docs
- Explorer: https://aztecscan.xyz/contracts/instances/0x11d2bed21a36289fd6f6a6af93a546b5be7115caf957f0f700f42d56e25fe0a3
- Repository: https://github.com/aztec-labs-eng/zkmoney-public
- Contracts explorer (Disco): https://disco.l2beat.com/ui/p/zkmoneyv6

## Protocol description

zk.money lets users send DAI privately on Aztec and move it into sUSDS savings. Funds are escrowed on Ethereum. Names, deposits and withdrawals are public.

Every withdrawal and refund needs a zk proof and a signature from a live AWS Nitro enclave (TEE). The enclave decrypts and reads the operations it handles, and its approved image is unpublished. Aztec Labs controls names, the code of future deposit addresses and the contract lists the released wallets use.

### Architecture

The portal releases funds only after Aztec proves the withdrawal message and one registered enclave signer co-signs it. Stealing escrowed funds requires both layers to fail, while a failure of either breaks privacy.

### Flow

1. **Deposit.** You fund an L1 deposit address called a SIPA, and anyone can sweep it into the portal. USDC and USDT are swapped to DAI through Curve. After fees, an Inbox message credits private notes on Aztec. Reusing a SIPA links its deposits.
2. **Pay.** You add a name as a contact, and the wallet reads its Aztec address from the onchain registry and sends a private transfer.
3. **Withdraw.** Aztec proves the withdrawal message, an enclave co-signs it and the portal pays out DAI on Ethereum. A relayer submits it, or the user's own wallet after an hour. A swap escrow can instead pay out USDC, USDT or ETH, and give a fresh recipient ETH for gas.

### Keys

Accounts sign with a passkey. The released wallet creates it only in Apple's, Google's or 1Password's synced passkey manager, or on a security key.

### App

The ratings cover DAI payments and sUSDS savings in Desktop, which runs local code. Its endpoint settings replace the Aztec node, the frozen v5 network's node, the Ethereum endpoint and the enclave. Aztec Labs always serves the two unsigned contract lists, and replacing them can redirect future deposits and payments. Its account service receives each account's name and L1 account on every launch.

The hosted wallet reloads code on every visit. Its owner can read viewing keys and request harmful passkey signatures through misleading prompts.

### Savings

Savings hold sUSDS in a second portal with its own L2 token and the same enclaves. A move in withdraws DAI to a deterministic SkyEscrow, which converts it through USDS into sUSDS shares and deposits them into the sUSDS portal. A move out reverses both legs into the DAI portal. Each move publishes its DAI and share amounts, tied by the escrow. Moving a whole position out republishes the share amount it went in with. The wallet moves sUSDS only to and from the user's own DAI balance.

### Names

Tags such as l2beat.zk.money publish Aztec addresses and keys on Ethereum.
- **L1 deposits:** ENS-compatible wallets resolve a tag to a deposit address through the recipient's chosen resolver operator. The default is a centralized resolver who can link deposits to their tag.
- **L2 transfers:** wallets read the registered Aztec address when a tag is added as a contact.

Name claims need the domain owner's signature. XMTP, an encrypted offchain messaging network, powers QR-code or link contacts and carries payment requests.

### Resolver

For ENS lookups, the resolver operator derives each deposit address from a secret shared with the recipient and announces it to them on L2. The assessed wallet derives its own deposit addresses privately. The onchain Resolver checks a zk proof on every lookup, which stops the operator from redirecting payments. Users can choose a custom operator for name payments.

### Migration from v5

Balances of the frozen v5 deployment move here through refunds. The wallet refunds v5 notes to a migration contract, which deposits them into the v6 portal for the same account. Users can instead withdraw v5 balances to Ethereum.

### Exits

**Refund.** If Aztec Network governance changes its canonical rollup, anyone can freeze the portals, see [upgrades and governance](https://l2beat.com/privacy/projects/zkmoneyv6#upgrades-and-governance). Refunds then publish note or deposit amounts on Ethereum and use proofs without zero knowledge.

### Compliance

The assessed wallet screens withdrawal recipients through Predicate, via zk.money, and stops when screening fails. The relayer screens token movements against OFAC and optionally Predicate, and self-submitted sweeps and withdrawals skip it.

The name resolver screens deposit addresses and funders against OFAC before notifying the recipient on L2. A blocked payment leaves funds at an address unknown to the wallet. Recovery requires the recipient's own tooling to re-derive it and authorization from their L1 account. Screening happens only in these offchain services.

### Fees and limits

A DAI sweep pays 0.4 DAI, or 0.5 DAI when claiming a name, and an sUSDS sweep 0.25 sUSDS. A name costs 5 DAI. Each ordinary withdrawal pays 0.1 DAI toward Aztec fees.

Gas sponsorship needs a registered name or a voucher from a registered account. An empty fee-paying contract, or fees above its allowance, stall the assessed wallet. Modified code can pay with the account's own Fee Juice.

DAI deposits share 100,000 DAI of capacity, refilling over 1 day. sUSDS deposits share 100,000 sUSDS, refilling over 1 day.

DAI deposits, payments and withdrawals are capped at 5,166 DAI each. sUSDS deposits and withdrawals are capped at 5,166 sUSDS each.

### Anonymity set

The chart counts depositors traced through deposit addresses. Each migration counts as one depositor, since its v5 refund names no funder. Moves out of savings count no depositor, since the mover already holds funds in zk.money.

### Source verification

The [token verification steps](https://github.com/l2beat/l2beat/blob/main/packages/config/src/projects/zkmoneyv6/verificationSteps-token.md) compare a fresh source build with the DAI and sUSDS L2 contracts pinned by their Ethereum portals. The [verifier steps](https://l2beat.com/zk-catalog/barretenberg#verifiers) regenerate the keys and Solidity verifiers of the refund and resolver circuits.

## Privacy

**What the protocol promises:** Hides senders, amounts and the link between deposits and withdrawals inside the ledger. Names, deposits and withdrawals are public.

**Apps**

- **[zk.money Desktop](https://github.com/aztec-labs-eng/zkmoney-public/releases/tag/desktop-v0.8.0)** v0.8.0 (Reference): The ratings assume this app, since 2026-10-28 · Source [8fd1984](https://github.com/aztec-labs-eng/zkmoney-public/tree/8fd198412a956f214639b5782d3a86e3d47ca60e)
- **zk.money web wallet** (Leaks more): Runs whatever code Aztec Labs' server sends on each visit, so a changed build could read the user's viewing keys. Fix: Serve each build under an onchain pin, such as an ENS contenthash, so every code change shows onchain. · [Source (checked 2026-10-28)](https://wallet.zk.money)

[How we pick the reference](https://l2beat.com/publications/privacy-methodology#reference-app)

Ethereum is public by default. Each protocol is rated on its main privacy promise, like hiding who paid, who received, how much, or which deposit became which withdrawal. Against each adversary, the colour says whether it holds for a careful user with the app's own settings: green yes, yellow only with significant extra work, red no. Fields marked at risk stay private only under the condition in their note.

### Public observer

Link private (sentiment: good)

**Who:** Everyone with a block explorer and some basic tools. Sees every public onchain event, but does no correlation beyond following links. Examples: A curious counterparty, an employer, a journalist.

Private payments publish encrypted notes. Claiming a name ties it, its Aztec address and its registration deposit address to the wallet that funds the claim. The first payment to a new contact reveals the recipient through a handshake. L2 logs mark every transaction of the shared token contract.

**Advice:** Claim the name from a wallet without a public link to the user. Fund each deposit address once and let it be swept.

**Inside**

- Sender: private
- Recipient: exposed. Revealed by the first payment to each new contact.
- Amount: private
- Asset: exposed. DAI and sUSDS use separate portals and token contracts.
- Link: private

**Sources**

- [Fixed log tags on every token transaction](https://github.com/aztec-labs-eng/zkmoney-public/blob/8fd198412a956f214639b5782d3a86e3d47ca60e/vendor/oxide/noir-projects/oxide_lib/src/constants.nr#L78-L82)
- [Handshake announcements are tagged with the recipient address](https://github.com/aztec-labs-eng/aztec-node/blob/v6.0.0/noir-projects/noir-contracts/contracts/standard/handshake_registry_contract/src/main.nr#L75-L94)
- [Name claims publish the claiming account](https://l2beat.com/privacy/projects/zkmoneyv6#NameRegistry)
- [Names map to Aztec addresses](https://l2beat.com/privacy/projects/zkmoneyv6#AccountMetadataRegistry)

### Chain analyst

Link at risk (sentiment: warning)

**Who:** Scrapes all public data and correlates it: timing, amounts, gas and wallet fingerprints, address clusters. Examples: Chain analytics firms, ZachXBT, data brokers.

In practice the anonymity set is zk.money's users on Aztec, although the L2 contract is permissionless. The first payment to a name from outside zk.money is publicly tied to that name. A migrated v5 balance arrives as one deposit of its full amount, in the same transaction as its v5 refund. A payee can tell which payments come from the same payer, since each pair shares one secret for tagging notes.

**Advice:** Give outside payers a deposit address the user's wallet created. Withdraw common amounts rather than everything at once. Wait before exiting and pick a different time of day than the deposit. Exit to a fresh address every time and spend from it with a different wallet than the one that deposited.

**Inside, compared with a public observer**

- Amount: at risk. Inferable when a payment sits between a matching public deposit and withdrawal.
- Link: at risk. Registration deposits are publicly tied to their name.

**Sources**

- [Each v5 refund is deposited into the v6 portal](https://l2beat.com/privacy/projects/zkmoneyv6#MigrationExecutor)
- [RegistrationSIPA](https://l2beat.com/privacy/projects/zkmoneyv6#RegistrationSIPA)
- [Resolver notifies the recipient of each deposit address](https://github.com/aztec-labs-eng/zkmoney-public/blob/8fd198412a956f214639b5782d3a86e3d47ca60e/vendor/oxide/noir-projects/oxide_token_contract/src/main.nr#L237-L251)
- [The notification and the sweep request share one Aztec transaction](https://github.com/aztec-labs-eng/zkmoney-public/blob/8fd198412a956f214639b5782d3a86e3d47ca60e/packages/sdk/src/services/sipaIntents.ts#L343-L358)

### Network observer

Link at risk (sentiment: warning)

**Who:** Sits between the user and the services and sees traffic only: ISPs, VPNs, Tor exits, public RPCs and relayers. Ties requests to a user by content, session or timing: what they name, a shared IP or login, and when they arrive. Services the operator runs count as the insider. Examples: Infura or Alchemy, a Tornado relayer, a wallet vendor selling telemetry, Google captcha or analytics in the dapp frontend.

Alchemy, called under Aztec Labs' key, sees an account's deposit addresses and withdrawals in one session unless the user sets their own Ethereum node. Desktop has no Tor setting. Routing all of the computer's traffic through Tor works, but Chrome's QUIC traffic to WalletConnect bypasses Tor unless UDP is blocked.

**Advice:** Set the user's own Ethereum node as the L1 endpoint. Run Desktop on a system that sends all traffic through Tor and blocks UDP, such as Whonix.

**Inside, compared with a public observer**

- Sender: at risk. XMTP shows who asks whom for payment.
- Link: at risk. Private only with the user's own Ethereum node and all traffic through Tor.

**Sources**

- [Endpoint settings: Aztec node, old-network node, L1 RPC and enclave](https://github.com/aztec-labs-eng/zkmoney-public/blob/8fd198412a956f214639b5782d3a86e3d47ca60e/packages/web-wallet/src/config/endpointOverrides.ts#L17)
- [Every L1 client reads the configured L1 RPC](https://github.com/aztec-labs-eng/zkmoney-public/blob/8fd198412a956f214639b5782d3a86e3d47ca60e/packages/web-wallet/src/config/env.ts#L405-L445)
- [XMTP identity is the account bootstrap address](https://github.com/aztec-labs-eng/zkmoney-public/blob/8fd198412a956f214639b5782d3a86e3d47ca60e/packages/web-wallet/src/platform/xmtp/WebXmtpClient.ts#L95-L109)

### Privileged insider

Link exposed (sentiment: bad)

**Who:** Holds an operator role, custodies funds, receives keys or plaintext by design, or delivers the app: upgrade admin, custodian, view key holder, enclave operator, association set provider, hosted prover, registry, frontend host. Examples: A compliance backdoor key, a DAO with an upgrade key, a KMS committee, an ASP operator, a custodial bridge.

An AWS Nitro enclave reads payments, withdrawals and deposit claims, and the image it runs is unpublished. Wallets accept only an enclave registered for the approved image, but nobody outside Aztec Labs can obtain or rebuild that image. Aztec Labs' default Aztec nodes, like Alchemy under its key, see an account's deposit addresses and withdrawals in one session. The resolver operator, Aztec Labs today, derives each deposit address paid through a name, so it knows the recipient.

**Inside, compared with a public observer**

- Sender: exposed
- Amount: exposed
- Link: exposed

**Sources**

- [Wallets accept only enclaves whose keys the registry holds](https://github.com/aztec-labs-eng/zkmoney-public/blob/8fd198412a956f214639b5782d3a86e3d47ca60e/vendor/oxide/yarn-project/oxide-client/src/fleet_signer.ts#L165-L191)
- [One approved image for both portals](https://l2beat.com/privacy/projects/zkmoneyv6#TeeRegistry)
- [The image list has no download for the approved image](https://docs.zk.money/docs/run-an-enclave)
- [The resolver derives addresses paid through a name](https://github.com/aztec-labs-eng/zkmoney-public/blob/8fd198412a956f214639b5782d3a86e3d47ca60e/packages/front-core/src/oxide/resolverPayments.ts#L171)

### Future adversary

Link exposed (sentiment: bad)

**Who:** Harvest now, decrypt later. Holds every byte ever published and runs the known quantum attacks: elliptic curves, pairings and RSA fall. Hashes, symmetric ciphers and post-quantum schemes stand until an attack on them is known. Examples: An intelligence agency archiving chain data today, then anyone once a break is public.

Whoever breaks elliptic-curve cryptography can decrypt historical notes and payment events published to Ethereum. Registered Aztec addresses identify the accounts. Deposit addresses paid through a name and enclave communication use the same class of cryptography.

**Inside, compared with a public observer**

- Sender: exposed
- Recipient: exposed
- Amount: exposed
- Asset: exposed
- Link: exposed

**Sources**

- [Registered Aztec addresses](https://l2beat.com/privacy/projects/zkmoneyv6#AccountMetadataRegistry)
- [Addresses paid through a name use secp256k1 key exchange](https://github.com/aztec-labs-eng/zkmoney-public/blob/8fd198412a956f214639b5782d3a86e3d47ca60e/packages/front-core/src/oxide/resolverPayments.ts#L171)
- [Enclave channel uses P-256 HPKE](https://github.com/aztec-labs-eng/zkmoney-public/blob/8fd198412a956f214639b5782d3a86e3d47ca60e/vendor/oxide/yarn-project/oxide-lib-tee/src/encryption.ts#L1-L3)

## Anonymity sets

### 30 day historic anonymity set

How many unique depositors you could have blended in with if you withdrew on a particular day after depositing during the previous 30 days. This metric is a proxy for the historic anonymity set and shows how it developed over time.

The metric looks backwards: it counts deposits that already happened, including from addresses that have since withdrawn. Your real anonymity also depends on deposits made after yours, which cannot be known in advance.

### Estimated anonymity set by holding duration

An estimate of how many unique depositors you blend in with, depending on how long you leave your deposit in the pool. It is based on historic data of past deposits: each point counts depositors from the preceding period, so holding for up to 30 days effectively means blending in with everyone who deposited during the last 30 days.

The interactive charts are shown on [the HTML page](https://l2beat.com/privacy/projects/zkmoneyv6#privacy-anonymity-set).

## Flows

The interactive flows chart is shown on [the HTML page](https://l2beat.com/privacy/projects/zkmoneyv6#privacy-flows).

## Assets Breakdown

| Asset | Deposits 7D | Deposits 30D | Deposits Total |
| --- | --- | --- | --- |
| DAI | 260 ($46.14 K) | 260 ($46.14 K) | 266 ($48.16 K) |
| Total | 260 ($46.14 K) | 260 ($46.14 K) | 266 ($48.16 K) |

## Milestones & Incidents

- 2026-10-26: [zk.money moves to Aztec v6](https://etherscan.io/tx/0xb63523f6de8ab744acb279878b8f0bdccd759af3af2adf344479239c4567a0db). New portals on Aztec v6 take their first deposits, and v5 balances migrate into them.

## Risk summary

### Funds can be stolen if
1. Aztec's private execution or refund proof is unsound and the enclave layer also fails.
2. malicious wallet code obtains a harmful signature, or substituted unsigned contract lists redirect future deposits and payments.
3. Aztec Labs' deployer EOA blesses malicious code for future deposit addresses or redirects future payments to names (see [upgrades and governance](https://l2beat.com/privacy/projects/zkmoneyv6#upgrades-and-governance)).
4. a malicious sUSDS token upgrade confiscates escrowed shares (see [upgrades and governance](https://l2beat.com/privacy/projects/zkmoneyv6#upgrades-and-governance)).

### Funds can be lost if
1. a user loses their passkey.
2. all registered signers stop serving, since nobody else can obtain the approved enclave image.
3. resolver screening blocks an external payment and the recipient lacks the tooling to re-derive its deposit address.

### Privacy can be lost if
1. a user pays a new contact, whose handshake reveals the recipient (see public observer).
2. a user's payments hide only among zk.money's users on Aztec (see chain analyst).
3. the unpublished enclave image keeps or leaks what it reads, or AWS Nitro is compromised (see privileged insider).
4. the resolver operator links deposits paid through a name to their recipients (see privileged insider).
5. the default endpoints, Alchemy and Aztec Labs' Aztec nodes, see deposit addresses and withdrawals in one session (see network observer and privileged insider).
6. a portal freezes, and refunds publish note or deposit amounts on Ethereum.
7. elliptic-curve cryptography is broken, which decrypts data published to Ethereum (see future adversary).

## Upgrades & Governance

Aztec Network's v6 rollup and zk.money's portals, enclave registry and payout contracts are immutable.

### Enclave signers and freeze

Anyone can register a signer with an AWS Nitro attestation of the approved image up to 1 hour old. Both portals share 2 signers. If Aztec governance makes another rollup canonical, anyone can freeze the portals for good, leaving only refunds.

### Deposit addresses and names

One Aztec Labs EOA owns the SIPAFactory, the ForwardingTable, the NameRegistry and zk.money in ENS. It can bless new code for future deposit addresses, which can redirect them, and reassign names. The DNS holder can reclaim zk.money in ENS. A second EOA authorizes name claims.

### Savings asset

Sky governance can upgrade sUSDS and change its savings rate.

## Trusted setup

Risk levels follow the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381). Yellow (medium risk): all contributions are published and the final output can be verified, the ceremony client is open source, there were at least 30 contributions, participation was open to the public and announced, and participants are publicly identified. Green (lowest risk): everything required for yellow, with at least 150 contributions. Red (highest risk): at least one requirement for yellow is not met. N/A: the proof system needs no trusted setup.

### Aztec Ignition

- Risk: green (lowest risk)
- Proof systems: UltraHonk (Plonk)

Aztec Ignition is a trusted setup ceremony for KZG commitments over BN254 curve that was run by Aztec for KZG commitment over BN254 curve in 2019.
It included 176 participants and was publicly open for participation.

- Github repo to download and verify the ceremony artifacts: [https://github.com/AztecProtocol/ignition-verification](https://github.com/AztecProtocol/ignition-verification).
- Github repo with instructions for ceremony participants: [https://github.com/AztecProtocol/Setup](https://github.com/AztecProtocol/Setup).
- Ceremony announcement with a call to participate: [https://aztec.network/blog/announcing-ignition](https://aztec.network/blog/announcing-ignition).

## Ossification & Updates

Each date links the update on the HTML page, which also shows its contract diffs.

### [2026-10-28 10:49 UTC](https://l2beat.com/privacy/projects/zkmoneyv6?update=4cf2689b) (34 changes)

Initial discovery of zk.money on Aztec v6: immutable DAI and sUSDS OxidePortals sharing one TeeRegistry with a fixed enclave image, v5-to-v6 MigrationExecutors, and deposit-address, name and resolver contracts. The deployer EOA owns the SIPAFactory, ForwardingTable and NameRegistry.

## Permissions

Explore these contracts and permissions in Disco, L2BEAT's contract explorer: https://disco.l2beat.com/ui/p/zkmoneyv6

### Ethereum

#### Actors

##### EOA 1

Addresses: [0x8c5EE3f90cA6D24eD2e2c1817f0caEE89e521601](https://etherscan.io/address/0x8c5EE3f90cA6D24eD2e2c1817f0caEE89e521601)

- Can interact with SIPAFactory
  - bless deposit address implementations and approve ForwardingTables. A newly blessed implementation for an intent decides the code of every new deposit address for that intent. Earlier blessings are never revoked
- Can interact with NameRegistry
  - replace the RegistrationController and the AccountMetadataRegistry, and change the domainOwner. A new RegistrationController can reassign names and rewrite any user record, and a new AccountMetadataRegistry decides where future payments to zk.money names resolve to
- Can interact with Resolver
  - replace this Resolver as the ENS resolver of zk.money names, which decides the addresses that payments to these names resolve to
- Can interact with ForwardingTable
  - add rows for unlisted tokens, add fees for unlisted intents, and change the beneficiary of deposit-address fees. A new row can route an unlisted token to any contract that reports that token as UNDERLYING and the table's ROLLUP_VERSION

##### 2 EOAs

Addresses: [0x04Ffc6aD66934937737DD5Fea303bd0903B7625e](https://etherscan.io/address/0x04Ffc6aD66934937737DD5Fea303bd0903B7625e) (EOA 2), [0xCb88D07F5d30837d3dE8a10fCDb7bA8aBb3fbeC6](https://etherscan.io/address/0xCb88D07F5d30837d3dE8a10fCDb7bA8aBb3fbeC6) (EOA 4)

- Can interact with TeeRegistry
  - co-sign withdrawals and refunds. Without a signature from a registered TEE signer, no funds can leave the portals that use this registry

##### EOA 3

Addresses: [0x768001056E4d89fd45Bf74Df3d91809F9BEb1ee1](https://etherscan.io/address/0x768001056E4d89fd45Bf74Df3d91809F9BEb1ee1)

- Can interact with NameRegistry
  - authorize or refuse every name claim and sign custom registration fees

##### EOA 5

Addresses: [0xF20076E445e159B17fF3aaAAC567dc4b2e45FB8c](https://etherscan.io/address/0xF20076E445e159B17fF3aaAAC567dc4b2e45FB8c)

- Can interact with PortalFactory
  - deploy new OxidePortals for any token, L2 token contract and deposit and transaction caps. They share this factory's TeeRegistry and refund verifiers

## Smart contracts

Explore these contracts and permissions in Disco, L2BEAT's contract explorer: https://disco.l2beat.com/ui/p/zkmoneyv6

### Ethereum

#### NitroValidator

Addresses: [0x13114c5C847a414D20755DBc2eCbe00cc98039DF](https://etherscan.io/address/0x13114c5C847a414D20755DBc2eCbe00cc98039DF#code)

Validates AWS Nitro enclave attestations against the certificate chain verified by the CertManager.

#### NamePortal

Addresses: [0x158161B257f9bAD34C12Dd8D52638424b216c3a2](https://etherscan.io/address/0x158161B257f9bAD34C12Dd8D52638424b216c3a2#code)

Announces a zk.money name on Aztec. Anyone can send an L1->L2 message carrying a named account's name hash and bootstrap key to an Aztec address of their choice. It accepts only accounts deployed by ACCOUNT_FACTORY.

#### SIPAFactory

Addresses: [0x186C20F0F294378E1DecA7419c667e44c73E992C](https://etherscan.io/address/0x186C20F0F294378E1DecA7419c667e44c73E992C#code)

Deploys zk.money deposit addresses (SIPAs) as deterministic clones. A clone counts as blessed when its implementation was blessed and its ForwardingTable approved. Each clone's code and table are fixed in its address. New deposit addresses, from the wallet or the Resolver, clone the current implementation for their intent.
- Roles:
  - **owner**: EOA 1

#### OxideAccountFactory

Addresses: [0x187d19EccBf2909AD3d71B798A8704D950b9C3ee](https://etherscan.io/address/0x187d19EccBf2909AD3d71B798A8704D950b9C3ee#code)

Permissionless factory for deterministic L1 accounts. The implementation is immutable and there is no administrator.

#### ResolverVerifier

Addresses: [0x1E63715af06Bb12331f6A319b46253713e4d0206](https://etherscan.io/address/0x1E63715af06Bb12331f6A319b46253713e4d0206#code)

UltraHonk verifier for the zk.money resolver circuit with a hardcoded verification key. The Resolver uses it to check that a resolver operator's answer matches the user's registered keys and L2 address.

#### OxidePortal_sUSDS

Addresses: [0x2EbFEE284bABf94869FAC44BC85eDb3C34e536D8](https://etherscan.io/address/0x2EbFEE284bABf94869FAC44BC85eDb3C34e536D8#code)

Escrow of zk.money on the Aztec Network. A withdrawal needs both a proven Aztec L2->L1 message from L2_TOKEN and a signature from a TEE signer registered in the TEE_REGISTRY. Once the Aztec Registry's canonical rollup is no longer ROLLUP, anyone can permanently freeze the portal, stopping deposits and fixing the refund snapshot at the last proven checkpoint. A refund needs a zk proof against that snapshot and a registered signer's signature.

#### ZKTranscriptLib

Addresses: [0x428Fa81B22AAF7C9acb9c73D114894886E3F7d4d](https://etherscan.io/address/0x428Fa81B22AAF7C9acb9c73D114894886E3F7d4d#code)

Runtime library immutably linked into the zk.money resolver verifier. It evaluates circuit constraints or derives Fiat-Shamir challenges for zero-knowledge UltraHonk proofs.

#### RegistrationController

Addresses: [0x45F626E2a4D63232677C96B163ac46e20514a915](https://etherscan.io/address/0x45F626E2a4D63232677C96B163ac46e20514a915#code)

Completes paid name registrations from blessed registration addresses: deploys the user's L1 account, claims the name, writes the user record, optionally announces the name on Aztec through the NAME_PORTAL, and installs the user's first passkey. Fees above the relayer fee go to an allowlisted beneficiary.

#### UserOpSIPA

Addresses: [0x5180f0659D021368CDF5c4499967B9A329C775A0](https://etherscan.io/address/0x5180f0659D021368CDF5c4499967B9A329C775A0#code)

Implementation of zk.money deposit addresses that carry an operation of the user's L1 account. Sweeping a funded clone executes the account operation fixed in the clone's address through the ERC-4337 EntryPoint, with the user's signature, then pays the listed fees and deposits the rest into the portal its ForwardingTable names. The recipient's account can recover any funds from the clone.

#### OperationExecutor

Addresses: [0x5ecE3b4EBE7137b1b6f92406dE17d9816D585c1c](https://etherscan.io/address/0x5ecE3b4EBE7137b1b6f92406dE17d9816D585c1c#code)

Permissionless helper that executes a call and forwards the resulting token payout to the caller. Used by finalizers to collect fees and subsidies.

#### MigrationExecutor

Addresses: [0x70E9c762B02Ec645DF4BC2456271805cba80126c](https://etherscan.io/address/0x70E9c762B02Ec645DF4BC2456271805cba80126c#code)

Payout contract that moves refunds from the frozen SOURCE_PORTAL into DESTINATION_PORTAL. Only SOURCE_PORTAL can call it. It deposits the refund, minus the relayer tip committed in the refund, into DESTINATION_PORTAL for the recipient commitment the refund names.

#### PlainWithdrawalExecutor

Addresses: [0x7C8c2147d1BB8B83e0a0501097372de170eE702a](https://etherscan.io/address/0x7C8c2147d1BB8B83e0a0501097372de170eE702a#code)

Default payout contract for withdrawals and refunds. Only the PORTAL can call it. It pays the recipient and relayer tip committed on Aztec. An ordinary withdrawal first pays FEE to BENEFICIARY, while refunds pay no fee.

#### SkyEscrowFactory

Addresses: [0x7F890e5DF3B4165D1cE4E9A42e97C44f1d7dCc09](https://etherscan.io/address/0x7F890e5DF3B4165D1cE4E9A42e97C44f1d7dCc09#code)

Deploys deterministic escrows for moving funds between the DAI and sUSDS portals. Anyone can execute a funded escrow. Its implementation and routes are immutable.

#### FrozenNotesRefundVerifier

Addresses: [0x880F3C8356A930522896A7c539157D4c87F95377](https://etherscan.io/address/0x880F3C8356A930522896A7c539157D4c87F95377#code)

UltraHonk verifier for refunds of notes that were unspent when the zk.money portal froze. Its verification key is immutable.

#### TeeRegistry

Addresses: [0x8b705C3519169F29850D156574ec377B686bd9CD](https://etherscan.io/address/0x8b705C3519169F29850D156574ec377B686bd9CD#code)

Registry of the TEE signers that the zk.money portals accept for withdrawals and refunds. Anyone can register a signer with an AWS Nitro attestation of the enclave image PCR0_HASH that is at most TEE_ATTESTATION_MAX_AGE seconds old. Registration also sends an L1->L2 message to L2_RECIPIENT, whose inclusion the zk.money contracts on Aztec prove to accept the signer there. Registrations are permanent, and the approved image cannot change.
- Roles:
  - **teeSigners**: EOA 2, EOA 4

#### SwapEscrowFactory

Addresses: [0x8F4105a55C457D796Adab90d5D9E649861E81625](https://etherscan.io/address/0x8F4105a55C457D796Adab90d5D9E649861E81625#code)

Swap-on-withdraw: a withdrawal can pay DAI to a SwapEscrowV2 clone whose route, recipient, gas share and tip are fixed in its address. Anyone can deploy and execute a funded clone to pay USDC, USDT, ETH or DAI to the recipient.

#### MigrationExecutor_sUSDS

Addresses: [0x92270578f3A311B3ced0019a4E15701e7405b4AE](https://etherscan.io/address/0x92270578f3A311B3ced0019a4E15701e7405b4AE#code)

Payout contract that moves refunds from the frozen SOURCE_PORTAL into DESTINATION_PORTAL. Only SOURCE_PORTAL can call it. It deposits the refund, minus the relayer tip committed in the refund, into DESTINATION_PORTAL for the recipient commitment the refund names.

#### RegistrationSIPA

Addresses: [0x96A52ed47Af73423D4b8a920913e5c1ceFdC1319](https://etherscan.io/address/0x96A52ed47Af73423D4b8a920913e5c1ceFdC1319#code)

Implementation of zk.money registration addresses. Sweeping a funded clone registers the name through the current RegistrationController of the NameRegistry, pays the committed and listed fees and deposits the rest into the portal its ForwardingTable names. The recipient's account can recover any funds from the clone.

#### FrozenDepositsRefundVerifier

Addresses: [0xa460C3130D1701a94f76d1122362C0D127f1C6A3](https://etherscan.io/address/0xa460C3130D1701a94f76d1122362C0D127f1C6A3#code)

UltraHonk verifier for refunds of deposits that reached Aztec but were unspent when the zk.money portal froze. Its verification key is immutable.

#### NameRegistry

Addresses: [0xa9863B8F573D62377d987ccb9AF6e0000f99D14a](https://etherscan.io/address/0xa9863B8F573D62377d987ccb9AF6e0000f99D14a#code)

Registry of zk.money names. It points to the RegistrationController and the AccountMetadataRegistry, which together decide where payments to a zk.money name resolve to.
- Roles:
  - **domainOwner**: EOA 3
  - **owner**: EOA 1

#### SkyEscrow

Addresses: [0xB61D97Faf96ec8de617aAF54F4764d01cfd25b8b](https://etherscan.io/address/0xB61D97Faf96ec8de617aAF54F4764d01cfd25b8b#code)

Implementation for savings conversion escrows. Each clone fixes the route, deposit commitment, relayer tip and recovery commitment in its address. It converts DAI into sUSDS or redeposits DAI after a savings withdrawal. The recovery account can reclaim stranded tokens, including shares taken without redemption.

#### DepositSIPA

Addresses: [0xBFe3dE3C4466cbC5803A756847208c69B3BAe401](https://etherscan.io/address/0xBFe3dE3C4466cbC5803A756847208c69B3BAe401#code)

Implementation of zk.money deposit addresses. Anyone can sweep a funded clone, which swaps USDC or USDT to DAI, pays the fees its ForwardingTable lists and deposits the rest into the portal that table names for the token, for the recipient fixed in the clone's address. The recipient's account can recover any funds from the clone.

#### Resolver

Addresses: [0xc329a74542688a3c4948B7d46F204d3d7e5Dd525](https://etherscan.io/address/0xc329a74542688a3c4948B7d46F204d3d7e5Dd525#code)

ENS resolver for zk.money names. It returns a deposit address derived from a resolver operator's answer, which must come with a zk proof that it matches the user's registered keys and L2 address in the AccountMetadataRegistry.
- Roles:
  - **ensNodeOwner**: EOA 1

#### SwapEscrow

Addresses: [0xc953308e66DA19881d8ddD240E6369Db8Ef72Ab9](https://etherscan.io/address/0xc953308e66DA19881d8ddD240E6369Db8Ef72Ab9#code)

SwapEscrowV2 implementation. A clone swaps via the Curve 3pool (and Uniswap for ETH) with a slippage bound of 100 bps for stablecoins and 200 bps against the Chainlink ETH/USD price for ETH. It can first swap a capped share of the DAI to ETH for the recipient's gas. If the swap cannot execute, only the recovery key committed in the clone's address can move the funds.

#### OxidePortal

Addresses: [0xCB99C58Fe81Ae6b2cB4835e46F7b703745879042](https://etherscan.io/address/0xCB99C58Fe81Ae6b2cB4835e46F7b703745879042#code)

Escrow of zk.money on the Aztec Network. A withdrawal needs both a proven Aztec L2->L1 message from L2_TOKEN and a signature from a TEE signer registered in the TEE_REGISTRY. Once the Aztec Registry's canonical rollup is no longer ROLLUP, anyone can permanently freeze the portal, stopping deposits and fixing the refund snapshot at the last proven checkpoint. A refund needs a zk proof against that snapshot and a registered signer's signature.

#### PortalFactory

Addresses: [0xCeae64c7211a2208afFc4F396ADD1D46996Cd2A2](https://etherscan.io/address/0xCeae64c7211a2208afFc4F396ADD1D46996Cd2A2#code)

Deploys OxidePortals that share its TEE_REGISTRY and refund verifiers. Each portal is a separate escrow for one token and one L2 token contract, and nothing in a deployed portal refers back to the factory.
- Roles:
  - **owner**: EOA 5

#### RelationsLib

Addresses: [0xCEBD4589238699fcD7FEA8F89f05AE35F4D7E8c4](https://etherscan.io/address/0xCEBD4589238699fcD7FEA8F89f05AE35F4D7E8c4#code)

Runtime library immutably linked into the zk.money resolver verifier. It evaluates circuit constraints or derives Fiat-Shamir challenges for zero-knowledge UltraHonk proofs.

#### PlainWithdrawalExecutor_sUSDS

Addresses: [0xd0D8E5C5B128ea7e5f2d461Afd6C669BC0877dF8](https://etherscan.io/address/0xd0D8E5C5B128ea7e5f2d461Afd6C669BC0877dF8#code)

Default payout contract for withdrawals and refunds. Only the PORTAL can call it. It pays the recipient and relayer tip committed on Aztec. An ordinary withdrawal first pays FEE to BENEFICIARY, while refunds pay no fee.

#### OxideAccount

Addresses: [0xdA0D7cD0f49cE7b1D04bf03eE56374a8981c2844](https://etherscan.io/address/0xdA0D7cD0f49cE7b1D04bf03eE56374a8981c2844#code)

Immutable implementation of users' L1 accounts. The bootstrap key authorizes the first passkey. Once a passkey is installed, only the user's passkeys can authorize operations and manage keys. The last passkey cannot be removed. Deposit recovery checks signatures against this account.

#### AccountMetadataRegistry

Addresses: [0xDA79Bae4485c40291363D885Aae5B543d2D0Efa9](https://etherscan.io/address/0xDA79Bae4485c40291363D885Aae5B543d2D0Efa9#code)

Stores user records (Aztec L2 address, keys, chosen resolver operator) and resolver operator entries. User records can be written by the user or by the RegistrationController. Anyone can register as a resolver operator.

#### CertManager

Addresses: [0xe3DDDf3D4B624F49B4CeB81807338CCa14f5dd86](https://etherscan.io/address/0xe3DDDf3D4B624F49B4CeB81807338CCa14f5dd86#code)

Verifies and caches AWS Nitro attestation certificates. The only trust anchor is the hardcoded AWS Nitro root certificate.

#### UnprocessedDepositRefundVerifier

Addresses: [0xF15780eB45c49a7cB4FB0BF178D3DaF0F1D68c8a](https://etherscan.io/address/0xF15780eB45c49a7cB4FB0BF178D3DaF0F1D68c8a#code)

UltraHonk verifier for refunds of deposits that never reached Aztec before the zk.money portal froze. Its verification key is immutable.

#### SkyWithdrawalExecutor

Addresses: [0xFE0B2B24cca52D1680103E258985A5aCA33742d5](https://etherscan.io/address/0xFE0B2B24cca52D1680103E258985A5aCA33742d5#code)

Payout contract for sUSDS withdrawals and refunds. Only the PORTAL can execute a payout. It normally redeems sUSDS into USDS and converts USDS to DAI before paying the committed recipient and relayer tip. The recipient can complete an ordinary withdrawal in sUSDS shares through withdrawInShares, bypassing redemption.

#### ForwardingTable

Addresses: [0xFf839a8Be7c90c804F42563f352324cEBcDfe41C](https://etherscan.io/address/0xFf839a8Be7c90c804F42563f352324cEBcDfe41C#code)

Routing table of zk.money deposit addresses. For each listed token it names the portal that deposit addresses using this table sweep into, and per intent the fee for the beneficiary and the tip for the sweeper. Rows and intents can only be added, never changed or removed.
- Roles:
  - **owner**: EOA 1