Skip to main content

Glossary

Action​

The fundamental unit of a Platus transaction. One 2-in / 2-out Action spends up to two input notes and creates up to two output notes, under a single owner and a single net value commitment; any side may be a dummy (zero value). All Actions share one ZK circuit shape and verification key, enabling efficient recursive aggregation. See Action Circuit.

Action Circuit​

The Noir ZK circuit that proves an Action is valid — i.e., that the input note exists in the Merkle tree, the nullifier is correctly derived, the output note is well-formed, and the values balance. See Action Circuit.

ak (Spend-Auth Verifying Key)​

The public key corresponding to ask. It is a BabyJubJub point: ak = [ask] · G_spend. Published indirectly via the re-randomized rk in each Action.

ask (Spend-Auth Signing Key)​

The private key used to sign the SigHash in spend-authorization. Derived from sk via PRF^expand(sk, 0x06). Never published on-chain.

BabyJubJub (BJJ)​

A twisted Edwards elliptic curve defined over the BN254 scalar field. The choice of BN254's scalar field means BJJ arithmetic can be done natively inside Noir circuits, which target the BN254 backend. Used for key material, value commitments, and signatures.

Barretenberg​

The proving backend used by Platus. Implements UltraHonk, a variant of PLONK with specialized gates for lookups and range checks. Provides both a WASM build (for browser proving) and a native binary (for bundler/server proving via Unix socket).

Binding Signature​

A Schnorr signature over BabyJubJub that proves a batch's input and output values balance. The signing key bsk = Σrcv is the aggregate of all Action blinding factors. The verifying key bvk = Σcv_net − netPublicValue·H is reconstructed on-chain from calldata. See Value Commitments.

BN254 (alt_bn128)​

The elliptic curve used by the UltraHonk proof system. BN254 has an Ethereum precompile (ecAdd, ecMul, ecPairing) which makes on-chain verification cheap. Also called alt_bn128 in Ethereum context.

C_enc​

The recipient ciphertext attached to each output Action. Contains the note plaintext (d, value, rho, rcm, psi) encrypted with ChaCha20-Poly1305 using a key derived from ECDH between the sender's ephemeral key esk and the recipient's transmission key pkd. See Note Encryption.

C_out​

The sender-recovery ciphertext attached to each output Action. Contains (pkd, esk) encrypted under PRF_ock(ovk, cvNet, cm, epk). Lets the sender (or auditor holding ovk) recover the full note plaintext from chain data alone.

Commitment (Note Commitment, cm)​

A short cryptographic fingerprint of a note. Stored as a leaf in the on-chain LeanIMT. Computed as Poseidon2([domain, gd_x, gd_y, pkd_x, pkd_y, v, ρ, ψ, rcm, assetAddr, assetId]). Hiding but binding. See Note Commitment.

Diversifier (d)​

An 11-byte address tag that, combined with gd = DiversifyHash(d) and pkd = [ivk]·gd, forms a payment address. Different diversifiers produce different on-chain addresses for the same recipient, preventing address-based linkability. Derived deterministically from the diversifier key dk and an index.

dk (Diversifier Key)​

A 32-byte key derived from sk at tag 0x09. Used to generate the diversifier d[i] = lower88bits(Poseidon2([DIVERSIFY_DOMAIN, dk_field, i])). This is a Platus extension — Zcash Orchard does not have a separate dk.

epk (Ephemeral Public Key)​

The public half of the ephemeral key pair used for note encryption: epk = [esk]·gd_new. Published on-chain per output Action. Constrained inside the circuit to prevent griefing (constraint 11).

esk (Ephemeral Secret Key)​

A fresh random BJJ scalar sampled per output note. Used to derive epk and the ECDH shared secret for C_enc encryption. Never published; known only to the sender during proof generation. Recoverable from C_out.

Faerie Gold Attack​

A double-spend attack where an attacker crafts two different note commitments that produce the same nullifier, spending one and creating the other. Defended against by the rho chaining mechanism: rho_new = nf_old, making the output note's uniqueness tag unpredictable until after the input is spent.

Finalize Circuit​

A Noir circuit that wraps the root of the recursive proof tree (a recursive_2_leaf or recursive_2_inner proof) and produces an EVM-format UltraHonk proof for on-chain verification. Public inputs: [publicsDigest, actionVkHash, leafVkHash, innerVkHash].

Full Viewing Key (FVK)​

fvk = (ak, nk, rivk, dk, ovk). Allows viewing all incoming and outgoing notes. Cannot authorize spends.

ivk (Incoming Viewing Key)​

ivk = Poseidon2([IVK_DOMAIN, ak_x, ak_y, nk, rivk]) mod 2^251. Used to scan incoming notes: pkd = [ivk]·gd. Can be shared with an incoming-only observer. Derivable from fvk but not vice versa.

LeanIMT (Lean Incremental Merkle Tree)​

A binary Merkle tree variant where a lone left child is its own parent (no zero-padding). This makes insertions cheaper and membership proofs smaller for sparse trees. Used for the on-chain commitment tree at depth 16 (max 65,536 leaves per tree).

nk (Nullifier-Deriving Key)​

A BN254 field element derived from sk at tag 0x07. Used in the nullifier PRF: PRF_nk(ρ) = Poseidon2([NF_DOMAIN, nk, ρ]). Must remain private; knowledge of nk allows computing nullifiers for any observed note.

Note​

A private record of token ownership: (d, gd, pkd, value, asset, ρ, ψ, rcm). Only the commitment cm is on-chain; the full note is known only to the holder.

Nullifier​

A value revealed when spending a note: nf = Poseidon2(NF_DOMAIN, nk, ρ, ψ, cm). Stored on-chain to prevent double-spending. Unlinkable to its commitment without knowledge of the spending key. See Nullifiers.

ovk (Outgoing Viewing Key)​

A 32-byte value derived from sk at tag 0x0a. Used to decrypt C_out, recovering notes the holder sent. Can be shared with an outgoing-only auditor.

Pedersen Commitment​

A commitment scheme of the form cm = v·H + r·G where H, G are independent generators and r is the blinding factor. Additively homomorphic: cm(v₁) + cm(v₂) = cm(v₁+v₂). Used for value commitments (cv_net) in the binding signature.

Poseidon2​

A ZK-friendly hash function optimized for the BN254 prime field. Much cheaper to compute inside a ZK circuit than SHA-256 or Keccak. Used for note commitments, nullifiers, IVK, Merkle tree nodes, and action digests.

PRF^expand​

The key derivation function used in Platus's key hierarchy: PRF^expand(sk, tag) = SHA512(sk ‖ tag). Produces 64 bytes of pseudorandom output. Adopted from Zcash Sapling/Orchard.

psi (ψ)​

Additional nullifier randomness stored in the note. Combined with rho and cm in the nullifier derivation. Provides extra entropy to the nullifier beyond what the note commitment alone supplies.

publicsDigest​

A binary Merkle tree of per-Action digests, computed via repeated Poseidon2([a, b], 2). The root is published as a public input to the Finalize circuit and recomputed on-chain from calldata. Binds the proof to the specific calldata submitted.

rcm (Randomness for Commitment)​

The hiding blinding factor in the note commitment. Sampled freshly per note. Without it, an observer could brute-force small values to deduce note amounts.

rcv (Randomness for Value Commitment)​

The blinding factor in the net value commitment: cv_net = (v_old − v_new)·H + rcv·G. The bundler aggregates these as bsk = Σrcv to produce the binding signing key.

rho (ρ)​

The uniqueness tag stored in a note. For deposit notes: derived from the deposit nonce. For Action output notes: forced to equal the input nullifier (rho_new = nf_old) by circuit constraint 6. This is the Faerie Gold defense.

rivk (IVK Trapdoor)​

A BN254 field element derived from sk at tag 0x08. Input to crh_ivk alongside ak and nk to produce ivk. Part of the full viewing key but not disclosed with ivk alone.

rk (Randomized Spend-Auth Key)​

rk = ak + α·G_spend. A per-Action re-randomization of ak. Published as a public input. Unlinkable to ak because α is fresh per Action. The spend-auth signature is verified against rk.

SigHash​

The message signed by both the binding signature and all spend-auth signatures. Includes chain ID, contract address, vault address, deadline, netPublicValue, asset, publicsDigest, and payload digest. Ensures signatures cannot be replayed in a different context.

sk (Spending Key)​

The 32-byte master secret. Everything else derives from it. Should be backed up and never exposed. In production, derived from a WebAuthn PRF extension or stored encrypted.

UltraHonk​

The PLONK variant used by Barretenberg. Supports specialized gates for lookups and range checks, reducing constraint counts for operations like BabyJubJub arithmetic. Produces proofs verifiable by the on-chain FinalizeVerifier.sol.

UserBundle​

The per-user slice within a transact call. Contains the binding signature, net public value, asset, deadline, refund target, and the index range of ops belonging to that user. Enables multi-user batching while keeping each user's signature independent.

VK (Verification Key)​

The public parameter that defines what a proof proves. In UltraHonk, the VK encodes the circuit structure. All Action proofs share one VK — this is what makes recursive aggregation tractable. VK hashes are pinned in the PinnedVkHashes contract.