Transact v3 ceremony — chain in progress

Working area for the transact v3 phase-2 chain (#659). Each state is attached here as it is produced; the audit package lands in ceremony/transact/ on main when the chain closes.

Do not treat anything here as final. The verifying key that reaches mainnet is the one published after the beacon.

Chain so far

#	contributor	file	sha256
—	initial key	paraloom_0000.zkey	b44d657c…032d7ebd
1	LoomOG	paraloom_0001.zkey	24c4367d…f58201ba
2	NodeSafe	paraloom_0002.zkey	b373cfd3…17482610
3	WakiyamaP	paraloom_0003.zkey	8b408941…f7b5d158
4	LuckyStar	paraloom_0004.zkey	3636b610…5402a010

Contribution hashes, as printed by zkey verify and each confirmed against the one the contributor reported independently:

#1 LoomOG    1ffe7aa6 920f11c5 a2cab8c4 7f40e585
             d362013d 12d65fd1 6333d011 a36289da
             0ead01a4 99c8a59d 0f8e8b3e 6c7c80aa
             62d51592 75f8c211 c776274d b1844469

#2 NodeSafe  18bfe58e d3ca3e44 e0672224 13da205d
             5faabc63 7d1b5f66 87ada883 22248df3
             7921b26f 999d2d4c fdc2fb1b 20a822f6
             cced17f6 323ae082 34ed3461 06cc7c46

#3 WakiyamaP 6464c18c cabbea74 f1fda9c2 e0f0bc34
             9c5f5c33 1adea2d0 1af5ed30 13509830
             2cd6935e 59d013f1 87a93268 cfe46460
             244ff7b5 aa0f87f6 5cbf2f8e 0a7cbfae

#4 LuckyStar c4431118 f6a59598 0b6c089b c3b44e2f
             c5f500f2 0c4520b7 e70a3dc9 fcdd2325
             f20a2ff0 6eaa48cc c60ed9b8 df42ffa3
             05ca2ec7 5c40c19c 5d3497fe 8ab5bc00

Contributions are closed at four. paraloom_0004.zkey is the last one, and every contribution above was verified on receipt against the hash its contributor computed independently.

What remains is the beacon: a public random value applied on top, so that no contributor — and not the coordinator either — could have chosen the final key by picking their share after seeing the others. Until that lands this is not the production key.

The initial key is deterministic: snarkjs groth16 setup over the pinned circuit and the public transcript produces it byte for byte, which two independent runs here confirmed. Nobody has to trust that the chain started from an honest key — regenerate it and compare:

snarkjs groth16 setup transact_v3.r1cs powersOfTau28_hez_final_16.ptau check.zkey
shasum -a 256 check.zkey

Inputs: transact_v3.r1cs from v0.6.0-rc2, and powersOfTau28_hez_final_16.ptau from the Perpetual Powers of Tau — 54 public contributions and a beacon, BLAKE2b 6a6277a2f74e1073…3efec125.

Verifying any state

snarkjs zkey verify transact_v3.r1cs powersOfTau28_hez_final_16.ptau paraloom_NNNN.zkey

Prints every contribution in chain order and ends in ZKey Ok!. Contributors: the hash snarkjs printed for you appears in that list — that is how you confirm the contribution included was yours.

Contributing

One command, no toolchain:

npx snarkjs@0.7.5 zkey contribute paraloom_NNNN.zkey paraloom_NNNN+1.zkey --name="your handle"

Then destroy your entropy — delete the file copies and the shell history, and tell no one what you typed. The setup is sound if a single contributor genuinely discarded their share, and nobody can tell which one did.

Full instructions: ceremony/transact/RUNBOOK.md