​
Summary

  • Network: Zcash public testnet and private regtest chains. Every proof type has run on the testnet (scripts/e2e-testnet.sh, 26 checks on real payments). Nothing has been run on mainnet.
  • Review: unaudited. The only review is by the author (crypto review), which found and fixed one forgery. No external cryptographer has looked at it.
  • Circuits: the base receipt uses the stock Orchard Action circuit. Two proofs use circuits written or forked here; they carry most of the risk.

​
Per proof

​
Attacks on the testnet proofs

Found and fixed (details in assurance): claims and payer tags shared a tag per key and domain name; a claimant chose the floor a claim shows; a truncated nullifier cache could pass a spent note; tags of one wallet’s accounts counted twice with no way to merge them; a FROST policy proof needs its commitment pinned. Checked against the new code: 45 mutants of the claim and cache changes, 37 caught, 7 unviable, 1 missed (a test helper); fuzzing of the text decoders; a 4-minute API soak with no errors.

​
What to be careful about

It reuses the Action constraints as they are and adds two public inputs. A soundness bug in it would let someone claim twice or forge a payer tag. Only the claim and payer-tag proofs depend on it; the base receipt does not. See forked circuits.
The gadget comes from eryxcoop/blake2b_halo2, whose authors say it is unaudited. Porting it to the zcash/halo2 API changed import paths and the lookup and gate API, and added a personalization option. The port is unaudited too. Only sibling-account proofs use it.
Binaries in this workspace build on orchard 0.16 plus a patch that adds accessors, the claim circuit and precomputed verifier parameters. A wallet that depends on zceipt-core without the orchard-ext feature builds on stock orchard and gets the base receipt, batches and source proofs, as scripts/check-stock-orchard.sh checks. Claims need the patch.
Ironwood (NU6.3, which librustzcash calls NU7) is not in a release, so eight crates are pinned to a git revision.
That the transaction is mined (a lightwalletd server’s word, unless you cross-check a second one); that a disclosed output went to someone other than the payer; anything about the person presenting it (a receipt is a bearer proof; use a challenge). Details in the claim.
Out of scope. ZIP 311 already covers Sapling.

​
Next

After ZECATHON: propose the ZIP text, offer the core crate to librustzcash, and get an external review, starting with the two circuits above. See upstreaming.