Zero-knowledge engineering: privacy, delegated proving, storage

TL;DR. Six years of zero-knowledge engineering across the full stack: a production-grade private-transaction protocol (ZeroPool, 2019, grants from Web3 Foundation, NEAR and Waves), a Rust zkSNARK framework (Fawkes-Crypto), a construction for cloud ZK proving over a blinded witness (2023 — the strongest single result of the research line), and a sharded-storage / data-availability research program (2024). 22 research topics on ethresear.ch, 5 on zkresear.ch. The Plasma-era prehistory lives on its own page: the history-split finding.

ZeroPool: private transactions

ZeroPool is a fully private multi-blockchain transaction protocol: sender, receiver and amount are all hidden, with a common anonymity set and low fees. I founded it at ETHBoston in September 2019, where it reached the main-stage finals and took the SKALE prize (team: Igor Gulamov, Artem Vorobev, Nick Kozlov — Devpost, demo video). Later demos: a private transaction on Ethereum mainnet, ZeroPool on Substrate.

I presented ZeroPool's account-based privacy design at zkSummit 6 (online, November 2020) — talk recording (transcript) on the Zero Knowledge channel. Earlier that year: a zk-private-transactions talk at ETHDenver and a lightning talk on the same topic at Stanford Blockchain Week (both February 2020), and the ZeroPool beta shown at EthCC 3 in Paris (March 2020) — "the final offline event before COVID-19," per ZeroPool's blog.

Technically, ZeroPool is a UTXO-based design: UTXO hashes live in calldata, the Merkle root in storage, and UTXOs plus transactions are encrypted to the receiver's public key — the design write-up is on ethresear.ch (September 2019), with the gas-scaling follow-up "State of ZeroPool" (February 2020) showing transaction costs dropping from 40k toward 15k gas with batching.

Grants and integrations:

• Web3 Foundation Open Grants Program — 63,000 DAI across two milestones; deliverables: zkSNARK circuit + cryptography library, a Substrate pallet for private transactions, and a js/wasm wallet library. Grant application.
• NEAR Foundation — collaboration announced April 22, 2020: "A Deep Dive into Private Transactions on NEAR" (archived copy); a 2023 NEAR blog overview still listed ZeroPool as active on testnet (Medium). Code: zeropoolnetwork/zeropool-near; I also proposed the alt_bn128 precompiles for nearcore itself (PR #2842, 2020 — the alt_bn128 host functions were later stabilized in nearcore).
• Waves — anonymous-transactions prototype, including a fork of the Waves node with a groth16verify verifier. wavesplatform/anonymous-transactions-prototype.
• Gitcoin Grants — community quadratic funding (mentioned in the NEAR announcement).

Status, for the record: after the 2022 OFAC sanctions in the on-chain privacy space, a business around private transactions became untenable; ZeroPool remained free, open research and libraries — no token was ever issued, no venture round was raised, grant deliverables were shipped, code stays open under zeropoolnetwork. My later research engages the compliance question directly: the anti-mixer privacy protocol (September 2023) is a privacy design built around deanonymization and compliance concerns — privacy engineering that takes regulation seriously, not a mixer.

Fawkes-Crypto

To build ZeroPool's circuits I wrote Fawkes-Crypto (March 2020) — a lightweight Rust framework for building zkSNARK circuits over bellman (Groth16, BN254).

Delegated proving: shielded Sangria

The strongest single result of this research line: Running Sangria final proof in shielded mode on untrusted 3rd party prover (April 13, 2023).

The problem: ZK proving is expensive, so you want to outsource it to a cloud prover — but sending your witness to someone else's server destroys the very privacy the proof exists for. The construction: instead of running the final (expensive) proving step locally, the client — in one extra Sangria folding round of only linear complexity — folds its real Plonk execution trace with a specially generated high-entropy random trace, and hands the folded trace to the untrusted prover. The post proves that for any candidate initial trace there exists a consistent blinding trace producing exactly what the prover sees, so the delegated trace reveals nothing about the original witness: the thin client does O(n) work, the heavy final proof happens in the cloud, and there are zero data leaks. Worked computations (SageMath): snjax/sangria-delegated-zk. This idea family — folding-based delegated and private proving — has since become an active industry theme around proving markets and client-side privacy.

All five zkresear.ch topics:

Storage and data availability

In 2024 the research line shifted to the data problem: how to store and prove large amounts of data with web2 costs and web3 security.

• Blockchain Sharded Storage: Web2 Costs and Web3 Security with Shamir Secret Sharing (March 2024) — a horizontally scalable, fault-tolerant blockchain storage design (beyond petabytes) built on Shamir secret sharing, Reed–Solomon codes, FFT and zkSNARKs. Detailed walkthrough PDF (edited by Ivan Oleynikov).
• Minimal fully recursive zkDA rollup with sharded storage (March 2024).
• Mining attacks on PoRA (April 2024) — security analysis of Proof-of-Random-Access consensus against the "shrink attack" (cheaper storage with equal throughput) and the "Moore attack" (technology-driven throughput advantage).
• Efficient data distribution with Reed–Solomon codes for sharded storage (August 2024).
• Using FRI for DA with optimistic correctable commitments in rollups (September 2024).
• Research index: zeropool.network/research.

I gave the "Solving Vitalik's trilemma with zk-driven DA and Storage" talk at three 2024 events: ETHPrague 2024, ETH Belgrade 2024, and FIL Dev Summit 4, Brussels — full transcript with slides.

Where it started, and where it went

The zero-knowledge track grew out of the Plasma era — the full story of the December 2018 history-split finding explains why on-chain data availability won and privacy had to be engineered on top of it, not around it. And the security habits built while writing and reviewing circuits became the audit record, which in turn became SavantChat.