🖥️
Best Viewed on Desktop
The technical documentation and app previews are optimized for desktop viewing.
← Back to Home🔒
Threat Model
Four adversary classes (A1–A4) with increasing capabilities. Six formal security properties. Based on Section 3 of the ZK-Sentinel paper.
Adversary Hierarchy (Definition 3)
A1Passive Observer
Can observe all public blockchain data, transactions, balances, contract state
Block explorers, curious individuals
A2Professional Analyst
Sophisticated blockchain analysis tools, exchange data, law enforcement resources
Chainalysis, Elliptic, tax authorities
A3Active Attacker
Dust attacks, phishing, social engineering, smart contract exploitation
Hackers, scammers
A4Physical Adversary
Physical access to victim, can apply coercion, observe system use in real-time, read contract source code, demand credentials, apply escalating pressure
Criminals, kidnappers
⚠️ Key Insight (Paper §3.2)
Against A4 (Physical Adversary), the defense must be undetectable — the attacker cannot know whether defenses exist or were activated. A4 can force revelation of all passwords, observe system use in real-time, read contract source code, analyze transaction patterns, and demand proof that no hidden funds exist.
Security Properties (Definition 4)
Transaction UnlinkabilityDeposits and withdrawals cannot be correlated with advantage better than 1/|A|, where |A| is the anonymity set size
Balance ConfidentialityUser balance is computationally hidden from all adversary classes
Coercion ResistanceUnder physical coercion, the user can trigger decoy behavior mathematically indistinguishable from normal behavior
Gas IndependenceUsers can withdraw without prior ETH holdings (relayer network)
Front-Running ResistanceRelayers cannot redirect withdrawals — proof cryptographically binds recipient, relayer, and fee
Double-Spend PreventionEach nullifier can only be used once (nullifierHashes mapping)
Attack Vectors & Mitigations
Physical coercion ($5 wrench attack)
189+ documented attacks, $84M+ losses. KYC leak → Identity → Target → Coercion → Theft
Dual nullifier + Shadow Passphrase + ZKML — mathematically indistinguishable decoy path
criticalOn-chain link analysis
Tracing deposit→withdrawal via timing, amount, or gas patterns
Anonymity sets (2²⁰ per pool), batch ops, configurable time delay, relayers, multi-denomination
highDetectable anti-coercion logic
Attacker reads contract source, identifies duress branches, demands both passwords
Decision logic inside ZK circuit — no branching visible on-chain. Arithmetic selector a=ia×frase, same R1CS constraints for all a∈{0,1}
criticalRelayer front-running
Relayer redirects funds to own address or increases fee
Groth16 proof cryptographically binds relayer address + fee as public inputs. Theorem 1: requires breaking q-SDH assumption.
highRegulatory compliance request
Court order to reveal transaction origin
Selective Disclosure (22,457 constraints) — prove amount range, time range, ASP membership without revealing specific deposit. Audit nonce prevents replay.
highSmart contract exploit
Reentrancy, overflow, logic bugs
OpenZeppelin (ReentrancyGuard, Pausable, Ownable). Zentinel-Audit (28 tools): 63 alerts → 1 low-severity finding
criticalMerkle forgery / Poseidon collision
Produce valid path for non-existent leaf or find commitment collision
Reduces to breaking Poseidon collision resistance on BN254. Merkle depth 20, ROOT_HISTORY_SIZE=100.
highSide-channel (gas/timing)
Proof generation time or gas cost reveals circuit path taken
Constant R1CS constraints (Lemma 2). Same gas for real/decoy. Privacy Infrastructure: TimingService (0.1s base + 0.05s jitter), ResponseNormalizer (4096 bytes fixed)
low✅ Zentinel-Audit Security Validation
ZK-Sentinel's contracts validated using Zentinel-Audit (28 security analysis tools). Results: 63 initial alerts → 1 low-severity finding. Continuous hardening through the companion platform including GAEV v2 exploit generation and multi-LLM agents for cross-contract vulnerability detection.