Contribute now
Fresh entropy is mixed into the setup parameters in this tab and destroyed here — only the new parameters leave. $0 · no deposit · ~1 minute.
The same circuit runs on every chain we support, so these parameters become the verifying key everywhere — one ceremony behind six chains, not one behind each.
Any wallet, any network we support — Solana or EVM. One rule: the address must have at least one transaction. Brand-new empty wallets are rejected.
tidex6 Trusted Setup
Public ceremony for private stablecoin payments — one key for six chains: Solana, Arc, Arbitrum, Base, Hyperliquid, Whitechain. $0 · no deposit · ~1 minute. Your wallet is only your name on a public list. We want 20+ real wallets.
What is a trusted setup, and why does it need a ceremony?
The short version of the cryptography.
tidex6 proves things in zero knowledge with Groth16 — the same proof system used across the ZK ecosystem. Groth16 is fast and tiny to verify on-chain, but it needs a set of public parameters (a Common Reference String) that must be generated once, up front.
Generating those parameters produces a piece of secret randomness — the “toxic waste.” Whoever knows the toxic waste can forge fake proofs: mint value from nothing, or withdraw money that was never deposited. If it is destroyed, the parameters are perfectly safe. If it is kept, the whole system can be counterfeited.
So the only question that matters is: was the toxic waste really destroyed?
With 10–20 independent people, that is practically impossible. This is the “1-of-N” trust model.
That is the whole point of a public ceremony: it removes the “trust one party” assumption and replaces it with “trust that not everyone is dishonest.” The more independent contributors, the stronger it gets — which is exactly why we want you.
What already works
This is not a whitepaper. The protocol is live on two mainnets today.
Don't take our word for it — it's all checkable on-chain. Open the pool program ↗, the verifier ↗, or run the full two-layer flow yourself from the app. Nothing here is a promise — it is running right now.
Where we are
The honest current state — not a wishlist.
- Wrap → deposit → withdraw to a fresh address → confidential payout → unwrap — verified live
- Client-side wrap + deposit + withdraw with memo & auditor — the secret and the amount never leave the tab (WASM)
- Multi-asset: hidden amounts for both USDC and USDT on mainnet
- Our own security review — before any money sat in the pool — found two gaps in the original withdraw circuit: the recipient was bound by a lossy modular reduction (a hostile relayer could redirect a payout to a colliding address), and the amount lived outside the commitment.
- The new circuit binds recipient and relayer by their full 256-bit keys and puts the amount inside the commitment with a 64-bit range check. Same prover, same curve — different parameters, hence a fresh ceremony.
- A second review found that a note's amount was not tied to the amount paid in, and that a sender could still spend a note after paying it. No funds were lost. Both are fixed by a new note format rather than patched: the pool computes each note from what it actually received, and spending takes the recipient's own key.
- The fee is part of the pool itself, and a sender can take back a payment its recipient never collected, after a deadline the sender chose.
- Public, multi-party generation of the production parameters — this page. One contribution now covers two circuits: withdraw and the in-pool transfer.
- Earlier chains are preserved in the public transcript and do not carry over, since parameters are per circuit: the six contributions to the first circuit (log) and the four to the second (log). If you contributed before, please contribute again — it takes a couple of minutes.
- Deploy a fresh verifier carrying the ceremony parameters on every chain — the Anchor program on Solana, the Solidity verifier on Arc, Base, Hyperliquid and Whitechain, the Rust/WASM one on Arbitrum Stylus — re-verify the sources and renounce the upgrade authority where a chain has one
- Only then does real money go through the mainnet pools. The contracts are deployed and verifiable today; the switch is this ceremony, not the code
- Regulator-auditable pools — a pool-level viewing key that audits without the power to freeze
- Proof of innocence / association sets — prove your funds are clean without revealing who you are
- Shared anonymity pool — one crowd across every integrating app
Verify — don't trust
The server's log is not the source of truth. The published chain is.
The full transcript is public: for each circuit, the genesis parameters and the current chain of contributions. Download them and re-check everything on your own machine — every contribution carries a cryptographic proof of knowledge, and the verifier confirms the whole chain links genesis → … → current with nothing dropped, reordered or tampered:
git clone https://github.com/koshak01/tidex6 && cd tidex6
for c in withdraw_v2 transfer_v2; do
curl -o $c.genesis.state https://ceremony.tidex6.com/transcript/$c/genesis.state
curl -o $c.current.state https://ceremony.tidex6.com/transcript/$c/current.state
cargo run --release -p tidex6-circuits --bin ceremony_verify -- $c.genesis.state $c.current.state
done
The tool prints an attestation for every contribution — the same hex shown in the list above. Find your wallet in the output and you have independently proven your randomness is part of the final parameters. log.json ↗
How the ceremony ends
Nobody — not even the very last contributor — can bias the result.