A deposit can look clean when it arrives and be flagged weeks later. Trace keys let the protocol respond to that without a backdoor into everyone’s notes.
In the contract ABI a trace key is the RevocationKey struct, and its coordinates appear as revocationPublicKeyX/Y.

​
How it works

When the gatekeeper approves a deposit, it supplies a trace key:
  • x and y are published in the Deposit event.
  • hash becomes the deposit note’s value trapdoor. It is bound into the note commitment, so it can’t be swapped later.
Because the value trapdoor is part of the commitment, the trace key is fixed to that deposit’s note from the moment it is credited. The holder of the matching secret key can use it for retrospective taint recovery on that one deposit, without any power over other deposits.
The contract binds the key. The recovery procedure runs in the circuits and client tooling, and is published with the Veilify proving artifacts.

​
Properties

The hash must be a valid BN254 field element. A value ≥ the field modulus would create a note nobody can spend, so the contract rejects it (PublicInputNotInField).