Cryptographic Primitives - Veilify

Primitive	Choice	Used for
Proof system	UltraHonk (Barretenberg)	All three circuits
Circuit language	Noir	Transfer, withdrawal, swap
Proof curve	BN254	Verification via precompiles `0x06`–`0x08`
Hash	Poseidon2, width 4 (T4)	Commitments, nullifiers, Merkle trees, inbox-key hash
Encryption curve	Grumpkin	Note encryption keys (`ek`, `epk`)
Merkle tree	LeanIMT	Note tree and key registry, depth ≤ 32
Signatures	ECDSA secp256k1	Wallet authorization, verified in-circuit
Typed data	EIP-712	Key derivation, pull-deposit intents

BN254 scalar field

All public inputs and commitments live in

p = 21888242871839275222246405745257275088548364400416034343698204186575808495617

The contract range-checks every public input against p before verification.

Grumpkin

y² = x³ − 17   over F_p   (b = p − 17)

Grumpkin’s base field is BN254’s scalar field. Elliptic-curve operations inside a BN254 circuit are therefore native. It has prime order.

Poseidon2 T4

On-chain hashing uses Poseidon2T4Unrolled, a linked library with hash2, hash3 and hashMany. It must match the Noir implementation exactly. The library is deployed once per chain and linked into the implementation at compile time.

LeanIMT

A Lean Incremental Merkle Tree (from zk-kit) grows its depth as leaves are added, up to 32. Veilify keeps a persistent set of every root the tree has had. A proof against any historical root is accepted, because the tree is append-only. Double-spends are stopped by nullifiers, not root freshness.