Security Objectives

Integrity

Objective	Mechanism
Balance: value can’t be created inside the pool	Per-token balance constraint in every circuit
Ownership: only the owner can spend a note	ECDSA signature verified in-circuit against the note’s owner key
Single spend: a note is spent at most once	Note nullifier recorded on-chain
No replay: a signed transaction executes at most once	Transaction nullifier recorded on-chain
Domain separation: proofs don’t cross deployments	`VIRTUAL_CHAIN_ID` as public input #0; EIP-712 domain bound to `block.chainid` and the pool address
Recoverability: a lost device never loses funds	Keys re-derivable from a wallet signature

Objective	Mechanism
Sender privacy	Relayer submits; proof hides inputs
Recipient privacy	Recipient appears only as an encrypted note
Amount privacy	Values are committed with random trapdoors
Unlinkability of spends	Nullifiers are not derivable without the owner’s `nk`
Network privacy	Your IP never reaches the chain; the relayer broadcasts

Objective	Mechanism
Exit always open	`setPaused` never blocks withdrawals. Only the admin can pause exits.
Pending deposits reclaimable	`withdrawPendingDeposit` works while paused
No root expiry	Every historical root stays valid, so slow proofs never go stale
Self-submission	A fee-less operation can be submitted by anyone