On-Chain Guarantees

These properties hold because the pool contract and verifiers enforce them. No service operator can override them without an upgrade.

Spending

No spend without a proof. Transfers, withdrawals and swaps all go through _verifyProof. A failed proof reverts with InvalidProof.
No double-spend. Each input note’s nullifier is recorded. Reusing one reverts with NullifierAlreadySpent.
No replay. Each signed transaction has a transaction nullifier. Reusing it reverts with TxNullifierAlreadyUsed.
Bound to this deployment. VIRTUAL_CHAIN_ID is the first public input of every proof. A proof for another deployment does not verify.
Valid roots only. The note root must be one the tree actually had (InvalidNoteTreeRoot). Transfers also check the key-registry root.

Protocol fees ≤ 1%. MAX_PROTOCOL_FEE_BPS = 100, checked in setFeeConfig.
Check cost ≤ 1% of a rejected deposit.
Pull gas ≤ 5% of an ERC-20 permit deposit.
Relayer fee is exactly what you proved. The fee and fee token are public inputs.
Only allowlisted relayers can collect a fee. A fee-less operation is open to anyone.

Gatekeeper can’t alter a deposit. Approval and rejection are checked against the stored hash.
You can always reclaim a pending deposit, even while the pool is paused.
Gatekeeper gas is capped by the escrow and by basefee + 3 gwei.

Only the owner registers. pkX/pkY must hash to msg.sender.
Registration is final. A different key for the same address is refused.
Encryption key must be on Grumpkin. Off-curve keys would make notes unspendable, so they are rejected.

Property	Who provides it
Withdrawal happens at the selected round	Veilify Network scheduler
Stagger legs stay in separate rounds	Veilify Network scheduler
Privacy of your private history from the proxy	Proxy operator (or run it yourself)
Deposit screening quality	Gatekeeper
Censorship resistance	Relayer set and Robinhood Chain sequencer