agentsclimarketplace
Sign in

Privacy protocol auditor

Skill Yue-Zhou1/zkcrypto-audit/plugins/protocol-auditors/skills/privacy-protocol-auditor

Audit shielded-pool and mixer protocol logic: nullifier derivation, uniqueness, and spent-set semantics; note/value commitments and ownership binding; deposit/withdraw front-running; and state-transition replay domains. Use when reviewing privacy-protocol design above the circuit and Merkle layers.From its SKILL.md

Install
npx -y skills add Yue-Zhou1/zkcrypto-audit --skill privacy-protocol-auditor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.6 KB, 753 tokens by cl100k_base, as published. Nobody here has run it

privacy-protocol-auditor

Domain auditor for the protocol layer of privacy systems (shielded pools, mixers, private transfer protocols): the rules that connect commitments, nullifiers, Merkle roots, and on-chain state into a double-spend-free, unlinkable system.

When to Use

  • Auditing nullifier derivation, uniqueness, domain separation, and spent-set semantics
  • Reviewing note/value commitments and their binding to ownership keys
  • Reviewing deposit/withdraw flows, relayer roles, and front-running behavior
  • Reviewing shielded-pool state transitions, join-splits, change-output linkage, and replay domains (forks, multiple pools, protocol versions)

When NOT to Use

  • Circuit constraint completeness of the proof itself -> zk-circuit-auditor
  • Merkle tree mechanics (insertion, inclusion proofs, sparse defaults) -> merkle-tree-auditor
  • Verifier-contract precompile/calldata mechanics -> onchain-verifier-auditor
  • Commitment-scheme mathematics (Pedersen binding/hiding) -> commitment-scheme-auditor

Core Review Areas

  1. Nullifier derivation: computed from the note secret AND position/rho so each note has exactly one nullifier; domain-separated per pool, asset, chain, and protocol version
  2. Spent-set semantics: nullifier recorded before external calls; checked against the same tree/root domain the proof was verified for
  3. Commitment binding: note commitments bind owner key, value, randomness; ownership proof required to spend (not just knowledge of the commitment)
  4. Root management: which historical roots are accepted, root freshness windows, and cross-root replay
  5. Deposit/withdraw flow: front-running of deposits/withdrawals, relayer fee binding inside the proof statement, recipient binding
  6. State transitions: join-split value conservation at the protocol level, change-output linkage/unlinkability, migration paths between pool versions

Workflow

Phase 1: Protocol state mapping

  • Read references/privacy-protocol-checklist.md
  • Map the state machine: commitments in, nullifiers out, roots accepted, and every state-mutating entry point

Phase 2: Nullifier and transition review

  • Execute workflows/nullifier-review.md

Phase 3: Pattern hunt

  • Read references/finding-patterns.md
  • Prioritize nullifier collisions/aliasing, cross-domain replay, unbound relayer/recipient fields, and root acceptance gaps

Phase 4: Handoff

  • Send surviving findings to crypto-fp-check
  • Cross-route constraint suspicions to zk-circuit-auditor, tree mechanics to merkle-tree-auditor, and verifier-call mechanics to onchain-verifier-auditor

Output Contract

Produce a privacy-protocol handoff that includes:

  • protocol_state_transition
  • nullifier_or_commitment_invariant
  • privacy_or_replay_impact
  • evidence
  • disposition (one of verified, false_positive, unverified, observation, residual_risk)
  • next_route

Reference Index

What ships with it: 5 files

10.6 KB alongside SKILL.md

agents/

references/

workflows/

Keep looking

Skills are one crate of 326,852. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.