A proof shows that the values behind your credential's commitments meet a rule set. Solana checks it and writes a rule pass, a small account that transfers read afterwards.
The proof#
| System | Groth16 over the BN254 curve |
| Size | 256 bytes: A in G1 (64), B in G2 (128), C in G1 (64) |
| Public inputs | 36 |
| Private inputs | 8: your four values and four salts |
| Built | On your device, in the browser |
| Checked | On Solana, with the alt_bn128 syscalls |
The private inputs never leave your device. The app sends the proof bytes, the rule set and the pass expiry you chose.
What the public inputs bind#
The program rebuilds all 36 public inputs from the accounts it reads, so a proof cannot claim another wallet, verifier, rule set, epoch or expiry:
- your wallet and the verifier, as two 128-bit halves each,
- the rule set's address,
- the credential's epoch and four commitments,
- the credential's issuance and expiry times and the four attribute expiries,
- the pass expiry,
- the circuit version, the number of groups and each group's four conditions.
The proof's checking equation is e(A, B) = e(α, β) · e(L, γ) · e(C, δ), where L combines the public inputs with the verifying key.
The verifying key#
Governance uploads the circuit's verifying key once: 2,816 bytes, in 512-byte pieces, checked against its SHA-256 digest and then fixed forever. Every proof of every rule set is checked against that key. The Network page shows its digest.
The rule pass#
A proved rule set leaves a pass for your wallet:
| Field | Meaning |
|---|---|
| Wallet | The wallet that proved |
| Rule set | The rule set it proved |
| Credential | Your credential account |
| Epoch | The credential's epoch at proving |
| Verifier generation | The verifier's generation at proving |
| Expires | The end you chose, within the rule's limits |
| Proved at | The chain time of the proof |
A pass is live while it has not expired and your credential still has the same epoch, its verifier the same generation, and everything is still unexpired. Proving the same rule set again writes a fresh pass in the same account; under the same epoch, the new pass runs at least as long as the one it replaces.