ZK Proof-of-Reserves with Poseidon Deposit Commitments

Executive Summary

JIL Sovereign's zero-knowledge proof-of-reserves system pairs two circom-based Groth16 circuits: a deposit-commitment circuit that binds an individual deposit's depositor, amount, and salt to a source chain and recipient via a Poseidon hash commitment, and a reserves-solvency circuit that proves, over a bounded set of private per-entry deposit, mint, and burn amounts, that the aggregate net minted supply never exceeds total deposited reserves - all without revealing a single individual deposit, mint, or burn amount to any verifier.

Both circuits output a Poseidon commitment binding the proof to a specific asset, so a solvency proof generated for one asset cannot be substituted to satisfy a solvency check for another. The design lets a bridge or custodian publish a mathematically enforced solvency proof - the specific invariant users and regulators actually need verified - while keeping every underlying balance private.

Problem Statement

Reserve attestations in the wake of major exchange collapses have typically taken one of two forms: a self-reported balance snapshot with no cryptographic proof behind it, or a Merkle-tree-of-balances disclosure that lets an individual user verify their own inclusion but exposes every other participant's balance within the published tree. Neither approach lets a third party verify the actual invariant that matters - that liabilities (minted or claimed supply) do not exceed backing (deposited reserves) - without either trusting a self-report or accepting a privacy tradeoff that discloses the entire balance sheet.

Why Existing Solutions Are Insufficient

• Merkle-tree proof of reserves (post-FTX industry norm): discloses every balance in the tree; users confirm their own inclusion, but the aggregate composition of every other account is exposed.
• Self-attested reserve reports: no cryptographic proof at all - the figures are simply published and trusted, with no way for an outside party to independently verify the underlying solvency claim.
• Periodic auditor attestations: non-real-time, disclose the aggregate to the auditor rather than making the invariant independently, trustlessly verifiable by any third party at any time.
• Plain on-chain balance disclosure: technically verifiable but requires every deposit to be public, eliminating any privacy for individual depositors.

Technical Architecture

Deposit-Commitment Circuit

The circuit constrains the Poseidon hash of the five inputs to equal the publicly known expected commitment, and separately constrains the amount to be non-zero - proving a real deposit occurred and is correctly bound to its chain and recipient, without the depositor or amount ever appearing in the proof's public inputs.

Reserves-Solvency Circuit

The circuit enforces four constraints: the private deposit array sums to the claimed total deposited; the private mint array sums to the claimed total minted; the private burn array sums to the claimed total burned; and a computed surplus (claimedTotalDeposited + claimedTotalBurned - claimedTotalMinted) is range-checked non-negative via a 64-bit binary decomposition - the standard circom pattern for enforcing an inequality inside a field-arithmetic circuit. That surplus being non-negative is algebraically equivalent to net minted supply never exceeding total deposits, the core solvency invariant.

Asset-Bound Output Commitment

The reserves circuit outputs a Poseidon commitment over the four claimed totals and the asset identifier hash, binding the entire aggregate proof to one specific asset - a solvency proof generated for one asset's reserves cannot be presented as satisfying a solvency check for a different asset.

Prior Art Differentiation

Patent Claim