Security and Soundness
The question every private-money system must answer: can the supply be inflated? This
page follows the repository’s docs/soundness.md and keeps its three levels apart:
- impossible: Bitcoin’s own rules forbid it;
- impossible if the implementation is correct: a bug could allow it;
- detectable: it could happen, and it would show.
Nothing here has been audited by anyone outside the project.
Layer 1: taking real bitcoin out
Section titled “Layer 1: taking real bitcoin out”Impossible, by Bitcoin’s rules. The pool is one output worth V, and V is public.
No transaction can pay out more than its inputs, and the pool’s leaf binds the new value to
V + deposits − payouts − fees. No bug in Cheshire can make the pool pay out more bitcoin
than it holds.
The worst a break could do is misallocate that real, bounded, public value: a forged note could steal from other depositors. That is detectable against the public pool value. It is never silent, unlimited minting.
Layer 2: forging a note
Section titled “Layer 2: forging a note”Impossible if the implementation is correct. A note can only be forged by proving a false statement. There is no trusted setup to compromise, so that takes a bug in one of:
- the circuit constraints (conservation, range checks, membership, nullifiers, positions);
- the
stwofork’s prover and verifier, especially its custom changes (the ZK masking, the sparse Merkle prover, the SHA-256 channel); - the on-chain verifier script;
- the covenant’s value binding (still capped by Layer 1).
The remaining risk is implementation correctness. It is closed by audit and formal verification, not by another mechanism. Neither has happened.
- Defenses and findings: what is built against bugs, and the bugs found and fixed so far.
- Security margins: the proof’s security level, capacity, and quantum computers.
What to tell a reviewer
Section titled “What to tell a reviewer”Unlimited invisible inflation is impossible here: Bitcoin’s own conservation, a public pool value, and no trusted setup. Forging a note needs a soundness bug in the circuits or the verifier, which is what an audit and formal verification would close, and a redundant supply check refuses to settle on any insolvency a node can see. The two things that made Zcash’s 2018 flaw invisible and unbounded (a hidden supply and a trusted setup) are absent. What is also absent is anyone outside the project having checked any of this.