Cardano ZK Recovery Tool Don Finish Full Wallet Claim for Preview Testnet

One Cardano zero-knowledge recovery tool don complete full claim for the Preview testnet, move assets from one custody contract after e confirm say the person wey claim am control the original master seed.

The open-source release include the cryptographic circuit, local prover, Plutus V3 validator, formal verification work, test transactions and one prototype interface wey dem call ReclaimGlobal. E expand the earlier experiment wey Charles Hoskinson disclose into one public recovery flow wey people fit review, and e get on-chain results wey dey work.

The repository gather more attention after developer Phil highlight the architecture, documentation and the proving system. Hoskinson later repost the assessment.

ReclaimGlobal Dey Link Wallet Ownership to Rescued Assets

ReclaimGlobal dey designed for situations wey assets don already comot from compromised credentials and dem don put am inside one recovery contract.

Person wey the matter affect go connect the compromised wallet for read-only mode, generate ownership proof for him device locally and choose fresh wallet wey go receive the assets. The recovery phrase go remain for the user device and dem no go submit am to the contract, recovery operator or any external server.

Another separate locking flow allow operator, rescuer or donor to deposit assets into owner-bound Cardano UTxO. Na only user wey fit prove say the affected payment credential come from the correct master seed go fit claim the funds.

The tool no be for users wey don lose their recovery phrase. The person wey dey claim must still control the original seed, and the assets must first enter the custody structure to secure am. Funds wey don already pass beyond that recovery process no fit come back through the contract.

The repository describe one incident wey involve around 8,823 affected payment credentials. For the technical explanation, dem talk say recovery phrases, master seeds and chain codes no leak. Na the derived signing keys dem compromise through deterministic nonce flaw for the transaction signer.

Because individual wallet credentials dey derived from master secret through one-way operations, stolen derived key fit allow unauthorized transaction signing without exposing the original seed. The recovery system use this difference to separate the legit wallet owner from attacker wey only hold the compromised credential.

Plutus V3 Dey Verify Ownership Without Exposing the Seed

The ownership proof dey generated locally with Groth16 proving system wey dey operate for top BLS12-381 curve. The proof size na 336 bytes, and the underlying circuit get around 3.45 million constraints.

Cardano Plutus V3 environment dey verify the proof before the custody contract release any assets. The claimant recovery phrase, private keys and complete derivation path no dey published on-chain.

The new destination credential dey cryptographically bind to the proof. Observer no fit copy the transaction and replace the receiving address because to change the destination go invalidate the claim.

The validator still confirm say the requested payout match the entitlement wey dem store inside the custody datum. Additional conditions dey stop the contract from paying itself or sending the assets back to the compromised credential.

Dem complete two initial milestones for the Preview testnet. For the first one, five test ADA lock behind verification gate and release after the node accept valid proof. Second transaction wey use the same proof but modify one byte, the system reject am.

Dem then test the complete recovery flow through the full custody validator. Dem deposit five test ADA, generate proof for newly created destination wallet, and the contract verify ownership, entitlement and destination binding before e release the assets.

Later claim add more protections, including rule wey prevent payment go back to the affected credential and ticket-based mechanism to track spent claims. The transaction settle inside Cardano execution limits.

The repository still carry Lean 4 proofs wey cover the validator decision logic, plus technical specifications, circuit code and several review rounds. One formal connection still remain open between the complete R1CS constraint system and the canonical witness relation, including the SHA-512 and Ed25519 components.

Mainnet Use Go Need Extra Security and Governance Controls

ReclaimGlobal dey operate as Preview testnet prototype for now, and several production safeguards still dey under development.

The verifying key wey dem use for the current deployment come from single-operator trusted setup. The repository talk say this model fit work for testnet development but e no suitable for system wey go guard real user assets.

Groth16 need structured setup process to create proving and verifying keys. If any participant keep all the secret setup material, e fit theoretically manufacture invalid proofs wey still pass verification.

Because of that, the proposed production model go use multiparty ceremony where independent contributors go add their own randomness and destroy their individual secrets. The repository outline process wey involve public randomness, published contribution transcript and independent verification of the completed ceremony.

Operational controls still never finalize. The documentation identify say dem need define who go create the eligibility list, how people fit independently verify allocated amounts and how dem go protect custody assets while claims dey process.

Further work include to complete the on-chain spent-state and nullifier system, strengthen encoding protections, convert the prototype into production CIP-30 application and commission full external audit of the circuit, contract and setup ceremony.

The Preview transactions don show say Cardano fit verify multi-million-constraint ownership proof and finish recovery payout inside single transaction. To move the system reach production now depend on removing single-operator trust and setting transparent rules for custody, eligibility and claim authorization.