You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Go to file
Alexey Pertsev 1ef6a263ac
Merge pull request #97 from tornadocash/sol-coverage
add sol-coverage
1 year ago
.github/workflows add coverage to CI 1 year ago
circuits Add explicit constrains for recepient, relayer and fee 3 years ago
contracts mycomm 1 year ago
docs docs update 3 years ago
migrations deploy script 2 years ago
scripts change dir structure 1 year ago
src fix cli 1 year ago
test Merge pull request #93 from HowJMay/typo 1 year ago
.editorconfig Move contracts to repository root 4 years ago
.env.example change tree depth to 20 3 years ago
.eslintrc lint 2 years ago
.gitattributes add dummy test 4 years ago
.gitignore add sol-coverage 1 year ago
.nvmrc lint 2 years ago
.prettierignore add sol-coverage 1 year ago
.prettierrc lint 2 years ago
.solhint.json lint 2 years ago
LICENSE Create LICENSE 4 years ago add coverage to CI 1 year ago
deploy.js deploy script 2 years ago
index.html lint 2 years ago
package.json add sol-coverage 1 year ago
truffle-config.js add sol-coverage 1 year ago
yarn.lock add sol-coverage 1 year ago

Tornado Cash Privacy Solution build status Coverage Status

Tornado Cash is a non-custodial Ethereum and ERC20 privacy solution based on zkSNARKs. It improves transaction privacy by breaking the on-chain link between the recipient and destination addresses. It uses a smart contract that accepts ETH deposits that can be withdrawn by a different address. Whenever ETH is withdrawn by the new address, there is no way to link the withdrawal to the deposit, ensuring complete privacy.

To make a deposit user generates a secret and sends its hash (called a commitment) along with the deposit amount to the Tornado smart contract. The contract accepts the deposit and adds the commitment to its list of deposits.

Later, the user decides to make a withdrawal. To do that, the user should provide a proof that he or she possesses a secret to an unspent commitment from the smart contracts list of deposits. zkSnark technology allows that to happen without revealing which exact deposit corresponds to this secret. The smart contract will check the proof and transfer deposited funds to the address specified for withdrawal. An external observer will be unable to determine which deposit this withdrawal came from.

You can read more about it in this Medium article


  • Deposit gas cost: 1088354 (43381 + 50859 * tree_depth)
  • Withdraw gas cost: 301233
  • Circuit Constraints = 28271 (1869 + 1325 * tree_depth)
  • Circuit Proof time = 10213ms (1071 + 347 * tree_depth)
  • Serverless




Was it audited? protocols, circuits, and smart contracts were audited by a group of experts from ABDK Consulting, specializing in zero-knowledge, cryptography, and smart contracts.

During the audit, no critical issues were found and all outstanding issues were fixed. The results can be found here:

Underlying circomlib dependency is currently being audited, and the team already published most of the fixes for found issues


  1. node v11.15.0
  2. npm install -g npx


You can see example usage in cli.js, it works both in the console and in the browser.

  1. npm install
  2. cp .env.example .env
  3. npm run build - this may take 10 minutes or more
  4. npx ganache-cli
  5. npm run test - optionally runs tests. It may fail on the first try, just run it again.

Use browser version on Kovan:

  1. vi .env - add your Kovan private key to deploy contracts
  2. npm run migrate
  3. npx http-server - serve current dir, you can use any other static http server
  4. Open localhost:8080

Use the command-line version. Works for Ganache, Kovan, and Mainnet:


  1. cp .env.example .env
  2. npm run download
  3. npm run build:contract


  1. make sure you complete steps from Initialization
  2. ganache-cli -i 1337
  3. npm run migrate:dev
  4. ./cli.js test
  5. ./cli.js --help

Kovan, Mainnet

  1. Please use Reason: because tornado-core uses websnark 2041cfa5fa0b71cd5cca9022a4eeea4afe28c9f7 commit hash in order to work with local trusted setup. Tornado-cli uses 4c0af6a8b65aabea3c09f377f63c44e7a58afa6d commit with production trusted setup of tornadoCash


./cli.js deposit ETH 0.1 --rpc

Your note: tornado-eth-0.1-42-0xf73dd6833ccbcc046c44228c8e2aa312bf49e08389dadc7c65e6a73239867b7ef49c705c4db227e2fadd8489a494b6880bdcb6016047e019d1abec1c7652 Tornado ETH balance is 8.9 Sender account ETH balance is 1004873.470619891361352542 Submitting deposit transaction Tornado ETH balance is 9 Sender account ETH balance is 1004873.361652048361352542

./cli.js withdraw tornado-eth-0.1-42-0xf73dd6833ccbcc046c44228c8e2aa312bf49e08389dadc7c65e6a73239867b7ef49c705c4db227e2fadd8489a494b6880bdcb6016047e019d1abec1c7652 0x8589427373D6D84E98730D7795D8f6f8731FDA16 --rpc --relayer

Relay address: 0x6A31736e7490AbE5D5676be059DFf064AB4aC754 Getting current state from tornado contract Generating SNARK proof Proof time: 9117.051ms Sending withdraw transaction through the relay Transaction submitted through the relay. View transaction on etherscan Transaction mined in block 17036120 Done

Deploy ETH Tornado Cash

  1. cp .env.example .env
  2. Tune all necessary params
  3. npx truffle migrate --network kovan --reset --f 2 --to 4

Deploy ERC20 Tornado Cash

  1. cp .env.example .env
  2. Tune all necessary params
  3. npx truffle migrate --network kovan --reset --f 2 --to 3
  4. npx truffle migrate --network kovan --reset --f 5

Note. If you want to reuse the same verifier for all the instances, then after you deployed one of the instances you should only run the 4th or 5th migration for ETH or ERC20 contracts respectively (--f 4 --to 4 or --f 5).

How to resolve ENS name to DNS name for a relayer

  1. Visit and put relayer ENS name to the form.
  2. Copy the namehash (1) and click on the Resolver link (2) enslookup
  3. Go to the Contract tab. Click on Read Contract and scroll down to the 5. text method.
  4. Put the values: resolver
  5. Click Query and you will get the DNS name. Just add https:// to it and use it as relayer url


Special thanks to @barryWhiteHat and @kobigurk for valuable input, and @jbaylina for awesome Circom & Websnark framework

Minimal demo example

  1. npm i
  2. ganache-cli -d
  3. npm run download
  4. npm run build:contract
  5. cp .env.example .env
  6. npm run migrate:dev
  7. node minimal-demo.js

Run tests/coverage

Prepare test environment:

   yarn install
   yarn download
   cp .env.example .env
   npx ganache-cli > /dev/null &
   npm run migrate:dev

Run tests:

   yarn test

Run coverage:

   yarn coverage

Emulate MPC trusted setup ceremony

cargo install zkutil
npx circom circuits/withdraw.circom -o build/circuits/withdraw.json
zkutil setup -c build/circuits/withdraw.json -p build/circuits/withdraw.params
zkutil export-keys -c build/circuits/withdraw.json -p build/circuits/withdraw.params -r build/circuits/withdraw_proving_key.json -v build/circuits/withdraw_verification_key.json
zkutil generate-verifier -p build/circuits/withdraw.params -v build/circuits/Verifier.sol
sed -i -e 's/pragma solidity \^0.6.0/pragma solidity 0.5.17/g' ./build/circuits/Verifier.sol