Circuits

The protocol has four PLONK operations: settlement, transfer, withdrawal and account-only transition. Monetary circuits use up to eight input notes across assets and epochs and expose 71 public signals. The account-only circuit exposes 11. Both use statement schema 3; unused slots must be zero.

Statements and constraints

• Settlement consumes eligible ordinary, incoming or mature-refund notes and creates ordinary outputs, including authorized fees.
• Transfer proves ownership, membership and per-asset conservation while creating a pending recipient payment, private change and any authorized fee output.
• Withdrawal binds public asset redemption, recipients, minimum receipts and private change to valid inputs.
• Account-only transition proves checkpoint initialization or membership and advancement for deposits and unfunded private-margin actions.

All monetary operations constrain authorization, membership paths, ranges, nullifiers, note kinds and asset-specific conservation. Every proof also binds the successor checkpoint to the same spending key and increments its private revision. A deterministic initialization marker prevents a second history; the pool consumes the marker and inserts the successor atomically. Public execution context prevents a valid proof from being redirected to a different caller, recipient or external action. A nonzero Unix proof expiration limits validity at the block timestamp; zero means no proof expiration.

The specification defines the exact relation, field encodings and public-signal layout. Proving covers witnesses and artifacts. PLONK implementation covers compiler and arithmetic optimizations and their separate checks.

Margin and recovery

External-action funding uses the withdrawal relation with its own authorization domain. Private margin binds funding through withdrawForAction, a position-specific secret owner tag and the signed account-update hash. Funded actions carry the monetary proof; unfunded actions carry an account-only proof.

Position accounts, collateral and debt remain public Aave state. Controller signatures and the private owner binding jointly authorize private margin actions. Public margin uses controller signatures and an observable revision counter. See Margin Architecture.

Release requirements

Changing constraints, toolchains or witness translation requires matching proving keys, verification keys, verifiers and fixtures, plus renewed qualification. Agreement between two verifiers is not proof that the relation was compiled correctly. Independent acceptance is still outstanding; see Audits.