vote-stark

A Winterfell zk-STARK verifier for anonymous voting — published for independent audit.

vote_stark is a faithful Winterfell (v0.13.1) zk-STARK port of a Semaphore-style anonymous-vote circuit, over the Goldilocks field + RPO256 hash. In zero knowledge it proves that a prover:

1. (membership) knows an identity whose commitment is a leaf of a depth-20 Merkle tree with a public merkleRoot;
2. (nullifier) derived the public nullifierHash = RPO(externalNullifier, identityNullifier, revision) from that same identity (rotating per revision, so double-votes are detectable);
3. (choice) committed a voteChoice in [0, 2^16), bound into the execution trace.

⚠️ This is a Phase-0 feasibility spike, published specifically to be attacked.

It is not production-audited and must not gate real value until an independent audit signs off. We have taken it as far as internal adversarial review can (see AUDITING.md); the point of this repo is external scrutiny. Assume nothing is sound until you've checked it yourself.

Start here

• AUDITING.md — the audit narrative: what's been checked, the finding history, the currently open questions, and concrete residual assumptions we could not discharge. Read this first if you're here to audit.
• audits/ — the raw internal audit rounds (adversarial findings F1–F8, the re-audits, and the re-genesis spec that fixes the field/hash substrate).
• audits/solidity/ — historical Solidity integration and anonymous- governance audit evidence, including runnable adversarial vectors and provenance.
• VERIFIER_NOTES.md — the crate's own internals notes.
• src/ — the AIR, prover, and verify(). examples/ and tests/ — reproduction.

Reproduce in one command

cargo test                       # incl. adversarial tests whose names map to finding IDs
cargo run --example feasibility  # end-to-end prove → verify on a real proof

How to report what you find

• Soundness / completeness / anything that breaks a security claim → please follow SECURITY.md (coordinated disclosure).
• Everything else — questions, non-security findings, design discussion → open a GitHub Issue or Discussion. Bad-faith "you should use library X" drive-bys aside, we genuinely want adversarial eyes here.

License

Apache-2.0 — permissive, with a patent grant, chosen so this primitive can be examined, cited, and reused as widely as possible.