Operator surface simulated / strawman offline prototype

Public accounting for a Cardano ZK fund-recovery contract

This prototype visualizes the Operator role for a recovery vending machine. Governance is custodial through an M-of-N multisig, including an unconstrained drain power. Public, reproducible accounting is the check: every inflow, claim vend, and governance action is derived from chain plus the published eligibility snapshot.

Dashboard

Public accounting / transparency view. All figures below are derived from chain state plus the published snapshot, never from operator-asserted numbers.

chain + snapshot derived
Σ entitlement ≤ custodyper asset
OKSolvent
master solvency gauge
Total custody inmock chain
Recovered pool
Total vendedclaim path
Released exactly
Remaining custodycontract-held
Available
0%

Vended vs remaining

Claim transactions spend only through the claim path: a valid proof releases the committed entitlement and marks the credential nullifier spent.

Eligible credentials0
Claimed0
Unclaimed0

Snapshot status

Current root and snapshot_version pinned on chain. The full snapshot and solvency derivation are published for independent rebuilds.

simulated root

Per-credential status

Keyed by hashed credential C. Identities are not revealed.

Hashed credential C Entitlement Status Destination + tx id if claimed

Governance log

Reverse-chronological record of root commits, drains, migrations, pauses, amount, time, and signer set.

Governance

The only privileged authority is the M-of-N multisig. No single party can move custody or change governance state. Reference services are permissionless and replaceable.

custodial M-of-N

Signer set + threshold

Threshold: 3-of-5. The fake key fingerprints below are for prototype display only.

M = 3, N = 5

Governance powers

Each card opens a simulated proposal, signature collection, and execution flow. Execution plays the governance-action animation.

all mocked

Commit / replace snapshot root

constrained

Requires threshold plus append-only/monotone, solvency-bounded, publicly reproducible root commit checks.

Drain / move custody

unconstrained

Governance may move custody to any destination for upgrade, migration, or emergency. Public accounting is the check.

Deploy successor + migrate

successor

Deploys a successor instance with a new verifying key, carries spent-state forward, and conserves total value.

Set / extend deadline

extend-only

Default is no deadline. Governance may set or extend a deadline, never shorten it toward victims.

Emergency pause / resume

no funds moved

Halts the claim path while a flaw is fixed, then governance can resume or migrate.

Verifying key

locked

The verifying key is an immutable script parameter. It is not governance-mutable. A circuit change requires a successor + migration.

Pending proposals

Prototype list of proposals collecting signatures.

Snapshot

The eligibility snapshot is built off-chain from breach data, published in full, and committed on chain as root + snapshot_version. Anyone can rebuild the tree and verify solvency.

fixed-depth 14

Breach data

Compromised credential C plus entitlement.

  • C: hashed credential
  • ADA entitlement
  • native-token entitlement

Leaves

H(0x00 || C || entitlement || snapshot_version)

  • Domain-separated leaf
  • Version-bound
  • No identity revealed

Merkle tree

Fixed-depth 14 tree. Prototype hashing is simulated.

Root + version

Pinned on chain as an immutable parameter / reference input for the committed snapshot.

Build & preview

Editable prototype rows. Build computes a mock root, per-asset totals, and a solvency verdict.

simulated computation
Credential C ADA MIN BOOK

How it works

Technical walkthrough of the operator, governance, snapshot, and accounting mechanism. The victim proof flow is summarized only because it is out of scope for this page.

product-spec view

Snapshot creation: off-chain and reproducible

Take breach data: compromised credentials C and entitlements. Each leaf is H(0x00 || C || entitlement || snapshot_version). Build a fixed-depth 14 Merkle tree and publish the full snapshot plus a solvency derivation. Anyone can rebuild it and check the root.

Root commit: governance path

The M-of-N multisig proposes committing (root, snapshot_version) on chain. The on-chain check enforces threshold, append-only/monotone replacement, and solvency-bounded entitlement. The verifying key remains immutable.

Custody funding

The recovered ADA and tokens are locked at the Plutus V3 contract and sharded across UTxOs so one circuit or setup failure cannot drain the whole pool.

Claim path: victim flow summarized

A valid commitment-aware Groth16 proof bound to a destination D releases exactly the committed entitlement to D and marks the credential nullifier spent so it cannot be claimed twice.

Governance path

Governance can drain custody to any destination, commit constrained snapshot roots, deploy a successor and migrate with spent-state carry-forward and value conservation, set or extend a deadline, and pause or resume the claim path.

Accounting: open indexer

The indexer reads custody UTxOs, claim transactions, nullifier/spent-map entries, governance transactions, and the published snapshot. It derives custody, vended, remaining, solvency, per-credential status, and the governance log.

Trust model: custodial, publicly accountable

Governance can drain, so this is not cryptographic non-custody. Accountability rests on public reproducible accounting and the reputational weight of the M-of-N signer set. The dashboard is the check, not a decorative feature.

Claim path

Victim proof accepted → entitlement released to chosen fresh address → nullifier marked spent → dashboard shows claimed status by hashed credential C.

Governance path

M-of-N accepted → constrained root commit or unconstrained drain / migration / deadline / pause → dashboard log records amount, time, and signer set.

Requirements

Operator-role product requirements in plain English and EARS notation.

source-of-truth rendering

Plain English

  1. Privileged actions require an M-of-N multisig threshold; no single party can move custody or change governance state.
  2. Governance can commit/replace the eligibility snapshot root, but only if the new root is append-only/monotone, solvency-bounded (Σ committed entitlement ≤ actual custody per asset), and publicly reproducible.
  3. Governance can drain/move custody to any destination (unconstrained) for upgrades, migration, or emergencies.
  4. Governance can deploy a successor contract and migrate, carrying the spent-state accumulator forward and conserving total value, so already-redeemed credentials stay redeemed.
  5. Governance can set or extend a claim deadline (extend-only); by default there is no deadline and claims stay open indefinitely.
  6. Governance can pause the claim path (without draining) to halt claims while a flaw is fixed, and resume or migrate afterward.
  7. The verifying key is an immutable parameter and is not governance-mutable.
  8. The eligibility snapshot is a fixed-depth Merkle tree over (credential C, entitlement) leaves, published with an independently-reproducible solvency derivation, so anyone can rebuild it and verify the committed root and solvency bound.
  9. The operator funds custody (sharded so one failure cannot drain the whole pool), runs a public accounting dashboard + open indexer, and runs a relayer for users with no spare ADA; these reference services are permissionless.
  10. Every governance action (root commit, drain, migration, pause) is published with amount, time, and signer set.
  11. All accounting figures are derivable from chain + the published snapshot: total custody, vended, remaining, the solvency invariant, per-credential status by hashed credential, and the governance log, never from operator-asserted numbers.
  12. Custody leaves only via the claim path (a victim's valid proof) or the governance path (constrained root-commit, or the unconstrained drain); no other spend is allowed.

EARS notation

Requirement Type Statement
REQ-OP-01ubiquitousPrivileged actions shall require an M-of-N multisig threshold; no single key shall move custody or change governance state.
REQ-OP-02event-drivenWhen governance commits a snapshot root, the on-chain check shall require the M-of-N threshold AND that the new root is append-only/monotone, solvency-bounded (Σ entitlement ≤ custody per asset), and accompanied by a publicly-reproducible derivation.
REQ-OP-03ubiquitousGovernance shall be able to move custody to any destination (unconstrained drain) for upgrade, migration, or emergency.
REQ-OP-04event-drivenWhen governance migrates to a successor instance, the migration shall carry the spent-state accumulator forward and conserve total value (Σin = Σout), so already-redeemed credentials remain redeemed.
REQ-OP-05state-drivenWhile no claim deadline is set, claims shall remain open indefinitely; governance may set or extend a deadline (extend-only, never shortened toward victims).
REQ-OP-06event-drivenWhen governance pauses, the claim path shall halt with no funds moved, until governance resumes or migrates.
REQ-OP-07ubiquitousThe verifying key shall be an immutable script parameter and shall not be governance-mutable.
REQ-OP-08ubiquitousThe eligibility snapshot shall be a fixed-depth Merkle tree over (credential C, entitlement) leaves, published with an independently-reproducible solvency derivation.
REQ-OP-09ubiquitousCustody shall be sharded so that one circuit or setup failure cannot drain the whole pool.
REQ-OP-10ubiquitousEvery governance action shall be publicly recorded with amount, time, and signer set.
REQ-OP-11ubiquitousAll accounting figures shall be derivable from chain + the published snapshot, not from operator-asserted numbers.
REQ-OP-12ubiquitousCustody shall leave only via the claim path or the governance path; any other spend shall be rejected.
REQ-OP-13unwantedIf a snapshot-root commit would violate the monotone or solvency constraint, then the on-chain check shall reject it.
REQ-OP-14unwantedIf fewer than the required M signers approve a privileged action, then it shall not execute.