Security model
Latheon is a public prototype on testnets. This page sets out what the proofs guarantee, what remains publicly visible, which issues have been resolved and which limitations are still open.
Sources: THREAT-MODEL.md · STATUS.md · SECURITY.md
- The link between a withdrawal and its deposit, within the deposits in that pool at the time.
- The withdrawal goes only to the address the proof was made for (since V5: the recipient is part of the proof).
- Only a real deposit can be withdrawn (since V7: every step of the Merkle path is constrained).
- Your keys when you disclose a deposit to an auditor.
- Your other deposits and your withdrawal address when you disclose.
- Your wallet, when a withdrawal on the Latheon test chain goes through the relayer.
- That a deposit or a withdrawal happened, its block and time.
- The withdrawal recipient address.
- Gas and other transaction metadata.
- How many deposits a pool holds (the anonymity set).
- Which deposit it is, to the one auditor you disclose to.
Withdrawal vs. disclosure
A withdrawal hides which deposit funded it. A disclosure proves ownership of one specific deposit to one auditor of your choice.
| Withdrawal | Disclosure | |
|---|---|---|
| Who sees it | Everyone on the chain | One auditor you choose |
| Which deposit | Hidden | Known to the auditor |
| Your keys | Not revealed | Not revealed |
| Can someone else spend it | No | No |
| Reusable by others | — | No: bound to the auditor's nonce |
Withdrawal without a deposit (all pools before V7)
In every circuit before V7 one value in the Merkle path (the left/right choice at each level) was not limited to 0 or 1. A crafted proof could therefore satisfy the check for a deposit that never existed and withdraw from the pool. Found in an internal review on 27 October 2026 and reproduced in a local test; only testnet tokens were involved. Fixed in V7 (circuit withdraw_v5), now live on the Latheon test chain. Older pools — V3 to V6, and the pools on Ethereum Sepolia, Arbitrum Sepolia and Robinhood Chain Testnet — are frozen for deposits in our interface and kept only so existing notes can be withdrawn.
Recipient not bound to the proof (V3/V4)
A pending withdrawal could be redirected by replaying its proof with another recipient. Found internally and reproduced in a local test; only testnet tokens were involved. Fixed in V5, which binds the recipient into the proof. The old pools stay deployed, marked legacy.
- No independent audit or circuit review yet.
- Trusted-setup keys come from a single operator. A public ceremony is required before any real value.
- Small anonymity set: the pools hold mostly test deposits. A V7 pool holds up to 1,048,576 (the old V5 pools: 256).
- Bridge privacy (L1 → L2) is unsolved.
- Network level: who broadcast a transaction (IP address) is not protected.
- Router payouts: notes withdrawn together in one transaction are visibly linked.
- Latheon test chain: one sequencer and one validator, both run by us; owner powers sit with one development key. The relayer, also ours, sees the recipient and your IP address.
Responsible disclosure
Report vulnerabilities privately, not through public issues: latheon.protocol@gmail.com