---
name: avax-noir
description: Build or verify Noir membership proofs with Avalanche EVM domain binding, nullifiers and explicit privacy limits.
---

# Noir proof to Avalanche EVM

1. Specify the statement, hidden witnesses, public inputs and observer model before writing a circuit. Use the executable depth-two membership example in `examples/privacy/`; paths and commands in this topic resolve from the executable bundle root. It proves membership without publishing the leaf/path, not anonymous payments or a production mixer.
2. Pin a compatible toolchain: run `python3 scripts/setup_native_tools.py`, then `python3 scripts/setup_native_tools.py --check` and `node examples/privacy/verify.mjs`. The demonstrated combination is Noir 1.0.0-beta.22, Barretenberg 5.0.0-nightly.20260522 and solc 0.8.30. The runner uses the EVM proving target (`-t evm`) and generates its verifier from that verification key. Do not mix a compiler, proof, key or generated Solidity verifier from unrelated releases. Finish with passing circuit tests and a separately verified proof.
3. Inspect `circuit/src/main.nr` and `lib/src/lib.nr` under the example. The private inputs are secret, nullifier_secret, siblings and path directions; the public order is root, nullifier_hash, recipient, domain, action_hash. Domain-separated Pedersen hashes distinguish leaves, tree nodes, nullifiers and actions. Check root membership, recipient/domain nonzero constraints and binding of all public inputs. Finish with negative tests for changed secret, path, recipient and domain.
4. Read `MembershipGate.sol` before adapting the circuit. The application approves roots through an issuer, rejects reused nullifiers, derives its domain from chain ID and its own address, then verifies the exact ordered public inputs. The nullifier is stored only on successful consumption. Preserve application/chain/recipient binding when changing the action; proof validity alone does not authorize a different recipient or an unapproved root.
5. Run the EVM portion of the same verification command. It compiles the optimized generated HonkVerifier, deploys verifier and gate on a disposable local EVM, verifies a real proof, consumes it and checks stored nullifier state. Require rejection of unapproved roots, unauthorized root changes, recipient/domain substitution, damaged proof and replay. An nargo test or mocked verifier alone does not satisfy this step.
6. Document what remains visible and trusted. This example uses deliberately public synthetic witnesses (123/456), a depth-two tree and a trusted root issuer; recipient, nullifier and usage timing remain observable. It has no browser prover or production anonymity guarantee. Keep actual user witnesses out of command arguments, chat, logs and public bundles; use an appropriate protected application flow for any real witness material.

## Tool and artifact boundaries

The runner invokes nargo execute to produce ACIR/witness artifacts, bb prove with `--write_vk --verify`, a separate bb verify, and write_solidity_verifier for the same EVM target. Inspect those arguments in `examples/privacy/verify.mjs` instead of copying older backend flags from tutorials. The workspace has separate circuit, shared-library and synthetic-fixture packages. Generated proof/key/verifier files under target belong to one exact circuit/toolchain build.

The runner resolves local tool binaries from `.tooling/` or the nonsecret executable-path overrides AVAX_NARGO, AVAX_BB, AVAX_SOLC and AVAX_ANVIL. These are paths, not credentials. The supplied setup supports Linux x86_64 and checks exact official artifact hashes; other platforms need the same compatible versions.

## Extend only the demonstrated statement

For a larger membership set, add an authenticated tree/root lifecycle, witness distribution and recovery policy, and test the increased circuit/proof cost. For value transfers bind asset, amount, recipient and action to the statement and implement custody/accounting separately. Preserve old-root expiration and nullifier semantics explicitly. A relayer can change who pays gas, but does not automatically hide timing, recipient or funding relationships.

**Deliver:** exact toolchain; statement and input order; circuit and generated verifier identity; proof/verification results; EVM receipt/state assertions; negative cases; privacy/trust limits. Dated demonstration evidence is `research/parity-privacy/evidence.json`, not evidence of public deployment.

Sources: [Noir documentation](https://noir-lang.org/docs), [Barretenberg source](https://github.com/AztecProtocol/aztec-packages/tree/next/barretenberg), exact tool hashes and official sources in `config/native-tools.json`.