Circuit Specification

payroll.circom

Groth16 · BN254 · 660 constraints · 20 max recipients

Overview

The ZeroWage circuit is written in Circom 2.0 and compiled with the Groth16 proving system over the BN254 elliptic curve. It proves three properties about a payroll batch without revealing individual salary amounts.

Constraints

C1Sum correctness

sum(salaries[0..n]) === total

Proves the claimed total equals the actual sum of all salaries.

C2Minimum threshold

each salary[i] >= min_salary

Proves every recipient received at least the agreed minimum. Uses GreaterEqThan(32) from circomlib.

C3Recipient count

n_recipients > 0

Prevents empty payroll runs from generating valid proofs.

Signals

Signal	Type	Visibility	Description
salaries[20]	field[]	Private	Individual salary amounts — never revealed
total	field	Public	Claimed total disbursement
min_salary	field	Public	Minimum salary floor
n_recipients	field	Public	Number of active recipients

Trusted Setup

We use the Hermez Perpetual Powers of Tau ceremony, parameterized for 2^12 constraints. This ceremony had over 200 independent participants — security holds as long as at least one destroyed their toxic waste.

Ceremony

Hermez PoT (2^12)

Proving system

Groth16

Curve

BN254 (alt_bn128)

Constraints

660

Circuit tool

Circom 2.2.2

Prover library

snarkjs 0.7.6

Proof Structure

// Groth16 proof output

pi_a: [G1 point] — 2 field elements

pi_b: [G2 point] — 4 field elements

pi_c: [G1 point] — 2 field elements

// Verification equation

e(π_A, π_B) = e(α, β) · e(∑ aᵢuᵢ(τ), γ) · e(π_C, δ)

// Proof size: ~384 bytes