Zegel

Bounties claimed: ENS (Best Privacy-Preserving Use of ENS) · Mobula · Superteam NL · Swarm (partner integration).

The problem

In crypto, proving you are competent with money means pasting your address.

That single act hands over, permanently and to everyone: your net worth, every trade you ever made, every counterparty, the hours you trade — and, through any modern wallet-label graph, your identity cluster. You cannot take it back, you cannot scope it, and you cannot give one counterparty less than you gave the last one.

Offline this was solved centuries ago. You show a landlord a statement for one account over three months. You do not hand them your bank login, and you certainly do not publish it.

Zegel is that statement. The adversary is named: the counterparty who keeps your data after the deal closes, and the chain-analytics industry that buys it from them.

What it does

Zegel issues a private financial reference: verified claims about a wallet's real trading record, disclosed to one specific person, for a limited time, revocably, under an ENS name — without revealing the wallet.

• Claims are derived, never declared. Everything asserted is computed from live on-chain data through Mobula. Nobody types in their own win rate.
• Disclosure is tiered. The public sees a commitment and an expiry — that a reference exists, nothing more. A tier-1 grantee sees which thresholds were met, with no address and no raw numbers. A tier-2 grantee gets every upstream response verbatim and can re-run the derivation themselves instead of trusting the issuer.
• Access control is encryption, not a permission check. An un-granted read returns 404, indistinguishable from data that never existed.

How it works, and the one insight it rests on

CCIP-Read cannot do read access control, and building as though it can is the standard mistake. In ERC-3668 the sender field is the resolver contract, not the caller. eth_call carries no signature. Through the UniversalResolver, the caller your resolver sees is the UniversalResolver. And decisively: if the callback verifies a gateway signature, every response the gateway emits is a freely replayable bearer token until it expires — one authorised reader fetches once and can publish the blob.

So Zegel's gateway is deliberately a dumb pipe. It serves only the public envelope, published under ENSIP-24 data(), and holds no state at all — it reads the current envelope from a Swarm feed on every request. Confidentiality lives in Swarm's Access Control Trie, keyed to each grantee's own secp256k1 key. The gateway operator can censor. They cannot read, and they cannot forge.

That also closes a gap Swarm's own engineers documented: "a drive owner can grant access to a grantee, but the grantee has no way to know — there's no notification, no inbox, no discovery mechanism." ENS is the discovery mechanism.

What is deployed and live

• zegel.eth on Ethereum mainnet, resolving through our own CCIP-Read resolver 0x479b0E18B3cE76C62402622e654bc235B1B529d1 — supportsInterface answers true for ENSIP-10 (0x9061b923), ENSIP-24 (0xecbfada3) and ERC-7996 (0x582de3e7).
• ZegelAnchor on Base mainnet 0xbcB85eCdeF23a11D5015b260cC4eDCc0c250f42e — commitments, expiry, revocation.
• Solana mainnet attestation 36A3Fyeid2fauHVs1atAvc8YFvt7tvDSMqofZaeYYQbM — soulbound, via the Solana Attestation Service.
• ENSv2 Enhanced Access Control on Sepolia — ZegelIssuerRegistry, granting the right to write exactly one record on exactly one name via resource(node, part), with revocation that regenerates the token id and invalidates every prior grant by construction.
• Evidence sealed on Swarm under ACT, on a postage batch bought on Gnosis mainnet.
• Live app, live gateway, CLI, 702 passing tests.

Which Mobula data is used, and why it matters

/2/wallet/positions-history gives closed position cycles with realized PnL, entry and exit — a track record rather than a balance, which is the only thing a reference can honestly be built on. /2/wallet/trades carries the MEV component of fees, so trading cost is real cost. /2/wallet/funding identifies who funded the wallet first — the single sharpest deanonymisation vector, which is why the exposure view leads with it. /2/wallet/labels supplies the label graph. And /2/token/security is the differentiator: a 14-check explainable score that lets a claim read "fewer than one in five of the tokens it traded score below 60 out of 100 on Mobula's safety check, which looks for hidden minting rights, insider bundling, faked volume and sell taxes that trap buyers." No other provider exposes a pre-decomposed score you can render as a sentence. Multi-chain across Ethereum, Base and Solana. The demo host needs no key, so the whole read path works with zero credentials.

The negative controls

A green check that cannot go red is worthless. Three of ours go red on demand, and a judge can reproduce each in one command:

1. On Base, verify(referenceId, commitment) returns 1 (Valid). Change one hex digit of the commitment and it returns 4 (CommitmentMismatch). An unknown id returns 0 (NeverAnchored).
2. On Solana, the same one-digit change turns VALID into COMMITMENT-MISMATCH, exit code 2, with both hashes printed.
3. On Swarm, a revoked reader gets 404 while the publisher still reads 200 on the same object in the same second — proving the bytes are present and the failure is access, not absence.

It refuses to flatter, and it refuses to guess

On the demo wallet the system reported a net loss and a 20% win rate. On our own freshly created wallet it could compute only 3 of 10 claims and omitted the other seven entirely rather than defaulting them to false — no source supported them, so no claim was made. A reference system that only ever flatters is worth nothing to the person reading it.

We also found and fixed an evidence-integrity failure of our own: an early envelope was assembled with a throwaway canonicaliser that dropped JSON nulls, silently altering the recorded bodies. The claims still re-derived, the commitment still matched and the on-chain anchor still read valid — every surface check passed. Only the digest-level re-derivation caught it. It is written up in full in CLAIMS.md.

Honest limits

Revocation is forward-only — it cuts a reader off from every future version and cannot retract what they already hold. A tier-2 grantee learns the wallet: privacy here is from the public, not from your counterparty, exactly like handing a landlord a bank statement. A grantee must run a Bee node to read (an unfunded ultra-light one is enough). The public Swarm gateway can seal but never unseal, because it never reveals its publisher key — so we run our own node. ENSv2's LabelStore is an on-chain labelhash-to-plaintext database, so we use ENSv2's access control, not its privacy, because it has none. All thirteen limits are enumerated in CLAIMS.md with an explicit list of what we do not claim.

Verify it yourself

JUDGES.md is a 12-step path; the first six need nothing but curl and a browser — no wallet, no API key, no funded account. PROOF.md links every claim to a live explorer entry.