authorization, on a public ledger

How Alice updates a group on-chain.
And why three Bobs can't.

Open · Anonymous · Onchain. Every state change in an Onym group is gated by a ~700-byte PLONK proof. The chain checks the math; nobody — including us — gets to override it.

Measured against release tag v0.0.11 (2026-05-07) on Stellar testnet alpha.

the cast

One member. Three impostors.

Alice holds a valid witness to the current group commitment $C_g$. The three Bobs each try a different shortcut — none of them get past the verifier.

the happy path

Alice updates the group.

A swim-lane through one legitimate update. Off-chain on the left — Alice's wallet computes the new root, builds the witness, and runs the prover. On-chain on the right — Stellar verifies the proof and swaps the commitment in storage. Click any primitive to dig in.

Five steps; one ledger entry on success. No application-layer operator sees any of it — the trust shape is the Stellar validator set and the cryptographic assumptions in §5.

why it doesn't break

Three Bobs. Three ways to fail.

Same swim-lane. Pick an adversary and watch where the diagram red-flashes. Each Bob is stopped by a different layer of the construction.

All three attacks reduce to a single observation: every public input — $C_g$, $C_g'$, epoch, policy tag — is bound into the proof. There is no surface for an outsider to fake a witness, an insider to skip the policy circuit, or a network observer to rewrite the destination commitment without making the pairing check reject.

the cryptographic stack

Seven pieces, stacked.

Click any node. The panel on the right swaps in concrete parameters, security assumptions, and the post-quantum stance.

SHA-256 sits outside the transaction path. It's how the SRS and verifying keys are pinned in the supply chain — distinct from the in-circuit hash that gates state changes.

references

Where these pieces come from.

Primary literature for every primitive Onym depends on. Links open in a new tab.

Honest about post-quantum: Onym is classically secure today and broken under Shor's algorithm on a CRQC. Migration paths (lattice-based polynomial commitments, hash-based SNARKs) are tracked but not deployed.