ZK-CID 🛡️
Zero-Knowledge Compliance Identity & Decentralized Workflow Orchestration
Prove you are compliant, protect who you are. Users prove KYC/sanctions compliance with a
zero-knowledge proof instead of revealing their identity, and a Chainlink CRE workflow keeps
that status current by revoking credentials automatically when the sanctions feed changes.
🏆 BLI Legal Tech Hackathon 2 (LegalTech & RegTech) · Chainlink CRE: Best workflow with CRE
🌐 Live demo: https://web-3-0-decentralized.vercel.app/zk-cid (no wallet needed for the
full ZK check, see the judge path below)
🎥 Pitch video: 2:48, English ·
strict-mode acceptance clip, 34 s
| Landing | Issuer (KYC → on-chain credential) | Verifier (ZK proof → AccessNFT) |
|---|
| | |
Hackathon Submission
Judge Quick Path (3 minutes, no wallet)
- Open the main demo and generate a random
anonymous identity (it never leaves the browser).
- Tab 2 · Issuer → Demo issuer (testnet only) adds only your commitment to the
on-chain Semaphore group on Sepolia.
- Tab 1 → Generate ZK proof (computed locally).
- Tab 3 → Verify proof without gas runs
AccessNFT.mint as an eth_call against the
live contracts, so the real Semaphore v4 verifier checks your proof in strict mode. No
transaction, no testnet ETH.
- Optional: connect a wallet with Sepolia ETH, regenerate the proof and mint the AccessNFT.
Verify It Yourself
cd zk-cid
yarn install --immutable
yarn test # contracts (34) + frontend unit (12) + CRE logic + mock API (13)
yarn workspace compliance-lifecycle test:sim # CRE workflow simulation: 11 workflow tests + 3 Poseidon vectors
yarn workspace compliance-lifecycle compile:cre # compile the workflow to CRE WASM
yarn next:build # frontend production build
yarn e2e:install # one-time Chromium download
yarn e2e # Playwright E2E (uses the build above)
yarn npm audit -A --severity high # dependency gate (must be clean)
The Chainlink CRE workflow is also verified with the official CLI: cre workflow build and
cre workflow simulate both run end to end
(raw log):
DON-consensus fetch of the sanctions API, getMembers()/getLeaves() reads against the
Sepolia deployment, Semaphore-tree rebuild with real Merkle siblings, and the revoke branch
({"status":"revoked","revokedCount":1}).
A real broadcast rehearsal produced an actual on-chain revocation:
tx 0xb64c050e…
removed the credential from the live Semaphore tree
(getMembers() went from one member to none). Caveats and the mock-vs-production
forwarder setup are documented in
cre-broadcast-evidence.md.
The workflow has two handlers: a cron trigger that re-screens every member, and an
EVM log trigger on ComplianceGate.UserAdded that screens each new credential at the
moment of issuance. Both are covered by the SDK TestRuntime tests; the evidence summary is in
evidence/README.md.
Sepolia deployment, transaction hashes and the CRE evidence chain are documented in
zk-cid/SEPOLIA_DEPLOYMENT.md. Known limitations are listed
in zk-cid/README.md.
Live Deployment
Quick Overview
Current Web3 compliance is flawed: users leak privacy to centralized KYC gates, and manual
revocation of sanctioned identities is slow.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
