ZK-CID 🛡️
Zero-Knowledge Compliance Identity & Decentralized Workflow Orchestration
Prove you are compliant, protect who you are. Users prove KYC/sanctions compliance with a
zero-knowledge proof instead of revealing their identity, and a Chainlink CRE workflow keeps
that status current by revoking credentials automatically when the sanctions feed changes.
🏆 BLI Legal Tech Hackathon 2 (LegalTech & RegTech) · Chainlink CRE: Best workflow with CRE
🌐 Live demo: https://web-3-0-decentralized.vercel.app/zk-cid (no wallet needed for the
full ZK check, see the judge path below)
🎥 Pitch video: 2:48, English ·
strict-mode acceptance clip, 34 s
| Landing | Issuer (KYC → on-chain credential) | Verifier (ZK proof → AccessNFT) |
|---|
| | |
Hackathon Submission
Judge Quick Path (3 minutes, no wallet)
- Open the main demo and generate a random
anonymous identity (it never leaves the browser).
- Tab 2 · Issuer → Demo issuer (testnet only) adds only your commitment to the
on-chain Semaphore group on Sepolia.
- Tab 1 → Generate ZK proof (computed locally).
- Tab 3 → Verify proof without gas runs
AccessNFT.mint as an eth_call against the
live contracts, so the real Semaphore v4 verifier checks your proof in strict mode. No
transaction, no testnet ETH.
- Optional: connect a wallet with Sepolia ETH, regenerate the proof and mint the AccessNFT.
Verify It Yourself
cd zk-cid
yarn install --immutable
yarn test # contracts (34) + frontend unit (12) + CRE logic + mock API (13)
yarn workspace compliance-lifecycle test:sim # CRE workflow simulation: 11 workflow tests + 3 Poseidon vectors
yarn workspace compliance-lifecycle compile:cre # compile the workflow to CRE WASM
yarn next:build # frontend production build
yarn e2e:install # one-time Chromium download
yarn e2e # Playwright E2E (uses the build above)
yarn npm audit -A --severity high # dependency gate (must be clean)
The Chainlink CRE workflow is also verified with the official CLI: cre workflow build and
cre workflow simulate both run end to end
(raw log):
DON-consensus fetch of the sanctions API, getMembers()/getLeaves() reads against the
Sepolia deployment, Semaphore-tree rebuild with real Merkle siblings, and the revoke branch
({"status":"revoked","revokedCount":1}).
A real broadcast rehearsal produced an actual on-chain revocation:
tx 0xb64c050e…
removed the credential from the live Semaphore tree
(getMembers() went from one member to none). Caveats and the mock-vs-production
forwarder setup are documented in
cre-broadcast-evidence.md.
The workflow has two handlers: a cron trigger that re-screens every member, and an
EVM log trigger on ComplianceGate.UserAdded that screens each new credential at the
moment of issuance. Both are covered by the SDK TestRuntime tests; the evidence summary is in
evidence/README.md.
Sepolia deployment, transaction hashes and the CRE evidence chain are documented in
zk-cid/SEPOLIA_DEPLOYMENT.md. Known limitations are listed
in zk-cid/README.md.
Live Deployment
Quick Overview
Current Web3 compliance is flawed: users leak privacy to centralized KYC gates, and manual
revocation of sanctioned identities is slow.
以上为 README 的开头部分。其余内容请阅读原文。 查看完整 README ↗
