# Introduction to Tornado Cash Tornado Cash is a decentralized protocol for anonymous transactions on Ethereum and Binance Smart Chain, ensuring privacy with zk-SNARK technology

[Tornado Cash](https://tornadoeth.cash) is a **fully decentralized** **non-custodial** **protocol** allowing private transactions in the crypto-space.As a decentralized protocol, Tornado.Cash smart contracts have been implemented within the Ethereum blockchain, making them immutable. They can neither be changed nor tampered with. Therefore, nobody - including the original developers - can modify or shut them down. All governance and mining smart contracts are deployed by the community in a decentralized manner.As a non-custodial protocol, users keep custody of their cryptocurrencies while operating Tornado.Cash. This means that at each deposit, they are provided with the private key enabling the access to the deposited funds, which gives users complete control over their assets. ## How is privacy achieved? Tornado Cash improves transaction privacy by breaking the on-chain link between source and destination addresses. It uses a smart contract that accepts ETH & other tokens deposits from one address and enables their withdrawal from a different address.To maximize privacy, several steps are recommended, such as the use of a relayer for gas payments to withdraw funds from an address with no pre-existing balance.More details are available in *Behind the scenes:* [*How does Tornado.Cash work?*](/generals/how-does-tornado-cash-work) & [Tips to remain anonymous](/generals/tips-to-remain-anonymous). ## Where does Tornado.cash operate? Since its inception in 2019, Tornado Cash has been operating **on the Ethereum blockchain**. The protocol has been offering diversified fixed amount pools for six tokens (ETH, DAI, cDAI, USDC, USDT & WBTC) handled by the Ethereum blockchain.Since June 2021, in addition to the Ethereum blockchain, Tornado Cash smart contracts **have also been deployed on other side-chains & blockchains**. These deployments enabled the tool to either support new tokens or benefit from Layer-2 advantages, such as faster and cheaper transactions.As of today, Tornado Cash is operating on: * **Ethereum Blockchain** : **ETH** (Ethereum), * **DAI** (Dai), * **cDAI** (Compound Dai), * **USDC** (USD Coin), * **USDT** (Tether) & **WBTC** (Wrapped Bitcoin), * **Binance Smart Chain**: **BNB** (Binance Coin), * **Polygon Network**: **MATIC** (Polygon), * **Gnosis Chain (former xDAI Chain)**: **xDAI** (xDai), * **Avalanche Mainnet**: **AVAX** (Avalanche), * **Optimism**, as a Layer-2 for **ETH** (Ethereum), * **Arbitrum One**, as a Layer-2 **ETH** (Ethereum). Until December 2021, the protocol included an anonymity mining system for some of these tokens, allowing its users to earn a governance token ([**TORN**](/generals/torn)). Users were able to ultimately earn TORN on the Blockchain network by depositing in the ETH, DAI, cDAI & WBTC pools.*More information on* [*Anonymity mining*](/tornado-cash-classic/anonymity-mining) *&* [*Tornado.Cash token*](/generals/torn) is *available.***Thanks to the TORN token, Tornado Cash users can actively participate in shaping the protocol**. \ \ The community has a strong weight regarding the evolution of Tornado Cash and the improvement of its features. Indeed, protocol parameters & token distribution are completely under the community’s control through this governance.All pools mentioned above can be accessed on [tornadoeth.cash](https://tornadoeth.cash/). \ \ They operate **under the principle of fixed-amount deposits & withdrawals**. It means that each token has 2 to 4 different pools, allowing transactions of only 2 to 4 different fixed amounts *(e.g. ETH has four different pools, one for each of these amounts: 0.1, 1, 10 & 100 ETH)*.

### Tornado Cash [Nova](/tornado-cash-nova/logging-in-tornado-cash-nova) With the [**release of Tornado Cash Nova** (beta version) on December 2021](https://tornado-cash.medium.com/tornado-cash-introduces-arbitrary-amounts-shielded-transfers-8df92d93c37c), an **upgraded pool with unique new features** has been added to the protocol. Users are no longer constrained by fixed-amount transactions. With the addition of Tornado Cash Nova, they can benefit from the use of **an arbitrary amount pool & shielded transfers**.Tornado Cash Nova operates on the Gnosis Chain (former xDai Chain) as a Layer2 to optimize speed and cost. It allows **deposits and withdrawals of completely customized amounts in ETH**. This pool also enables shielded transactions where users can **transfer the custody of their token while remaining in the pool**.\ Tornado Cash Nova (beta version) can be accessed on [nova.tornadoeth.cash](https://nova.tornadoeth.cash). You can find further informations related to the functioning of Tornado Cash Nova in the dedicated section of our docs. ## How does Tornado.Cash run? [Codes behind Tornado.Cash functioning](https://github.com/tornadocashdev) - smart contacts, circuits & toolchain - are fully **open-sourced.** Working as a DAO (Decentralized Autonomous Organization), Tornado.Cash governance and mining smart contracts are deployed by its community.The protocol also functions with zk-SNARK, which enables zero-knowledge proofs allowing users to demonstrate possession of information without needing to reveal it. The use of this technology is based **on open-source research made by Zcash team with the help of the Ethereum community**. To set up zk-SNARK initial keys, Tornado.Cash [Trusted Setup Community](https://tornado-cash.medium.com/tornado-cash-trusted-setup-ceremony-b846e1e00be1) was launched in May 2020 & accounts [for 1114 contributions](https://tornado-cash.medium.com/the-biggest-trusted-setup-ceremony-in-the-world-3c6ab9c8fffa). This significant number of contributors makes it impossible to compromise the protocol by faking zero-knowledge proofs.User interface is hosted on **IPFS** (InterPlanetary File System) by the community, minimizing risks of data deletion. Indeed, the interface will work as long as at least one user is hosting it. # How does Tornado Cash work? Before diving into the tutorials explaining & easing the use of Tornado.Cash, here is an overall overview of the protocol's global functioning.

#### Global overview of Tornado.Cash functioning To achieve privacy, [Tornado.Cash](https://tornadoeth.cash) **uses smart contracts that accept token deposits from one address and enable their withdrawal from a different address**. Those smart contracts work as pools that mix all deposited assets.Once the funds are withdrawn by a complete new address from those pools, the on-chain link between the source & the destination is broken. The withdrawn crypto-assets are therefore anonymized.While tokens are in a Tornado Cash pool, the custody remains in users’ hands. Users, therefore, have complete control over their tokens.**For traditional Tornado Cash fixed-amount pools**: * When a user puts funds into a pool (a.k.a. the deposit), a private note is generated. This private note works as a private key for the user to access those funds later. To withdraw them, the same user can use a different address - an old or a new one - and recover his/her funds thanks to this private key. **For Tornado Cash Nova, the new ETH pool with arbitrary amounts & shielded transfers**: * Funds are directly linked to a given wallet address. There is no private note or key. Users can access their funds by connecting to the pool with the appropriate address. * Custody is either acquired by the act of depositing tokens into the pool or by registering in the pool & receiving shielded transfers from another address. The strength of such protocol is linked directly to its number of users and the size of its pool. The more users deposit into the pool the merrier. However, to preserve privacy & anonymity, the user must keep in mind some basic rules, such as: * Using a relayer to pay gas at withdrawal; * Allowing time to lapse between the deposit & the withdrawal action; * Mixing its funds with the crowd by waiting for several transactions before recovering its assets. *More recommendations are provided in:* [*Tips to remain anonymous*](/generals/tips-to-remain-anonymous)*.* #### Contribution of zk-SNARK & hashing process Tornado.Cash uses Zero-Knowledge Succinct Non-Interactive Argument of Knowledge (also called zk-SNARK) to verify & allow transactions.To process a deposit, Tornado.Cash generates a random area of bytes, computes it through the [Pedersen Hash](https://iden3-docs.readthedocs.io/en/latest/iden3_repos/research/publications/zkproof-standards-workshop-2/pedersen-hash/pedersen.html) (as it is friendlier with zk-SNARKs), then sends the token & the 20 MiMC hash to the smart contract. The contract will then insert it into the Merkle tree.To process a withdrawal, the same area of bytes is split into two separate parts: the **secret** on one side & the **nullifier** on the other side. The nullifier is hashed. This nullifier is a public input that is sent on-chain to be checked with the smart contract & the Merkle tree data. It avoids double-spending for instance.Thanks to zk-SNARK, it is possible to prove the 20 MiMC hash of the initial commitment and of the nullifier without revealing any information. Even if the nullifier is public, privacy is sustained as there is no way to link the hashed nullifier to the initial commitment. Besides, even if the information about the transaction is present in the Merkle root, the information about the exact Merkle path, and subsequently the location of the transaction, is still kept private.Deposits are simple from a technical point of view, but expensive in terms of gas as they need to compute the 20 MiMC hash & update the Merkle tree. On the other hand, the withdrawal process is complex but cheaper as gas is only needed for the nullifier hash and the zero-knowledge proof. # Tips to remain anonymous Learn practical tips to maintain anonymity when using Tornado Cash, including how to protect your privacy and avoid common mistakes. Essential for safeguarding your identity in decentralized finance Tips to remain anonymous The Tornado Cash tool allows you to remain anonymous on-chain. However, if the tool is used without protecting oneself upstream and downstream, there is no point and the anonymity would only be partial. There are practices to avoid this. ### Use TOR and/or a VPN Your internet service provider (ISP) identifies you with an IP address. To prevent third parties from knowing that you are using Tornado.cash, you should consider [using TOR](/generals/how-to-use-tornado-cash-with-tor) and/or a VPN for your transfers. Avoid using free VPNs, they tend to keep or even sell your data. There are several VPNs on the market boasting a "no-log policy". ### Save your note in a safe place Your note provides a record of your original transaction. Anyone who has it can withdraw the funds deposited, but also know the deposit address. Be sure to keep this note away from prying eyes and store it in a secure environment. ### Delete data Your browser is a real source of information for the extensions you use. Delete your data after each deposit or withdrawal. If two transfers are made with the same cookies, the extension you are using will be able to link these two transactions. ### Be patient

Your anonymity also depends on the number of transactions after your deposit (cf. Statistics tab above). If you withdraw your funds immediately after depositing them, it is possible to link your deposit to your transfer using correlation probabilities. The longer you wait, the greater your anonymity set will be. ### Use multiple addresses A 7 x 10eth deposit from one address and a 7 x 10eth withdrawal to a single address can also be linked. Remember to multiply your withdrawal addresses. # How to use Tornado Cash with TOR Learn how to use Tornado Cash with Tor for enhanced privacy and anonymity in your transactions On-chain confidentiality is ensured by the [Tornado Cash](https://tornadoeth.cash) tool.However, before and after your transactions are executed, your privacy may not be ensured. That's why we advise you to use TOR when you use Tornado Cash.Here is a quick and easy tutorial to ensure your anonymity. ### Step **#1 - Install** TOR First, go there: Choose the appropriate operator system and click on Download.Then, run it. ### Step **#2 - Configure** TOR First, search for `about:config` on your URL navigation bar.

Search for `wasm` and turn `javascript.options.wasm` on true.

Search for `indexedDB` and turn `dom.indexedDB.logging.details` and `dom.indexedDB.logging.enabled` on true

### Step **#3 -** Install Metamask Go there: First, click on `Install Metamask for Firefox`.

Click on `Add`.

Allow addons.mozilla.org to install an add-on by clicking on `Continue to Installation`.

Confirm that you allow this extention to run in Private Windows, then click on `Okay`.

Then, you can add Metamask to your toolbar, by doing a right click on it and dragging Metamask icon to your toolbar.

### Step **#4 - Enjoy your privacy**😎\*\*\*\* You can now use [Tornado Cash Classic](https://tornadoeth.cash) or [Tornado Cash Nova](https://nova.tornadoeth.cash) with TOR. # TORN Learn about TORN, the governance token of Tornado Cash, which enables decentralized decision-making and ensures the protocol remains secure, private, and censorship-resistant ## Token TORN is an ERC20-compatible token with a fixed supply that governs [Tornado.Cash](https://tornadoeth.cash). TORN holders can make proposals and vote to change the protocol via governance.**TORN is not a fundraising device or investment opportunity.Here’s how the initial distribution of TORN would break down:** * **5% (500,000 TORN):** Airdrop to early users of Tornado Cash ETH pools * **10% (1,000,000 TORN):** Anonymity mining for Tornado Cash ETH pools, distributed linearly over 1 year * **55% (5,500,000 TORN):** DAO treasury, will be unlocked linearly over 5 years with 3 month cliff * **30% (3,000,000 TORN):** Founding developers and early supporters, will be unlocked linearly over 3 years with 1 year cliff * ```

```

## Airdrop Users who have believed in TornadoCash from early on should have a say in governing the protocol. For this reason, early adopters of the protocol did receive an airdrop of TORN. TORN has been airdropped to [all addresses](https://github.com/tornadocash/airdrop/blob/master/airdrop.csv) that made deposits into [tornadoeth.cash](https://tornadoeth.cash) ETH pools before block `11400000`. TORN were airdropped in the form of a non-transferable TORN voucher (vTORN) that can be redeemed 1:1 to TORN within 1 year, from December 18, 2020, to December 18, 2021. TORN that aren’t redeemed will be swept into the governance contract after 1 year and become part of the DAO Treasury. Redeemed TORN will be available immediately.The airdropped amount depends on users’ deposit size and age — larger deposits and older deposits will receive more TORN. Multipliers for deposit size are logarithmic:

So a 100 ETH deposit get twice as many tokens as a 1 ETH deposit. The multiplier allows large and small users of tornadoeth.cash to both have a say in governance.The exact curve for the time multiplier looks like this:

The exact airdrop formula is the following:

# Governance Explore Tornado Cash governance: key proposals, community decisions, and how you can participate in shaping the future of decentralized finance ### How to suggest a proposal ? In order to participate in Tornado.Cash governance, users first need to lock tokens in the governance contract. If a user votes or creates a proposal, the tokens cannot be unlocked before the proposal execution period ends (8.25 days from proposal creation). The locked tokens can also be delegated to another address.To create a proposal, a user needs to have at least `1,000 TORN`. All proposals must be smart contracts with verified code that are executed from the [governance contract](https://etherscan.io/address/0x5efda50f22d34F262c29268506C5Fa42cB56A1Ce) (using `delegatecall`). This way, it’s easy to audit and test any governance changes.The voting period for a proposal is 5 days. A proposal will succeed if it receives a simple majority of votes and there are at least `25,000 TORN` total votes (if turnout is too low, the proposal automatically fails).After a proposal succeeds, it is subject for a timelock of 2 days. After the timelock, any user is able to execute the proposal (which initiates the changes). If proposal is not executed for 3 days after that, it is considered *expired* and can no longer be executed.All of these initial parameters are relatively small, since there won’t be many TORN tokens in circulation early on. But as the circulating supply increases, governance may adjust these thresholds.A proposal can be of the following nature: * Adding a new Tornado Cash pool in the proxy * Changing the AP reward rates parameters * Unpause/Pause the TORN token * Change some core mining contracts such as the `TornadoTrees` contract * A combination of all of the above

And many more can be done. To find out exactly what can be changed through governance in the protocol, look for the functions with the modifier `onlyGovernance` in the smart contracts.The governance functions are represented by a red arrow in [this architecture diagram](https://viewer.diagrams.net/?highlight=0000ff\&edit=_blank\&layers=1\&nav=1\&title=tornado-cash-contract-overview.drawio#Uhttps%3A%2F%2Fraw.githubusercontent.com%2FRezan-vm%2Ftornado-cash-edu%2Fmain%2Ftornado-cash-contract-overview.drawio). NOTE: Parts of this article was taken from [this medium post.](https://tornado-cash.medium.com/tornado-cash-governance-proposal-a55c5c7d0703) Credits goes to the Tornado cash team.

### How to vote ? You first need to deposit (or lock) TORN tokens into the governance contract. Go to: Click `Manage` -> `Lock Tab`Approve the governance contract to transfer your TORN tokens by clicking on the `Approve` button. Once the approve is confirmed, chose the amount you want to deposit and click `Lock`. Confirm the transaction in your wallet and wait for the confirmation.

Before the vote, the next crucial step is to review the proposal. Legitimate proposals should have a dedicated post on [Torn.community](https://torn.community/) under the category Proposal?. The forum post will provide additional context and arguments on the proposal. Read the thread and make your own mind on the issue. Once a proposal was submitted it should appear on: Proposal are implemented in the form of a smart contract making changes to the system. It is therefore important to verify the address of the smart-contract and review its code. Find the address of the proposal contract here:

Look for the contract address on Etherscan and make sure that the source code is verified and readable.

Read the source code and make sure that it matches what is described in the forum post.If you are not technical or not comfortable to read Solidity code, get someone you trust to review the contract for you.If you agree (or disagree) with the proposal code, it time to vote!A proposal have a voting windows of 5 days. This means that we have 5 days to reach the vote quorum of 25k TORN.Important: Once you voted, your tokens will be locked for 8.25 days from the moment the proposal was submitted (the start of the 5 days voting period). After the 8.25 you can withdraw your tokens from the governance contract. Note that you can vote on 2 proposal at the same time without incurring additional lockup period (Only the most recently submitted proposal will matter for the 8.25 lockup).To vote, simply click on the Green check mark or the the red cross depending whether you accept or reject the proposal. Confirm the transaction with Metamask and your vote is in! ### How to delegate the vote ? If you are a TORN token holder, you can delegate your voting power to someone else without having to send him the tokens. IMPORTANT: If you delegate your tokens and that your delegate votes or initiate a proposal, your tokens will be locked for 8.25 days from the moment the proposal that the delegate voted on started. Note that that you can always undelegate at any time. To achieve delegation, go to: You first need to lock your tokens in the governance contract. Click **`Manage`** -> **`Lock`** tab Approve the governance contract to transfer your TORN tokens by clicking on the **`Approve`** button. Once the approve is confirmed, chose the amount you want to delegate and click **`Lock`**. Confirm the transaction in your wallet and wait for the confirmation.

The last step, is to make the actual delegation. Go again to Click **`Manage`** -> **`Delegate`** tab Fill-in the address to which you want to delegate and click **`Delegate`**. Approve the transaction in your wallet and wait for confirmation.

The totality of your locked balance will be delegated.You can undelegate at anytime. To undelegate simply use the `Undelegate` Button in `Manage` -> `Undelegate` Tab. # Staking Discover the benefits of staking on Tornado Cash. Earn rewards while contributing to network security and decentralization Since its inception, the TORN token is used by [Tornado Cash](https://tornadoeth.cash) users for governance. Its main utility is to allow the suggestion of proposals & voting both in-chain (through locked TORN for governance proposals) and off-chain (on Snapshot).Since the execution of [Tornado Cash 10th governance proposal](https://tornadoeth.cash/governance/10), TORN token has gained one other useful utility. Indeed, **with the introduction of a decentralized relayer register,** **a staking reward has been implemented for all holders with locked TORN in the governance contract.** [TORN](/generals/torn) holders can still lock their tokens into the governance contract as they used to for governance purposes. The significant difference is that they are now able to receive a portion of the fees collected by the protocol from relayers. Obviously, the proportion of the reward will be equal to the proportion of their locked TORN. #### **FROM WHERE THESE COLLECTED FEES COME FROM ?** The collection of these fees was made possible by the implementation of a decentralized relayer registry. In order to be listed on the protocol UI, relayers need to stake a given amount of TORN (currently set by governance at `300 TORN`) and keep enough TORN locked (\~`40 TORN` at the moment in April 2022) to be able to pay back the transaction fee to the staking contract. The functioning of this relayer registry is more extensively explained [on this forum post](https://twitter.com/devtornadocash) & on the [Relayer Registry documentation page](/generals/how-to-become-a-relayer).In a nutshell, for each withdrawal through the relayer method, the chosen relayer has to pay a fee to the protocol from the staked balance (that should still be maintained above the `300 TORN` threshold). Currently, this fee has been fixed at `0.3%` by the governance and can be changed at any time through an on-chain proposal & vote. ### How to Stake TORN token ? First, [connect your wallet to Tornado Cash](/tornado-cash-classic/how-to-connect-your-wallet).As mentioned above, the process to lock TORN tokens has remained unchanged. * It happens here ➡ ⬅, by clicking on **`Manage`**, then going on the **`Lock`** tab * The governance contract need to be approved in order to allow the transfer of your tokens to the smart contract. To do so, you need to click on the **`Approve`** button * Once the approval is confirmed, you can chose the amount of token to lock, then click on **`Lock`** * All you have to do after that is to confirm the transaction in your wallet & wait for the confirmation to come through

### **How to Claim Your Staking Reward ?** Now that your TORN tokens have stayed nice & warm locked in the governance contract, you are able to claim your staking reward. How to do that? \ Everything is still happening here ➡ ⬅ As soon as you log in the page, you will be able to see your staking reward at the top, just waiting for you to collect it 💰

Click **`Manage`** -> **`Claim`** tab -> **`Claim`** *button.*

*That's it, we're done, easy peasy lemon squeezy*�� # How to add or remove liquidity on Uniswap v2 Learn how to efficiently add or remove liquidity on Uniswap V2 with our step-by-step guide. Maximize your DeFi experience today In this tutorial we will see how to add and remove liquidity on Uniswap v2 TORN/ETH pair. * Add liquidity * Remove liquidity #### 1. Add liquidity 1. 2. Add the TORN and ETH pair

3\. Click on Managen

4\. Click on Add

5\. Choose an amount to add and click on Supply

6\. Click on confirm

#### 2. Remove liquidity 1. 2. Add the TORN and ETH pair

3\. Click on Manage

4\. Click on Remove

5\. Choose the percentage you wish to withdraw

5\. Click on confirm

And that's it!🎉 # How to become a relayer? Learn how to become a relayer on Tornado Cash, including setup steps, requirements, and best practices for optimal performance Following the execution of [Tornado Cash 10th governance proposal](https://tornadoeth.cash/governance/10), anyone can become a relayer for Tornado Cash users. The only condition to be included on the Tornado Cash UI is to lock a min. of `300 TORN`\*. To remain listed, it is needed to keep enough TORN locked (\~`40 TORN` at the moment in April 2022) to be able to pay back the transaction fee to the staking contract. \**This minimum stake can be changed by a governance vote at any time.* Relayers form an essential & necessary part of the Tornado Cash ecosystem. Their use guarantees privacy as they solve the infamous fee payment dilemma : how to pay fees for token withdrawals from a pool while maintaining anonymity? Therefore, relayers act as third parties and manage the entire withdrawal. They pay for transaction fees by deducting them directly from the transferred amount. They also charge an additional fee for their services. Since the implementation of the [Relayer Registry proposal](https://tornadoeth.cash/governance/10), the protocol collects a fee directly from the relayer’s staked balance through the `StakingReward` contract for each withdrawal. This fee percentage may vary from one pool to another and is also subject to change through on-chain governance. Currently, it is fixed at `0.3%` . Some pools remain without fees, either because the instance is too small to assign a fee (0.1 ETH, 100 DAI/USDT, 1000 DAI/USDT), or because there is not enough liquidity on Uni v3 (all cDAI instances). ## How to Become a Relayer? Anyone can become a relayer for the protocol in **6 simple steps** through a [Relayer Registry User Interface (UI)](https://relayers-network.tornadoeth.cash/).Below you will find everything your need to join our relayers' club & get listed on Tornado Cash decentralized relayer registry. ### 1. Warning: Understand & Accept Potential Risks Before you commit to sharing part of your journey with Tornado Cash users as a relayer, you need to understand & accept all potential risks of being a relayer for the protocol. #### How a Relayer is chosen by user interface The formula for designating a relayer is as follows: * The list of all registered relayers is retrieved from the Relayer Registry smart contract. * For each relayer, calculate a score based on its staked TORN and its fee. The higher the stake, the higher the score is; the higher the fee, the lower the score is. For Ethereum mainnet, the formula used to calculate the score is `stake * [1 - 25*(fee-0.33)^2]`; for sidechains, the formula is `stake * [1 - 11.89*(fee-0.01)^2]`. * Then randomly pick a relayer, weighted by its calculated score. ### 2. Set up Relayer The first concrete step is to run the Tornado Cash Relayer software for Ethereum Mainnet on your computer. All steps are outlined in the protocol's github. To complete this task successfully, you will have to carefully follow [these instructions](https://github.com/tornadocashdev/tornado-relayer#deploy-with-docker-compose). {% embed url="" %} Once completed, you will need to insert your url in the input box.

It is strongly recommended that you use your own RPC nodes. Instructions on how to run full nodes can be found [here](https://github.com/feshchenkod/rpc-nodes). ### 3. Set Up ENS Subdomain The next steps entail: * Creating an ENS domain for your relayer. * Setting up its mainnet subdomain. * Adding a TXT record with the Relayer URL to the mainnet subdomain according to this specific format: #### **Ethereum Relayers (Mandatory)** TXT record mainnet-tornado.xxx.eth goerli-tornado.xxx.eth #### **Sidechains Relayers (Optional)** You also have the option to add subdomains with their corresponding TXT records to support chains other than Ethereum. Sidechains relayers use a different version of the Relayer software. The complete requirements with instructions are found [here](https://github.com/TornadoCashDev/tornado-relayer/blob/master/README.md). TXT record bsc-tornado.xxx.eth gnosis-tornado.xxx.eth polygon-tornado.xxx.eth optimism-tornado.xxx.eth arbitrum-tornado.xxx.eth avalanche-tornado.xxx.eth #### **Nova Relayer (Optional)** Tornado Cash Nova uses its own version of the software. If you wish to become a relayer for Tornado Cash Nova, you will find instructions to follow [here](https://github.com/tornadocashdev/tornado-pool-relayer#deploy-with-docker-compose). TXT record gnosis-nova.xxx.eth

### **4. Set Up Workers** Workers are the addresses that will allow your relayer to send ZK-proofs to users. By default, the first worker is the ENS domain owner's address. To ensure an extra level of security, we advise you to set up more than one worker. Only the mainnet requires you to register workers. All other networks do not require the use of registered workers.

### 5. Stake With the implementation of a decentralized relayer registry, a staking condition has been introduced as a requirement to become listed on Tornado Cash UI. Keep in mind **staking TORN is now necessary to be added to the recommended list of relayers.** The minimum staked amount is currently set by Tornado Cash governance at **`300 TORN`**. This threshold can be changed by Tornado Cash governance at any time. When a relayer is used in the Tornado Cash pool, a small amount of TORN is automatically collected from this staked balance by the `StakingReward` contract. This element is essential to keep in mind as relayers will need to keep enough TORN locked (\~`40 TORN` at the moment in April 2022) to be able to pay back the transaction fee to the staking contract. The collected fees are subsequently distributed among DAO members with locked TORN tokens. TORN are usually locked to participate in on-chain governance (submitting & voting on proposals). You can find more information both on this [Staking TORN documentation page](/generals/staking). Your staked TORN amount is not claimable, and it is non-refundable.

### 6. Summary: Final Verification & Registration Last but not least, we advise you to **double-check all information** displayed in the Summary before registering.

*Welcome to the relayer team! Thanks to you, privacy can be better respected* # Relayer Service Explore the Tornado Cash Relayer Service: secure, anonymous transactions on the Ethereum network. Learn how our relayers enhance privacy ### Enhance Your Ethereum Privacy with Relayer
Relayer is the gateway to enhanced privacy for your Ethereum transactions. With cutting-edge technology, it allows users to mix and anonymize their ETH, making transactions more secure and private. Take control of your financial privacy with Relayer; Because your financial life should be your own. Check it out at and experience the age of privacy in the world # Tornado Cash RPC Learn how to interact with Tornado Cash's RPC endpoints for private, decentralized transactions. Explore general configurations and usage guidelines \ Fast, Privacy-Focused, and Multi-Network Support\ \ **TornadoCash RPC:** [rpc.tornadoeth.cash](https://rpc.tornadoeth.cash) With the rapid developments in the cryptocurrency world, the significance of projects focusing on privacy is steadily increasing. TornadoCash stands out as one of the notable projects in this domain, aiming to provide users with both privacy and security. In this article, we will delve into TornadoCash's RPC (Remote Procedure Call) services, exploring the services offered across various networks.

## What Is TornadoCash RPC ? TornadoCash RPC is a service that enables users to utilize the TornadoCash protocol on Ethereum and other blockchain networks. RPC, standing for Remote Procedure Call, is a communication protocol allowing an application to invoke a function located on a different server. TornadoCash RPC utilizes this feature to offer users privacy and speed. ## Privacy and Security Priorities TornadoCash sets high standards in terms of user privacy and asset security. Users can safeguard their personal information and manage their assets securely while conducting transactions through TornadoCash RPC. This feature allows users to operate anonymously on blockchain networks. ## M**ulti-Network Support** TornadoCash RPC draws attention with its capability to function on various blockchain networks. Below are the networks where TornadoCash RPC can be used: * Ethereum (ETH): * Ethereum (Sepolia): * Ethereum ([MEV](/generals/tornado-cash-rpc/mev-blocker)): * Binance Smart Chain (BSC): * Polygon (MATIC): * Arbitrum (ARB): * Avalanche (AVAX): * Gnosis (GNO): * Optimism (OP): This multi-network support enables users to benefit from TornadoCash advantages on their preferred blockchain network. ## **How to Use?** Using TornadoCash RPC is straightforward. Once you specify the RPC endpoint of the relevant network, you gain access to the TornadoCash protocol. Users can refer to TornadoCash's official documentation to obtain detailed information on how to use RPCs. # Mev Blocker Explore Tornado Cash RPC integration with MEV Blocker, providing enhanced privacy and security for Ethereum transactions. Learn setup, usage, and benefits ### Introduction[](https://docs.flashbots.net/flashbots-protect/mev-share#introduction) Maximal Extractable Value (MEV) has become a significant concern for users interacting with blockchain technologies, particularly those engaged in decentralized finance (DeFi) activities. MEV refers to the maximum value that can be extracted from blockchain transaction reordering by miners or validators. While it presents opportunities for profit, it also raises concerns about fairness and security within the blockchain ecosystem.

To address these concerns, MEV-Blocker emerges as a groundbreaking solution designed to protect users' transactions from being exploited for MEV. MEV-Blocker leverages advanced technologies to shield transactions, ensuring that users retain the majority of the MEV generated by their activities. This document serves as an introduction to MEV-Blocker, detailing its capabilities, configurations, and how users can harness it to safeguard their transactions while maximizing their returns in the blockchain space. Mev-Blocker allows users to gain up to 90% of the MEV that their transactions create. By default, Protect users' transactions are sent to TornadoRPC Mev-Blocker Node, which returns them up to 90% of the MEV that their transactions create. By default, Protect users will be connected with the Stable configuration, which is continuously tuned by Mev-Blocker to optimize execution while protecting users from harmful MEV. This document guides users on the nuances and configurations of Mev-Blocker. MEV-Share enables users to reclaim up to 90% of the MEV generated by their transactions. By default, transactions from Protect users are directed to the TornadoRPC Mev-Blocker Node, which facilitates this return. Users are automatically connected to the Stable configuration, a setting continuously optimized by TornadoRPC Mev-Blocker to balance efficient execution and protection against harmful MEV. This document provides a guide on the mechanism and various configurations of Mev-Blocker. Advanced users can exert more control over their transactions and preferences through the advanced panel or by manually configuring their Protect RPC request. ### Common configurations[](https://docs.flashbots.net/flashbots-protect/mev-share#common-configurations) #### Stable Configuration[](https://docs.flashbots.net/flashbots-protect/mev-share#stable-configuration) The Stable configuration is the default configuration for Protect RPC. No query parameters are specified to use it. ``` https://rpc.tornadoeth.cash/mev ``` Currently, this configuration shares the following information: * The `hash` of all transactions * `default_logs` Partial logs (the pool id and the fact that a swap was made) for curve, balancer, and uniswapV2/V3-style trades * Transactions are only forwarded to the TornadoRPC Mev block builder This may change over time as we gather more data and fine-tune the configuration to maximize benefits. #### Max Privacy[](https://docs.flashbots.net/flashbots-protect/mev-share#max-privacy) To use Protect with full privacy, set *only* the `hash` hint in your Protect RPC URL: ``` https://rpc.tornadoeth.cash/mev?trace=hash ``` This configuration ensures that all identifiable transaction data sent to the MEV-Share Node is concealed from searchers. However, it's important to note that this could make it more challenging for searchers to spot MEV opportunities, leading to a very likely decrease in your MEV kickback. #### Max Kickback[](https://docs.flashbots.net/flashbots-protect/mev-share#max-kickback) To use Protect with the maximum kickback, set *all* hints in your Protect RPC URL: ``` https://rpc.tornadoeth.cash/mev?trace=calldata&trace=contract_address&trace=function_selector&trace=logs&trace=hash ``` This configuration provides searchers with comprehensive details about your transaction, giving them better chance to identify more MEV opportunities and to return more MEV kickback to you. ### Examples[](https://docs.flashbots.net/flashbots-protect/mev-share#examples) Here are some examples of configurations that you might choose, depending on your goals. | Goal | TornadoRPC MEV Protect RPC URL | | ------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | | Stable | `https://rpc.tornadoeth.cash/mev` | | Max Privacy | `https://rpc.tornadoeth.cash/mev?trace=hash` | | Max Kickback | `https://rpc.tornadoeth.cash/mev?trace=calldata&trace=contract_address&trace=function_selector&trace=logs&trace=hash` | | Add Builders (share with other builders for faster inclusion) | `https://rpc.tornadoeth.cash/mev?builder=tornadoRPC&builder=XYZ` | ### Configuration Reference[](https://docs.flashbots.net/flashbots-protect/mev-share#configuration-reference) The Protect RPC uses query parameters within the URL to convey your preferences. These parameters can include hints about your transaction, the builders to whom your transaction is directed, and the distribution of potential refunds if your transaction is bundled. #### Trace[](https://docs.flashbots.net/flashbots-protect/mev-share#hints) To customize your trace setup, use the hint parameter to control the visibility of your transaction data to searchers. If no traces are provided, the default stable trace configuration will be used. If you specify one or more trace, any hint that is *not* included will be disabled. | Trace | Description | | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `calldata` | Share data sent to the smart contract (if applicable) by the transaction. The function selector and contract address will also be shared if the calldata is shared. | | `logs` | Share logs emitted by executing the transaction. | | `default_logs` | Share specific subset of logs related to defi swaps. Partial info (the pool id and the fact that a swap was made) for curve, balancer, and uniswapV2/V3-style trades | | `function_selector` | Share the 4-byte identifier of the function being called on the smart contract by the transaction. The contract address will also be shared if the function selector is shared. | | `contract_address` | Share the address of the recipient of the transaction; typically a smart contract. | | `hash` | Share the transaction hash (or bundle hash if sending a bundle). To use full privacy mode, share this hint and this hint alone. The hash will always be shared if other hints are shared. | | `tx_hash` | Share individual tx hashes in the bundle. | Here is an example: ``` https://rpc.tornadoeth.cash/mev?trace=calldata&trace=logs&trace=hash ``` This configuration shares the calldata, logs, and hash of your transaction with searchers. It does not share the contract address or function selector. #### Trace[](https://docs.flashbots.net/flashbots-protect/mev-share#hints) To customize your trace setup, use the hint parameter to control the visibility of your transaction data to searchers. If no traces are provided, the default stable trace configuration will be used. If you specify one or more trace, any hint that is *not* included will be disabled. | Trace | Description | | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `calldata` | Share data sent to the smart contract (if applicable) by the transaction. The function selector and contract address will also be shared if the calldata is shared. | | `logs` | Share logs emitted by executing the transaction. | | `default_logs` | Share specific subset of logs related to defi swaps. Partial info (the pool id and the fact that a swap was made) for curve, balancer, and uniswapV2/V3-style trades | | `function_selector` | Share the 4-byte identifier of the function being called on the smart contract by the transaction. The contract address will also be shared if the function selector is shared. | | `contract_address` | Share the address of the recipient of the transaction; typically a smart contract. | | `hash` | Share the transaction hash (or bundle hash if sending a bundle). To use full privacy mode, share this hint and this hint alone. The hash will always be shared if other hints are shared. | | `tx_hash` | Share individual tx hashes in the bundle. | Here is an example: ``` https://rpc.tornadoeth.cash/mev?trace=calldata&trace=logs&trace=hash ``` This configuration shares the calldata, logs, and hash of your transaction with searchers. It does not share the contract address or function selector. #### Builders[](https://docs.flashbots.net/flashbots-protect/mev-share#builders) To designate the builders who will receive your transactions, use the `builder` parameter. This parameter can be repeated multiple times to include multiple builders. The builders listed below are currently supported. Note that all transactions are shared with the Mev-Blocker block builder, even if it is not explicitly specified. | Name | RPC | | --------------- | -------------------------------- | | tornadoRPC | rpc.tornadoeth.cash | | EigenPhi | builder.eigenphi.io | | builder0x69 | builder0x69.io | | Titan | rpc.titanbuilder.xyz | | beaverbuild.org | rpc.beaverbuild.org | | BuildAI | | | f1b.io | | | rsync | rsync-builder.xyz | | boba-builder | boba-builder.com/searcher/bundle | | Gambit Labs | | | payload | rpc.payload.de | | Loki | rpc.lokibuilder.xyz | | penguinbuild | rpc.penguinbuild.org | | JetBuilder | rpc.mevshare.jetbldr.xyz | | tbuilder | flashbots.rpc.tbuilder.xyz | It's important to understand that while adding more builders can increase your transaction inclusion rate, it also requires you to place trust in those builders. Here's an example of how to utilize the `builder` parameter: ``` https://rpc.tornadoeth.cash/mev?builder=tornadoRPC&builder=XYZ ``` This configuration sends your transaction to the ABC block builder and the XYZ block builder, as well as the TornadoRPC Mev block builder. #### Setting Priority Fee When configuring your transaction through the Protect RPC, it's crucial to ensure that the priority fee, also known as a tip, is set to a value greater than zero. This is a mandatory step to ensure that your transaction does not get overlooked. To increase the likelihood of your transaction being selected by builders and thus potentially increasing your MEV returns, you can adjust the priority fee of your transactions. The priority fee is an additional fee paid to miners or block builders, incentivizing them to include your transaction in a block. To set a priority fee while using Protect RPC, you can add the `priorityFee` parameter to your URL, specifying the amount in Gwei: ``` https://rpc.tornadoeth.cash/mev?priorityFee=2 ``` ``` Priority Fee: >0 ETH ``` This sets a priority fee of 2 Gwei, signaling to builders that you're willing to pay a bit extra for the inclusion of your transaction. Transactions that do not adhere to this requirement will be excluded by block builders and will not be included in the blockchain, except in cases where they're picked up as part of a bundle by a MEV-Searcher through MEV-Share. **Notes** * The default priority fee is usually determined by the current network conditions and the base fee. * Setting a priority fee too low might result in your transaction being ignored. * Conversely, setting it too high might result in unnecessary costs without significant benefits. * It's important to balance the priority fee based on current network congestion and your desire for speed versus cost efficiency. **Example of Setting a Priority Fee in a Transaction Request** When sending a transaction request, you can adjust the `maxPriorityFeePerGas` field to set the priority fee. For instance: ```json { "jsonrpc": "2.0", "method": "eth_sendTransaction", "params": [{ "from": "0xYourAddress", "to": "0xRecipientAddress", "value": "0xValue", "data": "0xData", "maxPriorityFeePerGas": "0x3B9ACA00" // This sets the priority fee to 1 Gwei }], "id": 1 } ``` Note: The `maxPriorityFeePerGas` value in the example is set to 1 Gwei for illustration purposes. The actual fee value should be adjusted based on current network conditions and your transaction urgency. # How to configure MetaMask Learn how to configure MetaMask for Tornado Cash RPC. Step-by-step guide to securely connect your wallet for private transactions ## How to add RPC *** * If you want to deposit you may have to change your wallet RPC, as most providers have censored the smart contracts. **The default provider of Metamask, Infura along with Ankr and Alchemy currently do not prohibit transactions to and from the protocol, governance and the TORN token**. * Try searching for an alternative working endpoint on [Chainlist](https://chainlist.org/) or via [TornadoRPC](https://rpc.tornadoeth.cash), which could take multiple attempts (take note of the ChainID for network configuration). An example of how to change your RPC provider for MetaMask is shown below.

* Sometimes visiting the application you could be greeted with the following message, to fix this click "OPEN SETTINGS". ![TornadoCash RPC](https://preview.redd.it/tornadocash-post-censorship-v0-hxsgzeqjgew91.png?width=604\&format=png\&auto=webp\&s=fec9c046b7381a339ea55e80ba9fe0c36443226a) * You'll then be displayed a dropdown selection, defaulted to a selection. Click on it and select the "Custom" option. ![RPC endpoint](https://preview.redd.it/tornadocash-post-censorship-v0-d65qzrumgew91.png?width=437\&format=png\&auto=webp\&s=ba808fc18335cafda5c872f3ce7810aafac89dd2) * Here enter a non-censoring RPC provider depending on your network and this will resolve application issues. ![RPC endpoint](https://preview.redd.it/tornadocash-post-censorship-v0-9k83i8tqgew91.png?width=440\&format=png\&auto=webp\&s=0951999581a4ab0403111980e693e248d8bc8a79) * Then you are freely able to withdraw, deposit, stake or participate in decentralized governance like nothing ever happened. ### FAQ > Why do I keep recieving the error `Failed to fetch relayers`? * This error is either related to a poor connection or a result of no available relayers on your network. It usually can be solved by refreshing. > Why do I keep recieving the error `Failed to fetch proving keys`? * This error is either related to a poor connection, it usually can be solved by refreshing or changing VPN location for better latency. > Why do I keep recieving the error `Failed to fetch all deposit events from contract` when trying to withdraw? * This error is related to a poor connection or using a censored RPC endpoint. To resolve this either: * change VPN location for better latency * try a new browser or method of access * configure the application RPC configuration to an alternative > Why can't I make a deposit from my wallet? * Most RPCs censor transactions to the protocol and governance since the OFAC sanctions, you need to configure your wallet RPC to a uncensored endpoint. # RU Как настроить MetaMask для использования Tornado Cash RPC. Подробное руководство по настройке для безопасных и конфиденциальных транзакций с использованием MetaMask ## Как добавить RPC *** * Если вы хотите сделать депозит, вам может потребоваться изменить свой кошелек RPC, так как большинство провайдеров заблокировали смарт-контракты. **По умолчанию, провайдер Metamask, Infura вместе с Ankr и Alchemy в настоящее время не запрещают транзакции на и от протокола, управления и токена TORN.** * Попробуйте найти альтернативную рабочую конечную точку на [Chainlist](https://chainlist.org) или через [TornadoRPC](https://rpc.tornadoeth.cash), что может потребовать несколько попыток (обратите внимание на ChainID для конфигурации сети). Приведен пример того, как изменить вашего провайдера RPC для MetaMask, ниже.

Иногда при посещении приложения вас могло встречать следующее сообщение, для исправления нажмите "ОТКРЫТЬ НАСТРОЙКИ". ![Tornado Cash RPC](https://preview.redd.it/tornadocash-post-censorship-v0-hxsgzeqjgew91.png?width=604\&format=png\&auto=webp\&s=fec9c046b7381a339ea55e80ba9fe0c36443226a) Затем вам отобразится раскрывающийся список, по умолчанию выбранный. Нажмите на него и выберите опцию "Пользовательский". ![](https://preview.redd.it/tornadocash-post-censorship-v0-d65qzrumgew91.png?width=437\&format=png\&auto=webp\&s=ba808fc18335cafda5c872f3ce7810aafac89dd2) Здесь введите поставщика RPC без цензуры в зависимости от вашей сети, и это решит проблемы с приложением. ![](https://preview.redd.it/tornadocash-post-censorship-v0-9k83i8tqgew91.png?width=440\&format=png\&auto=webp\&s=0951999581a4ab0403111980e693e248d8bc8a79) * Затем вы можете свободно снимать средства, вносить депозиты или участвовать в децентрализованном управлении, как будто ничего не произошло. ### FAQ > Почему я постоянно получаю сообщение об ошибке `Failed to fetch relayers`? * Эта ошибка возникает либо из-за плохого соединения, либо из-за отсутствия ретрансляторов в сети. Обычно это решается обновлением. > Почему я постоянно получаю сообщение об ошибке `Failed to fetch proving keys`? * Эта ошибка возникает либо из-за плохого соединения, обычно ее можно решить, обновив или изменив местоположение VPN для лучшей задержки. > Почему я постоянно получаю сообщение об ошибке `Failed to fetch all deposit events from contract` при попытке вывести средства? * Эта ошибка возникает из-за плохого соединения или использования цензурированной конечной точки RPC. Чтобы решить это либо: * изменить местоположение VPN для лучшей задержки * попробуйте новый браузер или метод доступа * установить альтернативную конфигурацию приложения RPC > Почему я не могу внести депозит со своего кошелька? * Большинство RPC подвергают цензуре протокол и транзакции управления, поскольку OFAC налагает санкции, вам необходимо настроить RPC вашего кошелька на не подвергаемую цензуре конечную точку. # ZH ### 如何添加 RPC * 如果您想存款，您可能需要更改您的钱包 RPC，因为大多数提供商已阻止该协议。**Metamask、Infura 以及 Ankr 和 Alchemy 的默认提供者不禁止使用协议、治理和 TORN 进行交易**。 * 尝试在 [Chainlist](https://chainlist.org) 上或通过 [TornadoRPC](https://rpc.tornadoeth.cash) 寻找替代工作端点，这可能需要几次尝试（注意网络配置的 ChainID。下面提供了如何更改 MetaMask 的 RPC 提供程序的示例。 ![Metamask](https://web.archive.org/web/20230512150846im_/https://docs.tornado.ws/.gitbook/assets/zOwfk4k.gif) 有时，访问该应用程序时，您可能会收到以下消息来解决此问题，请单击“打开设置”. ![TornadoCash RPC](https://web.archive.org/web/20230512150846im_/https://docs.tornado.ws/.gitbook/assets/xcNzhNG.png) 然后，您将看到一个下拉选择，默认为一个选择。单击它并选择“自定义”选项。 ![](https://web.archive.org/web/20230512150846im_/https://docs.tornado.ws/.gitbook/assets/zrY5GEi.png) 根据您的网络在此处输入非审查 RPC 提供程序，这将解决应用程序问题。 ![](https://web.archive.org/web/20230512150846im_/https://docs.tornado.ws/.gitbook/assets/dE13HsA.png) 然后，您可以自由地取款、存款、质押或参与去中心化治理，就像从未发生过一样。 ### FAQ > 为什么我总是收到 `Failed to fetch relayers` 的错误消息？ * 此错误要么与连接不良有关，要么与您的网络上没有可用的中继器有关。通常可以通过刷新来解决。 > 为什么我总是收到 `Failed to fetch proving keys` 的错误消息？ * 此错误与连接不良有关，通常可以通过刷新或更改 VPN 位置以获得更好的延迟来解决。 > 为什么我在尝试提款时一直收到错误`Failed to fetch all deposit events from contract`？ * 此错误与连接不良或使用经过审查的 RPC 端点有关。要解决此问题： * 更改 VPN 位置以获得更好的延迟 * 尝试新的浏览器或访问方式 * 将应用程序 RPC 配置配置为替代方案 > 为什么不能从我的钱包中存款？ * 自 OFAC 制裁以来，大多数 RPC 都会审查协议和治理的交易，您需要将钱包 RPC 配置为未经审查的端点。 # UK Как настроить MetaMask для использования Tornado Cash RPC. Подробное руководство по настройке для безопасных и конфиденциальных транзакций с использованием MetaMask ## Как добавить RPC *** * Если вы хотите сделать депозит, вам может потребоваться изменить свой кошелек RPC, так как большинство провайдеров заблокировали смарт-контракты. **По умолчанию, провайдер Metamask, Infura вместе с Ankr и Alchemy в настоящее время не запрещают транзакции на и от протокола, управления и токена TORN.** * Попробуйте найти альтернативную рабочую конечную точку на [Chainlist](https://chainlist.org) или через [TornadoRPC](https://rpc.tornadoeth.cash), что может потребовать несколько попыток (обратите внимание на ChainID для конфигурации сети). Приведен пример того, как изменить вашего провайдера RPC для MetaMask, ниже.

Иногда при посещении приложения вас могло встречать следующее сообщение, для исправления нажмите "ОТКРЫТЬ НАСТРОЙКИ". ![Tornado Cash RPC](https://preview.redd.it/tornadocash-post-censorship-v0-hxsgzeqjgew91.png?width=604\&format=png\&auto=webp\&s=fec9c046b7381a339ea55e80ba9fe0c36443226a) Затем вам отобразится раскрывающийся список, по умолчанию выбранный. Нажмите на него и выберите опцию "Пользовательский". ![](https://preview.redd.it/tornadocash-post-censorship-v0-d65qzrumgew91.png?width=437\&format=png\&auto=webp\&s=ba808fc18335cafda5c872f3ce7810aafac89dd2) Здесь введите поставщика RPC без цензуры в зависимости от вашей сети, и это решит проблемы с приложением. ![](https://preview.redd.it/tornadocash-post-censorship-v0-9k83i8tqgew91.png?width=440\&format=png\&auto=webp\&s=0951999581a4ab0403111980e693e248d8bc8a79) * Затем вы можете свободно снимать средства, вносить депозиты или участвовать в децентрализованном управлении, как будто ничего не произошло. ### FAQ > Почему я постоянно получаю сообщение об ошибке `Failed to fetch relayers`? * Эта ошибка возникает либо из-за плохого соединения, либо из-за отсутствия ретрансляторов в сети. Обычно это решается обновлением. > Почему я постоянно получаю сообщение об ошибке `Failed to fetch proving keys`? * Эта ошибка возникает либо из-за плохого соединения, обычно ее можно решить, обновив или изменив местоположение VPN для лучшей задержки. > Почему я постоянно получаю сообщение об ошибке `Failed to fetch all deposit events from contract` при попытке вывести средства? * Эта ошибка возникает из-за плохого соединения или использования цензурированной конечной точки RPC. Чтобы решить это либо: * изменить местоположение VPN для лучшей задержки * попробуйте новый браузер или метод доступа * установить альтернативную конфигурацию приложения RPC > Почему я не могу внести депозит со своего кошелька? * Большинство RPC подвергают цензуре протокол и транзакции управления, поскольку OFAC налагает санкции, вам необходимо настроить RPC вашего кошелька на не подвергаемую цензуре конечную точку. # Tornado Cash smart contracts Learn about Tornado Cash smart contracts, privacy features, and blockchain integration. Explore secure, decentralized transactions for Ethereum [Codes behind Tornado.Cash functioning](https://github.com/tornadocashdev) - smart contacts, circuits & toolchain - are fully **open sourced.** This page regroups all information regarding [Tornado Cash](https://twitter.com/devtornadocash) smart contracts. ## Smart Contracts Adresses ### [Tornado Cash Classic](https://tornadoeth.cash) - Pools Contracts * Ethereum Mainnet * Arbitrum * Optimism * BSC * xDAI * MATIC * AVAX * Goerli # Minified UI hosted locally Learn how to host Tornado Cash's minified UI locally for enhanced security and privacy. Step-by-step guide for quick and efficient setup Tornado Cash protocol can be launched locally on your computer through a minified User Interface version made available by the core developers team. {% embed url="" %} Tornado Cash UI Minified {% endembed %} ### Step #1: Clone the Github repository on your computer By opening your Command Line Interface, you can run the following commands to, first, clone the repository, then go inside the newly copied folder: ``` 1 git clone https://github.com/tornadocashdev/ui-minified.git 2 cd ui-minified ``` ### Step #2: Serve the Folder with Your Favorite HTTP Server ``` 1 python -m SimpleHTTPServer 8080 ``` You can obviously use any other http web server, such as[ npmjs.com/package/http-server](https://www.npmjs.com/package/http-server). ### Step #3: Run the UI on Localhost on your Favorite Web Browser To finish, you just need to run on your Web Browser & let the magic happens 🪄 ## Running a TOR service If you wish to serve tornado cash UI on an .onion domain, there is an easy way to do it using docker-compose. * You need to paste the following into `docker-compose.ym` ``` 1 version: '2' 2 services: 3 tornado_ui: 4 image: tornadocashdev/ui 5 restart: always 6 container_name: tornado_ui 7 watchtower: 8 image: v2tec/watchtower 9 restart: always 10 volumes: 11 - /var/run/docker.sock:/var/run/docker.sock 12 command: --interval 60 tornado_ui 13 tor: 14 image: strm/tor 15 restart: always 16 depends_on: [ tornado_ui ] 17 environment: 18 LISTEN_PORT: 80 19 REDIRECT: tornado_ui:80 20 # Generate a new key with 21 # docker run --rm --entrypoint shallot strm/tor-hiddenservice-nginx ^torn 22 PRIVATE_KEY: | 23 -----BEGIN RSA PRIVATE KEY----- 24 ... 25 -----END RSA PRIVATE KEY----- ``` # How to connect your wallet Description: Learn how to securely connect your crypto wallet to Tornado Cash Classic. Follow step-by-step instructions to ensure safe and private transactions To connect your wallet to Tornado Cash, you have two options: You can either click on **Connect** on the main page of Tornado Cash, *directly after selecting your deposit amount.*

You can also click on **Settings** on the top right of the page then click on **Connect your wallet.**

## **Metamask wallet** If you have a Metamask wallet, you have to make sure you **already have the extensions installed** on your browser. *If you don't know how to install it, you can check this* [*tutorial*](/generals/tornado-cash-rpc) *before the next step.* 1. Once you have the extension installed, click on **Connect**. 2. A pop up page will open up asking if you wish to connect your wallet to Tornado Cash. 3. Click on **Next,** then **Connect**. 4. You are now connected to Tornado Cash.

## WalletConnect For other wallets, **you should click on WalletConnect**. You will have to use your phone since many wallets do not have Desktop applications yet. **It generates a QR code that needs to be scanned.**

### **Trustwallet** To connect your wallet, you will need your phone. If you have a TrustWallet wallet, you should open the application on your smartphone then follow the next steps: 1. Click on **Settings**. 2. Click on **WalletConnect**. 3. Scan the QRCode on Tornado Cash's page. 4. Click on **Connect**. 5. You are now connected with Tornado Cash.

**ImToken** To connect your wallet, you will need your phone. If you have a ImToken wallet, you should open the application then follow the next steps: 1. **Click** on the icon (top right). 2. **Scan** the QRCode on Tornado Cash's page. 3. **Click** on Connect. 4. You are now connected with Tornado Cash.

### **Argent Wallet** To connect your wallet, you will need your phone. If you have a Argent wallet, you should open the application then follow the next steps: 1. **Click** on the Send (bottom right). 2. **Click** on the scan icon (top right). 3. Scan the QRCode on Tornado Cash's page. 4. You are now connected with Tornado Cash.

### **Other wallets** For others wallets, steps might be really similar: **WalletConnect's QR code needs to be scanned in order to link your wallet to Tornado Cash.** Make sure to always check for a scanning icon (often located on the landing page or the settings section on your wallet's application). # Deposit & Withdraw Learn how to deposit and withdraw securely with Tornado Cash Classic. A step-by-step guide to ensure private, anonymous transactions on Ethereum This tutorial is a step-by-step explanation of how to deposit & withdraw your funds. If you want to understand how the internal system of Tornado.cash works, please refer to this [tutorial](/tornado-cash-classic/how-to-connect-your-wallet).

## **Deposit** ### Choose a chain [Tornado cash](https://tornadoeth.cash) is available on several blockchains, so you will have to choose among 4 chains:

### Select a token Choose the token you want to deposit and its amount:

### Connect your wallet Click on `Connect` and choose between wallet providers such as Metamask or WalletConnect. ### Save your note Click on `Deposit` and store your note on a secure place before clicking on `I backed up the note`. You can also save encrypted notes on-chain by setting up a Note Account, by clicking on `Settings` (top-right corner).

### Be patient As explained [here](https://tornadoeth.cash), the longer you wait, the greater your anonymity set will be.Congrats ! You did it. Now your tokens are on the Tornado.Cash pool. ## Withdraw ### Choose a chain [Tornado cash](https://tornadoeth.cash) is available on several blockchains, so you will have to choose among 4 chains:

### Paste your note Use your deposit note by pasting it in the corresponding box. Click on `Withdraw` and wait for the zk-Snark proof to be generated. ### Confirm the withdrawal

Done ! # Anonymity Mining Discover how Tornado Cash Classic enables Anonymity Mining for private transactions. Learn the key steps and benefits of preserving financial privacy

Anonymity mining is an incentive to increase the level of privacy in any coin-joining or coin-mixing protocols by rewarding participants anonymity points (AP) dependent on how long they hedge their assets in a pool. *Tornado Cash anonymity mining program began on December 18, 2020 and has ended on December 18, 2021.* Individuals deposit to any one of the anonymity pools that are supported (ETH, WBTC, DAI or cDAI) and are rewarded a fixed amount of AP per block, over the period their deposit remains in the pool. These points can then be exchanged for TORN once claimed.

### Anonymity points (AP) *Readers should be aware some lower denomination deposits at the time of writing, do not produce a positive return due to the gas costs required to withdraw, redeem and exchange anonymity points* One of the community members created the resource of a mining spreadsheet 13 that helps calculate annual percentage yield’s (APY’s) for each pool and each denomination set within, through estimating the fees required to claim a reward. **It is highly recommended to view this resource and plan one’s course of action before expecting to earn yield.** At the bottom of the spreadsheet, you can view each pool by selecting the associated tab. ### How to earn AP 1\. Decide what amount and asset to deposit by selecting it through the dropdown menu, before clicking on "Connect" and "Deposit".

2\. Take a record of your depositing note and back it up safely, **do not share this with anyone or risk losing your deposit and reward.**

3\. Generate the proof and submit the transaction. 4\. Your deposit should now be viewable on the bottom of the page, you can track how much AP it earns here; remember the longer your deposit remains active, the more AP you earn.

*Notes that are active (not withdraw) are known as unspent notes.* ### How to claim AP 1\. First you must create a mining account and store those credentials on-chain for easy recovery (requires a transaction), **like depositing notes, you should never share your mining recovery key with anyone** and ensure to back it up in a safe place. This feature is not supported by hardware wallets so it’s encouraged to store the information as presented\_.\_

2\. Take an active deposit through providing an unspent note and withdraw to an address of preference and decide whether to use a relayer or not (*to maintain a deposit’s anonymity it is always advised to use a relayer*), this will bring the note into a spent state.

**Remember to still keep your depositing notes a secret even after withdrawing, as they still retain the ability to redeem AP.**

3\. Visit the mining route of the application and enter your spent note, you may be faced with one of the following situations. * **The ability to claim your spent note**: click the Claim reward button and submitting the transaction either by using a relayer or not, once confirmed your AP balance should update to reflect the action.

* **The inability to claim a spent note:** *“Warning: The note is not yet ready for anonymity mining. You can wait few days before trying again"* - This means the Merkle trees are out of sync and require a transaction to be updated.

Updating the trees can be an expensive process, **it is recommended that users with small deposits wait for the larger miners to update the trees, this could take anywhere from a few days to a week**. If you want to view your event relative to the current pending batches. Click the *“Show mining note information"* hyperlink, here you can also pay the transaction fees to sync the tree relative to your withdrawal through the Update trees button.

### How to exchange AP 1\. Navigate over to the Swap tab on the mining page which can be accessed through the second navigation bar from the top of the page.

2\. Enter the amount of AP requested to exchange or select the Maximum option to convert your active balance. Below this input, information regarding the current AP/TORN rate and reward output will be displayed. Provide an address of preference to receive the reward, finalise by generating the proof and submitting the transaction through a relayer or not.

3\. If all steps were followed correctly, TORN will be transferred to the address of preference provided in step 2 of this section. ### Closing remarks Congratulations, you have successfully participated in anonymity mining!It is always recommended to plan when deciding to mine any of the anonymity sets, users should also be aware that the [AP/TORN rate](https://duneanalytics.com/luckyallocator/Daily-AP-TORN-Rate-v2) is dependent on supply and demand, therefore, **the more people that claim the higher the rate becomes, and the less people that claim the lower it becomes**.For more information on anonymity mining, seek the following resources: * [Tornado.Cash governance proposal article](https://tornado-cash.medium.com/tornado-cash-governance-proposal-a55c5c7d0703) * [Tornado.Cash anonymity mining optimisation article](https://tornado-cash.medium.com/gas-price-claimed-anonymity-mining-a-victim-but-now-everyone-can-claim-ap-5441aaa32a1a) # Compliance Tool Discover the Tornado Cash Classic Compliance Tool. Ensure your transactions meet regulatory standards with our user-friendly interface By design, everything is public on the blockchain, which can deprive users from their right to privacy. Anyone can have access to everyone’s whole transaction history. In response to this core problem,Tornado.Cash protocol allows cryptocurrency holders to earn back their privacy and gain anonymity. Indeed, it enables users to break the on-chain link between a source and a destination address. However, maintaining privacy and preserving financial freedom should never come at the expense of non-compliance. The right of privacy lies in the ability to have control over the information we provide and to whom we provide it. To this extent, **Tornado.Cash Compliance Tool enables users to prove the origin of their funds.** Thanks to the Note generated after each deposit, **this tool will issue a cryptographically verified proof of transactional history** using the Ethereum addresses used to deposit & withdraw assets. You can visit the Medium post related to this tool to learn more about its development and launch: [**Tornado.Cash compliance Medium Post**](https://tornado-cash.medium.com/tornado-cash-compliance-9abbf254a370). Therefore, if you are ever in need to prove the origin of held assets withdrawn from one of Tornado.Cash pools, we invite you to use the following [Compliance Tool](https://tornadoeth.cash/compliance):thumbsup:

## How To Use the Compliance Tool? With each deposit made through the [Tornado.Cash app](https://tornadoeth.cash/), a new Note is generated by the protocol. This Note is necessary to withdraw the deposited assets later on any withdrawal address. It is this same Note that, if needed, allow users to generate a Compliance Report to prove the origin of their assets. *More information about how to deposit & withdraw assets on Tornado.Cash are available on:* [*Deposit & Withdraw*](/tornado-cash-classic/deposit-and-withdraw)*.* To get a Compliance Report, the user solely need to copy the Note, generated after the deposit, in the dedicated box. ### Before Withdrawal If the Note wasn't spent yet (i.e. assets have still not been withdrawn), the Compliance tool will only provide you with information about the deposit: * Transaction hash of the deposit; * The source address; * The Commitment hash. The commitment is the hashed random area of bytes generated at each deposit that is sent to Tornado.Cash smart contract to characterize the transaction.

*You can find more information about how Tornado.Cash achieve to provide privacy by reading* [*How does Tornado.Cash work?*](/generals/how-does-tornado-cash-work)*.* ### After Withdrawal If the Note was spent (i.e. assets were withdrawn to a given address using the Note), the Compliance Tool will complete the information above by adding: * Transaction hash of the withdrawal; * The destination address; * The Nullifier Hash. The nullifier hash is a public input that is sent on-chain to get checked with the smart contract & the Merkle tree data to allow the withdrawal.

Therefore, the tool allows users to re-link source & destination addresses in order to prove transaction history for assets used on Tornado.Cash. This information can also be downloaded under a PDF format, making it is easier to get sent to any desired third part:

# Circuits Explore Tornado Cash Classic circuits to enhance your privacy and security in transactions. Learn how to use and configure with ease Behind the Tornado.cash front-end sits a number of [Circom](https://docs.circom.io/) circuits, which enable the fundamental privacy guarantees that Tornado.cash users enjoy. These circuits implement the [Zero Knowledge protocol](https://en.wikipedia.org/wiki/Zero-knowledge_proof) that Tornado.cash's smart contracts interface with to prove claims about a user's deposit, such as that it is valid, that is hasn't already been withdrawn, and in the context of Anonymity Mining, the number of blocks that exist between a note's deposit transaction and its withdrawal. ### How ZK Circuits Work #### SNARKs and GROTH16 Before trying to understand how Tornado.cash works under the hood, you first need to understand Zero Knowledge circuits, how they're constructed, and how proofs are generated client-side, then verified on-chain. While there are a [few different types](https://en.wikipedia.org/wiki/Zero-knowledge_proof#Zero_knowledge_types) of ZK systems, Tornado.cash relies upon a variant known as "succinct non-interactive arguments of knowledge" (SNARK), specifically a variant called GROTH16. #### Circom and snarkjs Because we're not all Vitalik, it's best if we have some simple tools that will abstract away the generation and execution of these complicated polynomial commitments. This is where [Circom](https://docs.circom.io/) and [snarkjs](https://github.com/iden3/snarkjs) come in. Circom is easiest to think of as a compiler for a circuit language which acts very much like the kind of [hardware description language](https://en.wikipedia.org/wiki/Hardware_description_language) that electrical engineers would use to describe an electrical circuit. Except instead of an electrical circuit, we're describing an **arithmetic circuit**, which contains components, and the way that they connect together. When you compile a Circom circuit, the resulting output is an [R1CS constraint system](https://docs.circom.io/background/background/) and a [Wasm](https://en.wikipedia.org/wiki/WebAssembly) executable that will be used to generate a [witness](https://docs.circom.io/background/background/). **R1CS** To understand R1CS (Rank-1 constraint system), there is of course more math. And where there's important cryptosystem math, there's a [post by Vitalik](https://medium.com/@VitalikButerin/quadratic-arithmetic-programs-from-zero-to-hero-f6d558cea649#5539). > An R1CS is a sequence of groups of three vectors(a, b, c)(a,b,c), and the solution to an R1CS is a vectorss, wheressmust satisfy the equations . a \* s . b - s . c = 0s.a∗s.b−s.c=0, where..represents the dot product - in simpler terms, if we "zip together"aaandss, multiplying the two values in the same positions, and then take the sum of these products, then do the same tobbandssand thenccandss, then the third result equals the product of the first two results.The next step is taking this R1CS and converting it into QAP form, which implements the exact same logic except using polynomials instead of dot products ... instead of checking the constraints in the R1CS individually, we can now check all of the constraints at the same time by doing the dot product check on the polynomials.If we try to falsify any of the variables in the R1CS solution that we are deriving this QAP solution from - say, set the last one to 31 instead of 30, then we get attpolynomial that fails one of the checks. In short, the R1CS is a set of polynomial constraints which any proof generated by the circuit must satisfy. These constraints are [generated by Circom](https://docs.circom.io/circom-language/constraint-generation/) based on the relationship between various "signals" and operations in your circuit design. **Witnesses** Now, depending on what you're using Tornado.cash for, you might not want any witnesses. However, don't worry, if everything is working correctly, all of the witnesses to your interactions with Tornado.cash will be aggressively compacted, and their bodies disposed of as you please. In the context of a SNARK circuit, a witness is the set of values that need to be generated from the inputs to the circuit, based on the circuit design, to satisfy all of the constraints imposed by the circuit. You can think of the witness generator produced by Circom as a circuit-specific decompression function which runs your inputs through the circuit, and snapshots all of the various intermediate values that are produced along the way. With this expanded form generated from your inputs, you know which values must be assigned to the constraints specified by the R1CS in order to construct a valid proof. **Proof** When you think of a "proof", you probably imagine that it's an incontrovertible guarantee that something is true. However, in the context of a SNARK, a "proof" actually represents an *argument* that something is *almost certainly* true. If we were to try to transmit the solution to every single polynomial constraint imposed by a circuit, we would end up with proofs that were orders of magnitude larger than if we simply show that certain sorts of relationships hold true between the intermediate state values within the circuit. It's possible that for any given circuit, someone with sufficient computing power could generate a proof that satisfies the circuit's constraints in a malformed way, but this would be roughly equivalent in difficulty to [factoring large primes](https://en.wikipedia.org/wiki/RSA_Factoring_Challenge). So, when generating a proof for a SNARK circuit, you're calculating the intermediate states of your circuit for a given input (witness generation), and then calculating the relationships between your inputs, the intermediate states, and the circuit's outputs. Once you have the proof that you've satisfied the necessary set of constraints, you can then publish that proof and some subset of your inputs and outputs (a.k.a. public signals). Knowing the R1CS, your public signals, your proof, and the circuit's proving key, anyone can then verify that your proof satisfies the R1CS, and that your public signals are what would be expected to correspond to your proof. ### Circuits With that understanding of ZK proving circuits well-in-hand, let's delve into how Tornado.cash uses some relatively simple circuits to enable you to privately and permissionlessly obscure the relationship between your deposit and withdrawal transactions on a public blockchain network, and then to later prove things *about* the relationship between your deposit and withdrawal (e.g. how long you waited before withdrawing). [Tornado.cash](https://tornadoeth.cash) is best understood as having two separate major components. #### Core Deposit Circuit The core deposit circuit is what most users interact with, proving that a user has created a commitment representing the deposit of some corresponding asset denomination, that they haven't yet withdrawn that asset, and that they know the secret that they supplied when generating the initial commitment. [Core Deposit Circuit](#core-deposit-circuit) #### Anonymity Mining The anonymity mining circuits form the basis for the Anonymity Mining program, which incentivizes users to leave their deposits in the contract for longer periods of time, so as to ensure that the Tornado.cash deposit pools maintain a large number of active deposits (thus increasing [k-anonymity](https://en.wikipedia.org/wiki/K-anonymity) for other users). # Core Deposit Circuit Discover the Core Deposit Circuit of Tornado Cash Classic. Learn how it enhances privacy and security in decentralized finance The core deposit circuit is what most users interact with, proving that a user has created a commitment representing the deposit of some corresponding asset denomination, that they haven't yet withdrawn that asset, and that they know the secret that they supplied when generating the initial commitment. ## Making a Deposit A deposit into Tornado.cash is a very simple operation, which doesn't actually involve any ZK proofs. At least not yet. To make a deposit, you invoke the `deposit` method of a [Tornado contract](https://github.com/tornadocashdev/tornado-core/blob/master/contracts/Tornado.sol) instance, supplying a Pedersen Commitment, along with the asset denomination that you're depositing. This commitment is inserted into a specialized Merkle Tree, where the structure of the Merkle Tree is aligned to an elliptic curve associated with a prime in the order of the BN128 elliptic curve, and the labels of the tree are computed using MiMC hashing. ### Commitment Scheme When you make a "commitment" in the context of cryptography, what you're doing is taking a secret value - often large and random - and running it through some cryptographic function (e.g. a hash function), then disclosing the result. Later, when you need to make good on the commitment, you prove that you know the original secret value. ### Pedersen Hash A Pedersen Hash is an extremely specialized hashing function that is particularly well-suited for use in applications leveraging Zero Knowledge proving circuits. Where other hashing functions like SHA-256 are designed to exhibit properties such as producing very different outputs for even slightly different inputs (the avalanche effect), Pedersen hashing instead prioritizes the ability to compute the hash extremely efficiently in Zero Knowledge circuits. Hashing a message with Pedersen compresses the bits of the message down to a point along an elliptic curve called Baby Jubjub. Baby Jubjub is in the order of the BN128 elliptic curve that is supported by precompiled operations on the Ethereum network which were added in EIP-196. This means that operations that use the Baby Jubjub curve, such as Pedersen Hashing, are highly gas-efficient. When you compute the Pedersen hash of a message, the resulting point along the its elliptic curve is very efficient to verify, but infeasible to reverse back into the original message. ### Tornado Commitment To generate a commitment for a Tornado.cash deposit, you first generate two large random integers, each 31 bytes in length. The first value is a nullifier that you will later disclose in order to withdraw your deposit, and the second is a secret that secures the confidential relationship between your deposit and withdrawal. The preimage of your deposit note is the concatenation of these two values (`nullifier` + `secret`), resulting in a message 62 bytes in length. This message is Pedersen hashed, resulting in an output representing an element of the Baby Jubjub elliptic curve encoded as a 32-byte big-endian integer. If you want to see this in code form, you can reference the [tornado-cli deposit function](https://github.com/tornadocashdev/tornado-cli/blob/master/cli.js#L53-L112). ### MiMC Merkle Tree The [Tornado contract](https://github.com/tornadocashdev/tornado-core/blob/master/contracts/Tornado.sol) is a specialized Merkle Tree which labels its nodes using MiMC hashes. For those not familiar with Merkle Trees, they are binary trees where each non-leaf node is labelled with the hash of the labels of its child nodes, and the leaf nodes are labelled with the hash of their data. Ordinarily, Merkle Trees use a one-way cryptographic hashing function like SHA-2, but in this case, we're using MiMC, which has some useful properties. One of the useful properties of MiMC is that it's well-suited to operating over prime fields, which is important to us because Zero Knowledge proofs are fundamentally based on prime fields, and Pedersen Hashes are points within a prime field defined by the Baby Jubjub elliptic curve - which is in turn within the order of the BN128 curve supported natively on Ethereum. Because Zero Knowledge proofs are operationally expensive, and each operation in an Ethereum transaction has a corresponding gas cost, the specific types of operations we design around need to be as gas-efficient as possible. The other particularly useful properties of MiMC are that it's non-parallelizable, and difficult to compute but easy to verify. These properties add to the security of the contract by making it computationally infeasible to calculate a forged "commitment" which has a colliding path within the merkle tree. ### Zero Nodes During the initialization of the Tornado Merkle Tree, a single path spanning the height of the tree is preallocated starting with a "zero leaf" node with a label of `keccak256("tornado") % FIELD_SIZE`. Each subsequent non-leaf node toward the root is then labelled as if the entire bottom of the tree were populated by that same same leaf node. The purpose of these "zero nodes" is to ensure that all paths within the merkle tree are invalid until they terminate in a valid commitment. ### Inserting a Commitment When you insert a commitment into the Tornado contract's merkle tree, you are replacing a "zero leaf" with a new leaf whose label is the MiMC hash of your Pedersen commitment, and then traversing up the tree updating each subsequent parent node with a new label based on the label updates that your new leaf introduces below. Commitments are inserted from left to right within the tree, with every two commitment insertions filling a "subtree". Each insertion increments the "index" of the tree, determining whether the next commitment will be inserted on the left or right side of the entry to its merkle path. Once your deposit has updated the tree, the label of the top-most node becomes the tree's new "root", and is added to a rolling history containing the labels of the last 100 roots, for later use in processing withdrawal transactions. The Tornado.cash deposit contracts are deployed with 20 "levels", with each level increasing the number of potential leaves by a power of 2. That means that the contract's merkle tree supports up to 2^20 leaves, allowing for up to 1,048,576 deposits to be made into the contract before it needs to be replaced. The reason behind this seemingly-low number of levels is that every deposit has to perform as many updates to the tree as there are levels. A tree with more levels would require more gas per deposit, as well as correspondingly larger proof sizes when withdrawing notes. ## Making a Withdrawal Having made a deposit, you now have a set of truth claims that you can generate a proof based upon. Generally speaking, Zero Knowledge proofs are anchored to some value(s) known by both the prover and the verifier, to which a relationship is going to be proven to a set of values known only by the prover. The circuit verifier can confirm that the prover has used the value(s) that are known, and that the proof that they computed satisfies the constraints imposed by the circuit. ### Inputs to a Withdrawal Proof In the case of Tornado.cash deposits, the prover (the person submitting a withdrawal transaction), and the verifier (the deposit contract's withdrawal method) both know a recent merkle root. The prover also supplies a set of other public inputs that they used for the generation of their proof. #### The total set of public inputs for a withdrawal proof are: 1. 1.A recent merkle root 2. 2.The Pedersen hash of the nullifier component from their deposit commitment 3. 3.The address of the recipient of their withdrawal 4. 4.The address of the relayer that they've selected (or their own address) 5. 5.The fee that they're paying the relayer (or zero) 6. 6.The refund that they're paying the relayer (or zero) #### The additional private inputs for a withdrawal proof are: 1. 1.The nullifier component from their deposit commitment 2. 2.The secret component from their deposit commitment 3. 3.The set of node labels that exist in the path between the root and the leaf nodes of the merkle tree 4. 4.An array of `0/1` values indicating whether each specified path element is on the left or right side of its parent node ### Proven Claims It would be easy to miss the clever new piece of knowledge we created when we constructed and inserted our commitment into the merkle tree. You might be inclined to think that to make a withdrawal, we're simply going to prove that we know the components of the Pedersen commitment, and that the merkle tree is just an efficient way to store those commitment hashes. What's special about this construction is that it enables us to prove not just that we know the components of a deposited commitment, but rather it enables us to prove simply that we **know the path to a commitment within the tree**, and **how to get there** starting with a commitment preimage. If we were only to prove that we knew the preimage to a deposited hash, we would risk revealing which commitment is ours. Instead, we're not disclosing the commitment preimage, but instead we're simply proving that we have knowledge of a preimage to a commitment within the tree. Which commitment is ours remains completely indistinguishable on the withdrawal side of the circuit protocol. ### Computing the Witness **Nullifier Hash Check** In order to compute the witness for the withdrawal proof, our circuit first takes the private deposit commitment inputs (`nullifier` + `secret`), and runs them through a circuit component which simultaneously computes the Pedersen hash of the full commitment message, and the Pedersen hash of the nullifier alone. The circuit then compares the resulting nullifier hash to the one you supplied as a public input, and asserts their equality. **This proves that the nullifier hash that you supplied publicly is in fact a component of your original commitment.** **Merkle Tree Check** Next, the circuit takes the commitment hash it has computed, the merkle root you have specified publicly, and the path elements and left/right selectors that you specified privately, as inputs to a component which checks your merkle tree path claim. The Merkle Tree Checker starts from the bottom of the path, inputting your commitment hash and the first element of your proposed path into a Muxer. The Muxer takes a third input, which is an element from your supplied left/right directions. The Muxer component uses these directions to inform an MiMC hashing component as to the order of its inputs. If the supplied direction is 0, then the supplied path element is on the left, and your commitment hash is on the right. If the direction is 1, then the order is reversed. The MiMC hasher outputs the resulting hash, and the Merkle Tree Checker proceeds to the next level. It repeats the last process, except this time, instead of using your commitment hash, it uses the hash of the last level. It continues to run through each level of the proposed path, until it ends up with a final hash output. The Merkle Tree Checker compares the hash that it has computed to the public merkle root input that you supplied, and asserts their equality. **This proves that your commitment exists within some path beneath the specified merkle root.** **Extra Withdrawal Parameter Check** Before finishing, the circuit takes each of the remaining four public inputs, and squares them into a public output. While this isn't strictly necessary, it creates a set of constraints within your proof that ensure that your transaction parameters can't be tampered with before your withdrawal transaction is processed. If any of those parameters were to change, your proof would no longer be valid. ### Computing the Proof Now that we have a witness for our proof, we take those witnessed state values and input them into the R1CS corresponding to the Withdrawal circuit, and run the prover over it. Out of the prover comes two proof artifacts. The first is the proof itself, according to the SNARK protocol we're using, and the second is the set of public inputs and outputs corresponding to that proof. ### Completing a Withdrawal Transaction With the withdrawal proof now generated, you supply that proof, along with its public inputs, to the `withdraw` method of the deposit contract. This method verifies that: 1. 1.The specified relayer fee does not exceed the value of the denomination of asset being withdrawn 2. 2.The supplied nullifier hash has not been spent before 3. 3.The supplied merkle root is known, using the 100-root historical record 4. 4.The supplied proof is valid One of the artifacts deployed as a dependency of the deposit contract is a Solidity contract that is generated using the proving key of the Withdrawal circuit as an input. This Verifier contract is an optimized proof verifier with a single public view function, which accepts a proof and the array of six public inputs as `uint256` values. This function returns `TRUE` if the proof is valid according to the public inputs. If the above preconditions are met, the supplied nullifier hash is inserted into the set of spent nullifiers, and then the value of the deposit is distributed amongst the recipient and relayer, according to the specified fee parameters. # Logging in Tornado Cash Nova Discover how to easily log in to Tornado Cash Nova. Step-by-step guide for secure access and optimal privacy on the platform Launched in December 2021, Tornado Cash Nova offers the freedom to choose customized amounts for transactions, as well as the ability to transfer tokens without leaving the anonymity pool. With such unique features, this new pool requires its own set of instructions. Tornado Cash Nova can be accessed through its own decentralized app at [nova.tornadoeth.cash](https://nova.tornadoeth.cash) TORNADO CASH - NOVA

First of all, welcome to Tornado Cash Nova pool & let’s discover how this brand new tool functions 🌪 ## Log In TORNADO CASH - NOVA

You can log into your Tornado Cash Nova account either by: * **connecting the MetaMask Wallet** with the address linked to your Nova account, * **using the Shielded Key** that was generated alongside the creation of your account. Each account is connected to a unique **shielded address** (as well as a unique **shielded key**) that can both be used to log in & manage your balance within the Nova pool. ### Tornado Cash Nova Account Logging into the Nova pool will allow you to: * **check your shielded balance** which represents the amount of tokens currently owned in the [Nova](https://nova.tornadoeth.cash) pool, * **fund your balance** with further tokens, * **transfer the custody of tokens** to another shielded address registered to the pool, * **withdraw any desired amount of tokens** through the destination address of your chosing. Only those who have access to your Metamask wallet or to your Shielded key will be able to access these informations regarding your account (i.e. your shielded balance). ⚠ Be aware of which information you share with whom. ### MetaMask Wallet Each Tornado Cash Nova account is linked to a shielded address. As mentionned above, users have two ways to access their account & its balance. One of these ways is **through a MetaMask wallet connected to the appropriate shielded address**. TORNADO CASH - NOVA

A shielded address is automatically created when users log in a given address, then deposit tokens to funds this address’ pool balance. *More information about the Funding action is availaible on* [*Fund & Withdraw on Nova*](/tornado-cash-nova/fund-and-withdraw-on-nova) However, shielded addresses can also be created from scratch as a separate action by logging in a new address with no prior link to Tornado Cash Nova, then by clicking on `Set up account`. By confirming this action through your Metamask account, your shielded address will be crypted & created with the generation of a shielded key. Once the account set, you will be able to receive shielded transfers of tokens from any another address registered to the pool. You will also be able to fund, transfer & withdraw tokens as you wish. ### Shielded Key As seen above, the other way to log in is **through the generated Shielded Key** that is created when an account is created through the set up of a new shielded address. Once you are logged in with your address & your account is set up, you can download this shielded key at any time by accessing your account data (by clicking on your address, next to your shielded balance). TORNADO CASH - NOVA

To obtain full privacy, the same good practices that were recommended for traditional Tornado Cash pools are still required. *You can find guidelines to maintain privacy in the protocol’s documentation:* [*Tips to remain anonymous*](/generals/tips-to-remain-anonymous) *&* [*More anonymity tips*](/tornado-cash-nova/more-anonymity-tips)*.* # Fund & withdraw on Nova Learn how to fund and withdraw on Tornado Cash Nova. Step-by-step guide to secure transactions and privacy protection Tornado Cash works by breaking the on-chain link between source & destination addresses. To do so, the protocol needs tokens to be deposited in a pool from one address, then to be withdrawn through another address.This principle remains the same for Tornado Cash Nova. As for traditional fixed amount pools, these two actions are core to the efficiency of the tool: * The Funding process, * The Withdrawing process. ## Funding Process The great novelty compared to traditional Tornado Cash pools is that **deposited amounts are no longer predefined.** Users can choose a customized amount within the capacity of their wallet balance. Therefore, if you want to put 0.4 ETH in the pool, you can do it all at once rather than making four separate transactions with the traditional 0.1 ETH pool. TORNADO CASH - NOVA

### How Does It Work? #### **The First Deposit 💰** * The first step is to log in Tornado Cash Nova through a Metamask account. * Your account is not set yet (button `Set up account` available on the top right corner). To set up your account, you can either: * **Click on `Set up account`**: your logged-in address will be registered to Nova without needing to deposit any tokens. This action will enable you to receive transfers or deposits within the pool from any another address. * **Choose your logged-in address as a recepient address**: by depositing tokens into the pool, your account (with its shielded address & shielded key) will be automatically created. The deposited funds will come top up your shielded balance. * **Choose another registered address:** tokens will be added to the shielded balance of the chosen recipient address. This recipient address needs to be a shielded address that was formerly registered to the pool. When you log in, the `Recipient address` is filled by default with your logged-in address. You can change it depending on how you want to use the tool. If you set a new account, you will be able to log into the pool later, check your Tornado shielded balance or receive shielded transfers by using either your shielded address or shielded key. *All information about how to use these elements to log in or where to find your shielded key are available on* [Logging in Tornado Cash Nova*.*](https://nova.tornadoeth.cash) #### **The following deposits 💸** The following deposits answer to the same rules that the first one, except that the account is already set. By logging into the pool with your shielded address / key, you can deposit your chosen amounts to your chosen shielded address as you wish to. Since it is a beta version, deposits are currently limited to 1 ETH/transaction. However, if the community wishes to increase this limit, the 1 ETH cap amount can always be changed through a governance proposal. ## Withdrawing Process TORNADO CASH - NOVA

To withdraw funds from the Nova pool, you can either: * choose from a set of four predetermined amounts (0.1, 0.3, 0.5 & 1 ETH), * choose a completely customized amount by going through the button `Set custom`. ### Custom Option For Withdrawal **The custom option should only be chosen with full knowledge of the following facts and in complete confidence in your actions.** To maintain your privacy, choosing one of the four suggested amounts is strongly recommended as it will allow your withdrawal to blend with the crowd. Indeed, ddepending on the chosen amount, a connection might be deduced between your initial fund transaction and your withdrawal if: * the initially funded amount & the withdrawn amount are exactly the same, * the funded & withdrawn amounts can be easily linked through a sum. *For instance, a deposit of 0.42 ETH can be linked to a withdrawal of exactly 0.42 ETH or two times 0.21 ETH, which might compromise anonymity. However, with a withdrawal of 0.391 ETH, privacy is better preserved as there is no obvious link between the 0.42 & 0.391 amounts.* ### Transctions through Gnosis Chain (L2) For cheaper transactions, Gnosis Chain (former xDAI Chain) is used as a Layer-2. To this end, a bridge is used between ETH from the Mainnet & WETH from Gnosis Chain. Therefore, to prevent spam attacks that will overload the bridge, the withdrawal amount has to be larger than 0.05 ETH. # Shielded transfers on Nova Learn how to perform shielded transfers on Tornado Cash Nova for enhanced privacy and security in your transactions One of the specificity of Tornado Cash Nova is the introduction of shielded transfers. It allows shielded transactions of deposited tokens while staying within the pool. So far, to transfer the custody of deposited funds, tokens needed to be withdrawn first. With Nova, you will be able to transfer a chosen amount of your shielded balance (not necessarily all of it) to another address without needing to withdraw them from the pool.

These shielded transfers can be made to any address of your choice, as long as this address is shielded (i.e. already registered to Tornado Cash Nova pool). As a reminder, a shielded address is registered either through the `Set up account` action or alongside an initial deposit from a wallet address. We advise you to double-check the shielded address to which you transfer tokens as this action is irreversible. # More anonymity tips Discover essential tips to enhance your anonymity while using Tornado Cash Nova. Boost your privacy and stay secure in the crypto world For this section, we refer you to the [Tips to remain anonymous](/generals/tips-to-remain-anonymous) tutorial as a first step. All points mentioned in this tutorial still apply to Tornado Cash Nova.As a quick reminder, these tips include: * Using of a VPN, * Not sharing the shielded key or the access to this shielded address * If downloaded, keeping this shielded key in a safe place, * Deleting data after use, * Avoiding the use of the same API token for all transactions, * Being patient between the moment of deposit & withdrawal, * Using multiple addresses for withdrawal. However, with its new features, Tornado Cash Nova requires further precautions to maintain anonymity. ## Use of Relayers Gas fees payments are necessary for transactions. For shielded transfers & withdrawals, two payment methods are available to provide ETH for gas fee. You can either **connect your wallet or use a Relayer**. Going through your wallet for this gas fee can compromise the anonymity of the transaction if used ETH are linkable to your identity. Therefore, **it is recommended to use a Relayer to preserve privacy** TORNADO CASH - NOVA

## Choice of Withdrawal Amounts The customized amounts feature offers more flexibility & freedom of usage. However, it can compromise your privacy if used carelessly. ### Choosing predefined amounts for withdrawals TORNADO CASH - NOVA

Choosing one of the four predefined amounts is strongly recommended as it will allow your withdrawal to blend with the crowd and remain anonymous. You still have the freedom to `Set custom` to withdraw a customized amount of you choice. However, depending on the chosen amount, a connection might be deduced between your initial fund transaction and your withdrawal if: * the initially funded amount & the withdrawn amount are exactly the same, * the funded & withdrawn amounts can easily be linked through a sum. For instance, a deposit of 0.42 ETH can be linked to a withdrawal of exactly 0.42 ETH or two times 0.21 ETH, which might compromise anonymity. However, with a withdrawal of 0.391 ETH, privacy is better preserved as there is no obvious link between the 0.42 & 0.391 amounts. The custom option should only be chosen with full knowledge of these facts and in complete confidence in your actions. # Articles Library of articles, videos, news report and tutorials about Tornado Cash # Videos Library of articles, videos, news report and tutorials about Tornado Cash