noir

Compile with nargo compile, execute the witness with nargo execute, then run bb write_vk with --oracle_hash keccak and bb write_solidity_verifier to produce the verifier contract. The old nargo prove and nargo verify commands were removed; proving and verification use the bb CLI directly.

Poseidon was removed from the Noir standard library, so add the noir-lang/poseidon git dependency to Nargo.toml and import poseidon::poseidon::bn254::hash_2. Never use SHA256 in-circuit since it costs roughly 30,000 gates versus about 600 for Poseidon.

Noir/Barretenberg proofs verify on any EVM chain with BN254 precompiles, including Ethereum mainnet, Optimism, Arbitrum, Base, Scroll, and Polygon PoS. zkSync ERA works but with higher gas costs, while Polygon zkEVM is being shut down and should be avoided.

Failures usually come from serialization mismatches: the circuit pub parameter order, NoirJS proof.publicInputs order, and Solidity verify input order must match exactly. Also ensure --oracle_hash keccak on CLI commands and { keccak: true } in generateProof, and that the @aztec/bb.js version matches your bb CLI version.

Use a simple private proof when proving a fact about private data like age or balance without needing anonymity. Use commitment-nullifier only when participants must act anonymously from a shared set, such as voting or withdrawals, since it requires a Merkle tree, nullifiers, and a separate acting wallet.

The ZK proof hides the commitment-nullifier link, but msg.sender is public, so acting from the same wallet that deposited reveals the connection. Users must act from a fresh burner wallet funded through a relayer or ERC-4337 paymaster to preserve unlinkability.