AnchorShield zk access layer
Stellar testnet

BLS12-381 Groth16 · Stellar testnet

Prove you're eligible.
Reveal nothing.

AnchorShield is a reusable zero-knowledge access layer for Stellar. Holders prove KYC, sanctions screening, age and jurisdiction from a single credential — then payments and real-world assets are gated on-chain without identity ever touching the ledger.

proof system
Groth16
constraints
15,866
on-chain verify fee
stroops
Verifier live on testnet Payment proof accepted · 250 transferred RWA proof accepted · 100 minted One credential root across policies Replayed nullifier rejected Action-mismatch proofs rejected

browser proving session

No proof generated

idle
curve BLS12-381
constraints 15,866
public signals 17
proof time
trace
Ready

two gates, one primitive

Eligibility gates

The same circuit and credential root drive a payment corridor and a regulated-asset issuance. Pick a gate to prove against it.

payment gate 01

Travel-rule payment gate

Proves the sender is KYC-cleared, sanctions-screened and within corridor limits before value moves over a Stellar SAC.

policy
202
asset
9001
amount
250
recipient
7000001
View tx
RWA gate 02

Regulated asset gate

Proves accredited-investor status and jurisdiction, then mints an OpenZeppelin SEP-57 asset gated by an on-chain identity verifier.

policy
303
asset
9101
amount
100
recipient
8000001
View tx

testnet event trail

Accepted on-chain

Each row is a real Soroban transaction: the proof was verified on-chain and the gate released. Fees are the actual charged stroops.

gate event amount fee tx
payment PaymentApproved 250 167,132 92e1efdd
RWA RwaMinted 100 1,495,616 5b2e61d2

selective disclosure

Auditor view

A regulator holding the view key can confirm a payment's disclosure packet binds to its on-chain action — without the user ever exposing raw identity.

disclosure pending
packet hash
bound payment tx

failure theater

Tampered proofs must fail

Mutating a public signal after proving should break verification. Run the checks to see each mutation rejected live.

  • Payment amount mutation not run
  • RWA recipient mutation not run
  • Payment proof into RWA gate rejected in contract tests