Ethereum-based privacy protocol Privacy Pools pauses deposits due to bug affecting user transactions

Ethereum-based privacy protocol Privacy Pools has temporarily paused new deposits due to a bug that affected two user transactions.

The issue occurred on May 15 when two users made deposits in quick succession and reused the same preCommitmentHash — a unique identifier the user interface generates for each deposit.

The platform's UI failed to sync properly, which caused the second deposit to duplicate the first hash. The front-end interface did not update fast enough to generate a new hash for consecutive deposits, a vulnerability exposed under rapid user actions.

This created a non-unique nullifier, a critical component needed for withdrawals, which left a total of 0.2 ETH (about $500) permanently stuck.

Only two deposits suffered impacts. All other funds remained safe, and withdrawals continued to function normally. However, new deposits remain frozen until the team implements a fix.

The Privacy Pools team fully reimbursed affected users. The team clarified that the bug did not compromise pool integrity or permit malicious exploitation.

The team halted new deposits to prevent further issues and now develops a smart contract update to reject reused user-generated hashes, with deployment planned after an audit of the incident concludes.

Privacy Pools enables private token transfers while simultaneously have regulatory compliance through zero-knowledge proofs. The platform allows users to deposit ETH or ERC-20 tokens into a pool, obscure their transaction history, and withdraw funds to a new address, with ZKPs to prove their funds lack links to illicit sources.

A technology known as Association Set Providers (ASPs) helps achieve this. They curate "clean" transaction sets with onchain analytics and filter out suspicious activity without KYC requirements.

The protocol, inspired by a 2023 paper co-authored by Vitalik Buterin, launched on Ethereum's mainnet in March of this year and supports transactions between 0.1 ETH and 1 ETH, with gas fees required.

Unlike Tornado Cash, which faced sanctions for unfiltered anonymous transactions, Privacy Pools uses ASPs to align with anti-money laundering regulations, which makes it a regulator-friendly alternative.

Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures .

LATEST CRYPTO NEWS

Naver and Upbit to pour $7 billion into AI, blockchain following mega-merger: reports

Upbit suffers $37 million hack on Solana assets, halts withdrawals

Bitcoin rebounds above $91,000 as December rate cut odds rise

SpaceX transfers $105 million in bitcoin to unmarked wallets: Arkham

Ethereum-based privacy protocol Privacy Pools pauses deposits due to bug affecting user transactions

Quick Take

Subscribe for Premium Content

RATINGS

Crypto infrastructure firm Taurus becomes custodian and super validator for Canton Network