Core concepts

The four primitives tasknull is built on. The reference CLI implements all of them with Node's standard crypto — Ed25519 signatures and SHA-256 hashing.

Identity & secret

Running tasknull init generates two things, stored locally in ~/.tasknull:

• a 32-byte random secret — the root of your nullifiers; it never leaves your machine and is never put on-chain;
• an Ed25519 keypair used to sign completion proofs.

Your public Solana address is a base58-encoded Ed25519 public key — safe to share, and it reveals nothing about your secret.

Commitment

A commitment binds a solution to a bounty without revealing the solution:

commitment = SHA256( bounty ‖ SHA256(solution) ‖ secret )

Publishing it lets you prove later that you held this exact solution for this exact bounty, while keeping the work hidden until you choose to reveal it.

Nullifier

The nullifier is the heart of double-claim prevention:

nullifier = SHA256( "nullifier" ‖ secret ‖ bounty )

• Deterministic per (secret, bounty) — the same identity proving the same bounty twice yields the same nullifier, so the second claim collides and is rejected.
• One-way — it's a hash of your secret, so it can't be reversed to recover the secret.
• Unlinkable — on its own it looks like random bytes; it doesn't reveal which identity produced it.

Proof

A proof is a JSON object signed with your Ed25519 key. It carries everything a verifier needs:

{
  "bounty": "zk-audit-114",
  "solutionHash": "…",
  "commitment": "…",
  "nullifier": "…",
  "payout": "7xKX…",
  "publicKey": "BrvFkjhE…FTCkBJ",
  "signature": "…"
}

Verification re-checks the signature over the exact payload, so any tampering — changing the payout, the bounty, or the nullifier — invalidates the proof.

The privacy model — honestly