CLOAKWORK PLATFORM

Prove Domain Ownership.
Reveal Nothing.

Production-ready ZK identity infrastructure for Stellar smart contracts. DNS domain control in. Zero-knowledge proof out. Domain never touches the chain.

LAUNCH APP -> VIEW ON GITHUB

→ WHAT CLOAKWORK DOES

DNS Identity. Zero Exposure.

Real DNS identity — prove control of an actual web domain, not a synthetic address.
Zero knowledge by default — the domain string never touches the blockchain. Ever.
Stellar-native credentials — Soroban contracts issue and verify reusable DomainCredentials.
Developer simple — one line of Rust gates any contract function behind domain identity.
Audit-friendly — commitments, nullifiers, RRSIG timestamps, verifier version all public.
DNSSEC-verified — Cloudflare DoH + AD flag proves the full DNS chain is authentic.

→ THE STACK

Browser → Stellar → Any dApp

Layer 1: Browser Proof Client

Challenge generation, DNSSEC verification via Cloudflare DoH, Circom/snarkjs proof generation. Nonce and secret stay in memory only.

Poseidon(domain, nonce) · DNSSEC TXT · Groth16 BN254 · Web Worker

Layer 2: Stellar Testnet

Verifier contract runs native BN254 pairing check. Registry issues reusable credentials with 30-day cap. GatedAction demo shows SDK in production.

Verifier · Registry · GatedAction · Protocol 26 host functions

Layer 3: Any dApp

Domain-gated payments, voting, minting, admin actions, access control — all without knowing the underlying domain.

CloakworkClient::require_valid_credential(&env, registry, owner, nullifier)

→ HOW THE PROOF WORKS

Five Steps. Private End to End.

Browser

Generate Poseidon commitment and local nonce + secret.

DNS

Publish DNSSEC-signed TXT record at _stellar-cloakwork.domain.

ZK Prover

Circom circuit runs in Web Worker. Exports 256-byte Groth16 proof.

Stellar

Registry calls Verifier. BN254 pairing check passes. Credential issued.

dApp

One SDK call gates any action behind the active credential.

→ DEVELOPER SDK

One Line Gates Any Function

require_valid_credential

Panics if credential is invalid, expired, or revoked. The idiomatic one-line guard.

get_credential

Returns Option<DomainCredential> for a nullifier. Non-authenticating read.

is_credential_active

Returns bool — true only if Active, owner matches, and not expired.

→ PRIVACY BOUNDARY

Public vs. Private

ON-CHAIN (PUBLIC)NEVER LEAVES BROWSER

domain_commitment (Poseidon hash)Domain name string

nullifier (Poseidon hash)DNS TXT record value

RRSIG timestamps (not_before/after)DNSSEC raw bytes

Groth16 proof — 256 bytesnonce — 32 random bytes

verifier_versionsecret — 32 random bytes

→ DEPLOYED CONTRACTS

Live on Stellar Testnet

CONTRACTADDRESS

Verifier CAYOV2FM…FWNI5 ↗

Registry CATC4JJX…WSVA ↗

GatedAction CDDEOP4H…ID3 ↗

→ PROOF PASS CW-ZK01

FROM DNS Real domain control

→

TO ZK Private credential

CHAINStellar

PROOFGroth16

DOMAINHidden

// Gate any Soroban function — one line
CloakworkClient::require_valid_credential(
  &env,
  registry,
  owner,
  nullifier,
);
// Domain verified. Nothing revealed.

Generate Challenge nonce + secret → local only

✓

Publish DNS Record DNSSEC-signed TXT

✓

Generate ZK Proof 256 bytes · BN254 Groth16

✓

Submit to Soroban DomainCredential issued

→

LAUNCH APP → TRY IT LIVE

→ DEVELOPER QUICK START

Zero to Domain-Gated Contract

# 1. Clone the repo
git clone https://github.com/Mohamed-Aaftaab/Cloakwork.git
cd Cloakwork && npm install

# 2. Connect Freighter wallet on Stellar testnet
# Visit /app and click "Connect Wallet"

# 3. Generate a challenge for your domain
# Enter domain name → Generate Challenge

# 4. Publish TXT record at _stellar-cloakwork.yourdomain.com
# Then click "Check DNSSEC" — must show AD=true

# 5. Generate ZK proof (~30s, runs in browser)
# Click "Generate ZK Proof"

# 6. Submit to Soroban → DomainCredential issued on-chain
# Click "Submit to Soroban"

Prove what's true. Reveal nothing.

Private DNS-backed identity for any Stellar app. No ZK knowledge required.

LAUNCH APP -> VIEW REPOSITORY

Prove Domain Ownership.Reveal Nothing.