Sanctions Oracle
The sanctions components build a Poseidon Merkle representation and publish a root to an oracle. A non-membership proof establishes a relationship to that supplied tree; it is not a guarantee that all sanctions obligations have been satisfied.
Current pilot construction
The pilot-transfer-v3 proof screens both the sending and receiving wallet. The tree stores raw 160-bit EVM addresses, sorted, with two boundary leaves (0 and 2^160), in a Poseidon Merkle tree of depth 20. That holds up to 1,048,574 addresses. For each wallet, a gap proof shows the address lies strictly between two adjacent leaves; adjacency comes from the Merkle path bits, and every compared value is range-checked.
The pilot’s sanctions root is a signed root snapshot with a revision number and the digest of the previous snapshot. The authorization service accepts only the current head. Only raw hex addresses are screened; ENS names are never resolved.
Non-EVM address formats (for example Bitcoin or Solana) are not supported by this profile.
Legacy construction
The legacy compliance.circom circuit uses a separate depth-20 tree of hashed keys and publishes its root through the SanctionsOracle contract. The two trees are not interchangeable. The tree builder and witness generator must agree on leaf encoding, sorting and boundary handling.
Update workflow
The repository contains automation for source retrieval, tree rebuilds and proposed updates. Operators must validate source provenance, unexpected changes, target networks and relay results. The presence of a scheduled workflow does not demonstrate that the current deployed root is fresh.
After a root update, relay it to every intended deployment and verify consistency. A successful local build is insufficient evidence of an on-chain update.
Contract controls
The current oracle source includes an update cooldown, a leaf-count floor, nonzero-root validation, a configurable grace period, pause controls and a bounded history of 1,000 roots. These checks reduce particular operational risks; they do not establish source correctness.
A registry can reject a stale root through the oracle’s freshness check. API and SDK integrations need their own complete verification context; current parity remains open.
Evaluation
Use explicit test data for local scenarios. Do not treat offline sample addresses as a current sanctions list. Record source versions and observation times for any evidence that must be reconstructed later.