Solution Overview
How Agora solves voting challenges with zero-knowledge proofs and Canton settlement
A New Paradigm for Anonymous Participation
The six failure modes described in the Problem section share a common root cause: they are each treated in isolation. Agora rejects that framing. Our solution is a single integrated stack where Semaphore, RLN, UniRep, Canton Network settlement, and cross-platform accessibility all reinforce each other.
This is not a voting app bolted onto a blockchain. It is an anonymous social ecosystem — 52 backend modules, 28 extracted packages, and 19 circom circuit files across three trees — built over a compressed series of milestones (v1.0 through v9.0) between 1 and 22 March 2026, and extended since July 2026 by the anonymous-action v2 platform, which lives on a branch and has not been deployed.
Each of the six pillars below answers a failure mode from the Problem section, with code, circuits and DAML templates behind it. They are at different stages, and each section says which: the anonymous-action v2 path is built and tested but has not yet been deployed, so it has not served a production user; Canton settlement is built against Agora's own validator, with ledger recording not yet switched on in production; reputation is in development; and the token economy is a design rather than a deployment.
Semaphore v4 — Anonymous Voting
Semaphore v4 lets a member prove group membership and cast a ballot without revealing which leaf of the Merkle tree is theirs; the proof is generated in the client and the identity secret stays there. Nullifiers separate identity from action, so a ballot is unlinkable to other members and to anyone reading the ledger, and not to the operator: a registration row on our servers maps an account to its identity commitment.
RLN — Spam-Resistant Anonymous Posts
Rate-Limiting Nullifier (RLN) lets anonymous users post and comment while automatically rate-limiting them. Exceeding the quota reveals the user's secret, so spam becomes self-incriminating. In the shipped v1 the identity commitment is stored beside the user id, so an RLN-gated post is attributable by the operator; v2 replaces this with a blind-signed admission credential.
UniRep-Inspired Pseudonymous Reputation — In Progress
A UniRep-inspired design for epoch-based reputation that can be proved without naming the user to other members. epoch_key and reputation_proof have groth16/bn128 verification keys and real proving keys behind them; state_transition has neither, so the epoch-transition half cannot run yet and no proof round-trip has been executed end to end.
Planned Token Economy — Dynamic Incentives
A planned incentive economy, still in design and not deployed. Vote rewards and the daily reward cap are written to scale down as the platform grows, in brackets running from 10K users to 1M+. One constraint belongs in the same breath: while settlement runs on Canton, the token engine's value-moving endpoints — staking, vesting, treasury transfers, batch payouts, reward claims and poll reward pools — return a skip instead of executing, so the token economy and Canton settlement are alternatives rather than layers.
Canton Network Settlement
Agora runs its own live Canton Network mainnet validator. A DAML attribution ledger records token operations, vote receipts, and poll-created events, while Canton Coin settlement handles poll-activation fees and rewards privately through a shielded fee pool.
Cross-Platform Accessibility
Next.js 15 on web and React Native 0.81.5 / Expo 54 on mobile: 122 web routes, 20 mobile feature modules, with offline quota tracking and background sync on both. Client-side proof generation runs on both platforms, but the v2 anonymous-action path is web-only today — shipped mobile builds still run the v1 flow, in which the server issues the voting identity instead of the device generating it. The v2 mobile client is built and waiting on a staged store rollout.
How It Works
Identity Generation
Users generate a Semaphore v4 identity. On mobile the identity is Poseidon2-derived and persisted in SecureStore. The secret never leaves the client — the server only sees the commitment.
Group Registration
The identity commitment is added to the target Merkle tree (poll, community, or global group). For reputation-gated actions, a UniRep epoch key is also registered.
Anonymous Action (Vote, Post, Comment, Boost)
The client assembles one envelope: an anonymous credential (a Privacy Pass publicly-verifiable token — an RFC 9474 RSA blind signature, single-use and unlinkable to its issuance), a depth-20 Semaphore v4 membership proof checked against the current published root of the group the action requires (global, poll-eligible, or community), a cohort readiness attestation, and — where the action is charged — a shielded-fee spend proof. A single request digest binds every piece to this one action, so a credential, a membership proof, or a fee proof lifted from one action does not verify against another.
Verification & Canton Anchoring
The server verifies the envelope's proofs and records the action. Where Canton settlement is switched on, the vote record is submitted by the organisation's own Canton party — never the voter's — and while a sealed poll is open that write is deferred until results unseal. Ledger recording is built but gated off by default, and has not been switched on in production.
Key Advantages Over Traditional Systems
✓ Cryptographic Security
A ballot cannot be forged, and that holds against everyone including us, because proof verification enforces it rather than our good behaviour. One ballot per member per poll is weaker: it rests on a unique index in our own database, a constraint we hold and could drop, so the operator stays inside the trust boundary.
✓ True Anonymity
Zero-knowledge proofs keep your ballot unlinkable to you by other voters and by the public. They do not hide it from us: see the threat model for what the operator can still see.
✓ Public Verifiability
A closed poll publishes an evidence bundle — tally, counts, and RFC 9162 roots over its ballot and nullifier sets — that a standalone offline verifier checks without talking to any Agora server and without exposing individual ballots; recounting the ballots themselves needs the auditor-tier export. The bundle's digest is anchored on the ledger once per poll, and the bundle's own signature is the operator vouching for itself, so reading that anchor back is the check that matters — and today only the organisation that ran the poll and Agora's own validator can perform it.
✓ Decentralized Trust
Agora operates all of it today. The design splits settlement, credential signing and the log into separate processes with separate keys, and the client is written to refuse a witness quorum below two — but the independent witnesses and auditor parties those seams exist for have not been recruited, and every record we write to Canton carries a single signatory: ours. Read this as single-operator trust with the seams cut for distribution, not as distributed trust.
✓ Global Accessibility
Vote from anywhere, anytime, using web or mobile interfaces.
✓ Cost Efficiency
Reduced infrastructure costs compared to physical polling stations.