Solution Overview
How Agora solves voting challenges with zero-knowledge proofs and Canton settlement
A New Paradigm for Anonymous Participation
The six failure modes described in the Problem section share a common root cause: they are each treated in isolation. Agora rejects that framing. Our solution is a single integrated stack where blind-signed credentials, Semaphore membership proofs, a per-epoch admission budget, a reputation layer in development, Canton Network settlement, and cross-platform accessibility all reinforce each other.
This is not a voting app bolted onto a blockchain. It is an anonymous social ecosystem — 52 backend modules, 28 extracted packages, and 19 circom circuit files across three trees — built over a compressed series of milestones (v1.0 through v9.0) between 1 and 22 March 2026, and extended since July 2026 by the anonymous-action v2 platform, which has been in production since 28 August 2026.
Each of the six pillars below answers a failure mode from the Problem section, with code, circuits and DAML templates behind it. They are at different stages, and each section says which: the anonymous-action v2 path has carried production ballots since 28 August 2026, while the social kinds on the same lane are enabled at the gateway but had not yet carried a production action by 6 September 2026; Canton settlement runs against Agora's own validator, with ledger recording on in production; reputation is in development; and the token economy is a design rather than a deployment.
Semaphore v4 — Anonymous Voting
Semaphore v4 lets a member prove group membership and cast a ballot without revealing which leaf of the Merkle tree is theirs; the proof is generated in the client and the identity secret stays there. Nullifiers separate identity from action, so a ballot is unlinkable to other members and to anyone reading the ledger, and not to the operator: a registration row on our servers maps an account to its identity commitment.
Admission Budget — Spam Control Without a CAPTCHA
Every anonymous post or comment is admitted by a single-use, blind-signed credential drawn from a fixed per-epoch batch — 120 social actions per seven-day epoch per account, as deployed on 31 August 2026 — so an account can spam only as far as its batch allows, and the credential it spends says nothing about which account minted it. This replaces the v1 lane's rate-limiting nullifier (RLN), which is retired: its community routes were withdrawn from production at the v2 cutover, and it stored the identity commitment beside the user id, which left an RLN-gated post attributable to its author by the operator. In production the poll-vote kind has carried ballots on this lane; the social kinds are enabled at the gateway and had not yet carried a production action by 6 September 2026.
UniRep-Inspired Pseudonymous Reputation — In Progress
A UniRep-inspired design for epoch-based reputation that can be proved without naming the user to other members. epoch_key and reputation_proof have groth16/bn128 verification keys and real proving keys behind them; state_transition has neither, so the epoch-transition half cannot run yet and no proof round-trip has been executed end to end.
Planned Token Economy — Dynamic Incentives
A planned incentive economy, still in design and not deployed. Vote rewards and the daily reward cap are written to scale down as the platform grows, in brackets running from 10K users to 1M+. One constraint belongs in the same breath: while settlement runs on Canton, the token engine's value-moving endpoints — staking, vesting, treasury transfers, batch payouts, reward claims and poll reward pools — return a skip instead of executing, so the token economy and Canton settlement are alternatives rather than layers.
Canton Network Settlement
Agora runs its own live Canton Network mainnet validator. A DAML attribution ledger records token operations, vote receipts, and poll-created events, while Canton Coin settlement handles poll-activation fees and rewards privately through a shielded fee pool.
Cross-Platform Accessibility
Next.js 15 on web and React Native 0.81.5 / Expo 54 on mobile: 122 web routes, 20 mobile feature modules, with offline quota tracking and background sync on both. Client-side proof generation runs on both platforms, but the v2 anonymous-action path is web-only today — shipped mobile builds still run the v1 flow, in which the server issues the voting identity instead of the device generating it. The v2 mobile client is built and waiting on a staged store rollout.
How It Works
Identity Generation
Users generate a Semaphore v4 identity. On mobile the identity is Poseidon-derived and persisted in SecureStore. The secret never leaves the client — the server only sees the commitment.
Group Registration
The identity commitment is added to the target Merkle tree (poll, community, or global group). For reputation-gated actions, a UniRep epoch key is also registered.
Anonymous Action (Vote, Post, Comment, Boost)
The client assembles one envelope: an anonymous credential (a Privacy Pass publicly-verifiable token — an RFC 9474 RSA blind signature, single-use and unlinkable to its issuance), a depth-20 Semaphore v4 membership proof checked against the current published root of the group the action requires (global, poll-eligible, or community), a cohort readiness attestation, and — where the action is charged — a shielded-fee spend proof. A single request digest binds every piece to this one action, so a credential, a membership proof, or a fee proof lifted from one action does not verify against another.
Verification & Canton Anchoring
The server verifies the envelope's proofs and records the action. Where Canton settlement is switched on, the vote record is submitted by the organization's own Canton party — never the voter's (for an organization without one, Agora's system party records the vote and Agora's provider party records the poll and its evidence anchor) — and while a sealed poll is open that write is deferred until results unseal. Ledger recording is on in production and has carried real vote records.
Key Advantages Over Traditional Systems
✓ Cryptographic Security
A ballot cannot be forged, and that holds against everyone including us, because proof verification enforces it rather than our good behaviour. One ballot per member per poll is weaker: it rests on a unique index in our own database, a constraint we hold and could drop, so the operator stays inside the trust boundary.
✓ True Anonymity
Zero-knowledge proofs keep your ballot unlinkable to you by other voters and by the public. They do not hide it from us: see the threat model for what the operator can still see.
✓ Public Verifiability
A closed poll publishes an evidence bundle — tally, counts, and RFC 9162 roots over its ballot and nullifier sets — that a standalone offline verifier checks without talking to any Agora server and without exposing individual ballots; recounting the ballots themselves needs the auditor-tier export. The bundle's digest is anchored on the ledger once per poll, and the bundle's own signature is the operator vouching for itself, so reading that anchor back is the check that matters — and today only the organisation that ran the poll and Agora's own validator can perform it.
✓ Decentralized Trust
Agora operates all of it today. The design splits settlement, credential signing and the log into separate processes with separate keys, and the client is written to refuse a witness quorum below two — but the independent witnesses and auditor parties those seams exist for have not been recruited, and every record we write to Canton is signed only by parties Agora operates — since 2 September 2026 two of them, the writing party and the app-provider party. Read this as single-operator trust with the seams cut for distribution, not as distributed trust.
✓ Global Accessibility
Vote from anywhere, anytime, using web or mobile interfaces.
✓ Cost Efficiency
Reduced infrastructure costs compared to physical polling stations.