Ethereum-based privacy protocol Privacy Pools pauses deposits due to bug affecting user transactions

Ethereum-based privacy protocol Privacy Pools has temporarily paused new deposits due to a bug that affected two user transactions.

The issue occurred on May 15 when two users made deposits in quick succession and reused the same preCommitmentHash — a unique identifier the user interface generates for each deposit.

The platform's UI failed to sync properly, which caused the second deposit to duplicate the first hash. The front-end interface did not update fast enough to generate a new hash for consecutive deposits, a vulnerability exposed under rapid user actions.

This created a non-unique nullifier, a critical component needed for withdrawals, which left a total of 0.2 ETH (about $500) permanently stuck.

Only two deposits suffered impacts. All other funds remained safe, and withdrawals continued to function normally. However, new deposits remain frozen until the team implements a fix.

The Privacy Pools team fully reimbursed affected users. The team clarified that the bug did not compromise pool integrity or permit malicious exploitation.

The team halted new deposits to prevent further issues and now develops a smart contract update to reject reused user-generated hashes, with deployment planned after an audit of the incident concludes.

Privacy Pools enables private token transfers while simultaneously have regulatory compliance through zero-knowledge proofs. The platform allows users to deposit ETH or ERC-20 tokens into a pool, obscure their transaction history, and withdraw funds to a new address, with ZKPs to prove their funds lack links to illicit sources.

A technology known as Association Set Providers (ASPs) helps achieve this. They curate "clean" transaction sets with onchain analytics and filter out suspicious activity without KYC requirements.

The protocol, inspired by a 2023 paper co-authored by Vitalik Buterin, launched on Ethereum's mainnet in March of this year and supports transactions between 0.1 ETH and 1 ETH, with gas fees required.

Unlike Tornado Cash, which faced sanctions for unfiltered anonymous transactions, Privacy Pools uses ASPs to align with anti-money laundering regulations, which makes it a regulator-friendly alternative.