noir
Privacy Apps with Noir
What You Probably Got Wrong
"Use nargo prove and nargo verify." Those commands were removed. Nargo only compiles and executes. Proving and verification use bb (Barretenberg CLI) directly. If you generate nargo prove commands, they will fail.
"I can use SHA256 for hashing in my circuit." SHA256 costs ~30,000 gates in a circuit. Poseidon costs ~600. For in-circuit hashing, always use Poseidon. Poseidon was removed from the Noir standard library — you must add it as an external dependency. The correct import is use poseidon::poseidon::bn254::hash_2 after adding the noir-lang/poseidon dependency to Nargo.toml. Not std::hash::poseidon::bn254::hash_2 (removed from stdlib), not Poseidon2::hash, not pedersen_hash.
"pub goes before the parameter name." Noir 1.0 changed public input syntax: pub merkle_root: Field → merkle_root: pub Field. The old syntax gives "Expected a pattern but found 'pub'".
"Set compiler_version = ">=1.0.0-beta.3" in Nargo.toml." compiler_version rejects beta strings — >=1.0.0-beta.3 fails. Use >=0.36.0 or omit compiler_version entirely.
"I built a commitment-nullifier circuit so my app is private." The ZK proof hides the link between commitment and nullifier, but msg.sender is public. If the same wallet deposits a commitment and later calls act() to withdraw/vote, anyone can link the two transactions onchain. The whole pattern is pointless unless the acting wallet is different from the committing wallet. Use a fresh burner wallet + a relayer or ERC-4337 paymaster to pay gas without revealing the link.
"The generated HonkVerifier.sol works with any Solidity version." The verifier generated by bb write_solidity_verifier requires pragma solidity >=0.8.21 and EVM version cancun. If your Foundry project uses a lower version, add solc_version = '0.8.27' and evm_version = 'cancun' to foundry.toml.