PrivaScan Whitepaper

Privacy protocols on EVM blockchains serve a legitimate and growing purpose: they give users the same financial confidentiality that traditional bank accounts provide by default. But the protocols themselves carry technical and regulatory risks that are harder to evaluate than standard DeFi contracts. Their whole design obscures information — including, sometimes, their own vulnerabilities.

PrivaScan is an open-source risk scoring system that evaluates EVM privacy protocol contracts across six measurable dimensions — code quality, ownership structure, liquidity depth, audit coverage, regulatory compliance, and governance maturity — and computes a single deterministic composite score from 0 to 100.

The score is not a recommendation. It is a structured, reproducible data point that gives users, researchers, and builders a consistent basis for their own risk assessment. Every number is derived from on-chain data, public audit records, and automated static analysis. No black boxes. No opinions.

When you use a privacy protocol to shield a transaction, you are trusting a set of smart contracts with more than your funds. You are trusting them with your privacy. If those contracts are exploited, you may lose both.

The challenge is that evaluating privacy protocol risk requires skills and data across multiple disciplines simultaneously:

• • Static analysis — reading the bytecode for vulnerabilities. Requires Slither, custom detectors, and understanding of ZK circuit patterns.
• • Ownership analysis — determining who controls the protocol, whether timelocks exist, and whether upgrades can happen without warning.
• • Liquidity context — understanding TVL as a proxy for protocol maturity and the financial exposure of users inside it.
• • Audit provenance — knowing which firm audited it, when, whether findings were remediated, and how the auditor’s track record holds up.
• • Regulatory screening — checking contracts against OFAC’s Specially Designated Nationals list and known exploit registries.

No single tool covers all five. Most users do none of them. PrivaScan covers all of them and surfaces the result as a single actionable grade.

PrivaScan treats a privacy protocol not as a single contract but as an ecosystem — every deployed contract (router, verifier, pool, vault, proxy) is scored individually, then aggregated into a single ecosystem-level grade.

This matters because risk in privacy protocols is often distributed. A clean core contract with a vulnerable peripheral contract is not a safe protocol. Our ecosystem model captures this.

The system has two tracks:

• • Curated track — 14 manually vetted protocols, automatically rescored every 6 hours via Celery beat. All contracts verified, all metadata confirmed.
• • Community track — any EVM address on any supported chain. First scan runs full Slither analysis (30–60s), then cached for 1 hour.

The composite score is a weighted sum of six sub-scores:

Each sub-score is independently bounded to [0, 100]. The composite is also bounded to [0, 100]. Hard overrides can cap the composite below the calculated value — see the Hard Overrides section.

Weights reflect the relative importance of each dimension for privacy protocol risk, based on post-mortem analysis of historical privacy protocol incidents. Code risk carries the highest weight because smart contract vulnerabilities are the proximate cause of most protocol failures.

Two conditions trigger hard overrides that cap the composite score regardless of what the six dimensions calculate. These are non-negotiable and cannot be offset by strong performance in other dimensions.

Standard Slither detectors are not designed for privacy protocol patterns. We wrote five custom detectors that target the vulnerability classes most common in ZK-based and mixer-based protocols:

The curated registry contains 14 privacy protocols that have been manually vetted for inclusion. Criteria: verified source code on a block explorer, live mainnet deployment, documented architecture, and a public point of contact.

Curated protocols are rescored every 6 hours via an automated Celery beat schedule. All contracts in the ecosystem are scored individually and the results are aggregated using the same methodology as community scans.

To request addition to the curated registry, use the Add Protocol form. Submissions are reviewed within 72 hours.

All PrivaScan scores are accessible via a REST API. The API is free for community use at 500 requests per hour with a free key. It is designed to be embedded into wallets, DeFi frontends, research tools, and risk dashboards.

Full API documentation including endpoint specifications, request/response schemas, error codes, and code examples is available at:

@PrivaScanBot brings risk scoring to Telegram. Users can score contracts, set up watchlists with alert thresholds, and receive real-time notifications when a protocol’s risk grade changes — without leaving Telegram.

Commands: /score · /watch · /unwatch · /mylist · /protocol

PrivaScan scores are informational tools produced by automated analysis. They are not financial advice, legal advice, or security certifications. A grade A score does not mean a contract is safe. A grade F score does not mean a contract will fail. Scores reflect the state of a contract at the time of analysis and may become stale.

PrivaScan is open source under the MIT licence. The codebase, detectors, and methodology are publicly reviewable at github.com/only1angelnath/Privascan.

Do not interact with any smart contract based solely on a PrivaScan score. Always conduct your own independent research.