Tracing the gas trails back to the root cause.
Look at the GitHub commit history on Vitalik Buterin’s personal repository from July 2024. Nestled between EIP-4848 commentary and a Sepolia testnet script is a new directory: aztec-annonboard. The commit message reads: “Stage 2 prototype – anonymous bulletin with censor.” Sparse. Clinical. Five files total – a Solidity contract, a Noir circuit, a React frontend, a config file, and a README. No marketing. No token. No grant announcement. Just code.
This is not a product. It is a proof-of-concept that deliberately marries zero-knowledge privacy with a censorship mechanism – a combination many purists consider oxymoronic. But Vitalik, as he often does, is probing the boundaries of what’s technically possible. And for anyone who has spent years auditing smart contracts, this 500-line repository tells a story far more interesting than its modest footprint suggests.
Shifting the consensus layer, one block at a time.
To understand the significance, we need to revisit the state of privacy on Ethereum in mid-2024. Aztec Network, a ZK-rollup focused on privacy, had just launched its programmable privacy layer (often referred to as “Stage 2” in its own roadmap). Unlike earlier iterations that only allowed private transfers, the new phase enables arbitrary smart contract logic to be executed privately using Noir – a domain-specific language for zero-knowledge proofs. Vitalik’s demo is the first high-profile application to exploit this capability.
The premise is simple: a bulletin board where users can post messages anonymously, but a designated “censor” can remove posts that violate certain rules. The anonymity is provided by ZK proofs (the poster’s identity is never revealed on-chain), while the censorship is enforced by a smart contract that grants an admin address the power to delete entries. The tension between these two properties is exactly why the demo is worth dissecting.
The code does not lie, but the auditor must dig.
Let’s walk through the architecture. The core logic lives in two files: bulletin_board.nr (Noir circuit) and BulletinBoard.sol (Ethereum smart contract).
The Noir circuit handles the private part. A user constructs a proof that they know a secret (a nullifier) and that their message content does not exceed a maximum length. The circuit outputs a commitment that is posted on-chain. The censor’s role is handled entirely in the Solidity contract: a function removePost(bytes32 postId) that is only callable by an address stored in a owner variable. On the surface, this is straightforward.
But the subtlety lies in the linkage between anonymity and censorship. In a traditional ZK anonymity system like Tornado Cash, the contract has no power to delete deposits – it only allows withdrawals with a valid proof. Here, the censor can remove posts, which means the contract must store a list of “removed” nullifiers or post IDs. This creates a public record of censorship activity. Anyone can see which posts were removed and when. The anonymity of the poster remains intact, but the fact of removal is transparent.
This is a design choice that screams “regulatory preparedness.” The system offers plausible deniability for the platform operator (the censor can point to a transparent audit trail), while preserving user privacy. Based on my own experience auditing the Parity multisig – where I learned that the most elegant solutions often hide the most dangerous assumptions – I immediately flagged one: the censor is a single point of trust. If the censor’s private key is compromised, every post can be wiped without user recourse. The demo does not implement any governance mechanism (multisig, timelock, or DAO). It’s a prototype, so that’s acceptable, but it reveals the core trade-off.
Another technical nuance: the proof size. Aztec’s UltraPLONK proving system produces proofs around 4KB for simple operations. For a bulletin board with many posts, the on-chain storage of removed post IDs would grow linearly – a potential gas cost issue. The demo sidesteps this by limiting the test to a single session, but any production version would need a Merkle tree or similar accumulator.
In the chaos of a crash, the data remains silent.
Now, the contrarian angle. Most commentary will focus on how this demo “proves” that privacy and compliance can coexist. I argue the opposite: it proves how fragile that coexistence is.
Consider the censorship mechanism. The censor is hardcoded as a single address. In a real-world deployment, that address would likely belong to a centralized entity (the platform owner). The entire system’s integrity hinges on that entity acting honestly and never being compromised. This is not a trust-minimized system – it’s a trust-substituted system. Instead of trusting users with their own privacy, you trust a censor to use their power responsibly. The ZK part only guarantees that users’ identities remain hidden from the censor, but the censor has full power over the content.
Moreover, the demo does not solve the front-running problem. A malicious miner or sequencer could see the removal transaction and reorder it to censor a post before it’s even confirmed. Aztec’s rollup sequencer is currently permissioned (run by the team), so this is a real attack vector. Vitalik’s code does not include any anti-front-running measures.
Finally, the demo implicitly assumes that the censor is always an honest actor. History tells us otherwise. In the Terra-Luna collapse, the Anchor protocol’s “guardian” multisig was supposed to pause withdrawals in an emergency, but the team’s delay in acting caused billions in losses. The same single-point-of-failure risk applies here.
Takeaway: A pattern, not a product.
Vitalik’s Aztec demo is not a template for a shipping product. It’s a cryptographic sketch of a regulatory-friendly privacy architecture. The next wave of privacy applications will likely copy this pattern – ZK for anonymity, a transparent censorship log for compliance – but they must decentralize the censor role. Governance tokens, threshold signatures, or on-chain dispute resolution will be required to avoid recreating the very power structures crypto was meant to dismantle.
I expect to see forks of this codebase used in anonymous voting systems, privacy-preserving moderation tools for DAOs, and even identity-reputation hybrids within 12 months. The code does not lie – it reveals a path forward, but only if we acknowledge the assumptions baked into its simplicity. As always, the devil is in the missing governance.