You only need to prove that you're allowed to vote, at the moment of voting, without saying who you are.
You register a commitment publicly from your real address (everyone sees you joined the set), then vote from a throwaway address with a zk proof that says "I know the secret behind one of the registered members" — without saying which one. A nullifier hash gets stored so you can't vote twice, and it can't be traced back to you.

This pattern (commitment + merkle tree + nullifier) shows up everywhere — private airdrops, anonymous credentials, allowlists that don't doxx the list.
So: privacy here isn't hiding everything. The membership set is fully public. You just break the one link between who you are and what you did.

Where everything runs

The circuit is written in Noir, compiled once to bytecode. The chain verifies the proof, but the proof itself is generated in the user's browser:

What the circuit actually checks

So what does the proof actually prove? It's not one big step — it's four checks that all have to hold at once, each one blocking a specific way to cheat.

1. The nullifier hash is real — the circuit re-hashes your secret nullifier and demands it match the one you submitted. So you can't spend someone else's nullifier, and you can't invent one.

2. The commitment is rebuilt from secrets, not copied — your commitment gets recomputed inside the circuit from the nullifier + secret. It never accepts the commitment itself, only the preimage. So the public commitment everyone can see on-chain is useless to an attacker — only you hold both secrets.

3. The commitment is actually in the tree — the membership check. It takes your leaf index, turns it into bits to know left vs right at each level, walks up through the siblings you provide, and demands the root it computes equals the one the contract handed it. Not a leaf? No siblings produce a matching root.

4. The vote is a real choice — one constraint pins it to 0 or 1: vote × vote has to equal vote, which is true for nothing else. Skip it and someone passes a junk value and quietly skews the tally.

All four hold or the proof fails — and none of them reveal which member you are. That's the whole point: you prove you followed every rule of a legit vote while saying nothing about who you are.

public list, private vote.