Managing Credible Anonymous Identities in Web 3.0 Services: A Scalable On-Chain Admission Framework with Recursive Proof Aggregation

TL;DR

ZK-AMS is presented, a scalable admission and provisioning layer that bridges real-world Personhood Credentials to anonymous on-chain service accounts, and stable verification cost across batch sizes and substantially improved admission efficiency over non-recursive baselines are shown.

Abstract

Open Web 3.0 platforms increasingly operate as \emph{service ecosystems} (e.g., DeFi, DAOs, and decentralized social applications) where \emph{admission control} and \emph{account provisioning} must be delivered as an always-on service under bursty demand. Service operators face a fundamental tension: enforcing Sybil resistance (one-person-one-account) while preserving user privacy, yet keeping on-chain verification cost and admission latency predictable at scale. Existing credential-based ZK admission approaches typically require per-request on-chain verification, making the provisioning cost grow with the number of concurrent joiners. We present \textbf{ZK-AMS}, a scalable admission and provisioning layer that bridges real-world \emph{Personhood Credentials} to anonymous on-chain service accounts. ZK-AMS combines (i) zero-knowledge credential validation, (ii) a \emph{permissionless} batch submitter model, and (iii) a decentralized, privacy-preserving folding pipeline that uses Nova-style recursive aggregation together with multi-key homomorphic encryption, enabling batch settlement with \emph{constant} on-chain verification per batch. We implement ZK-AMS end-to-end on an Ethereum testbed and evaluate admission throughput, end-to-end latency, and gas consumption. Results show stable verification cost across batch sizes and substantially improved admission efficiency over non-recursive baselines, providing a practical and cost-predictable admission service for large-scale Web 3.0 communities.

Figures (9)

• Figure 1: ZK-AMS end-to-end architecture and admission workflow. (1) Client-side credential processing; (2) decentralized batch aggregation over IPFS/IPNS with confidential folding; (3) PBS proof finalization (untrusted); (4) on-chain admission with a single proof $(\pi, X)$; and (5) service binding via MLSAGS in the Soul Registry.
• Figure 2: An example of PHC designed in the form of VC.
• Figure 3: The block diagram of the arithmetic circuit in the zkSNARK algorithm.
• Figure 4: The illustration of the generation and verification process of a linkable ring signature.
• Figure 5: Circuit constraint counts versus admission batch size $N$.