In the Tornado Cash constructor, it takes an argument:

Ihasher _hasher;

where the Ihasher is:

interface IHasher {
   function MiMCSponge(uint256 in_xL, uint256 in_xR) external pure returns (uint256 xL, uint256 xR);

In the mainnet contract, they use the address: https://etherscan.io/address/0x83584f83f26af4edda9cbe8c730bc87c364b28fe

it's not verified, but apparently refers to a precompiled circom contract (my guess?).

Just want to know if anyone has information on:

  • what is it exactly?
  • what address to use if I want to deploy it to another EVM chain (say Polygon)?
  • can I just deploy the bytecode on my own (will this work)?

1 Answer 1


Figured it out. They use the mimc_sponge hash function (https://byt3bit.github.io/primesym/) and it's all precompiled by the IDEN guys and just the bytecode is deployed on-chain (so no solidity).

Here is the script that tornado uses to deploy it:


It goes to this file which has all the updated logic (tornado might be out of date): https://github.com/iden3/circomlibjs/blob/main/src/mimcsponge_gencontract.js

As you can see, they literally create the contract byte by byte. But it's just hashing, so you can deploy and redeploy pretty cheaply and it's fine.

  • Error ! when targetting the ᴇᴠᴍ, Circom1 (circom2 is not used by Tornado Cash) is compiled to a smart contract with most of the security check of the cicrom code removed. Dec 25, 2022 at 0:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.