Private statement proof

## Inspiration

Bank statements contain highly sensitive financial information, but people often need to prove ownership of that information to banks, auditors, lenders, or applications. Traditional sharing exposes the entire statement.

We built Private Statement Proof to demonstrate how Midnight can verify statement ownership without putting the statement, identity key, balance, or transactions on-chain.

## What it does

The bank issues a private statement commitment. The account holder receives a locked PDF containing a verification link. The holder enters their private identity key, and the app uses Midnight to prove that their private statement and nonce match the bank’s commitment.

Only after the proof succeeds is the statement unlocked. The holder can then ask an AI assistant questions about the statement, such as:

What did I spend on subscriptions?
What was my balance in March?
Were there unusual transactions?

## How we built it

The Compact smart contract stores commitments and exposes circuits for issuing a statement and proving ownership. Private values are supplied as witnesses, while only cryptographic commitments and proof results are public.

The demo uses:

Midnight Compact
Midnight local devnet
Docker Compose
TypeScript
Vite
Browser-based PDF generation
Nodemailer for email delivery
Groq API for the post-verification assistant

The encrypted witness package is carried in the verification URL fragment, so it is not sent in normal HTTP requests. The AI assistant is unavailable until Midnight ownership verification succeeds.

## Challenges

The biggest challenges were configuring the local Midnight devnet, downloading and caching proving keys, handling long zero-knowledge proof generation times, and connecting the browser demo to the real Compact contract gateway.

## What we learned

We learned how Midnight separates private witnesses from public ledger state, how Compact circuits can enforce matching commitments, and how privacy-preserving proofs can support real financial workflows without exposing transaction history.

## Future work

A production version would use wallet-generated identity keys, persistent encrypted storage, production deployment, and a privacy-preserving AI model or local inference so that even the unlocked statement would not be sent to a third- party AI provider.