ZK and Me

zk and me pipeline
Genome profile before loading DNA file and creating proofs
Genome profile after finding matched DNA tokens on the Solana Blockchain
Demo page before loading DNA file and creating proofs
Demo page after loading DNA file, creating proofs and finding a match on the Solana blockchain
A matched segment was found
zk and me's program page on Solana Devnet, and shows the program's 4 instructions
A genome match on Solana: one token account owned by the zk and me program, holding a hash and the two wallets that share a segment

Inspiration

You can change a leaked password. You cannot change a leaked genome.

In October 2023, hackers breached 23andMe. By compromising just 14,000 accounts, they scraped the genetic data, ancestry reports, and family trees of 6.9 million people.

Then, in 2025, 23andMe went bankrupt. The DNA of 15 million customers was suddenly treated as a distressed corporate asset. Despite lawsuits from 28 attorneys general, the court allowed a $305 million sale of the database to go through.

Both of these catastrophic failures stem from a fundamental architectural flaw: to tell you who your relatives are, a centralized company has to hold everyone's DNA in one giant honeypot. If their servers get hacked, your DNA is leaked. If their business goes under, your DNA is sold. You can reset a leaked password, but you can't reset your genome.

I wanted to know: Is it possible to find your relatives and connect with them, while keeping your DNA strictly on your own device?

What it does

zk and me is a decentralized, privacy-preserving genetic matching network. It eliminates the need for centralized database.

Here is how it works:

A lab sequences your DNA and digitally signs a "fingerprint" of it. Your actual DNA is sent to your device and never leaves it.
In your browser, your DNA is chopped into 128 segments. Each segment is mathematically hashed into a unique token.
Your browser generates a Zero-Knowledge Proof (ZK Proof) for each segment. This proof says: "I have an authentic, lab-verified DNA segment that perfectly hashes into this token."
You submit ONLY the tokens and the proofs to the Solana blockchain.
Because relatives share identical stretches of DNA, they will generate the exact same tokens. When your relative posts their token, it naturally collides with yours on-chain. That collision is the match.

You find your family, but the blockchain only stores random-looking hashes. There is no DNA database to hack, and no data worth selling.

Background:

Zero-Knowledge Proofs

A zero-knowledge proof lets you prove a statement is true without showing the underlying data. The person checking the proof only learns whether it's valid or not. For example, proving you are over 18 to a bouncer without showing them your ID. They will never know your birthdate but they can be sure that you are over 21 or not.

For this project, I used Groth16 proofs on the BN254 elliptic curve that Solana supports natively. Every Zero knowledge prove must fulfill these three properties:

Completeness: If the statement is genuinely true, an honest prover will always successfully convince the verifier.
Soundness: If the statement is false, it is mathematically impossible for a cheating prover to trick the verifier into believing it is true.
Zero knowledge: The verifier learns absolutely nothing about the underlying secret data other than the simple fact that the statement is true.

Solana

Matching genomes requires millions of micro-transactions. If a million users publish 64 segments each, that's 64 million proof-verified writes. This design relies on specific architectural strengths unique to Solana to make that workload possible:

Native ZK Verification: Solana exposes BN254 elliptic-curve operations (the alt_bn128 syscalls) directly to developers, meaning complex zero-knowledge math can be run natively on-chain.
The Account Model: Solana's deterministic Program Derived Addresses (PDAs) turn standard state storage into a highly efficient routing and collision engine.
Micro-Transaction Economics: The first relative to post a token pays a tiny rent deposit (~0.0035 SOL). The second relative pays nothing. On chains with high gas fees, uploading 64 segments per person would bankrupt the user; on Solana, it costs pennies.
Parallel Execution: Since almost every token is unique to one person, transactions don't block each other. Solana processes these non-overlapping account writes in parallel, allowing for massive scale.

How I built it

1. The Circuit & Cryptography (Circom, snarkjs & Groth16)
I wrote a custom circuit in Circom that translates the privacy logic into a Rank-1 Constraint System (R1CS) with 12,848 constraints. Your genome is cut into 128 windows and committed to a Merkle tree using Poseidon hashing. For each segment you publish, the circuit proves three things: the segment actually belongs in your tree at that specific position, an accredited lab's EdDSA signature covers the tree's root, and the output "token" is the correct hash of the segment, its position, and the current week.

To make this cheap to verify on a blockchain, I used the Groth16 proving system over the BN254 elliptic curve (secured via a "Powers of Tau" trusted setup). This shrinks all that heavy math into a tiny 256-byte proof. It all compiles to WebAssembly and runs locally in a background browser thread, taking under a second per proof.

2. The Smart Contract (Rust, Anchor & Solana PDAs)
I wrote an Anchor program on Solana to handle the proof verification and the relative matching. When a user submits a token, the program first checks that the public inputs match our on chain registry so nobody can use a fake lab. Then it uses Solana's native alt_bn128 syscalls to run the Groth16 pairing check and verify the zero knowledge proof directly on chain.

To handle the matching, I used Solana's account model instead of a traditional database. The program takes the token hash from the circuit and uses it as a seed to derive a Program Derived Address. If two people share the same DNA segment, they generate the identical token hash. That means both transactions point to the exact same account address. When a second user writes to that account, that on chain collision registers the match.

3. The Frontend (Vite & React)
I built a clean, static single-page app where absolutely everything sensitive happens client-side. The app parses the DNA file, builds the tree, and handles the cryptography locally. To make it easy to test, the demo runs two identities side-by-side in separate windows to visualize a real-time match without ever transmitting a single genomic marker to a server.

Challenges I ran into

**There is no ready-made path from Circom to Solana.* Ethereum's toolchain emits a Solidity verifier in a single command. Solana provides the raw curve syscalls and the groth16-solana crate, but connecting them to Circom's output is entirely up to you. I had to manually convert the verifying key into Rust and meticulously match the proof encoding byte for byte to ensure the program could actually read and verify the proofs being generated in the browser.

Accomplishments that I'm proud of

Successfully verifying real, complex Groth16 proofs purely on-chain via Solana devnet.
Building a complete test suite (11 program tests, 12 circuit tests) that proves the system naturally rejects forged tokens, stolen profiles, and tampered proofs.
Pioneering a database-less matching engine using Solana's PDA architecture.

What I learned

I learned how to get a zero-knowledge proof to verify on-chain using Solana's curve syscalls.
Learned how to create a trusted setups (like the Powers of Tau), and the math that makes destroying the initial random data almost impossible to break into.
Learned how to deploy Rust smart contracts, and how Solana's PDAs can be used to replace a traditional backend database.
Learned how raw 23andMe-style text files are structured, and figured out how to translate genetic markers into math the circuit could process.

What's next

Zero-Knowledge Machine Learning (ZKML)

Currently, the system relies on exact token collisions, meaning a single sequencing error or tiny mutation completely breaks a match.

To solve this, the next major step is running a machine learning model directly inside the zero-knowledge circuit. Instead of requiring a strict 1-to-1 hash match, ZKML will evaluate the genomic data and output a confidence score of relatedness. This allows the smart contract to verify family connections even with imperfect genetic data, all while keeping the underlying DNA completely hidden and off-chain.

Please try it out at: https://zk-and-me.netlify.app

Please make your own at: https://github.com/jameslrivera/zk-and-me

Please explore the zk and me blockchain structure at: https://explorer.solana.com/address/9q6kP67QT8gwSwszckPaU1b9wvV1qMjzLJg3C1NwRDtP?cluster=devnet