Grady Miller

Until A Critical Fix Is Required
ZK circuits don’t upgrade silently. Newton’s pretransaction policy enforcement layer runs agent constraint evaluation through ZK proof circuits that encode the specific logic defining what a valid policy check looks like, and those circuits are mathematical constructs with fixed parameters baked into the proving and verification keys generated during an initial trusted setup ceremony, meaning any meaningful change to the policy enforcement logic whether to fix a constraint evaluation bug, expand the parameter set for new policy types, or patch a discovered circuit vulnerability requires generating entirely new proving and verification keys through a brand new trusted setup process before the updated circuit can be deployed. And a new trusted setup isn’t an internal engineering decision, it’s a ceremony requiring trusted external participants to generate and then permanently destroy entropy, because if the toxic waste from that ceremony survives anywhere, the entire proof system for the updated circuit is compromised from its first block onward.
Here’s the operational problem that mainnet beta conditions won’t stress test adequately. Every active agent session authorized under the old circuit’s verification key becomes technically incompatible with the new circuit the moment Newton deploys an upgrade, because the verification key the Keystore used to validate policy compliance proofs under the old circuit doesn’t verify proofs generated by the new proving key, meaning existing agent sessions either need full revocation and reauthorization under the new circuit parameters or the protocol has to maintain parallel verification infrastructure for both the old and new circuits simultaneously during a migration window. Running dual circuit verification adds state complexity to the Keystore rollup, creates a period where agents operating under the old circuit carry a different policy enforcement guarantee than agents newly authorized under the upgraded circuit, and introduces a version mismatch problem that the TEE environments reading Keystore state need explicit handling logic for before the upgrade happens. That logic has to be written, audited, and deployed in advance, not patched in reactively after a live circuit issue surfaces.
My cynical take, and I’ve watched ZK protocol teams badly underestimate upgrade ceremony complexity in production environments that had clean initial deployments. Trusted setup ceremonies for production ZK circuits are coordination heavy, resource intensive events that don’t compress well under patch timeline pressure, and the teams most likely to skip or rush the ceremony process are exactly the ones responding to a live circuit vulnerability that needs a fast fix rather than a scheduled feature release with months of lead time. I want Newton to publish the full governance process for ZK circuit upgrades including how trusted setup participants get selected and verified, what the minimum participant threshold for a valid ceremony looks like under their security model, how existing agent sessions migrate across circuit versions without forcing full reauthorization at scale, and whether any emergency patch mechanism exists that doesn’t require a complete new ceremony cycle. Until that process is documented somewhere publicly auditable and not buried in a developer FAQ, every policy enforcement guarantee Newton ships on mainnet beta is conditionally valid only as long as the current circuit never needs urgent revision.
$NEWT
@NewtonProtocol $NEWT #Newt

Every proof is a broadcast. When Newton’s TEE generates a ZK proof that an agent’s trade cleared pretransaction policy enforcement, that proof gets submitted as calldata to the underlying chain before the trade itself executes, meaning the mempool sees a cryptographically verified signal that a specific authorized trade is incoming before any DEX router processes it. MEV searchers don’t need to crack the policy circuit or understand the agent’s strategy to extract value from that signal. They just need to read the pending proof submission, identify the implied asset and approximate sizing from the associated calldata, and position ahead of the settlement transaction inside the same block. And the policy enforcement system functionally helped them do it by generating a verifiable, readable, pre-execution confirmation of intent.
Here’s the mechanic that makes this worse than standard MEV exposure. A normal unprotected DEX trade sits in the mempool without any formal confirmation that it’s going to execute, searchers are betting on probability and they compete in a noisy environment full of failed transactions and reverted slippage checks. A Newton policy approved trade arrives with a valid ZK proof attached confirming it already cleared all constraint checks, meaning the searcher’s probability estimate just went to near certainty before the block closes. That’s not standard mempool visibility, that’s a credible execution signal with cryptographic backing, and front-running a near-certain execution is a structurally different and more profitable operation than front-running a standard pending swap. The same proof mechanism that makes Newton’s policy enforcement verifiable also makes its agent trades more predictable targets than vanilla DEX transactions.
My honest take, and I’ve traded through enough MEV seasons to recognize this pattern. Private mempool routing or proof submission through a protected RPC like Flashbots Protect can blunt some of this exposure, but those solutions exist outside Newton’s core architecture and there’s nothing in the documented pretransaction enforcement flow that mandates or even recommends protected submission paths for policy proofs at the application layer. If Newton’s default execution path submits proofs through public RPC endpoints into open mempools, every policy enforced agent trade is broadcasting a cleaner execution signal to searchers than most users realize they’re emitting. I want Newton to publish whether proof submission and trade execution get bundled atomically through a private relay by default, or whether that’s left as an optional integration for developers who already know to ask. Until that’s spelled out clearly, the verifiable enforcement guarantee and the MEV vulnerability it introduces are shipping together as a package deal.
$NEWT
@NewtonProtocol $NEWT #Newt

The Keystore gets all the attention but I’m watching the layer below it. Agent intents in Newton’s architecture don’t route directly into the policy enforcement circuit, they travel through RPC endpoints that relay transaction data into the TEE environment before any ZK proof gets generated. If those RPC nodes are operated by a small set of providers or by Newton’s own team during mainnet beta, the decentralization claim lives at the proof layer while the data routing layer stays quietly centralized. And centralized routing under load is where systems fail first, not the cryptography.
Here’s the technical problem most posts skip. TEE environments need clean, tamper evident data feeds to generate valid proofs, because corrupted or delayed inputs from an RPC node can silently degrade policy enforcement without tripping any onchain alarm. ZK proofs verify that a computation was executed correctly, but they don’t verify that the data fed into the TEE was timely or unmanipulated at the network routing layer before proof generation happened. A sophisticated actor who can position between an RPC endpoint and the TEE input doesn’t need to break any cryptography, they just need to feed stale or reordered data at the right moment during a volatile block. That attack surface is real.
My honest read after sitting with this. I don’t think Newton’s engineering team missed this entirely, the zkPermissions architecture shows enough careful layered thinking that a blind spot this obvious seems unlikely. But careful proof layer design doesn’t automatically translate into production grade RPC infrastructure at launch, and mainnet beta under real trading stress will hit the routing layer harder than any testnet scenario prepared for. I want a published answer about who operates the RPC nodes feeding the TEE environment, how many independent operators exist at launch, and what failover looks like if a node goes dark mid execution. Until that’s documented somewhere readable, the decentralization story has a structural gap sitting right below the headline architecture.
$NEWT
@NewtonProtocol $NEWT #Newt

I went digging into what actually happens if you want out of the Newton $NEWT Keystore system entirely, not just pause an agent but fully revoke and withdraw custody. The pitch is that zkPermissions let users keep blind custody while still letting agents execute within proven boundaries. Good in theory. But every rollup style system has an upgrade key or admin multisig somewhere controlling the proof verification contract, and that’s the piece nobody benchmarks when they’re busy praising the zk architecture. If that multisig can pause settlement or freeze pending intents during an upgrade window, your custody isn’t actually independent of trust assumptions, it’s just trust wearing a verifiable wrapper.
Here’s what I’d want answered before mainnet beta gets taken seriously. What’s the multisig threshold controlling the Keystore’s core contracts, and is there a timelock on upgrades or can changes go live instantly. A real decentralized custody claim needs a forced exit mechanism, something that lets a user pull funds even if the sequencer goes dark or the policy engine stalls. Most early rollups skip this because it’s hard to engineer and harder to market, they’d rather ship the happy path first and patch exit guarantees later. I’ve seen that movie before and it doesn’t end well for users holding funds during the patch window.
My cynical take, and I mean this respectfully. The TEE plus ZK combo for policy enforcement is legitimately clever engineering, I’m not dismissing the technical effort here. But clever engineering doesn’t matter if there’s a single point of failure sitting upstream of it that can freeze everything during exactly the moment users need an exit most. I want to see the forced withdrawal mechanism documented plainly, not buried in a whitepaper appendix. Until then I’m treating the custody claim as aspirational, not proven.
@NewtonProtocol $NEWT #Newt