Shield

Open Shieldshield.human.tech

Shield is human.tech’s bridge to Aztec: a privacy-preserving bridge between Ethereum L1 and Aztec L2, and the first app built on the Clean SDK, human.tech’s programmable privacy toolkit for Aztec. Move tokens into Aztec’s private layer while proving a real, unique human with clean funds is behind the transfer, without revealing personal information. Funds are screened both at entry (Ethereum to Aztec) and at exit (Aztec to Ethereum).

The only Aztec bridge with identity, sanctions, and PEP screening built in. Screening is enforced cryptographically: zero-knowledge proofs at identity issuance, on-chain attestation verification at every deposit and withdrawal. Shield’s bridge contracts are independently audited by Nethermind Security; the Clean Hands ZK circuits and the Human Network carry their own separate audits. See Security & Audits.

Every transaction clears Proof of Innocence (wallet and funds vs 23 sanctions sources) and proves a real, unique human via Proof of Personhood: Human Passport or Proof of Clean Hands.

Live on Aztec v5 mainnet as of 2026-07-21 (deployment 5.0.0_2026-07-21). Shield bridges USDC between Ethereum L1 and Aztec L2, arriving as Clean USDC (cUSDC) in private mode.

Aztec is an alpha network, with ongoing audits and an active bug bounty. Only bridge funds you can afford to lose.

How verification works

Shield gates private-mode transfers with a two-tier verification model, so casual users can start small without a full ID check while larger transfers meet a stronger compliance bar:

Human Passport (de-minimis tier). For transfers under $1,000, a Human Passport unique-personhood score of 20 or higher is enough. No government ID required.
Proof of Clean Hands (full tier). For transfers of $1,000 and above, a ZK Gov-ID Proof of Clean Hands credential is required: government-ID verification, a liveness check, and screening against 23 international sanctions and watchlist sources.

Public-mode transfers are fully transparent and traceable, so they carry no identity gate.

Shield charges a 0.5% fee, settled in USDC.

What Clean USDC is

Bridging into private mode mints Clean USDC (cUSDC) on Aztec.

The token is a Token from aztec-standards, the shared token standard for the Aztec ecosystem. cUSDC composes with any Aztec application that speaks the standard, and holding or moving it behaves like any other Aztec token.

cUSDC’s supply is exactly the set of tokens that cleared a verification gate, and it stays composable with the rest of Aztec because the gate is in minter control rather than in the token contract.

The token lifecycle is specified in two Noir contracts specific to Shield:

TokenMinterProxy is the token’s only minter. No other party can create cUSDC.
TokenBridge is the only caller of that proxy, and it verifies a legal verification attestation before every mint and every burn. Attestations are Schnorr signatures over Grumpkin, issued either by the Human ID attester (bound to a specific Clean Hands circuit and action ID) or by a Passport signer with an explicit max_amount cap and expiry.

This design ensures that:

Both directions are gated. Exit is verified the same way entry is, on both the private and public withdrawal paths.
Attestations are single-use. Entry and exit share one nonce map, so a signature consumed on either path cannot be replayed on the other.

Clean SDK

The @human.tech/clean.sdk package is the no-UI, programmable-privacy SDK that powers Shield. It lets developers embed the same compliant-privacy flow (identity attestation, per-transfer sanctions screening, and private bridging) directly into their own applications.

@human.tech/clean.sdk

Install the Clean SDK from npm to add programmable, compliant privacy to your app.