Anonymous Membership Proofs on Midnight: Building Privacy-Preserving Allowlists

Anonymous Membership Proofs on Midnight: Building Privacy-Preserving Allowlists Last month, I was tasked with building an allowlist system for a Midnight dApp. The requirement seemed simple: let authorized users access a feature without revealing who they are. In the clear-text world, you'd just check if (user in allowedList). But on a privacy platform, that if statement leaks everything. This tutorial walks through building a complete anonymous membership proof system — from the Compact contract on-chain to the TypeScript tooling that generates Merkle proofs locally. We'll cover sparse Merkle trees, depth-20 path verification, nullifier-based replay prevention, and admin root management. Why Merkle Trees for Allowlists? Traditional allowlists publish every member's address on-chain. That's fine for transparency, but terrible for privacy. A Merkle tree solves this differently: Off-chain: The admin maintains a list of member secrets On-chain: Only a single