Trust
What stays private
Exactly what's hidden, what isn't, and how people slip up.
Ztonk's privacy has one job: break the link between the wallet that pays and the wallet that trades. It's worth knowing exactly where that stops, because privacy tools fail in ways the screen doesn't show you.
Hidden and public
| Status | Why | |
|---|---|---|
| Which deposit a withdrawal came from | Hidden | The proof names no deposit. |
| That your trading wallet belongs to you | Hidden | It was funded from the shield and its fees were paid by a relayer. |
| That a trade happened, its size and price | Public | A bonding curve has to price against public reserves. |
| That you deposited into the shield | Public | The depositing wallet is visible. It's the withdrawal that's unlinked. |
| Pool reserves and prices | Public | Needed for anyone to trade. |
| Your IP address, to the relayer | Public | Use a VPN or Tor, or run your own relayer. |
How hidden you are
You're hidden among everyone else with an unspent deposit in the same pool — that group is your anonymity set. With 500 others it's a 1-in-500 guess. With 4 it's 1 in 4, whatever the cryptography says. Busier pools protect you better, and a brand-new pool protects you barely at all.
How people give themselves away
The maths holds up. Habits are what get people identified:
- Timing. Depositing and withdrawing a few minutes apart, when nobody else used the pool in between.
- Matching amounts. Depositing 10 SOL and withdrawing 10 SOL, every time, in the same pattern.
- Mixing wallets. Sending anything between your new wallet and your old one, even once.
- Cashing out to your name. Sending from the new wallet to an exchange account in your name.
- Your connection. The relayer sees the IP address a withdrawal request comes from.
Good habits
- Wait. Let plenty of other deposits land between yours and your withdrawal.
- Vary sizes and timing rather than repeating the same pattern.
- Use each new wallet for one purpose and never connect it back to your main one.
- Connect through a VPN or Tor when withdrawing.
What you're trusting
| Assumption | If it failed |
|---|---|
| The setup ceremony was done honestly | Withdrawals could be forged. This is why it must be a multi-party ceremony, and why the key is frozen afterwards. |
| Solana's cryptography built-ins are correct | Proofs could be forged or wrongly rejected. These are part of Solana itself, not Ztonk. |
| You keep your note safe | A lost note can't be recovered; a leaked note can be spent by whoever has it. |
| The admin doesn't pause the shield | Your SOL stays yours, but you couldn't move it while paused. |
In short
Ztonk hides who, not what. Use it with that in mind. More detail on keys and admin powers is in Security.