Ztonk
Launch
How it works

The shield

The shared pool that breaks the link between your wallets.

What it is

The shield is a shared pool of SOL. You put SOL in from one wallet and take it out to another. When you take it out, you prove that one of the deposits is yours without revealing which one — so nobody watching the chain can tell which deposit became which withdrawal.

DepositsWithdrawalsShielded poolhover a deposit

Hover a deposit on the left: its trail stops at the pool. That's not a simplification of the picture — the chain genuinely records only that deposits went in and withdrawals came out, never which matched which.

Depositing

  1. 1
    Pick a pool size
    0.1, 1, 10 or 100 SOL. Every deposit in a pool is the same size.
  2. 2
    Save your secret note
    Your browser makes two random secrets and turns them into a note. Save it somewhere safe before you continue.
  3. 3
    Confirm the deposit
    Only a fingerprint of your note goes on chain. It reveals nothing about the note itself.
A note looks like this
ztonk-1000000000-5f2c…e91a
      └─ pool size in lamports (1 SOL)
Your note is the only key
Anyone who has the note can withdraw the deposit, and without it nobody can — not you, not Ztonk. There's no reset and no support ticket that can help. Store it like a seed phrase.

Withdrawing

Your note
stays in your browser
Proof
built in your browser, a few seconds
Relayer
submits it and pays the fee
New wallet
receives the SOL

Paste your note and the address you want the SOL sent to. Your browser builds a zero-knowledge proof — a short piece of data that convinces the program you own one of the pool's deposits, without saying which. A relayer submits it and pays the network fee, so the receiving wallet can start completely empty.

The relayer can't redirect your SOL

The recipient address and the relayer's fee are built into the proof. If the relayer changed either one, the proof would stop being valid and the program would reject it. The worst a relayer can do is refuse to submit — and then you can use a different one.

Each note works once

Withdrawing records a second fingerprint of your note (a nullifier) that can't be linked to the deposit. Using the same note twice would produce the same nullifier, and the program refuses it.

Why fixed sizes

If you deposited 3.217 SOL and later withdrew 3.217 SOL, the amount alone would give you away. With fixed sizes, every deposit in a pool looks the same, so you're hidden among everyone else in that pool. To move an odd amount, split it across pools and withdraw at different times.

Details

Deposits per poolAbout 1 million
Proof systemGroth16, checked on chain with Solana's built-in alt_bn128 operations
Proof stays validAgainst any of the pool's last 64 states, so other people depositing while you prove doesn't break it
Relayer feeSet when you withdraw, up to a cap fixed per pool
  • The shield only holds SOL. Tokens you buy with it sit in the new wallet like any other.
  • Proofs are made entirely in your browser; your note never leaves your device.
Beta
Proofs like these rely on a one-time setup ceremony. Ztonk's builds on a public 80-person phase 1, but its circuit-specific phase 2 needs more contributors before real funds are used. See Security, and Zero-knowledge proofs for how the proof works.