Zero-knowledge proofs
How you prove a deposit is yours without saying which one.
The idea, without the maths
A zero-knowledge proof lets you convince someone a statement is true without showing them why. When you withdraw from the shield, the statement is: “I know the secret behind one of this pool's deposits, and I haven't used it before.” The program can check that's true. It learns nothing about which deposit.
What your proof says
| The proof shows | Without revealing |
|---|---|
| You own a deposit in this pool | Which deposit |
| You haven't withdrawn it before | Anything that links the two |
| The SOL goes to the address you chose | — |
| The relayer's fee is the amount you agreed | — |
The last two rows are what make relayers safe to use. The destination and the fee are part of what the proof proves. A relayer that tried to send the SOL somewhere else, or take a bigger cut, would break the proof and the program would reject it.
Your note, and its two fingerprints
Your note holds two random secrets. From them, your browser makes two fingerprints that can't be linked to each other:
| Fingerprint | When it goes on chain | Why |
|---|---|---|
| Commitment | When you deposit | Adds your deposit to the pool |
| Nullifier | When you withdraw | Marks the note as spent, so it can't be used twice |
Seeing both on chain tells an observer nothing: there's no way to work out which commitment a nullifier came from without the note.
Where it happens
The proof is built in your browser in a few seconds, and your note never leaves your device. The program then checks it on chain using Solana's built-in cryptography, so the check is part of the same transaction that pays you — there's no off-chain server deciding whether your withdrawal is valid.
Specifics
| Proof system | Groth16 on the BN254 curve |
| Checked with | Solana's alt_bn128 and Poseidon built-ins |
| Deposits per pool | About 1 million |
| Proof stays valid | Against any of the pool's last 64 states — others depositing while you prove won't break it |