How privacy works

Opaque does not hide balances by encrypting an account. It replaces accounts with notes.

Notes instead of balances

A note is a sealed statement: this much of this asset belongs to this owner. The chain holds only a commitment to the note, a hash that reveals none of those three things. Every note ever created sits in one Merkle tree shared by every asset and every user.

Your balance in an asset is the sum of the unspent notes you own. Nobody else can tell which notes are yours, or how many there are.

Spending is proving

To spend, you do not sign a transfer. You produce a zero-knowledge proof that:

• notes with these commitments exist in the tree,
• you hold the secret that owns them,
• the amounts going out equal the amounts coming in,
• the same notes have not been spent before.

The chain verifies the proof and records two things: a nullifier for each note spent (a value that marks it spent without revealing which note it was) and a commitment for each note created. That is the whole record of a transfer.

One tree, one crowd

Because every asset and every account share one tree, every transaction hides among all of them. There is no per-asset pool to be thin in. A transfer of a rarely held stock is indistinguishable from a transfer of the most common one.

What the chain can still see

The pool has an edge. Tokens enter it from a wallet and leave it to an address, and both events are public: the asset, the amount and the address. Opaque does not disguise them. What it guarantees is that nothing connects an entry to an exit, or to anything that happened in between.

Continue with Who sees what for the complete table.