Proofs

Proofs are zero-knowledge statements about the notes in your account, made against the same tree Shield maintains. They add nothing to Shield; the statement is its own circuit that reads the tree.

The holdings statement

One circuit covers the two facts people ask for:

With maxIndex at its maximum the statement is I hold at least this much. With maxIndex set to an older leaf it becomes I have held at least this much since then, because leaves are appended in order and never move.

Up to four notes go into one statement. The circuit outputs the nullifier of each note it used, and that is what a verifier checks against the pool to confirm the notes are unspent. Revealing a nullifier discloses nothing about the note, but it does let that verifier notice when the note is later spent (not to whom, and not for how much). A statement made from fresh notes carries nothing a verifier can watch for long.

Verifying

A statement is a small file: the public inputs, the nullifiers and the proof. Anyone can check it:

• In the app, under Prove → Check one: the proof is verified in the browser, then the root and the nullifiers are checked against the pool.
• On chain, through the program's holds_at_least instruction, which succeeds only if the proof verifies, the root is one the pool still remembers, and no nullifier in the statement exists as a spent-note account. Programs that gate on a holding call it and read 1 from the return data.

Every statement is bound to a tree root. Verifiers decide how recent a root they accept.

Disclosures

Sometimes a fact is not enough and someone needs the notes themselves: a tax preparer, a lender, an auditor of your own choosing. A disclosure re-encrypts the notes of one asset to a reader's shielded address. The reader can decrypt them, compute their commitments and check them against the tree. They cannot spend, and they learn nothing about your other assets.