Shield

Shield is the on-chain pool. It holds the tokens, the note tree and the spent-note markers, and it verifies every proof.

State

• Tree. A Poseidon Merkle tree of depth 26, appended two leaves at a time. It holds every commitment of every asset. Recent roots are remembered so a proof built a few seconds ago still lands.
• Nullifiers. Spending a note creates a small account named after its nullifier. A transaction whose nullifier account already exists is rejected.
• Listing. Which assets may be deposited. Delisting an asset stops deposits only; withdrawals of that asset can never be blocked.
• Audit key. The current key every transaction must seal to, injected as a public input to the verifier.
• Vaults. One token account per listed asset, owned by the pool.

A transaction

A Shield transaction is two Solana transactions signed together:

1. stage(proof, audit seal) parks the Groth16 proof and the sealed audit record in an account owned by the payer.
2. transact(root, nullifiers, commitments, extData) verifies against them and closes the staging account. extData carries the asset and amount crossing the boundary (positive in, negative out), the recipient, the relayer and its fee, and the encrypted memos for the two new notes.

extData is hashed into a public input, so nothing in it can be changed after proving. The program verifies the proof, creates the nullifier accounts, inserts the commitments, emits the memos and the audit record, and moves tokens across the boundary if the amount is non-zero.

Units

All amounts are the token's raw units. See Shares and raw units.

Authority

The authority is a multisig. It can list assets, list markets and rotate the audit key. It cannot touch funds, block withdrawals, or change the verifying keys.

Events