The anonymity set
Which notes a spend cannot be told apart from, why every transaction has the same shape, and what makes that set smaller in practice.
When you spend a note, an observer of the chain cannot tell which note it was. It could be any unspent note in the commitment tree your spend proves membership in. "Anonymity set" is the technical term for that collection of candidates. The larger it is, and the less the edges of the pool give away, the less a spend reveals.
What the set is
A spend proves, in zero knowledge, that its notes are leaves of the commitment tree for one pool index, under one of that tree's 512 most recent roots. The proof reveals the root, not the leaf. So every note in that tree is a candidate, whatever its token, its amount or its owner. Tokens share one tree: a USDC spend and a SOL spend draw on the same set.
Separate pool indexes have separate commitment trees. A spend names the tree it spends from, so its set is that tree's notes, not the notes of every pool index.
Why every transaction looks the same
Every value transaction, whether a deposit, a private transfer or a withdrawal, is the same instruction with the same shape: three notes in, three notes out, two deposit lanes and two withdrawal lanes. Slots a transaction does not use carry dummy notes. A dummy note has amount zero, but it produces a real, fresh nullifier and a real commitment, so the chain cannot count how many notes a transaction really spent or created. The program also appends three fee commitments to every transaction, including slots that pay nothing.
What makes it smaller
The cryptography keeps every note a candidate. What narrows the set in practice is everything around it:
- A young or quiet pool. Few notes means few candidates, and few transactions means each one stands out in time.
- Distinctive amounts at the edges. A deposit of 1,234.567 tokens and a withdrawal of 1,234.5 an hour later are easy to pair, even though nothing on chain links them.
- Timing. A withdrawal that closely follows a deposit, by the same person, invites the same pairing.
- A token only you use. Inside the pool the token is private, but deposits and withdrawals of it are not.
- The relayer tip's token. A tip is public, so paying it in a token says the transaction moved that token.
- Program-owned notes. Spending a note owned by a Solana address publishes that address, so those spends are not among the candidates for anyone else's.
None of these is visible in a single transaction. They show up across many, which is how chain analysis works. See how privacy is lost and privacy practices.
What the set does not cover
The anonymity set describes what a chain observer can infer. It says nothing about parties that see more than the chain does, such as the indexer's context service seeing which notes you ask for. Those are listed on what is private and what is visible.
Related
Last updated