What is private and what is visible
For every operation, what a chain observer can read, and what each party in the system can learn.
Inside the pool, who paid whom, how much and in which token are private. At its edges some of it is public: a deposit shows the depositing wallet, the token and the amount, and a withdrawal shows the destination, the token and the amount, though not who withdrew. This page puts every operation side by side, first as a chain observer reads it, then for every party.
What the chain shows
- Main wallet
- Your wallet (fee payer)
- Platform wallet
- Your derived wallet (signer)
- Identity commitment
- A field elementNow tied to both wallets
- Encryption key hash
- Keccak-256 of your ML-KEM public key
- Your keys
- Private
- Depositor
- Your platform wallet
- Token and amount in
- Exact
- Who receives the notes
- Private
- How the amount is split
- Private
- Zone
- Private
- Submitted by
- A relayer
- Relayer tip
- Amount and token, if paid
- Sender
- Private
- Recipient
- Private
- Amount and token
- Private
- Zone
- Private
- Destination
- The receiving address
- Token and amount out
- Exact
- Who withdrew
- Private
- Which notes paid
- Private
- Change left behind
- Private
- Destination, token, amount
- Exact
- The note's fields
- Twelve fields, including its owner
- Platform wallet
- For identity-owned notes
- Who funded the note
- Private
Every value transaction also publishes three nullifiers, three note commitments and three fee commitments. None of them can be tied to a note or an owner without keys the observer does not have. See nullifiers and note commitments.
What each party can learn
Two things carry the most weight:
- The indexer. A spend asks the indexer's context service for Merkle paths and nullifier gaps, and the request names your identity commitment and the notes you are spending. Whoever runs that service can link a spend to you. See how privacy is lost.
- The edges. A deposit is public and attributable, because registration links your identity commitment to the depositing wallet. A withdrawal publishes its destination, token and amount but not who made it, unless you submit it yourself, withdraw to an address already tied to you, or use the escape hatch. What the protocol keeps private is the path between them.
Related
Last updated
Disclosure
The encrypted sender record every value transaction carries, the keys that open it, how it is shared with the guardian nodes, and how a sender can prove chosen fields to a zone.
The anonymity set
Which notes a spend cannot be told apart from, why every transaction has the same shape, and what makes that set smaller in practice.