Zones
What a zone is, the signatures it controls for notes entering and leaving it, what stays private, and how zones are created, frozen and revoked.
A zone is a numbered compartment of the pool. Its notes can be spent, and notes can be created in it, only with a signature from the zone's own signing key, and the proof checks that signature without the chain learning which zone a transaction touched.
What a zone is
Every note carries a zone number. Zone 0 means no zone: its notes move freely, with no zone signature. Any other zone belongs to whoever runs it, through two keys: a zone authority, a Solana key that manages the zone in the zone registry, and a zone signing key, whose signatures the transaction proof checks.
What a zone controls
A zone signs for its own side of every movement across its boundary, so it controls both what leaves it and what enters it.
- Within zone 0, no signature is needed.
- Within a zone, spending its notes into notes of the same zone needs that zone's signature.
- Out of a zone, into zone 0 or out of the pool through a withdrawal, needs the zone's signature.
- Into a zone, whether by deposit or from zone 0, needs the receiving zone's signature.
- Between two zones, both sign: each authorises only its own side, so neither can move notes across alone.
Each signature covers exactly one transaction. Every real note a transaction spends must come from one zone.
What stays private
The zone number, the signing key and the signature are all private inputs to the proof. The chain sees only which version of the registry's list of zone signers the proof was checked against, so it cannot tell which zone a transaction involved, or whether it involved one at all. A zone's signer does recognise the transactions it signed. It learns note contents only when the sender chooses to open them to it; see disclosure.
Lifecycle
Anyone may apply to run a zone. Governance approves an application through a timelocked proposal, and the zone receives the next number. After that, the zone authority manages its own zone: it can rotate the signing key, hand the zone to a new authority or freeze the zone, and each such change waits a delay the zone chose for itself.
A frozen zone's notes cannot move through a normal transaction until it is unfrozen. If a zone's keys are lost, a recovery can replace them after the zone's own recovery delay, and the current zone authority can veto it. Governance can revoke a zone for good, and its number is never reused.
The notes of a frozen or revoked zone can still leave through the escape hatch, which checks no zone signature and publishes the note it takes out.
Who controls what
Governance approves and revokes zones and sets the registry's parameters, all through timelocked proposals. It cannot sign for a zone, and it cannot freeze one; freezing is the zone's own act. See governance and upgrades.
Related
Last updated
Screening
What the screener checks before it co-signs a value transaction, which addresses it screens, what it refuses, and what it sees.
Disclosure
The encrypted sender record every value transaction carries, the keys that open it, how it is shared with the guardian nodes, and how a sender can prove chosen fields to a zone.