An income the ledger has no field for
Privacy here is not a policy, a permission or a setting somebody could change. The block that records an agent being paid has nowhere to put the sender, the recipient or the amount — so it does not record them, and no amount of subpoena gets them out of it.
- txid
- 281a7a2940858ff7feca92d8…
- block
- 3,184,902
- spends
- 1 nullifier · 86b1f06f644718…
- outputs
- 2 commitments · 738990fa471835…
- from
- —
- to
- —
- value
- —
- memo
- 512 B ciphertext
- fee
- 0.00001 ZEC
The nullifier proves the spent note has not been spent before. The commitments prove new notes exist. Neither says whose, or how much — and there is no field elsewhere in the block that does.
What an observer actually gets to watch
Money usually enters the pool from somewhere, and that entry is visible: a transparent address shielded funds, and this much. Those lines are permanent. They are also where the record ends.
A diagram. Payments from five transparent addresses travel toward a shielded pool, each leaving a permanent line behind it, so the left of the picture fills with a web of visible funding legs. At the pool boundary the lines stop. Notes leave the far side to five agents carrying no history at all.
On a real chain the funding legs never fade; here they do, only so the picture stays readable. At the boundary the record stops, and the count of what went in tells you nothing about which note came out.
Money as notes, not balances
A transparent chain keeps a table of addresses and balances. A shielded pool keeps a forest of commitments, and every payment adds leaves to it.
A note
A note is a value, a recipient and some randomness. It exists off chain, held by whoever can decrypt it. Paying an agent means creating a note it can open.
value · recipient · rseedA commitment
The chain stores a commitment to the note — a hash that binds those contents without revealing them. Commitments go into an append-only tree that every node agrees on.
cm = Commit(note)A nullifier
Spending a note publishes a nullifier derived from it. Nodes check it has never appeared before. That is what stops double-spending without anyone learning which note was spent.
nf = PRF(nk, note)The consequence that matters for agents: address reuse stops being a mistake. On a transparent chain, giving every buyer the same address is how you get deanonymised — the address becomes a public ledger of your business. In a shielded pool, a thousand payments to one unified address produce a thousand unrelated commitments, and no observer can group them.
So an agent can publish one address, forever, in its manifest. Buyers do not need a fresh address per job. Nothing about the simple thing is the unsafe thing here.
The invoice rides inside the payment
Every shielded output carries 512 bytes of encrypted memo. It is the single most underused field in cryptocurrency, and it is exactly the size of a receipt.
2mzfsla6clzlst2vh30cjpzdlpcxtjtzp5dpfsdqet5l5yrkauwpf2vfn0jw9j0c2cvp8zg32fjt66vh4pum8sf3xff7sg9mx03a09rl7rj20rcs94m48mk4y9p23hh6ntskuql9x7asfcn042j6nhapt0avg97x746s8z83cyfeghnmdg2ysman422pl4tp72exgt5p54v0v32eupd5hkvlcl0h6ase99rlvkhhalhs7e9fv5jz682f0h6hdr4dqygf88vcmgrag3nsgxhgl9zm867wqrnmmgcnh5yqlefkj262j0mawrv0wyz87vw4ufvhqk6mwa4m67l5wrywur5puzvvelztz77yuct2fyta44782afs7j6qcqw33ctsq0yxchpj3c0yw7kd0hewjau0t9w5w7mahzwgqluu3ve0erkhg9z99svpz2upnel379tyt8n5zzrjk3dh0wlth9wklz9jsmd6nf7mnld8nqkjprxjedtx88sjm3rr7s2x
Always 512 bytes, whatever you typed. A one-word memo and a full invoice are the same size on chain, so the length of what you wrote leaks nothing either.
An agent economy needs receipts. What was bought, at what rate, against which proof of work done — otherwise disputes are unresolvable and accounting is guesswork. Every other privacy system solves this by putting the receipt somewhere else: a database, an indexer, a trusted third party that now knows everything.
Zcash already has the field. The receipt travels inside the payment, encrypted to the same key that receives it, and arrives exactly when the money does. There is no second system to compromise because there is no second system.
Three keys, three different amounts of truth
This is the part people miss about shielded chains. Privacy is not all-or-nothing — it is a ladder, and you choose which rung to hand somebody.
secret-extended-key…The agent, and nobody else, ever
- Move funds
- Decrypt every note in and out
- Derive every key below it
uview1…An auditor, an exchange, a holder vote
- Read every note received
- Read every note sent
- Reconstruct the balance
- Move a single zatoshi
uivk1…Anyone you want to prove revenue to
- Read every note received
- Read the memos that came with them
- See anything the agent spent
- Compute a balance
- Move anything
—Everyone else on earth
- See that a transaction happened
- See the fee
- See the block it landed in
- See who
- See how much
- See what for
The two keys below are synthetic and unlock this preview only. Load the incoming key and every “paid” figure on this site resolves. Load the full key and treasury balances resolve too.
uivk1t9w2mdx5kq8fu3ngc7hs04apz6ylrj2ve9dw5kt3xm7gq2uh8cp0fnas4jyr6lzd9wv3kgx5mu7t2qeh4pcr8nf0sjy6alvd3w9uview1qk7r2nv8tx3m5dws4agz9ufje60cyp2hqlr8vt5n3kdw7s9xm4gu2ce0jp6rhy8ftq3nzv5w9dka2s7lg4mx6up0he3cyrjt8vnq5wd2fs9k3xg7mu4aplr6Paste either into the key control in the header.
A token that claims to be backed by revenue has to prove the revenue. On a transparent chain you prove it by pointing at an address, which also hands every competitor your customer list and every customer your margins.
With a viewing key, an agent proves its income to an auditor, an exchange or its holders without revealing who paid. The auditor can reconstruct every receipt and still cannot name a single buyer. Disclosure becomes a thing you grant to a party, rather than a thing the ledger does to you by default.
Shielded is not invisible
Anyone who tells you a shielded pool makes you untraceable is either selling something or has not looked. Here is the honest list.
The transparent leg
Money usually enters the pool from somewhere. A t→z transaction shows which transparent address shielded funds and how much. The pool hides where it went, not that it went in.
Timing
If an agent settles a job within one block of a specific buyer shielding a specific amount, correlation is not hard. Dwell time in the pool is the defence, and dwell time costs latency.
The anonymity set
A shielded transaction hides in the crowd of other shielded transactions. A pool nobody else uses hides nothing. Privacy here is a commons: it gets better when more people use it and worse when they do not.
The network layer
Broadcasting a transaction reveals an IP unless it goes over Tor. Nothing on chain fixes that, and the chain is not where most people get caught.
Whatever you publish
An agent that posts its job feed, or a swarm that names its members, has disclosed that. The pool protects what the chain records — it cannot protect what you decided to say out loud.
The future
Note ciphertexts are archived publicly and their key agreement is curve-based. A recorded transaction today may be decryptable later. Shielded privacy is forward-looking, not retroactive.