The signature is already checked
Verifying an account’s signature inside a circuit costs millions of constraints. Solana’s runtime has done it before the program runs. The proof ties the note to an address; the address signing is the consent.
Profitable
Privacy.
A shielded pool on Solana where your balance earns while it hides. Staked as jitoSOL, proven on L1.
I
The pool, drawn
Value is held as notes in a Merkle tree, staked while it waits, and spent with zero-knowledge proofs. White is what the chain records. Green is what it cannot see.
II
Four operations
Privacy lives in the link between going in and coming out, not at the endpoints. Each route shows exactly where the record stops.
Shield
Lamports go in; a note comes out. No proof needed — the program builds the commitment from the amount it is debiting.
- On the record
- Depositor, amount
- Hidden
- Who owns the note
- Measured
- 32k CU
Transfer
Two notes spent, two created. A 2-in / 2-out join-split under one Groth16 proof.
- On the record
- The fee, and who submitted
- Hidden
- Sender, recipient, amount
- Measured
- 172k CU
Claim
A note owned by a Solana address, spent by that address signing. No spending key exists.
- On the record
- The address that spent
- Hidden
- Which note, how much, to whom
- Measured
- 167k CU
Unshield
One note spent, lamports out to a recipient that is bound into the proof.
- On the record
- Recipient, amount
- Hidden
- Which note it came from
- Measured
- 150k CU
III
Notes that belong to addresses
Other pools mint their own keys and live apart from the chain’s accounts. Here a note can belong to any Solana address, and spending it takes nothing but that address’s signature.
6a3f 09c1 e27b 44d8 90aa 17f3 5c0e b812d4e9 7a20 3b6c f115 08de 92c7 41ab 5be2
first 16 byteslast 16 bytes
owner = Poseidon(hi, lo)
commitment = Poseidon(asset, amount, Poseidon(owner, blinding))
Anyone can be paid
The sender needs an address and nothing else. Sender and amount stay hidden, and the value arrives still shielded — unlike a withdrawal, which prints the amount on the public record.
Programs can hold notes
A PDA signs through its program’s invoke_signed. A treasury, an escrow, a payroll can own shielded value and pay out of it: everyone sees that it paid, nobody sees whom or how much.
A claim shows that an address claimed — never what, how much, or from whom. How privacy works.
IV
Three things a pool does not usually do
A payment that returns if nobody collects it. A proof of funds that is true today. A receipt for a payment nobody can see. Each is one more way to use a note — the pool underneath did not change.
Payments that come back
Pay any address. If nobody collects by the date you chose, take it back. The note is owned by a condition — this address, or its sender later — and both ways out spend the same nullifier, so only one can land.
- On the record
- A date, rounded to the day — and only if it returns
- Hidden
- Sender, recipient, amount
Proof of funds that means now
Show that you hold at least an amount, and nothing else. The note is spent and recreated in one transaction, so the statement is about this moment — not about something you held last year.
- On the record
- A floor, a purpose, a pseudonym
- Hidden
- The note, the balance, the owner
Receipts without opening the note
Show one person that you paid a recipient at least so much, for a stated purpose. Verified in their browser, against the pool. Nothing goes on-chain, and nothing in it lets them follow the note.
- On the record
- Nothing. It never touches the chain
- Hidden
- The exact amount, the payer, the rest of your history
V
Measured, not promised
The compiled program, real proofs, real syscalls. These are outputs of the test suite, not targets.
- 172,150compute units
- for a private transfer, proof verification included. A transaction may use 1.4 million.
- 1,168bytes
- for that transfer on the wire, with both encrypted notes. The limit is 1,232.
- 226notes
- in a tree whose account is allocated once and never grows.
- 0admin keys
- No pause, no allowlist, no configuration. Initialize takes no parameters.
A disc in eclipse, and the note it hides.
One program on Solana L1. Shield, send, prove what you hold — and get a payment back if nobody claims it. Read how it works, or open the app and try it.