Using the pool costs what Solana charges, plus one small, permanent account per note you spend. The program as it stands takes no fee of its own; the protocol fee that arrives with $ZKSVM is described below.
What each operation costs
| Operation | Network fee | Rent | Compute units | Proof |
|---|---|---|---|---|
| Shield | yes | — | ~32,000 | none |
| Shield, earning | yes | — | ~66,000 | none |
| Send | yes | ~0.00095 SOL per note spent (1 or 2) | ~172,000 | ~16 MB key |
| Claim | yes | ~0.00095 SOL | ~167,000 | ~8.7 MB key |
| Take back | yes | ~0.00095 SOL | ~162,000 | ~8.9 MB key |
| Unshield | yes | ~0.00095 SOL | ~150,000 | ~8.3 MB key |
| Unshield, earning → SOL | yes | ~0.00095 SOL, plus Jito's 0.1% withdrawal fee | ~183,000 | same key |
| Unshield, as jitoSOL | yes | ~0.00095 SOL, plus ~0.002 SOL once if the recipient has no jitoSOL account | ~153,000 | same key |
| Prove a balance | yes | ~0.00095 SOL | ~143,000 | ~8.5 MB key |
| Receipt | — | — | — | ~0.6 MB key, off-chain |
The compute figures are measured: a test loads the compiled program into an SVM and replays real proofs through the real syscalls. They move by a few thousand units from run to run. Every operation fits well inside the 1.4 million units a transaction may use; the app asks for 250,000.
Why spending costs rent
A spent note is recorded as a tiny account whose address is derived from the note's nullifier. That the account exists is what makes the note unspendable a second time — Solana refuses to create the same account twice.
The account is 8 bytes and costs about 0.00095 SOL in rent-exempt balance, paid by whoever submits the transaction. It is never closed: closing it would make the note spendable again.
Two practical consequences:
- Notes worth less than the rent are not worth spending alone. Let them ride as the second input of a payment you are making anyway.
- A send that uses one note is cheaper than one that uses two. The app prefers a single note when one is large enough.
Proving keys
Building a proof needs the circuit's proving key. The app downloads each one the first time you use that operation, and your browser caches it. Proving itself takes a few seconds and a few hundred megabytes of memory.
Relayers
Every Solana transaction names its fee payer in public. A user who submits their own private transfer has attached their wallet to it.
The protocol has the fix built in. transfer, claim, redeem and reclaim
carry a fee inside the proof: an amount paid out of the spent notes to
whoever submits the transaction. A relayer can carry a transfer for a user who
holds no public SOL at all, and be made whole for the network fee and rent.
The fee is not bound to a particular relayer — anyone may submit the
instruction and collect — which costs the user nothing, since the transfer is
identical either way.
The app currently submits from your connected wallet with a fee of zero.
The protocol fee and $ZKSVM
With the $ZKSVM token the protocol takes a fee on earning balances — value it has staked on a user's behalf — and never on a private transfer inside the pool. Part of that fee buys $ZKSVM back on the open market, and what is bought is burned. Staking $ZKSVM earns a higher rate than the pool's base yield.
The schedule — the fee, and the share of it that goes to buybacks — is published with the token, before launch.
Transaction size
Solana caps a transaction at 1,232 bytes. A transfer — a 256-byte proof, five field elements and two encrypted notes — serializes to about 1,170. That is why a transfer has exactly two outputs, and why notes carry no memo field.
Exact layouts: Protocol.