Core concepts

#Notes and the Ironwood pool

Shielded ZEC is held as notes: encrypted records of a value addressed to a key. A wallet’s balance is the sum of its unspent notes. Since July 2026 the active shielded pool is Ironwood, which replaced Orchard after the Orchard counterfeiting flaw; Ironwood activated at mainnet block 3,428,143 and testnet block 4,134,000. Vouch proves facts about Ironwood notes.

The chain never shows a note. It shows two things about each one: a note commitment (cmx) when the note is created, and a nullifier when it is spent.

#The note-commitment tree and the spent set

Every note commitment ever created is a leaf of an append-only Merkle tree; its root at a height is nc_root. Every nullifier ever revealed is in the spent set, which Vouch arranges as an indexed Merkle tree (IMT) of sorted ranges; its root is nf_root.

A proof shows, for each of up to five notes, a Merkle path to nc_root (the note exists) and an IMT range that excludes its nullifier (the note is unspent), without revealing the note, the path or the nullifier.

#Anchors

An anchor is a finalised height and the two roots at it. A verifier accepts a proof only if both of its roots appear in the verifier’s anchor table. Vouch’s pof-anchor rebuilds the roots from public compact blocks and checks the tree root against lightwalletd’s own; anyone can re-derive every entry. See Anchors and chain data.

#The claim and its units

Each proof carries exactly one claim. Today that is HoldsAtLeast { zatoshi }: the notes together hold at least that much. The circuit counts value in units of 0.125 ZEC (12,500,000 zatoshi), so thresholds are whole multiples of 0.125 ZEC. The sum itself is committed inside the proof and never revealed. “Exactly X” is deliberately not offered: a threshold reveals less.

#The fields that make a proof single-purpose

#Scopes and tags

Each note in a proof produces a tag (the circuit calls it a governance nullifier). In format version 2 tags are derived from the scope: the circuit, the audience and the epoch. The same note always gives the same tag in one scope, and unrelated tags in different scopes.

So a verifier that records tags sees when the same coins are pledged to it twice in a period (AlreadyUsed), and two verifiers can never link their proofs to each other. A proof made without an epoch gets a fresh scope of its own and links to nothing.

#Unmoved since block H

Because the two roots are separate inputs, a proof can take the tree at an earlier block H₀ and the spent set at a later block H₁. It then says the notes were already in the chain at H₀ and have not moved since. The verifier chooses H₀ in its policy, for example a block before a known incident. See How it works.

#Exit certificates

An exit certificate is a proof made with the second circuit, which also reveals the certified notes’ real nullifiers. When the deposit lands, the rail reads the nullifiers the deposit transaction reveals and checks they are all certified. See Exit certificates.

#Attestations, receipts and feeds

#Demo, testnet and mainnet