Skip to content
VOUCHVOUCHDocs
Website

Trust and security

Asked before you ask

The questions a lender, a regulator, a judge or a Zcash developer asks in the first five minutes.

On this page

#Is this a mixer?

The opposite. A mixer hides; Vouch makes one fact visible again, to one named party, with an expiry. Nothing is moved and nothing is hidden that was not already hidden.

#Is this a bridge?

No. Nothing is bridged: the ZEC never leaves Zcash. Only a proof moves, and on Solana only a signed verdict about it.

#Does it get shielded funds through an exchange or a swap?

It gives the rail evidence, not a pass. An exit certificate shows the coins were already in the chain at a block the rail picks (say, before an incident) and have not moved since, and names them, so the deposit can be matched to exactly them. Whether that releases a held deposit is the rail’s policy. See Exit certificates.

#Does it prove the coins are clean?

No, and it never says so. It proves when the coins last moved, not where they were before. Tracing shielded funds is impossible by design; that is what the shielded pool is for. Coins stolen long before the block a rail picks, and left untouched, would pass, which is why the block is the rail’s choice.

#What stops them spending right after proving?

Nothing, and the proof says so: it is “as of” one block. A lender asks for a fresh proof at each check, can require a recent spent set, and, by naming a period in its request, sees the same coins pledged twice to it. An exit certificate is different: it names the coins, and the rail matches them against the deposit itself.

#Why not just use a viewing key?

A viewing key shows every payment ever received, forever, and cannot be revoked or scoped. A proof shows one fact, to one party, until one date, and can be revoked.

#What if my ZEC is in many small notes?

One proof covers up to five notes. Prove a batch instead (reserves): several proofs, one total, no note counted twice. Or send yourself the amount first so it sits in fewer notes; but a self-transfer makes new notes, so it restarts any “unmoved since” clock.

#Why Ironwood and not Orchard?

Ironwood replaced Orchard in July 2026 after the Orchard counterfeiting flaw, and holders are migrating. Anything built against Orchard alone is built against a closing door.

#What did you build versus reuse?

See What we built on. The circuit is Valar Group’s with two Vouch additions (the threshold, and the optional revealed nullifiers of exit certificates); everything around it is ours.

#Is it post-quantum?

No. Like Zcash’s shielded pools today, the proofs rest on elliptic-curve assumptions (the Pasta curves and RedPallas), and the attestations on Ed25519.

#Can I verify without trusting your website?

Yes. Download pof-verify from the releases (or build it), re-derive the anchors with pof-anchor from any lightwalletd, and check the file on your own machine. The site is a convenience: it runs the same verifier in your browser and never receives the proof.

#Does the verifier learn my balance?

No. It learns that the proven notes hold at least the threshold. The sum is committed inside the proof and never revealed, and unused slots are filled, so even the number of notes is hidden.

#Can two verifiers compare notes?

They can compare the claims they received, but not link the coins: tags are derived per scope, so the same notes give unrelated tags to different verifiers. An exit certificate is the exception by design: it reveals the notes’ nullifiers to the rail, which can then see them spent.

#Has it been audited?

No. Neither circuit change, the programs nor the attestor has been audited or formally verified. It is a hackathon build, testnet only, and says so everywhere.