How the vault holds nothing.

Zk Ledger is a fixed denomination shielded vault. A deposit inserts a commitment into an append-only tree and transfers SOL to a program derived address. A withdrawal submits a zero knowledge proof that the caller knows a note whose commitment is in the tree, and that the note's spend marker has not been recorded before. The program never learns which leaf was spent.

One vault account exists per denomination. Every account below is a PDA derived from the program id, so no keypair controls any of them.

The note is drawn in your browser and never leaves it. Only the commitment is published.

secret   = random_32_bytes()      // proves ownership
marker   = random_32_bytes()      // becomes the spend marker
commit   = poseidon(secret, marker)

note     = "zkledger:v1:" + denom + ":" + base58(secret || marker)
// deposit publishes commit only
// withdraw reveals marker, never secret

A note string is the entire claim on a deposit. There is no server copy, so a lost note means permanently sealed funds.

Commitments are appended to a height-20 incremental Merkle tree. The program keeps the last 64 roots so a proof built against a slightly stale root still verifies, which matters because deposits keep arriving while you assemble a withdrawal.

insert(commit):
  require(next_index < 2^20)
  path = filled_subtrees(next_index)
  root = hash_up(commit, path)
  roots.push_ring(root)          // 64-slot ring buffer
  next_index += 1
  emit Deposited { commit, next_index - 1, slot }

Public inputs are the root, the spend marker, the recipient, the relayer and the relayer fee. Private inputs are the secret and the Merkle path. Binding the recipient and fee into the proof is what stops a relayer from redirecting funds or inflating its own cut.

Requirements written so they can be checked against the code. Not deployed, not audited.

Every Solana transaction records a fee payer in the clear. If you pay it, that wallet is the link you came here to remove. Relayers submit proofs on behalf of withdrawers and are compensated inside the withdrawal itself.

POST /relay
{
  "denom": "1",
  "proof": "<256 bytes base64>",
  "root": "0x…",
  "marker": "0x…",
  "recipient": "9fQ…T4a",
  "relayer_fee": "0.0035"
}
-> 200 { "signature": "…", "slot": 318294112 }
-> 409 { "error": "marker_spent" }
-> 422 { "error": "stale_root" }

Example figures. Caps are enforced in-circuit, so a relayer cannot take more than the row above.

$ZKLEDGER gates the vault pages today, and its creator fees pay the rent Solana charges to store the program. It carries no claim on anything inside the vault: deposits are claimed by notes only, and the program has no concept of a token balance.

The honest limit: a vault is weakest the day it opens, and an exit taken minutes after a deposit narrows the crowd to whoever else moved in those minutes. Privacy here is arithmetic, and arithmetic needs company.