How a private payment works

Alice starts with one private note worth 5 PCASH. Her wallet constructs a payment that gives Bob 3 PCASH, returns 1.99 PCASH as change, and offers 0.01 PCASH to the account that relays the batch. Those amounts never become public transaction fields.

The public result is deliberately less descriptive: the PCASH chain ID, four nullifiers that may never appear again, five new output-body commitments, five hashes of exact output-data bytes, a fee, a validity window, one recent PCASH block hash, and one CHONK proof.

A note hides value before it enters the output tree

A note begins as three private facts: an owner identity, an asset ID, and an amount. A fresh note secret hides the owner. The resulting owner commitment, asset ID, and amount form the note-body commitment.

The final indexed output commitment adds one more operand: the output index assigned by the node. That split is useful. Alice can prove the body before anyone knows where the output will land, while every node can later compute the same final leaf from the body and its canonical position. Ordinary note bodies and private credit checkpoint bodies share this append-only accumulator under distinct private relations.

Spending reveals a nullifier, not the old note

To spend, Alice proves that her note exists under the selected recent state and derives its nullifier from the exact note commitment, her nullifier-key hierarchy, and the note secret. Nodes check that the nullifier is nonzero, distinct inside the transaction, and absent from the global spent set. Success inserts it permanently.

An observer sees that one of the four published nullifiers represented real value, but cannot tell which one. The unused input positions publish dummy nullifiers derived from one fresh per-action seed. Real and dummy nullifiers receive the same consensus treatment.

Every private-value action has the same public silhouette

The transaction commitment binds one global slot, four input-slot digests, and five output-slot digests. Each slot digest includes its index and private class, so a dummy cannot be reinterpreted as value and moving an output changes the authorized action.

For this payment, one input is a real native note and three are dummy inputs. Two outputs are real native notes—Bob's payment and Alice's change—and three are canonical zero-value dummy outputs. The reference wallet gives every output same-size proof-bound data, so its framing does not reveal how many recipients existed.

The commitment deliberately excludes the selected state root. When a recent proof anchor expires, Alice can rebuild the proof against a fresher state without changing the action she authorized.

Authorization is folded in, not published beside it

Alice's selected account entry commits the exact Mega verification-key hash of an application. The application returns five private fields: its configuration commitment, the transaction commitment, the recent PCASH block hash, Alice's stable authorization account ID, and the PCASH chain ID.

The direct protocol kernel authenticates that entry, opens Alice's real notes and AccountState, checks both note and nullifier construction, and enforces native conservation:

native inputs = native outputs + public fee

CHONK links the application, protocol kernel, family finalizer, and wire circuit into one compressed proof. Nodes verify only the fixed wire key and cannot classify which application authorized the spend.

Ethereum carries bytes; PCASH determines effects

Alice's exact transaction is 33,057 bytes. Alone in a batch, the candidate batch is 33,064 bytes. A relayer may place those bytes directly in calldata or encode them canonically into EIP-4844 blobs. Carrier choice changes the Ethereum fee, not the PCASH transaction.

Wire proof

23,840 bytes

One transaction

33,057 bytes

One-transaction batch

33,064 bytes

Output data

5 × 1,750 bytes

At its exact Ethereum position, every node first confirms that the bytes decode completely as a private-value transaction naming this network. Then it reconstructs the twenty verifier inputs and runs one fixed sequence of checks: each output-data item within its size bound, canonical public inputs, a recent block hash that is canonical and within the one-hour window, the validity window, nullifiers that are nonzero, distinct, and unspent, output capacity, nonzero output commitments, and the proof last. The first failing check becomes the transaction's committed outcome and nothing changes. Only when every check passes does the node insert nullifiers, record the fee, and append five final output commitments atomically.

Bob learns the meaning; the network does not

Bob scans the output data of successful transactions and tries to decrypt each envelope with his ML-KEM secret key. A successful authentication tag gives him the owner identity, note secret, asset ID, and amount required to reconstruct his note. Alice handles change the same way, and can additionally recover her own output secrets from her keys and the four public nullifiers.

The public fee is the intentional exception: nodes need its amount and recipient to update credit. Everything else that makes this a payment—Alice, Bob, 3 PCASH, 1.99 PCASH change, which input was real, which outputs were real, and which authorization application ran—remains private.