PCASH state is a small set of logical commitments. A proof names one recent block hash, privately opens only the roots and leaves it needs, and exposes a fixed public result without publishing those openings.
For youRead this when you want to understand roots, authenticated RPC data, or what belongs in a proving witness.
Before you startIt helps to know that Ethereum deterministically produces the PCASH block sequence.
This is the consensus model, not a database diagram. A conforming node may organize bytes however it likes as long as it derives these same typed commitments and the same block hash from canonical Ethereum history.
StateRoot is a depth-4 typed Poseidon tree. Separate keys commit the output, credit, and account state roots and their append counts; the 256-bit nullifier root occupies two lossless field limbs. Counts are explicit because a Merkle root authenticates contents but does not reveal the next free append position. The output tree contains indexed ordinary-note and private checkpoint commitments.
View the source behind this explanationnode/crates/state/src/inner.rs:61
The header is a directory of authenticated openings
The block header is another depth-4 typed tree. Its keys bind parent, number, timestamp, the transaction-results root, StateRoot, Ethereum history, PCASH history, and extra data. The transaction-results root commits every admitted transaction's L1 coordinates, exact-bytes hash, and outcome, so a failed transaction is part of the block hash even though it changed no state. A circuit can open one key without receiving every sibling fact as an input.
The two history roots sit beside StateRoot, not inside it. Ethereum history lets applications authenticate canonical L1 blocks and normalized logs. PCASH history lets a circuit authenticate an earlier PCASH block hash. Both are append-only accumulators tied to the current header.
- Header shape
- Depth 4, typed
- State shape
- Depth 4, typed
- State components
- Outputs · credit · account state · nullifiers
- Public component roots in a spend
- 0
One public hash opens the private state a proof needs
A circuit opens only what it uses. The component roots do not become separate public inputs.
A private-value proof publishes one recent PCASH block hash. Privately, it supplies the StateRoot value at header key 5 and the four siblings that recompute the block hash from it; the other header facts are never inputs. It then opens only the state components its relation uses—for a note-only direct spend, normally the output and account state roots; a credit-capable direct spend additionally opens the credit root.
This two-step opening matters for privacy, though not by hiding the snapshot: the published block hash already names it, and its component roots are publicly reconstructible from that block. What stays private is which components the action opened. A credit-bearing spend opens the credit root and a note-only spend does not, so publishing the set of opened roots would signal the funding path. One public anchor also keeps the proof interface uniform, and an application that privately selects an older fact through the history tree hides that selection as well.
The typed domains and fixed key positions prevent one valid path from being reinterpreted as a different kind of opening. The circuit also reconstructs complete leaves, rather than accepting unauthenticated partial fields from a proof-serving node.
View the source behind this explanationcircuits/stacks/private_value/direct_kernel/src/main.nr:214
Durable commitments and request-local witnesses are different things
- Block deltas
- Commitment roots
- Nullifiers
- Account rows
- Note preimages
- Merkle paths
- Selected rule + Mega VK
- Application and kernel witnesses
The durable chain contains commitments and public effects: block deltas, roots, nullifiers, account state rows, counts, and history accumulators. It does not contain note preimages, ownership secrets, selected policy openings, private application configurations, or the ordered CHONK witness maps used to produce a proof.
A wallet asks for proof-bearing state and history reads, verifies their envelopes, and combines them with its own durable secrets. The complete witness exists for that proving request. The application runs, the protocol kernel consumes its private statement, and the final wire circuit releases only the fixed public transaction fields.
View the source behind this explanationcircuits/stacks/private_value/wire/src/main.nr:4
Storage layout is an implementation choice
The reference node keeps canonical state, a rebuildable derived index, and local services in separate stores. Those choices matter for operation and recovery, but they are not the meaning of StateRoot. Table names, packed keys, savepoints, secondary indexes, and wallet databases belong in reference documentation.
For protocol reasoning, ask two questions instead: what logical fact is committed, and what authenticated path lets this circuit use it? That separation keeps a redb row from being mistaken for consensus state, and keeps a private Merkle path from being mistaken for something the network publishes.