How it works
Seven ideas, and you have the whole mechanism.
PCASH is private money whose state is derived from Ethereum history. Read these in order and you will know how a payment stays private, why no operator can change the rules, and exactly what the network can still see.
01
Value lives in notes, and the ledger stores only a fingerprint
Owner commitmentowner ID + note secret
Note-body commitmentowner commitment + asset ID + amount
Indexed output commitmentoutput body + assigned output index
A note is a discrete piece of private value: an owner, an asset identity, and an amount. None of those three facts is ever published. What the ledger records is a commitment — a hash that binds all of them without revealing any.
The commitment is built in layers. A fresh note secret hides the owner. The owner commitment, asset identity, and amount form the note body. Only once a node has decided where the note lands does the leaf index get folded in to produce the final commitment. That split matters: the sender can prove the body before anyone knows the note's position.
02
Spending publishes a nullifier, not the note it consumes
BeforeNote output 7 existsSpent set does not contain its nullifier
AfterThe output commitment remainsIts unlinkable nullifier is now permanent
To spend, the owner proves the note exists under a recent state and derives its nullifier from the note commitment, their nullifier key, and the note secret. Nodes check that the nullifier has never appeared before and record it permanently.
Nothing connects the nullifier back to the commitment it retired. An observer learns that some note was spent, never which one — so a payment cannot be traced to the value that funded it.
03
Every action has the same public silhouette
- one real nullifier
- dummy
- dummy
- dummy
- Bob
- change
- dummy
- dummy
- dummy
Public four nullifiers · five bodies · five data hashes · fee · timing
A transfer does not publish how many notes it consumed or created. Every private-value transaction occupies the same fixed shape — four inputs, five outputs — with unused positions filled by dummies that receive identical treatment from every node.
What reaches Ethereum is four nullifiers, five output bodies, five hashes of the output data, a fee, a validity window, one recent PCASH block hash, and one proof. A payment of 3 PCASH and a payment of any other amount are indistinguishable on the wire.
04
One folded proof checks the rules and your authorization
- Private applicationDid Alice approve this exact action?Key hash authenticated by her account entry
- Protocol kernelDo the notes, nullifiers, outputs, and values balance?Fixed ledger rules
- Family finalizerIs this an accepted type-0 protocol path?Exact kernel Mega key
- Wire circuitDo the twenty public fields equal the folded result?One protocol-pinned verifier key
The proof checks unspent inputs, value conservation, and authorization for each account contribution. An installed rule approves the exact action: an ECDSA signature, a passkey, a multisig threshold, or another private application.
Both fold into a single proof verified against one verifier key fixed by the protocol. Observers learn that some committed rule was satisfied. They do not learn which account acted, which rule it used, or what satisfied it.
05
Ethereum orders the bytes; every node derives the same state
PCASH has no sequencer and no consensus of its own. Anyone can collect transactions into a batch and post it to the inbox address in an ordinary Ethereum transaction. Batches are processed in the order Ethereum published them, and where two transactions conflict the first valid one wins.
Because state is a deterministic function of Ethereum history, every node computes the same result, and there is no administrator, upgrade key, or privileged poster who could compute a different one. When Ethereum reorganizes, nodes restore and replay rather than negotiate.
06
The money comes from burning Ethereum base fees
- Ethereum blockMeasure elapsed timeThe header gap selects this block's reward.
- TransactionsCount base-fee burnGas used × base fee, grouped by top-level sender.
- AllocationSplit the exact rewardEach sender receives the same fraction as its fraction of burn.
- PCASH stateIncrease address creditOne public lifetime total per credited address. No note is created yet.
New PCASH is issued to Ethereum users in proportion to the EIP-1559 base fees they burn. There is no premine, no sale — the distribution is earned by using Ethereum. The rate starts at 12 PCASH for every 12 seconds of Ethereum time, halves every 10,500,000 seconds, and can never exceed 21,000,000 PCASH.
Issuance first accrues as credit bound to an Ethereum address. That lifetime gross accrual is publicly derivable, but it is not a balance: spending it does not visibly reduce it. A payment may use notes, accrued value, or both without revealing that composition. Every recipient receives an ordinary private note.
07
What stays private, and where it does not
- one recent block hash
- four nullifiers
- five bodies and data hashes
- fee and timing
- one proof
- Alice and Bob
- amount and change
- real slot positions
- note and account openings
- authorization choice
Payment participants, amounts, balances, asset identities, and authorization stay private. The funding composition stays private too. Blocks, transaction outcomes, fees, and timing remain public.
Applications may publish facts needed for their own terms, such as an Ethereum payment in a Marketplace exchange. Those facts are shown where you review the action.
Go deeper
Each of these takes one mechanism further, with the source that enforces it.
- How a private payment worksFollow one PCASH payment from the sender's note to the recipient's wallet without reading the protocol source first.
- Where PCASH comes fromSee how Ethereum time and base-fee burn produce PCASH credit, with one exact allocation example.
- How credit becomes privateFollow public lifetime credit through a private-value proof into ordinary outputs and a recoverable debit checkpoint.
- How standard private assets workSee how one hidden asset identity is issued once, then privately transferred, conserved, sponsored, or burned.
- Accounts and authorizationSee how private value, authenticated accounts, exact application keys, and bounded revocation form a PCASH account.
- Private applications and contractsUnderstand private application circuits, immutable contract accounts, note-held state, and Ethereum event grounding.
- Derivation and reorgsSee how canonical Ethereum order deterministically produces PCASH state and how nodes restore and replay a reorg.
- State and proofsSee how one recent block hash opens only the logical roots and request-local witnesses a private proof needs.