*The road is public; the journey is yours.*
There's a sentence at the heart of this work that sounds like a contradiction:
The ledger must hold what it can *verify* but cannot *read.*
Sit with that for a second, because the whole thing lives in the tension between those two verbs. We want a shared public record that every stranger can trust — and that no stranger can snoop. A ledger that is, at once, auditable and blind.
This is the story of why we wanted that, why it's harder than it sounds, and how — over a long arc of work we call ADR 0014 — we got it running on a real blockchain, with the final proof generated *in a browser, on a device, from a fingerprint.* No amounts revealed. No trusted operator. Just math the network can check.
The problem nobody warns you about
The pitch for public blockchains is *transparency*. Anyone can audit the chain; no central party can cook the books. That's the feature.
It's also the bug.
On a transparent ledger, everyone sees everything — every amount, every sender, every recipient, forever. Imagine your bank statement was a billboard. Now imagine it was a *permanent* billboard that also showed who you paid and who paid you, so anyone could draw the graph of your whole financial life.
We ran into this building a small thing: lending. A creator pawns a piece of their work for a loan. Fine. But on a public chain, even if you *encrypt the loan's terms*, the money still moves — and the money trail betrays the secret. If income that used to land in Kenji's pocket suddenly lands somewhere else, any observer can infer he's encumbered, who his lender is, and roughly for how much. Hiding the contract isn't enough; the cashflow leaks the truth.
And once you see it in lending, you see it everywhere — every purchase, every royalty split, every paid subscription is public today. The leak wasn't a lending bug. It was the substrate.
The two things we refuse to give up
We had two non-negotiables, and on a public ledger they collide head-on.
- No trusted operator. Property should live on consensus — the network agrees on what's valid — *precisely so that no company (not even us) can seize it, forge it, or censor it.* The guarantee has to be "they *cannot*," not "they *promise not to.*"
- No property without privacy. A right you can't keep private isn't really yours; visibility is a vector for coercion, targeting, discrimination. Property facts must be hidden.
Put those together and you get the paradox. Consensus *wants to read* everything (that's how it checks validity). Privacy *forbids reading* anything. The only point in the entire design space that satisfies both is the strange one we opened with: the ledger holds something it can verify without reading.
So that's the target. The rest is figuring out how a network can check a sum it isn't allowed to see.
The magic trick: proving without showing
The key idea is a piece of cryptography that genuinely feels like a magic trick the first time it clicks: the zero-knowledge proof.
A zero-knowledge proof lets you convince someone a statement is true *without revealing anything beyond the fact that it's true.*
A homely analogy. Suppose you want to prove you know the secret password to a door, but you refuse to say the password. You step through the door and come back out the other side. The watcher learns *that you knew it* — and learns *nothing about what it is.* Zero-knowledge proofs do that for arbitrary mathematical statements. You can prove "I own enough to cover this" or "this transaction balances" while revealing none of the numbers.
That's the load-bearing primitive. Around it, three more ideas do the work:
- Commitments — a sealed, tamper-evident envelope. You put an amount inside and publish the *sealed envelope*, not the amount. Nobody can read it; nobody can change it after the fact; and later you can prove things about what's inside *without opening it.*
- The shielded pool — picture a big box full of these sealed envelopes ("notes"). To spend, you prove "I own *one* of the valid notes in this box, and here's a valid way to split it," without revealing which one. The crowd is your privacy: an observer sees a note left the box and two new ones entered, but can't link them to you or to each other.
- Nullifiers — a one-time stamp. The danger with hidden money is double-spending — spending the same secret note twice. Each note, when spent, emits a unique "nullifier": a stamp that proves *this note is now used* without revealing *which* note it was. The chain keeps a list of stamps it's seen. Try to spend twice, and the second stamp collides. Double-spend: mathematically impossible. Identity of the spender: still hidden.
Hide the amount (commitments). Hide *which* coin (the pool). Prevent cheating without unmasking (nullifiers). Prove the whole thing is legal without showing the inputs (zero-knowledge). That's confidential value.
The engineering bet: *where* does the check happen?
Here's the decision that made this real rather than a demo, and it's worth understanding even if you skip everything else.
A zero-knowledge proof is only as strong as *who checks it.* If a friendly server verifies the proof and then tells the chain "trust me, it's valid," you've reintroduced exactly the trusted operator we swore off. The check has to happen inside consensus itself — the validators, collectively, must verify the math, so the guarantee inherits the full strength of the network.
The problem: smart-contract sandboxes are deliberately slow and metered (they charge for every computation, to keep the network safe), and heavy cryptography there is painful and expensive. So we did something more fundamental. We taught the chain's core engine a new native verb — essentially a new built-in instruction: *"verify this zero-knowledge proof, in fast native code, as part of agreeing on the next block."* A smart contract can now hand the network a proof and get back a trustworthy yes/no, checked by everyone, off the slow meter.
The slogan we kept coming back to: the validators mathematically cannot see your amounts — and mathematically cannot accept an invalid one. Not "won't." *Cannot.* That's the whole game.
(We did the same for the chain's internal bookkeeping hash, so the structure that tracks all those sealed notes is also maintained natively, with nothing trusted between the proof and the ledger.)
The trust nobody talks about — and how we removed it
There's an uncomfortable footnote in this kind of cryptography: the trusted setup. The proving system needs some one-time secret parameters to be generated, and whoever generates them holds, briefly, a piece of "toxic waste" — knowledge that, if kept, would let them forge proofs no one could detect. Many systems quietly skip past this. We didn't want to.
So we ran a ceremony: the setup is performed in pieces by multiple independent participants, and the toxic waste is unrecoverable *unless every single one of them colluded.* One honest participant is enough to make forgery impossible forever. It's the cryptographic version of requiring every key-holder in the building to turn their key at once — and it means the "cannot forge" guarantee doesn't rest on trusting us.
So what are we actually trying to *prove?*
Strip away the machinery and the thesis is simple, and a little subversive:
Public consensus and privacy were never opposites. You can have a ledger that is simultaneously trustless and blind — and you can run it on a real smart-contract chain, today.
For years the trade-off was treated as a law of nature: you could have the auditability of a public chain *or* the privacy of a closed system, pick one. We're arguing — and now *demonstrating* — that the trade-off was an artifact of immature tooling, not a fundamental truth. A network can agree that a transaction is valid while none of its members, even working together, can tell you what it was for or who it touched.
And the second, quieter claim: privacy belongs in the substrate, not bolted onto each app. A private messenger built on a transparent money rail still leaks through the money. If privacy is the ground of property, it has to live *under* everything — in the value layer itself — so every transfer inherits it for free.
The honest part: privacy is a dial, not a switch
This deserves to be said plainly, because anyone promising *perfect* privacy is selling you something.
Perfect privacy is impossible for the same deep reason a perpetual-motion machine is impossible. Information is physical; anything that *happens* in a shared world leaves a trace — a timing, a footprint, the heat of the act itself. A system that leaked *strictly nothing* would have to not exist.
So privacy is not a state you achieve. It's a quantity you drive down toward a floor you can't cross. Zero-knowledge proofs hide the *contents* of a transaction, not the *fact that one happened.* Shielding hides amounts and recipients, not the timing or the rough shape of the activity graph. You can pile on more — batching, decoys, padding — and push the floor lower, at the cost of speed and bandwidth, but never to zero.
The maturity, then, isn't claiming "cannot." It's naming both halves: the strong guarantee *and* its irreducible residual. *Cannot see your amounts — but can see that some activity happened, and when.* Honest privacy is a *characterized leak*, published openly, never a promise of perfection. We hold ourselves to stating the residual every time we state the guarantee.
The receipts: what's actually running
The arc above wasn't a whiteboard exercise. We built it in stages, each one proven on a live chain before moving on:
- The cryptography works — a confidential-transfer proof verifies in under a millisecond.
- The chain can check it, on consensus — the native "verify this proof" verb, exercised by a real contract during real block production. A valid proof passes; a one-character-tampered copy fails closed.
- The shielded pool — deposit value behind a sealed commitment, transfer it privately (a note spent, two created, no amounts on chain), withdraw it back out — with double-spends blocked by nullifiers.
- The trust removed — the multi-party setup ceremony, so no one holds the forging key.
- Hardened to production shape — owner-bound notes (only you can spend yours), the note-tree maintained natively on chain, real value escrowed and paid out, encrypted note-discovery so a recipient can find what's theirs.
- And finally, the part that still makes me grin: a deposit where the zero-knowledge proof was generated in a web browser, on the user's own device, from a key derived from their passkey — their fingerprint, essentially — and submitted to a live chain that verified it on consensus and escrowed the value with the amount hidden. The secret keys never left the device. The network never saw the number. And it *worked.*
A proof, born on a phone-shaped sliver of glass from a fingerprint, that a whole network can check but no member can read.
That's the thing we were trying to prove. It's running.
*This is the lay-reader companion to ADR 0014, "Confidential value: cryptographic privacy is the endpoint of property-on-consensus." The engineering decision records, the threat model, and the honest leak inventory live alongside it for anyone who wants the full depth.*