Private UTXOs in one Merkle tree. Zero-knowledge spends. Lightning in and out.
01 — NOTES
A UTXO nobody can see
Value lives in notes. The chain never sees the note — only its hash, the commitment:
Like a UTXO — but the amount and the owner are inside the hash. ψ makes two identical notes hash differently.
02 — THE TREE
The chain stores one number
Every commitment is a leaf in one sparse Merkle tree, 160 levels deep. Consensus only carries the root:
Your wallet keeps the note + its Merkle path. Prove membership with 160 sibling hashes — no scanning, no addresses.
03 — THE NULLIFIER
Spending deletes the leaf
No nullifier list à la Zcash — the tree is the nullifier set. A spend proves the old root contained the note and the new root doesn't:
Tap it. The leaf dies, the root changes — double-spend impossible.
04 — NO INFLATION
Nobody prints sats in the dark
Every spend is 2-in-2-out and the circuit enforces Σ in = Σ out — proven, not audited:
Inputs die, outputs are fresh leaves — no link between them. Supply provably conserved.
05 — ON-CHAIN FOOTPRINT
A block = one proof
Spends fold into each other recursively. The contract checks one thing: old root → new root, proof valid:
That root transition is the entire on-chain footprint of every private payment inside it.
06 — LIGHTNING
⚡ Atomic in, atomic out
You already know the trick: an invoice settles only by revealing its preimage s. The swap escrow is locked to the same s — it's one more HTLC, living on-chain:
Both legs or neither — nobody custodies your sats. Withdraw is the mirror: your invoice, your preimage, their escrow. A substitutor fronts funds for speed; it can't redirect them.
Edges public. Middle invisible.
Mints and burns show amount + timing — everything between them is one hash.