Documentation

Introduction

Mertcash ($MCASH) is a token on Solana with a shielded pool forked from Zcash. Inside the pool, a transfer hides the sender, the recipient and the amount. You use this site to shield, send privately and unshield.

How the fork works

A Zcash-style shielded pool needs two pieces of shared state: a Merkle tree of note commitments, and a set of nullifiers for notes that have been spent. On Zcash those live in the consensus rules. On Solana, the Mertcash program keeps them in program accounts.

Your wallet does the heavy work. It picks the notes to spend, builds new notes for the recipient and your change, and creates a zero-knowledge proof that the transfer is valid. The program checks the proof, records the nullifiers and appends the new commitments. It never learns the amounts or the owners.

wallet:  notes in  ->  proof + nullifiers + new commitments + encrypted notes
program: verify(proof)
         require(nullifiers not seen)
         nullifier_set.insert(nullifiers)
         tree.append(new commitments)

Notes, commitments and nullifiers

A note is a private record of value: an amount and an owner, encrypted so only the owner can read it.

A commitment is a fingerprint of a note. It goes into the tree when the note is created and reveals nothing about what is inside.

A nullifier is published when a note is spent. Only the note's owner can compute it, and it can't be linked back to the commitment. Because the program refuses a nullifier it has already seen, a note can be spent once and only once.

Proofs

The proof says, in effect: "these spent notes exist in the tree, I own them, their nullifiers are correct, and value in equals value out." It proves all of that without showing which notes or how much.

Mertcash follows Zcash's newest pool design, Orchard, which uses the Halo 2 proving system. Halo 2 needs no trusted setup ceremony.

Shield and unshield

Shielding moves $MCASH from a normal Solana token account into the pool and creates a note for you. Unshielding spends a note and sends tokens back out to a Solana address.

These two edges are public: anyone can see that a wallet shielded or unshielded a given amount. Transfers inside the pool are not. For the most privacy, avoid unshielding the exact amount you shielded right after shielding it.

Viewing keys

Like Zcash, Mertcash separates spending from seeing. An incoming viewing key shows the notes you received. A full viewing key also shows what you spent. Neither can move funds. Share one with an accountant or auditor when you need to prove your history.

Compared with confidential transfers

Solana's Token-2022 program has a confidential transfer extension. It encrypts balances and amounts, but the sender and recipient accounts stay public, so anyone can still map who pays whom. Mertcash hides the sender, the recipient and the amount.

What stays visible

Some things are always public: that the Mertcash program was called, the Solana fee payer of each transaction, the time, and the shield and unshield edges. Use a fresh fee-paying wallet, or a relayer once one exists, if you don't want your main wallet linked to pool activity.

Launch status

Mertcash is not live. No mint address has been published. The explorer and fees read zero, and shield, unshield and convert are switched off until launch.

Origin

Zcash pioneered shielded payments and has run them in production for years. Its designs and code are open source. Mertcash takes that work to Solana, where transactions are fast and cheap but fully public by default. The name is a nod to Mert.

Questions

References

Background reading on the technology Mertcash builds on:

Zcash protocol specification
zcash/orchard on GitHub
zcash/halo2 on GitHub
Solana confidential token docs