Shielded transfers are not for value until an independent external audit of the cryptography and its integration has been completed and its findings fixed.
§1What is implemented#
| Capability | State |
|---|---|
| Deposit (shield), private payment, withdrawal (unshield) | Implemented |
| Consensus verification of Halo 2 proofs, RedPallas binding and spend signatures | Implemented |
| Orchard note tree of depth 32, recent anchors, permanent nullifiers in the state root | Implemented |
| Authenticated compact-block scanning, version 3 | Implemented |
| Viewing keys, watch-only wallets, accounting export, payment receipts | Implemented |
| Automatic reorganization recovery within 256 blocks | Implemented |
| Hardware-wallet integration | Not implemented |
| Production proving-resource qualification | Not done |
| Independent external cryptographic audit | Outstanding |
The native library pins Orchard revision 29d1d55db62153dcaeef8ef631c8991c53ed1248, the FixedPostNu6_2 circuit and orchard_v2 bundles.
§2Binding proofs to the chain#
A valid proof of a different statement is not enough. Consensus checks that the native bundle matches the transaction's declared operation, anchor, nullifiers, commitments and value balance exactly. Every action, including dummy actions, contributes a nullifier, a commitment and a spend signature. Nullifiers reject double spends both in the transaction pool and in committed state, and a failed execution rolls back shielded state together with accounts.
§3Accounting: the turnstile#
One shielded unit equals 1010 base units, which is eight decimal places of RSC, and conversions must be exact. The value balance is the negative deposit amount for a deposit, the fee for a private payment, and the amount plus the fee for a withdrawal. The public pool balance, the transparent debits and credits, and fees must reconcile in every block.
§4Authenticated compact blocks#
Wallets download compact blocks that carry the block's ordered transaction IDs and, for each shielded transaction, its effects, anchor, nullifiers, commitment and ciphertext pairs (724 bytes per action) and an authorization-data commitment. Proofs are not transported. On a measured two-action native corpus, this is 84% less bandwidth than shipping whole bundles.
The sync driver verifies the finalized sync-tip certificate when finality is available and requires each fresh block to extend the checkpoint. A changed checkpoint within the retained 256-block history rewinds to the common ancestor and rescans, keeping pending spend reservations.
The validator set itself is trusted on first contact until out-of-band anchor pinning is implemented. The light-client path also has an open internal finding, so for now treat the serving node as trusted for scanning.
§5Selective disclosure#
- Full viewing keys let an auditor or accountant scan activity without the power to spend.
- Accounting export produces CSV or JSON of the selected activity.
- Payment receipts disclose one payment. Verifying one needs an independently trusted anchor and the expected sender key; a receipt that is only self-consistent does not prove inclusion.
Local note state and the spending keystore are encrypted with the wallet passphrase. Watch-only keystores still hold plaintext viewing keys, and exports disclose what they select.
§6What stays visible#
Proofs hide who paid whom, and how much, inside the pool. They do not hide deposit and withdrawal amounts or the transparent account on that side, fees, the number of actions, or network-level timing. Proof privacy is not network anonymity.
§7The activation interlock#
Shielded processing is off unless shielded_activation_height is set, and setting it also requires an explicit experimental acknowledgment when the node starts. Every validator and wallet needs the native library. A pure-Go build rejects shielded activity and cannot follow a chain that contains it, so it is never used as evidence for shielded behavior.
The public testnet launch procedure sets the activation height to zero explicitly.
§8History#
Historical An internal review on 2026-09-12 found that the shielded layer of that time verified only proof length. It was replaced with native Orchard proving and verification, and the regression tests for those findings now pass natively. That episode is why this site separates implemented from qualified.
Sources: pkg/shielded, pkg/shielded/wallet, pkg/lightclient, native Rust library; shielded capabilities reference; shielded threat model; shielded protocol reference.
Cite this page
@misc{resilience-protocol-privacy,
title = {{Shielded transfers with Orchard}},
author = {{Resilience Network}},
year = {2026},
note = {Reference implementation c3acec4, protocol manifest r28},
url = {https://resiliencenetwork.xyz/protocol/privacy/}
}