FAQ
The questions this documentation raises. Each one gets the measurement, or the word undecided.
Some of these have an answer and some do not. The ones without say so, and name what holds around them. A question left open is not a question nobody thought about.
The circuit
| Question | Answer |
|---|---|
| How much can one proof cover? | Up to four notes at one anchor, added together. A holder whose balance sits across more than four cannot claim all of it in one proof. Sixteen is where a Solana transaction stops fitting. Every extra slot repeats a Merkle path, a note commitment, a key derivation and a fixed-base multiplication. |
| Does it show the notes are unspent? | No. Only a nullifier answers that, and publishing nullifiers is what the tag exists to avoid. What bounds the claim is the age of the anchor, and the interface prints that age beside it. |
| Why not check the proof on Solana itself? | Solana has no Pallas syscall. Converting the proof to something it can read costs 5.84 billion constraints at the floor, behind a 2.6 TB proving key. An attester checks it in ~25 ms and signs instead. |
| How long does a proof take? | About 31 seconds in a browser, in a Web Worker. The key behind it costs 68 seconds on the first press and nothing after. Natively a proof is about 2.5 seconds on four cores, 9.6 on one. |
Trust
| Question | Answer |
|---|---|
| Who signs the anchors, and how many? | Undecided, and it is the critical path. Three things around it already hold. The quorum sees public tree state and never a note, a key or a balance. It can never take your ZEC. And its signature travels beside the proof, so anybody can redo the check in ~25 ms. |
| What can a dishonest quorum do? | Assert a root it invented and sign attestations for notes that never existed. No proof system catches that, because the proof would be a valid proof about their tree. What catches it is publication. |
| How many confirmations before an anchor is posted? | Undecided. The shielding path takes its own anchor 10 blocks under the tip and a resumed scan always rewinds 100 blocks. Both are starting points rather than the answer. |
Scope
| Question | Answer |
|---|---|
| How much ZEC can this reach? | About 85% of the shielded supply crossed into Ironwood, some 3.7 million ZEC. Roughly 3% is still in Orchard, where this wallet reads it and the circuit cannot prove it. Migration is one-way, so the figure only rises. |
| Why Ironwood only? | One pool means one circuit and one curve. Orchard has taken no new output since Ironwood activated on 28 July 2026. What sits there is a balance to migrate, not a place to prove from. |
| Memo or public input for account binding? | A public input today. A 512-byte encrypted memo could carry it instead, and that path asks no integration from any wallet, because it works in every Zcash wallet that already exists. |
The two that are not cryptography
Neither of these has an answer, and neither is a maths problem, which is what makes them the harder two.
| Question | Where it stands |
|---|---|
| Who reads an attestation first? | A card's value is not in the plastic. It is in whether anybody accepts it, and Visa's hard problem was recruiting merchants rather than printing cards. That is separate work rather than a side effect of this one. |
| How does this pay for itself? | The attester set is the only component with a recurring cost rather than a one-time one, which ties this question to the last. The privacy graveyard is full of projects that died here rather than on cryptography. |
Asked elsewhere
The product questions have their own page. Is this a bridge, can Zolar see your balance, what happens to your ZEC if this project stops.