How Opacus works

#The pool

Opacus is a program on Solana that keeps one pool for every asset it holds. Deposits add to the pool's vaults and cash-outs pay from them. The pool's program keeps the books: for each asset, how much the pool holds. A deposit must arrive whole, and every payment out comes off the books.

Inside the pool nobody has an account balance that anyone can read. The pool keeps something else: a list of sealed notes.

#Notes

A note is an amount of an asset that belongs to an owner, sealed so that only its owner can open it. The pool's program never sees the note itself, only a fingerprint of it, called a commitment, added to a large tree of fingerprints (up to about 67 million).

When Ada pays Grace, Ada spends notes of hers and makes two new ones: one for Grace, one with Ada's change. Their amounts and owners are sealed. The new notes' contents travel in the transaction, encrypted to each owner, and Grace's app finds the one meant for her by trying her own key on what the pool lists.

#Spending a note, once

Each note, when spent, leaves a mark that only its owner's key can make, called a nullifier, and the pool's program refuses any mark it has seen before. So a note can be spent only once, and the mark says nothing about which note it was.

#Proofs, made on your device

To spend notes, you must show that they are in the tree, that they are yours, that they have not been spent, and that what goes in equals what comes out, without showing which notes they are or how much they hold. That is what a zero-knowledge proof does: it proves a statement is true and reveals nothing else.

Your app makes the proof itself, on your device, in under a second. Opacus uses Groth16 proofs over a circuit written in Circom; the program checks each proof on Solana before it accepts a move. A proof also binds everything outside it: the wallet a cash-out pays, the fee, the encrypted notes. Change any of it and the proof fails.

#The relayer

A payment inside the pool needs someone to sign and pay Solana's fee. If your own wallet did it, everyone would see your wallet paying. So Opacus's relayer signs and pays instead. It builds the transaction itself from your proof, and because the proof binds the payment, the relayer can send it or refuse it, never change it: not the amount, not who is paid, not its own fee.

#The indexer

Your app needs the pool's list of notes to find yours and to prove. Opacus's indexer reads the pool's transactions from Solana and serves the same list to everyone. Your app rebuilds the tree from it and checks the result against the pool's own record on Solana: a list with one changed entry is refused. The indexer never learns which entries are yours, since everyone asks for the same list.

#Your keys

Your account is two keys, made from your wallet's signature: a spending key, which makes your nullifiers and so spends your notes, and a viewing key, which opens the notes sent to you. Your Opacus address is the public half of both. The keys exist only while your page is open, inside the app's engine, and are never stored or sent.

#Where to read more

• What stays private: what each move shows, and to whom.
• Security and status: what protects the pool, and what is left before Solana's main network.