Public assets. Private ownership. Verifiable backing.
STSH lets you move tokens from the public ledger into a private balance you control. Inside the shielded pool, zero-knowledge proofs confirm that every transaction follows the protocol rules, without publishing which note you spent or how your notes connect.
The product
ShieldTransactSettle
Shield STSH into private notes. Spend them without revealing which note paid. Pay out to any public account; recipient and amount are public, and your Internet Identity signs the transaction. Deposits are public. Private send to another person and hidden-sender withdraw come later.
Your claim becomes a private note. The deposit still hits a public escrow.
The transfer into protocol escrow is recorded publicly on-chain. Your private note is not.
Your wallet creates the note privately and sends only a cryptographic fingerprint to the pool. Your notes follow your Internet Identity: sign in on any device and the wallet rebuilds them from the chain.
Deposits come in five standard sizes, so many users share the same visible shape. The sizes are set out below.
What stays public
- The deposit occurred
- The amount deposited
- The assets held in escrow
What stays private
- Your private ownership secret
- How you later use the private balance
- Which note funds any later payment
Move or hold value without publishing the trail between notes.
Inside the pool, your balance is represented by private notes controlled through your wallet. To make a transaction, the wallet generates a zero-knowledge proof. The proof confirms:
- You control a real, unspent note
- The note has not been spent before
- The values in and out balance: you cannot spend more than the note holds
The protocol checks the rules. It does not need to see your private activity.
You remain in control
STSH does not hold a password that can spend your private balance. Your wallet holds the private material needed to use your notes, and builds every proof on your own device. Nothing is sent to a prover service, because there is not one.
When a payment needs to be public, settle it. The funding note stays private.
There is one exit today: a private spend with a public payout. Your wallet proves that it controls a real, unspent note and that the arithmetic is sound. The pool pays the amount you chose to the public account you chose, and returns the remainder as a fresh private note. The payout amount and the recipient are visible on the ledger, as they must be for a payment to be a payment. Which note funded it is not.
Your Internet Identity signs the spend, so your account shows as the sender. Which note paid, and what else you hold, do not. Hidden-sender withdraw comes later.
Private spend with a public payout
You choose the amount. The remainder comes back as a fresh private note.
Private withdrawal
Privately withdraw a note to a shielded address.
Fees and payout arithmetic
The fee is paid out of the note, so the largest payment a note can make is always a little below its face value. Paying a note out in full in one step is not an operation the protocol performs; the remainder returns privately. Fee figures are on the Technical page.
Fixed denominations
Everyone deposits the same shapes.
Deposits use five standard sizes so many users share the same visible shape. That is what makes the anonymity set real. Withdrawals can be any amount you choose; the remainder returns as a fresh private note.
Why standard amounts?
Privacy works better when transactions look alike. A unique deposit amount can be recognisable later, regardless of how strong the underlying cryptography is. Standard note sizes mean many users' deposits share the same visible shape. Larger balances can be assembled from several private notes, while the wallet presents them as one simple balance.
The five sizes are frozen into the circuit at launch. Smaller sizes can be opened later by a pool upgrade. The largest size is what fixes the circuit's internal value bound, so the two always move together.
Privacy boundaries
What STSH hides, and what stays public.
Private inside the pool
- Ownership of private notes
- Which note funds a payment
- The link between a deposit and a payout
- The internal transaction trail
Public and auditable
- Total token supply
- Assets deposited into escrow
- Public payouts and their amounts
- The account that submits a private spend
- Public wallet balances
- Whether the pool's own accounting identity holds
The point
STSH protects transaction activity without hiding whether the protocol owes.
Selective disclosure
LaterPrivate does not have to mean unverifiable.
A user or treasury may need to demonstrate ownership, transaction history or compliance information to a chosen accountant, auditor or authorised party. STSH is designed so that an owner will be able to authorise selected private information to be viewed, without publishing it to the network.
Owner approved
Access would be granted by the user or organisation controlling the private account.
Read only
Viewing authority would never carry spending authority.
Selective
Only the required account, transaction or reporting information would be disclosed.
Ownership and recovery
Your balance belongs to you.
Private notes are controlled through your wallet, not by a central STSH account. Your wallet builds every proof on your own device. Your notes follow your Internet Identity: sign in on any device and the wallet rebuilds them from the chain.
Hold your own notes. Prove your own spends.
Publicly verifiable
Privacy does not hide the reserves.
Every token represented inside the shielded pool remains backed by assets held in public escrow. An independent on-chain monitoring canister checks that private obligations never exceed the available backing, allowing anyone to verify the pool's solvency without seeing individual private balances.
Want to inspect the machinery?
Explore the Technical page.
The underlying circuit, commitments, nullifiers, proof verifier, canister architecture, trusted setup, reproducible builds and current security status.