Private settlement. Publicly verifiable.
STSH combines an ICRC-compatible public token ledger with an optional zero-knowledge shielded pool. Private transfers are authorised by cryptographic proof, while token supply remains fully accounted for on-chain.
One source of truth
The shielded pool cannot create supply.
Every STSH token remains accounted for by the public ICRC ledger and the assets held in escrow. The private pool proves whether funds may move. It never determines how many tokens exist and has no authority to mint them.
Private transaction flow
From public assets to private settlement.
Shield
Tokens move from the user's public balance into protocol escrow. A private note commitment is added to the shielded pool.
Commit
The note contains a spending secret, value and random blinding factor. Only its Poseidon commitment is recorded publicly.
Prove
To spend, the user generates a zero-knowledge proof showing valid ownership, sufficient value and an unspent note — without revealing the underlying private data.
Settle
The verifier validates the proof, the nullifier prevents reuse, and the protocol completes the private transfer or authorised withdrawal.
No custodian · No mixer · No trusted transaction intermediary
Anonymity by design
Standardised deposits. Flexible withdrawals.
Fixed-denomination withdrawal
Matches common note sizes, making one withdrawal difficult to distinguish from another within the anonymity set.
Custom withdrawal
The recipient and note ownership remain private, but the specific withdrawn amount becomes visible on the public ledger.
Zero-knowledge layer
Prove validity without exposing the transaction.
STSH uses Groth16 zkSNARK proofs over the BN254 curve. Its circom circuit verifies note ownership, value conservation and double-spend protection without exposing the spender, recipient or fixed-denomination amount.
Commitments
Private notes are represented by Poseidon commitments, designed for efficient verification inside zero-knowledge circuits.
Merkle inclusion
Commitments are stored as leaves in an incremental Poseidon Merkle tree. A spend proves that its note exists without identifying the corresponding leaf.
Nullifiers
Each spent note produces a unique, unlinkable nullifier. Once recorded, the same note cannot be spent again.
Trusted setup — current disclosure
The production verification key comes from an initial ceremony with a single participant, disclosed transparently, and is committed on-chain. A multi-party re-ceremony to strengthen the trusted setup is planned after launch. Until then, this is the honest limit of the setup's trust assumption.
Isolated responsibilities
Critical functions are separated by boundary.
Public ledger
Defines token supply and executes standard ICRC transfers.
Shielded pool
Coordinates deposits, private spends and withdrawals without controlling supply.
Proof verifier
Independently validates Groth16 proofs before value movement is authorised.
Merkle & nullifier services
Maintain note commitments and permanently reject reused spends.
Monitoring
Checks escrow coverage and protocol invariants independently from the transaction path.
Publicly accountable
Escrow backing is independently verifiable on-chain.
A standalone monitoring canister checks that total private liabilities do not exceed publicly held escrow assets. Results are published through certified queries, allowing anyone to verify cryptographically authenticated protocol status rather than relying on a conventional database or operator statement.
Required invariant
The backing ratio never falls below 1:1.
Backing is checked by an independent on-chain monitor and published through certified queries — not asserted by an operator.
Threshold key management
Private access without centrally stored keys.
STSH uses the Internet Computer's vetKeys technology, anchored to Internet Identity, for cross-device shielded-wallet access and note recovery. Spending-key material is derived through threshold cryptography when required rather than exported to or stored by a central server.
Open infrastructure
Built to integrate. Built to be verified.
ICRC standards
ICRC-1, ICRC-2 and ICRC-10 compatibility allows the public token layer to work with existing ICP wallets, explorers and decentralised exchanges.
Reproducible builds
Published source can be rebuilt and compared with the exact Wasm binary deployed on-chain.
Independent review
Fifteen adversarial review passes are complete, including a dedicated zero-knowledge soundness review with multiple independent reviewers.
Compute-aligned fees
Public transfers remain free. Privacy operations fund their cost.
Exact figures published once settled and launch-ready.
Built with