Private settlement. Publicly verifiable.
STSH pairs an ICRC-compatible public token ledger with a zero-knowledge shielded pool. Private spends are authorised by cryptographic proof, while the ledger remains the only thing that defines how many tokens exist.
One source of truth
The shielded pool cannot create supply.
Every STSH token remains accounted for by the public ICRC-1 ledger and the escrow held on it. The pool proves whether funds may move. It never determines how many tokens exist and has no authority to mint them. A flaw in the circuit cannot inflate supply.
On-chain attestation and accounting alarms prove and protect the vault against malicious drains.
Private transaction flow
From public assets to private settlement.
Shield
Tokens move from the user's public balance into protocol escrow, in one of five fixed sizes. A private note commitment is added to the pool.
Commit
The note holds a spending secret, a value and a random blinding factor. Only its Poseidon commitment is recorded.
Prove
To spend, the wallet builds a zero-knowledge proof, on the user's own device, showing valid ownership, sufficient value and an unspent note, without revealing the underlying data.
Settle
A separate verifier canister checks the proof, the nullifier registry blocks reuse, and the pool completes the public payout.
No custodian · No mixer · No trusted transaction intermediary
Anonymity by design
Standardised deposits. One flexible exit.
Hides your balance and your notes
Shield STSH into private notes. Spend them without revealing which note paid, either by re-shielding into a fresh note or by paying out to any public account, where recipient and amount are public. Your account signs every spend: the simplest safe defence at launch against spam that would drain the proof verifier, at the cost of sender privacy.
Hides you
Spends can be submitted by anyone, so the pool stops asking who is spending. No circuit change and no migration: V1 notes keep working. Unlinkable prepaid verify tickets replace per-account spam limits, followed by private-to-private sends, hidden-sender withdraw and batched settlement. Full roadmap
Zero-knowledge layer
Prove validity without exposing the transaction.
STSH uses Groth16 proofs over the BN254 curve. Its circom circuit checks note ownership, value conservation, freshness of the nullifier, and the recipient. Proof generation runs client-side, in the user's own browser. Proof verification runs on-chain, in a separate canister. The circuit is bound to this deployment: proofs built for STSH's pool are valid nowhere else.
Commitments
Private notes are represented by Poseidon commitments, designed for efficient verification inside zero-knowledge circuits.
Merkle inclusion
Commitments are stored as leaves in an incremental Poseidon Merkle tree. A spend proves that its note exists without identifying the corresponding leaf.
Nullifiers
Each spent note produces a unique, unlinkable nullifier. Once recorded, the same note cannot be spent again.
Isolated responsibilities
Critical functions are separated by boundary.
Public ledger
Defines token supply and executes standard ICRC transfers.
Shielded pool
Coordinates deposits, private spends and payouts without controlling supply.
Proof verifier
A separate canister that validates Groth16 proofs. The pool calls it; verification never runs inside the pool.
Merkle and nullifier services
Maintain note commitments and permanently reject reused spends.
Monitoring
A separate monitor canister reads the pool's certified attestation, independently of the transaction path, and reads the attestation itself, not the public page, so the page can never become the thing that vouches for itself.
Emergency controls
The pool has emergency pause controls in code for deposits and for spends. Pause may be triggered by governance or by the operator in the event of a monitoring warning.
Publicly accountable
The pool publishes its own accounting, continuously.
The pool publishes a certified attestation of whether its own accounting identity holds: escrow backing, plus pending fee reimbursements, minus private liability, must be at least zero. The payload is deliberately narrow: a health bit, a shortfall figure, a coarse timestamp and a schema version. Every healthy state publishes exactly zero, indistinguishable from every other healthy state, so the figure cannot leak the pool's balance sheet. A separate "unavailable" state exists, so a monitor that cannot reach the pool never reads as a clean bill of health.
Why it matters
The pool can never owe more than it holds.
Every private note is backed by STSH held in escrow on the public ledger. The pool is never allowed to owe more than that escrow holds, and it reports this continuously, so anyone can check at reserves.stsh.fi. That is what keeps the pool solvent and your notes secure.
Note custody
Private access without centrally stored keys.
Your wallet holds the material needed to spend your notes and builds every proof on your own device; nothing is exported to a central server. Your notes follow your Internet Identity: sign in on any device and the wallet rebuilds them from the chain.
Open infrastructure
Built to integrate. Built to be verified.
ICRC standards
ICRC-1 and ICRC-2 compatibility lets the public token layer work with existing ICP wallets, explorers and decentralised exchanges.
Release identity
Shipped binaries are pinned by hash and reproduced under a sanitised build, so a deployed binary can be bound to a specific source commit.
Security review
STSH has a continuous adversarial AI red-team reviewing the deployed code, and any new components or changes; counter reviews and external review are ongoing as the protocol matures.
Compute-aligned fees
Public transfers remain free. Privacy operations fund their cost.
Fees are set. Changes need a vote and are capped per change.
Built with