PQ-MWEB / Opt-in shielded state
Private transactions without changing the transparent ledger
SOS keeps transparent transfers and adds an opt-in shielded pool. Users can shield transparent value, send inside the shielded state, and unshield back to a transparent address. The network verifies a proof and state commitments rather than receiving the private witness.
Shield, private send, unshield, and wallet recovery are exercised on testnet.
Model
Opt-in shielded extension blocks
Ownership
Position-bound nullifiers
Note delivery
ML-KEM-1024 sealed notes
Proving
User-controlled RISC Zero prover
The four transaction paths
Transparent transfers remain directly inspectable. Shield converts transparent value into a committed note. Private send consumes shielded notes and creates new encrypted notes without publishing sender, recipient, or amount. Unshield proves a valid shielded spend and releases value to a transparent address.
Every shielded action is checked against a consensus-bound commitment tree and nullifier set. A valid nullifier prevents the same note from being spent twice while avoiding publication of the note secret.
Private witness, public proof
Spend witnesses contain note secrets and belong on infrastructure controlled by the user. The wallet can connect to a local sos-privacy-prover, authenticate with its bearer token, generate the STARK receipt, and submit only the proof and public journal to the network.
Proof generation and validation are separate workloads. The mempool can retain proof-dependent work while validators continue processing transaction classes that do not require proving, reducing the chance that one saturated prover stalls the whole chain.
Recovery and scanning
The wallet derives transparent and shielded keys from the recovery phrase. It scans encrypted note blobs using view tags before attempting ML-KEM decapsulation, reconstructs owned notes, checks nullifiers, and rebuilds spendable shielded state without a server learning the viewing secret.
Privacy at the ledger layer does not automatically hide network metadata, browser telemetry, timing correlations, or a user's operational mistakes. Those remain part of the user and deployment threat model.
Questions
Common questions
Do private sends expose the recovery phrase or note secrets?
No. The witness stays in the wallet and user-controlled prover. The network receives a proof, public journal, commitments, and nullifiers.
Can a transparent SOS balance become private?
Yes. A shield action moves value into the shielded pool. An unshield action later returns proven value to a transparent address.
Can the same shielded note be spent twice?
No valid state transition can reuse its position-bound nullifier. Nodes reject a nullifier that is already present in consensus state.
Primary sources
Last reviewed: 2026-07-21