stealthPRIVATE is a fully dedicated private sidechain where sender, receiver, and amount are hidden by mathematics, not by policy. No transparent fallback. No opt-in privacy. Every transaction inside the sidechain operates under zk-STARK guarantees — always.
A deposit is recorded on stealthCORE as a CBridgeDeposit. It locks XST transparently into a multisig address and instructs stealthPRIVATE to mint an equivalent shielded note. The record is minimal by design — only what is needed for custody and withdrawal is persisted.
Deposits and withdrawals do not pair per-user. The bridge tracks two counters only — nTotalMinted and nTotalBurned — and enforces a single invariant: the shielded pool must always net to a non-negative, Core-collateralised supply. Every user's withdrawal consumes some unspent deposit UTXO. Which one is immaterial and unlinkable to the withdrawer.
A shielded note is a cryptographic commitment stored on-chain. It binds an amount and an owner — but reveals neither. The chain cannot tell you what a note is worth or who holds it, only that a valid note was created.
To spend a note, the owner publishes a nullifier — a one-way derivative of the note that marks it consumed, without revealing which note it was — and a zk-STARK proof attesting that the note existed, was not previously nullified, and that the output balances check out.
A global nullifier set prevents double-spending. Observers see that a nullifier appeared; they cannot tell which note produced it. Sender, receiver, and amount are not obfuscated — they are mathematically absent from the public record.
Inside stealthPRIVATE, value moves freely: B → C, C → D, split, merge, relay. Every step is shielded end-to-end. Only the size of the nullifier set and the size of the note commitment tree grow — neither reveals anything about who moved what, or when.
Payment Disclosure lets a sender selectively prove a single shielded payment to a third party, using their Outgoing Viewing Key (OVK) — a capability strictly weaker than spend: it can reveal the holder's own outgoing notes but can never move funds.
The disclosure reveals only what is needed for the other party to verify: the receiver address, the amount, and the memo — for one specific note. Nothing about the sender's wallet state, balance, other transactions, or history leaks.
There is no extra zero-knowledge circuit. A note commitment is a hash, cm = H(value ‖ ak ‖ ρ), and a collision-resistant hash has only one valid opening — so producing that opening is the proof of the payment's contents. The OVK's job is recovery: at output time the sender keeps an OVK-sealed record, then later re-derives the opening from the on-chain cm. A third party checks the opening and a Merkle inclusion proof that the commitment really sits in the on-chain set — so a self-consistent but never-created payment is rejected.
The result is surgical: binding (a forged amount or recipient fails), confidential to the OVK holder, and chain-bound to real payments — for the narrow cases where proof-of-payment is useful: refund, dispute, or merchant verification. Disclosure is sender-cooperative by design — it is a tool for proving a payment, not for compelling its reveal.
The stealthPRIVATE sidechain has no rich list, no visible transactions, and no searchable explorer — by design. The rich list RPC (getrichlist) only tracks transparent addresses on stealthCORE. Shielded transactions cannot be viewed, searched, or listed. Not "not yet"; not "for now" — not ever. The explorer does not and cannot exist for the shielded chain.
Both schemes were designed to protect transaction privacy on public blockchains. They achieve this through radically different mechanisms — with dramatically different security properties.
Ring signatures provide plausible deniability: one signer in a group, statistically hidden. zk-STARKs provide cryptographic certainty: a mathematical proof that nothing was revealed. One is obfuscation. The other is proof.
The distinction is not academic. It determines whether privacy strengthens, holds, or degrades as chain data accumulates — and whether it survives the quantum computer.
A transaction is signed by one member of a predefined group — the "ring." The signer selects n − 1 other public keys as decoys. An observer cannot definitively tell which member signed.
The privacy is statistical, not mathematical. The set of candidate signers — decoys included — is publicly visible on-chain. Every ring member, real and fake, is recorded forever. Monero is the canonical user of this scheme.
A zero-knowledge scalable transparent argument of knowledge. The prover generates a proof encoding the entire validity of a transaction — inputs, outputs, balances — without revealing any value.
No decoys. No candidate set. No statistical model to attack. The privacy is encoded in the mathematics of the proof itself — and it does not weaken as chain data accumulates.
Ring signatures rest on elliptic-curve discrete-log hardness — exactly what a large quantum computer running Shor's algorithm breaks. Every ring member is recorded on-chain forever, waiting to be deanonymised retroactively.
A zk-STARK's only cryptographic assumption is a collision-resistant hash. No elliptic curves, no pairings, no discrete-log. Shor's algorithm has nothing to attack. The trade: proofs are tens of kilobytes, not bytes — a deliberate exchange for security with no expiry date.
Verifying a ring signature checks the relationship across all n members. A ring-16 transaction verifies roughly 16× slower than a trivial one. On high-throughput chains, the overhead compounds.
zk-STARK verification is poly-logarithmic in the computation — independent of the anonymity set. A shielded transfer verifies in ≈0.8 ms. This is compatible with high-throughput chains that must validate thousands of transactions per second.
| Privacy property | zk-STARKs | Ring Signatures |
|---|---|---|
| Sender identity hidden | Provably complete | Probabilistic |
| Receiver identity hidden | Provably complete | Partial |
| Transaction amount hidden | Native & complete | Add-on required |
| Resistant to chain analysis | Permanent guarantee | Degrades over time |
| On-chain decoy records | None | Yes — all visible |
| Post-quantum secure | Yes — hash-based | No — elliptic-curve |
| Verification overhead | Sub-millisecond · poly-log | Scales with ring size |
| Privacy guarantee type | Cryptographic / mathematical | Heuristic / statistical |
| Architecture | Dedicated sidechain | stealthPRIVATE runs alongside stealthCORE. Fully shielded by default — no transparent pool, no opt-in. |
| Proof system | zk-STARK · Winterfell | Zero-knowledge scalable transparent arguments of knowledge. Hash-based (Rescue-Prime, Goldilocks field). Post-quantum. No trusted setup. Pure STARKs — no SNARK wrapper. |
| Bridge record | CBridgeDeposit | Stores the Core chain txid (locking transaction), amount locked, multisig P2SH address, committee keys (threshold quorum), and a spent flag. Does not store sender or receiver XSS address. |
| Custody model | n-of-m P2SH multisig | A per-deposit committee of bonded StealthNodes governs unlock; a signing threshold is required for withdrawal. |
| Privacy set | Pool · mint-burn | nTotalMinted − nTotalBurned = net supply. Anonymity set is every historical depositor. |
| Spend bundle | spend · output · change · proof | One spend action, one output action, one optional change output, one zk-STARK proof. ≈40 KB per transfer; verifies in ≈0.8 ms. |
| Note model | Commitment + nullifier | Notes are on-chain commitments. Nullifiers prevent double-spending with zero disclosure of which note was consumed. |
| Payment Disclosure | OVK-based | Sender-originated proof of a single payment: recipient, amount, and memo only — a selective opening of the note commitment, bound to the chain by a Merkle inclusion proof. Selective transparency; does not leak wallet state. |
| Explorer visibility | None — by design | Public data: block height, net supply, note commitment tree size, nullifier count. No rich list. No transaction explorer. |
| Fees | Feeless | No per-transaction fees inside the shielded pool. |