ra:st is a non-custodial shielded pool with a compliance proof built in. Every value below is what the chain actually records — and, just as importantly, what it never sees.
A note is deposited, certified into the association set, then withdrawn. Hover a private field to see what stays yours.
The withdrawal circuit proves your note is in the global tree and in the association set of non-illicit deposits — bound to the same leaf. A tainted note has no association path, so it simply can’t exit.
The asymmetry is the whole point. The auditor gets a compliance certificate, the public gets an unlinkable exit, and only you ever hold the link.
| Party | Learns | Never learns |
|---|---|---|
| You (owner) | Everything — you hold k, ρ, ℓ | — |
| Public observer | A fresh, associated note exited the pool | Which deposit it was |
| Auditor | The exit descends from 𝒜 (via rt𝒜) | Which leaf inside 𝒜 |
| Pool contract | nf is fresh · π verifies · pays R | cm, ℓ, k, ρ |
| Curator | A leaf was included in 𝒜 | That it was later spent |
Proving happens once on your device; the chain pays a small, fixed verification cost regardless of pool size.
Two Merkle paths — the global tree and the association set — dominate. The association path is the concrete price of compliance: it roughly doubles the circuit versus a plain mixer.
| Sub-circuit | Constraints | Share |
|---|---|---|
| Address hash · H(k) | 216 | 1.3% |
| Commitment hash | 276 | 1.6% |
| Nullifier hash | 276 | 1.6% |
| Global Merkle path · d=32 | 7,840 | 46.5% |
| Association path · d′=32 | 7,840 | 46.5% |
| Fee range · m=64 | 65 | 0.4% |
| Denomination + bind | 2 | 0.0% |
| Total | 16,515 | 100% |
| Plain-pool baseline (no assoc. path) | 8,675 | — |
Public parameters are immutable once a pool ships — changing them forks the pool and splits its anonymity set.
No party holds your funds or keys. The curator is trusted only for policy correctness — it cannot steal, freeze, or deanonymize.
| Actor | Role | Trusted for |
|---|---|---|
| Depositor | Publishes a commitment | nothing |
| Withdrawer | Proves and spends a note | nothing |
| Pool contract | Maintains 𝒯, 𝒩; verifies π | on-chain exec |
| Relayer | Submits a withdrawal tx | liveness only |
| Curator | Publishes rt𝒜 | policy only |
| Auditor | Checks exit compliance | nothing |
| Validators | Order & finalize txs | consensus + DA |
Four cryptographic guarantees, each reducible to a standard assumption. They fail only if the underlying primitive does.
Circuit, security proofs, anonymity bounds, economics, and benchmarks — the complete treatment lives in the whitepaper.