Denominations
Proofs hide who and how much inside the pool. They cannot hide the two moments where value crosses the boundary, because a deposit amount and a withdrawal amount are both calldata. Denominations are what stop those two amounts from finding each other.
Why an odd amount is a fingerprint
Shield 0.2337 today, withdraw 0.2337 next week, and the two ends link themselves. No proof broke. Nobody read a note. The number did the work. Matching public amounts across a shielded pool is a known deanonymization result, and it gets easier the rarer your number is.
Round amounts do not have that edge. Every 0.1 looks like every other 0.1, and each size is a crowd that grows every time somebody else uses it.
The ladder
Sizes are powers of ten around one whole token, six orders of magnitude above it and three below, clipped at the token’s own decimals. A boundary amount is split greedily from the largest size down, and each part is its own transaction.
| You ask for | It crosses as |
|---|---|
| 0.1 ETH | one transaction at the 0.1 size |
| 0.23 ETH | 0.1 + 0.1 + 0.01 + 0.01 + 0.01, five transactions |
| 100,000 COWL | one transaction — 100,000 is a size on the ladder |
| 90,000 COWL | nine transactions at 10,000 — 90,000 is not a size |
Anything left below the smallest size stays where it already sits, as change. A command fans out into at most twelve boundary transactions; past that the amount wants rounding, or an exact crossing, rather than a parade.
Three rules it follows
- Client side only. The contract forbids nothing. A size list baked into an immutable pool is a regret nobody can patch, and a size nobody uses is a crowd of one.
- Default, not mandate. Pass
--exactin the CLI, or flip the toggle in the app, and your precise amount crosses in one transaction. Sometimes a counterparty needs the exact figure and that is your call to make. - Boundary only. Private sends and change notes never surface an amount at all, so they stay arbitrary. Denominating them would buy nothing.
What it costs
Each part is a separate transaction, so each carries its own gas and, when gasless, its own relayer fee. Both clients price the whole plan up front and show it before you approve anything — the count, the size breakdown, and the total fee. Nothing fans out behind your back.
Related
- Shielded pool — the notes and the tree underneath.
- Gasless relayer — who pays for each part.
- Shield your funds — the walkthrough.