Protocol
ZK proofs & circuits
Every private action in Cowl is a zero-knowledge proof: math that convinces the chain a state change is valid without revealing what changed. This is what makes a shielded balance both private and verifiable.
What a proof asserts
- You own the notes you are spending.
- Inputs equal outputs — no value is created or destroyed.
- Each spent note is nullified exactly once, so nothing double-spends.
- The trade or transfer follows the pool’s rules.
None of the amounts, assets, or addresses appear on-chain — only the proof and the resulting commitments and nullifiers.
Commitments & nullifiers
| Primitive | What the chain sees |
|---|---|
| Commitment | A hash that hides a note’s amount, asset, and owner |
| Nullifier | A one-time marker that a note was spent — unlinkable to the note |
| Merkle root | A snapshot proving your note is in the set, without saying which one |
The circuits
The proving circuits are written in a dedicated ZK language and compiled to an on-chain verifier. Proving happens client-side or via a prover you can pay through the relayer; verification is a cheap, constant-cost check on-chain.
Open by design
Circuits and verifier are open source and independently audited. Privacy that can’t be reviewed isn’t privacy you should trust.