Bitcoin is private Bitcoin.
A shielded pool that lives in a single Bitcoin coin. You prove your own payments on your phone, and Bitcoin's own consensus re-checks the proof on every settlement. No bridge, no federation, no token.
Post-quantum, Zcash-Orchard-class privacy, running natively in Bitcoin Script. It needs the Great Script Restoration soft fork, so today it runs on a GSR test signet with test coins.
Why, how, what
Bitcoin is a public ledger. Every payment shows its amount, and chains of payments show who pays whom, forever.
Privacy has usually meant leaving Bitcoin for a sidechain, a federation, a bridge or a token, and trusting whoever runs it. Cheshire keeps your coins on Bitcoin, under rules Bitcoin itself enforces.
One covenant coin holds a shielded pool of private notes, in the style of Zcash's Orchard. Your wallet proves its own payment on your phone; no key or amount leaves it.
Payments settle in batches. Every settlement is one ordinary Bitcoin transaction whose script re-runs a STARK verifier, so a settlement that cheats does not confirm.
Who paid whom, and how much, stay off the chain. Each payment leaves one record of about 29 vB, and every one is two notes in, two out, so even counts are hidden.
Every note you own can be rebuilt from your seed and the Bitcoin chain alone. No server holds your keys or your history.
A forced exit request on chain must be handled by the next drain, every sixth settlement: paid if its note is unspent and its anchor recent, otherwise voided, never skipped. If settlements stop altogether, a solo exit needs no one.
Hash-based STARKs over SHA-256, with no elliptic curves in the proofs. Two pieces are not post-quantum yet: the payment-code handshake and taproot's key path. The docs say what that means.
No ceremony and no toxic waste. The pool's value is public, and Bitcoin's rules cap what it can ever pay out at that value.
The app proves on the device, checks Bitcoin's headers itself, and sends everything through Tor, built in and on by default.
How a payment works
Your wallet makes a zero-knowledge proof that a note is yours, is unspent, and adds up to the notes you create, in about a second.
It goes over Tor to the share chain, where nodes agree on a batch and split the proving work. They are paid in notes, by the settlement's own proof.
One transaction spends the pool coin and makes the next. Its script runs the STARK verifier on the whole batch, with about 29 vB of record per payment.
The payee's wallet finds its note in the records; nobody else can. Once settled, it can be spent again or rebuilt from the seed.
Until its settlement confirms, a payment is pending. Deposits come in through deposit coins, and withdrawals leave through a vault output; amounts at that boundary are public, as with Zcash's transparent side.
The wallet
A self-custodial wallet that does the private part itself. TestFlight soon
Test coins only. We'll post the TestFlight link here when it opens.
What Bitcoin needs
Cheshire runs in Bitcoin Script, with one change Bitcoin does not have yet: GSR. Its covenant and its STARK verifier use GSR's new tapscript leaf version and nothing else.
The verifier does field arithmetic with OP_MUL and OP_MOD, hashes with OP_SHA256 and OP_CAT, and the covenant rebuilds its own transaction with OP_CAT to carry the pool's state forward. An OP_CAT-only version was built first: each settlement took about 1.87 MvB over many transactions, and it could not bind the published data to the proof.
Neither BIP is active on Bitcoin. Cheshire is a demonstration of what the restoration makes possible, and we support the effort to activate it.
Every opcode pays for the bytes it reads and writes, so the restored opcodes cannot be used to make a block slow to validate.
OP_CAT, OP_SUBSTR, OP_MUL, OP_DIV, OP_MOD, shifts and bitwise operations; stack items above 520 bytes; script numbers of any length.
Where it stands
Cheshire is a research prototype. Here is what is real, what is not, and where it is weaker than the systems it is compared with.
Cheshire borrows Orchard's notes and nullifiers. Where it differs:
The pool's value is public, and Bitcoin's own rules cap what it can pay out at that value: no bug in Cheshire can make it pay out more bitcoin than it holds.
Inside the pool, forging a note would take a bug in the circuits or the verifier; there is no setup to compromise. Such a break could misallocate the pool's real value, and that is detectable against its public value. Finding those bugs first is what an audit is for.
