Skip to content
Cheshire

Introduction

Bitcoin is private Bitcoin.

Cheshire is a way to hold and pay bitcoin privately, with the rules enforced by Bitcoin itself. The chain shows that something happened. It does not show who paid whom, or how much. Nobody holds your coins, and nobody has to be trusted to run it.

These docs explain Cheshire page by page, in plain words. They start with why it exists, then how it works, then what you get. The landing page is at cheshire.taprootwizards.com.

Why

Section titled “Why”

Bitcoin is transparent. Every payment is public forever: the amounts, the addresses, and the links between them. Anyone can follow your coins from the exchange that sold them to the shop you paid. Your salary, your savings and your spending are open to your employer, your landlord and every analytics firm. That is a poor property for money.

The fixes so far ask you to trust someone. Private systems for bitcoin today are mostly one of these:

  • a federation or custodian that holds the coins while they are private;
  • a sidechain or bridge, where a group of signers controls the coins on Bitcoin;
  • a separate coin with its own token;
  • a zero-knowledge system with a trusted setup, where a secret that leaks could let someone print money no one can see.

Each one puts a person or a secret between you and your coins. Cheshire’s goal is privacy with none of them: the rules are checked by every Bitcoin node, the same way Bitcoin checks a signature.

How

Section titled “How”

One coin holds the pool. All private value sits in one Bitcoin output, the pool coin. Inside it, in the cryptographic sense, is a tree of private balances called notes, each a claim on the pool that only its owner can spend.

You prove your own payment. To pay, your phone makes a small zero-knowledge proof: “I own a note in the tree, I have not spent it before, and what I send adds up.” The proof reveals nothing else. It takes about a second.

Bitcoin re-checks a proof at every settlement. Payments are gathered into a settlement: one Bitcoin transaction that spends the pool coin and makes a new one. The pool coin’s script runs a full STARK verifier, so Bitcoin’s own nodes check that every payment in the batch was valid. A settlement that cheats does not confirm.

This needs Great Script Restoration. Bitcoin’s script today cannot run a verifier. GSR (BIP-440 and BIP-441) restores opcodes such as OP_CAT under a cost budget, in a new tapscript leaf version, 0xc2. Cheshire uses that and nothing else.

Nobody is in charge of settling. Anyone may gather payments and prove a settlement. In practice, nodes cooperate on a small side channel called the share chain, split the proving work, and are paid for it inside the settlement’s own proof. Every node builds the same transaction, byte for byte.

What

Section titled “What”
  • Private payments. Inside the pool, a payment hides the sender, the receiver and the amount. It also hides how many notes it spent and created.
  • Deposits and withdrawals without custody. A deposit stays yours until a settlement takes it, and you can cancel it until then. A withdrawal is paid by Bitcoin’s rules from the pool to your address.
  • Exits no one can block. If every node refused your withdrawal, you can force it through an exit inbox that every sixth settlement must empty. If no one settles at all, you can leave alone with a solo exit.
  • Seed-only recovery. Everything your wallet needs is on Bitcoin. With your twelve words and the chain, you can rebuild your whole wallet, even if every Cheshire server is gone.
  • No trusted setup, hash-based proofs. The proofs are STARKs. They need no secret ceremony, and their soundness rests on hashes rather than elliptic curves. A quantum computer does not break them; it only weakens hashes by the usual margin. (Two other parts are not post-quantum; security names them.)
  • An iOS wallet that proves on the phone, checks the chain itself, and talks to the network through Tor by default.

What it is not

Section titled “What it is not”

It is not a sidechain, a rollup with its own chain, a bridge, a token or a company’s service. It is also not finished. It has not been audited by anyone outside the project, its zero-knowledge argument has been checked only by the project, and its proof security level is one the project itself calls fine for a test network and too low for real money. Each page says what is built, what has run, and what is still a design.

Where to go next

Section titled “Where to go next”

Cheshire is built by Taproot Wizards. The design notes these docs are written from are listed in further reading.