FAQ
Is this a sidechain, a rollup or a bridge?
Section titled “Is this a sidechain, a rollup or a bridge?”No. There is one chain, Bitcoin, and one coin on it that holds the value. There is no second token, no validator set, no challenge period and no bridge. The nearest word is “validity rollup”, in that a proof of a state change is checked on the base chain. But there is no separate chain, only a tree inside a coin.
Who runs it?
Section titled “Who runs it?”Nobody has to. Wallets prove their own payments. Any node can gather them into a settlement and prove it; the share chain is how nodes agree on the next batch and who gets paid for proving. If every node stopped, every note would still be spendable by anyone willing to prove a settlement or a solo exit themselves.
Can someone steal my money?
Section titled “Can someone steal my money?”There is no operator. A settlement that pays out more than its proof allows fails the pool coin’s script and does not confirm. A deposit coin is yours until it is picked up, and comes back if it is never settled. A majority of provers can delay your ordinary payments; it cannot block your exit or keep your deposit.
The real risk is a bug: a flaw in the circuits or the verifier could let someone forge notes and drain other people’s value, up to what the pool holds. Nobody outside the project has audited the code. See security.
Can the supply be inflated?
Section titled “Can the supply be inflated?”Not the bitcoin: the pool is one public output, and Bitcoin’s rules cap what it pays out. A note could be forged only through a bug in the circuits or the verifier. There is no trusted setup.
Is it really private?
Section titled “Is it really private?”Inside the pool, a payment hides the sender, the receiver, the amount and the number of notes. The zero-knowledge argument is written down and conditional, and nobody outside the project has checked it. Deposits and withdrawals are visible at the edges, as in Zcash, and at today’s low volume their timing can link them. See privacy.
How does it compare to Zcash?
Section titled “How does it compare to Zcash?”Better in some ways:
- no trusted setup;
- hash-based, post-quantum-sound proofs;
- runs on Bitcoin, enforced by Bitcoin’s own nodes, with bitcoin as the money;
- counts of notes per payment are hidden.
Worse in others, honestly:
- cost per payment at low volume: every settlement pays for a ~44 kvB verifier, so a lone payment in a quiet hour is expensive, or waits;
- speed: a settlement takes about an hour to prove;
- maturity: Zcash has years of production use and outside review; Cheshire is an unaudited prototype;
- security margin: about 40–65 proven bits today, which the project says is too low for mainnet;
- anonymity set: today it is tiny;
- it needs a soft fork Bitcoin does not have.
Why does it need a soft fork?
Section titled “Why does it need a soft fork?”Bitcoin script cannot run a STARK verifier today: no OP_CAT, 520-byte stack items, a
1,000-item stack. Great Script Restoration (BIP-440 and BIP-441) restores the opcodes under a
cost budget. Cheshire runs on signets where it is active. See GSR.
Why STARKs and not SNARKs?
Section titled “Why STARKs and not SNARKs?”No trusted setup, no elliptic curves in the proof, and hash-based proofs are what a script
with OP_SHA256 and OP_CAT can check. The cost is size: about 44 kvB of verifier per
settlement.
How much does a payment cost?
Section titled “How much does a payment cost?”About 29 vB of a settlement that costs about 44 kvB fixed. In a full settlement that is around 50 sat at 1 sat/vB; in a nearly empty one, thousands. Wallets pay a fixed ladder value, 500 sat at the lowest level when fees are 1 sat/vB. See fees.
How long does a payment take?
Section titled “How long does a payment take?”Proving your payment: about a second on the phone. The settlement that carries it: about an hour of proving, then a Bitcoin block. At low volume, it may also wait for other payments to share the cost.
What if I lose my phone?
Section titled “What if I lose my phone?”Keep your twelve words. Every note you own, including ones paid to you, can be rebuilt from them and the chain, with no server. See seed recovery.
Is it ready for real money?
Section titled “Is it ready for real money?”No. It is an unaudited research prototype, with a proven security level the project itself calls too low for mainnet, on a soft fork that is not active on Bitcoin.
Why is the verifier so big?
Section titled “Why is the verifier so big?”It is a full STARK verifier in script: 7 queries, each opening Merkle paths, plus the constraint checks. Three rounds of work cut it from about 60 kvB to about 44 kvB without lowering any margin. Levers that would lower one were declined.
What is a re-pin?
Section titled “What is a re-pin?”Every circuit has a fixed identity, and each parent accepts only its pinned children. Changing a circuit changes its identity, its parents, the final verifier and so the pool’s address. A re-pin redoes all of that (about 1.5–3 hours on one Mac). It always means a new pool.
Does it use any other opcodes?
Section titled “Does it use any other opcodes?”No. Only BIP-440 and BIP-441 in tapleaf 0xc2, plus ordinary tapscript. The GSR test node
also carries some draft opcodes; Cheshire uses none of them.