Overview

Cheshire is a shielded pool on Bitcoin. The idea comes from Zcash’s Orchard design: coins are private notes, spending a note publishes a nullifier, and a zero-knowledge proof ties the two together without saying which note was spent. What is new is who checks the proof. In Zcash, the Zcash node does. In Cheshire, a Bitcoin script does, so Bitcoin’s own nodes enforce the pool’s rules like any other spending condition.

The life of a payment

 your phone                    the network                     Bitcoin
 ──────────                    ───────────                     ───────
 1. prove the payment  ──▶  2. nodes share it on the
    (about a second)           share chain, agree on a batch,
                               split the proving work
                                        │
                            3. the batch is folded into
                               one final proof (about an hour)
                                        │
                            4. every node builds the same  ──▶  5. the pool coin's script
                               settlement transaction             runs the verifier; miners
                                                                  confirm it like any tx
 6. your wallet sees the
    settlement in a block, and
    the payee finds the note

The pieces

The pool coin. One taproot output holds every private satoshi. Its value is public. Its script commits to a 32-byte hash of the pool’s state: the roots of the two trees and how full each is. There is no key that can spend it; only a valid settlement (or exit) can. See the pool coin.

Notes. A note is a hash that commits to an amount and an owner. Notes are leaves of a Merkle tree. Only the owner can open one. See notes and nullifiers.

Nullifiers. Spending a note publishes a value derived from the owner’s secret and the note’s position. It marks the note spent without pointing to it. A second spend of the same note would publish the same nullifier and is refused.

Contributions. A payment, a deposit or a withdrawal is one contribution: a STARK proof your wallet makes on its own device (~83 KB, about a second), plus the few public values it commits to. A contribution never reveals the amount, the sender or the receiver.

Records. Each contribution leaves a 92-byte record in the settlement transaction: two new note commitments, two nullifier keys and one data word. From the records, anyone can rebuild both trees. From the records and a wallet’s seed, the owner can rebuild every note they own. See records.

Settlements. A settlement takes a batch of contributions and makes one Bitcoin transaction: the pool coin in, a new pool coin out, the records in the witness. The contributions’ proofs are folded by recursion into one final proof, and the pool coin’s script verifies it. The verifier is about 44 kvB of script; each record adds 29 vB. See settlements.

Deposits come in through deposit coins that a settlement takes in, and that their owners can cancel until then (deposits). Withdrawals leave through a vault output that one follow-up transaction pays out to every recipient (withdrawals). An exit inbox and a solo exit make sure nobody can keep you in (exits).

The share chain. Nobody is in charge of making settlements. Nodes gossip contributions and proving work on a small chain of shares (like P2Pool), agree on each round’s batch, split the jobs, and are paid in notes by the settlement’s own proof. Every node then builds the same transaction and broadcasts it. Bitcoin sees one transaction. See the share chain and paying the provers.

Wallets. The wallet is an iOS app with a Rust core. It keeps twelve words, proves on the phone, checks Bitcoin’s headers and each settlement itself, talks through Tor, and can rebuild everything from the seed and the chain. See wallets.

What Bitcoin enforces, and what it does not

Bitcoin enforces that a settlement is valid: the proof verifies, the published records are the proof’s, the value adds up, and the new pool coin carries the new state.

Bitcoin does not enforce that a settlement happens. Who batches, who proves and when is the job of the share chain and the wallets. If they all stopped, the pool coin would sit still, and every note would still be spendable by anyone willing to prove a settlement or a solo exit themselves.

This split is the design. The part Bitcoin checks is small and fixed. Everything that makes the pool convenient (the share chain, the inboxes, the vault, payroll, migrations) is a layer on top. A layer can change who does the work and how fast. It cannot change what a valid settlement is.

The numbers that matter

a payment proof on the phone	~83 KB, about a second (measured in the iOS simulator, not a phone)
a settlement’s fixed cost	~44 kvB, mostly the verifier
each contribution in a settlement	one 92-byte record, 29 vB
contributions in one standard (100 kvB) transaction	about 1,900
proving one settlement on one Mac	about an hour, ~9 GB of memory
proof security	100 bits nominal; about 40–65 bits proven (security)

Sizes are from the re-pins of 2026-11-04 and 2026-11-07. They change when the circuits or the verifier change.