note commitment
In a shielded payment system, a coin is not stored as a visible balance but as a note — a private record of how much value it holds, who can spend it, and a dash of randomness to make it unique. The note commitment is the public, on-chain fingerprint of that note: a hiding, binding cryptographic commitment that reveals nothing about the value or owner, yet pins the note down so it cannot later be changed. It is the shielded equivalent of a UTXO entry, except that everyone can see the entry exists while nobody can read its contents.
A note typically bundles the recipient's address (or a public key derived from it), the value, and one or more random fields such as rho and a blinding factor. The commitment is produced by hashing these together with a collision-resistant, hiding commitment scheme — Zcash Sapling uses a Pedersen hash over an elliptic curve for this. 'Hiding' means the published commitment is statistically independent of the value and recipient, so observers learn nothing; 'binding' means the owner cannot open the same commitment to a different note later, which is what stops them from inflating their balance.
These commitments are not stored in isolation. Every new note commitment is appended as a leaf to an append-only, incremental Merkle tree — the note-commitment tree — whose root summarises the entire set of shielded coins ever created. To spend a note, you do not point at it directly (that would break privacy); instead your zero-knowledge proof demonstrates that you know the opening of some note whose commitment is a leaf under the current tree root, via a Merkle authentication path, and simultaneously reveals that note's nullifier to mark it spent. The verifier checks the proof against the public root and never learns which leaf you used.
The note/commitment/nullifier triad is the core data model of every modern shielded protocol and zk-mixer. Commitments are the coins entering the anonymity set and are never removed; nullifiers are the coins leaving and are recorded separately. Because spends reference only the tree root rather than a specific leaf, the anonymity set of a spend is, in principle, every note that existed when the proof was made — which is why a deep, widely-used commitment tree is the foundation of strong shielded privacy.
When Alice is paid, a note (value=2, recipient=Bob's pk, rho, rcm) is created and its commitment cm = PedersenHash(value, pk, rho, rcm) is appended to the tree as leaf number 4,210,983. Later, to spend it, Bob proves a Merkle path from cm up to the published root and reveals the note's nullifier — without anyone learning that leaf 4,210,983 was the one consumed.
A note becomes a leaf; spending proves leaf membership in zero knowledge against the root.
Because the commitment tree is append-only, your spend can prove membership against any past root, not just the latest — useful for light clients, but implementations must bound how old a root may be to keep nullifier checks tractable.