shielded transaction

A shielded transaction is a fully private transfer that takes place inside a shielded pool, hiding the sender, the receiver, and the amount all at once behind a single zero-knowledge proof. Where confidential transactions hide only amounts and ring signatures only the sender, a shielded transaction leaks essentially nothing on-chain except that some valid spend occurred. This is the model pioneered by Zcash: coins inside the shielded pool exist only as cryptographic commitments, and a transaction proves in zero knowledge that the rules were followed without exposing any of the inputs.

The pool works like a giant shared vault. Every shielded coin is a note — a record of (value, recipient, randomness) — stored on-chain only as a hiding commitment, and these commitments are appended as leaves to an append-only Merkle tree. To spend, you build a zk-SNARK proving four things at once: you know the secret opening of some note whose commitment is a leaf in the tree (a Merkle-path membership proof), that note has not been spent before (you reveal its nullifier, a unique tag the network records), the new output notes are well-formed, and the values balance. The verifier checks only the succinct proof and the nullifier; it never sees which note was spent or to whom value flowed.

Because the anonymity set is the entire shielded pool — potentially millions of notes — rather than a fixed ring of sixteen, the privacy ceiling is far higher than ring-signature systems. Transactions come in flavours: shielding (transparent to shielded, t-to-z), deshielding (z-to-t), and the fully private z-to-z. The catch is that privacy is only as large as the set of people actually using the pool, and crucially is only as good as the weakest link in your behaviour: shield, deshield to a fresh address, and never correlate the timing or amounts.

The honest weaknesses are usage and metadata. On chains where shielding is optional, most users transact transparently, so the shielded set is smaller than it could be, and round-trip patterns (shield X, immediately deshield X to a tagged exchange) can leak through amount and timing correlation even though the on-chain link is broken. Generating the zk-SNARK is also computationally heavier than a normal signature, which historically limited shielded transactions on low-power devices until proving systems like Sapling made them practical.