Program

The pool is one Anchor program (Anchor 1.2.1). Its address:

HjQyQZ3xewjsBb3w8JFGJSh2ztauV4f6X4o5CrZTobZm

The program is upgradeable, so the deployed program is the reference: an upgrade changes the last-deployed slot in its ProgramData account. The Voidcash app builds and proves every transact. This page describes what it sends and what the program stores, so you can read the pool's accounts, decode its transactions and check them.

Accounts and PDAsCopy Anchor Link

Every PDA is derived from the program id with one fixed seed, except the nullifier accounts.

With @solana/kit, a fixed-seed PDA is one call. A nullifier's account takes the nullifier as 32 big-endian bytes:

import { address, getProgramDerivedAddress } from '@solana/kit';

const programAddress = address('HjQyQZ3xewjsBb3w8JFGJSh2ztauV4f6X4o5CrZTobZm');
const [config] = await getProgramDerivedAddress({ programAddress, seeds: ['config'] });
const [tree] = await getProgramDerivedAddress({ programAddress, seeds: ['tree'] });

const be32 = (x: bigint) => Uint8Array.from(x.toString(16).padStart(64, '0').match(/../g)!, (h) => parseInt(h, 16));
const [spent] = await getProgramDerivedAddress({ programAddress, seeds: ['nf', be32(nullifier)] });
// The note behind `nullifier` is spent if and only if `spent` exists.

The buyback also uses two SPL Token associated token accounts owned by the buyback PDA: one for wSOL, one for VOID. Their addresses are fixed in the buyback state by init_buyback.

Field elements (roots, nullifiers, commitments) are 32 bytes, big-endian. Integers are little-endian.

ConfigCopy Anchor Link

The pause flags are 1 deposits, 2 private transfers, 4 exits and relayer fees, 8 the buyback.

TreeCopy Anchor Link

The tree account is not an Anchor account: it starts with the magic voidtree.

The tree is an append-only Poseidon Merkle tree of depth 26 whose empty leaf is 0. Each transact appends two leaves. The history keeps one root per slot that had an insert: a later insert in the same slot replaces that slot's entry, and a new slot takes the next one.

Buyback stateCopy Anchor Link

InstructionsCopy Anchor Link

Discriminators are Anchor's: the first 8 bytes of sha256("global:<name>"). Arguments follow in Borsh.

import { createHash } from 'node:crypto';

const discriminator = (name: string) => createHash('sha256').update(`global:${name}`).digest().subarray(0, 8);
discriminator('transact').toString('hex'); // 'd995828fdd34fc77'

Params is min_deposit: u64, shield_fee_bps: u16, exit_fee_bps: u16, buyback_share_bps: u16, 14 bytes. pause takes a non-zero combination of the four flags.

transactCopy Anchor Link

transact shields, sends privately and unshields. Its direction comes from the sign of ext_amount.

pub fn transact(
    ctx: Context<Transact>,
    proof: [u8; 256],
    root_index: u8,
    nullifiers: [[u8; 32]; 2],
    commitments: [[u8; 32]; 2],
    ext: ExtData,
) -> Result<()>

pub struct ExtData {
    pub ext_amount: i64,      // lamports entering (> 0) or leaving (< 0) the pool, before the exit fee
    pub relayer_fee: u64,     // lamports, paid from the notes
    pub deadline_slot: u64,   // the last slot the transaction may land in
    pub fee_bps: u16,         // the pool's fee rate for this direction, as shown to the user
    pub ciphertext0: [u8; 88],
    pub ciphertext1: [u8; 88],
}

Instruction dataCopy Anchor Link

595 bytes:

AccountsCopy Anchor Link

In this order:

The fee payer pays the two nullifier accounts' rent, and a shield's amount and fee.

What the program checksCopy Anchor Link

In order:

1. The current slot is at most deadline_slot (Expired).
2. |ext_amount| and relayer_fee are at most 2^60 (AmountTooLarge).
3. The pause flag for the direction is clear: deposits for ext_amount > 0, transfers for 0, exits for < 0, and exits for any relayer_fee > 0 (Paused).
4. A deposit is at least min_deposit (DepositTooSmall) and pays no relayer (DepositFee).
5. fee_bps equals the pool's rate for the direction: shield_fee_bps, 0 or exit_fee_bps (FeeChanged).
6. The Groth16 proof verifies (BadProof) against seven public inputs, in this order: the root at root_index, the public amount, the ext-data hash, the two nullifiers, the two commitments.

The nullifier accounts are created before the handler runs, so a spent note fails there: its account already exists.

The public amount is ext_amount - relayer_fee as a field element: x, or r − |x| when negative. The ext-data hash is SHA-256 over these parts, concatenated, with its first byte masked by 0x1f so it is below 2^253:

Where the SOL goesCopy Anchor Link

The fee is |ext_amount| × fee_bps / 10,000, rounded down. The buyback gets fee × buyback_share_bps / 10,000, rounded down; the treasury gets the rest.

EventsCopy Anchor Link

Anchor events, logged as Program data: while the pool program runs. The discriminator is the first 8 bytes of sha256("event:<Name>").

The ciphertexts and nullifiers are not in the events: read them from the instruction data. Pauses, parameter changes and upgrades emit no event; read them from the config account and the program's ProgramData.

Error codesCopy Anchor Link

Anchor numbers the program's custom errors from 6000. A failed transaction's logs carry the code, the name and the message.

Account constraints that fail report Anchor's own codes, such as 2012 (ConstraintAddress) for a wrong pinned account.