Private gas

A private transaction must not be sent from the user's address: the transaction's sender field would name them. So PrivateVault is itself an ERC-4337 account. A UserOperation names the vault as its sender and carries the transaction and its proof in its signature field. A bundler submits it to the canonical EntryPoint v0.8 (0x4337084D9E255Ff0702461CF8895CE9E3b5Ff108), and the operation pays its own gas in HYPE out of the notes it spends: the gas fee, ext.gasFee, fixed by the proof. Gas is always paid in HYPE, also when the operation moves a token: the gas then comes from a separate HYPE note spent in the same proof, so a user needs some shielded HYPE to move a token privately.

No deposit, relayer or paymaster pays for anyone. Each operation brings its own gas, and what it does not use goes to the fee collector.

The UserOperationCopy Anchor Link

accountGasLimits packs verificationGasLimit (high 128 bits) and callGasLimit (low 128 bits); gasFees packs maxPriorityFeePerGas and maxFeePerGas the same way. The proof does not fix these fields, so a bundler can estimate and price the operation. It fixes minCallGasLimit and the gas fee, because both are in ext, whose hash is a public input.

Every operation has the same sender, and its nonce key is its first nullifier, so operations from different users never queue behind each other. A nullifier can be spent once anyway.

Validation does the whole transitionCopy Anchor Link

function validateUserOp(PackedUserOperation calldata op, bytes32, uint256) external returns (uint256 validationData);
function execute4337(uint256 exitId) external;

validateUserOp can be called only by the EntryPoint (NotEntryPoint) and reverts while the vault is paused (EnforcedPause). Otherwise, in order:

maxCost = (verificationGasLimit + callGasLimit + preVerificationGas) * maxFeePerGas      wei
require ext.gasFee >= maxCost                                                          else GasFeeBelowCost

maxCost is exactly the prefund the EntryPoint requires of an operation with no paymaster. Because the operation deposits at least that much in its own validation, the deposit never pays for another operation. The tests check this with an earlier overpayment sitting in the deposit: an operation paying less than its own cost is still refused (test_vaultNeverPaysSomeoneElsesGas).

The execution step, execute4337(exitId), only pays the exit to its recipient, unless the exit is held or stopped. It never reverts on a recipient that refuses the HYPE or a token transfer that fails, and if it fails for any other reason the exit stays for releaseExit. Everything else already happened in validation, so a failing execution cannot undo a spend. See Paying an exit.

Estimating with a placeholder proofCopy Anchor Link

An invalid proof does not revert validation. validateUserOp returns SIG_VALIDATION_FAILED (1), as ERC-4337 expects of a bad signature, and writes nothing; the EntryPoint then refuses to execute the operation. A verifier that reverts is treated the same way. This lets a wallet ask a bundler for gas estimates with a random placeholder proof of the real size (9,152 bytes), then sign and prove once with the final numbers. The other checks still revert, so the estimate is realistic.

A proof made for ERC-4337 names the vault as ext.caller, so it cannot be submitted through transact (WrongCaller), and a proof made for transact must carry a gas fee of zero.

Where the gas fee goesCopy Anchor Link

The gas fee is part of the HYPE leaving the notes, and goes only to the EntryPoint deposit. Where it comes from depends on the asset the operation moves:

HYPE exit:        exitAmount = gasFee + exit,  feeAmount = 0          out of the main pair
HYPE send:        feeAmount  = gasFee,  exitAmount = 0               out of a spare HYPE fee note, when there is one
                  exitAmount = gasFee,  feeAmount = 0                otherwise out of the main pair
token operation:  feeAmount  = gasFee                                 out of the HYPE fee pair
                  exitAmount = the token exit                         0 for a send
exit fee          = floor(exit * 1%)                                  in the exit's asset; the gas fee pays none

For a token operation the vault requires feeAmount == gasFee when a token leaves (FeeAmountNotGasFee), so the fee pair pays the gas and nothing else. The app picks the smallest HYPE note that covers the gas fee, in the same tree as the token's notes, and returns its change to the spender. Without such a note it refuses before anything is signed.

A private HYPE send of a fixed amount (to an address, to a private address, or into a payment link) does the same when it can: the smallest HYPE note that covers the gas fee goes to the fee pair, and the two largest of the others must hold the amount (selectHypeWithFeeNote in the SDK). The send then has the public figures of a token send. When no note can be set aside, it pays its gas from the main pair as before.

1. Validation deposits gasFee into the vault's EntryPoint deposit.
2. The EntryPoint pays the bundler (the bundle's beneficiary) the gas the operation actually used, at the price it was charged, out of that deposit.
3. What is left stays in the deposit. sweepFees() sends the whole deposit, with the HYPE exit fees, to the fee collector (0x145618DF0662dCd38a2Cf2AC4d24Dfe1FC8A4991), which splits it between the team and buying VOID to burn. See Fees.

The deposit must not stay empty: a bundler simulates its gas estimate at a tiny gas price and still requires a prefund from the account's deposit, so with none it refuses with AA21 didn't pay prefund. Since sweepFees() empties the deposit and anyone can call it, the keeper (services/keeper) keeps it at 0.001 HYPE (MIN_DEPOSIT_HYPE): after any sweep it calls EntryPoint.depositTo(vault) for what is missing. That HYPE is swept to the collector at the next sweep.

No HYPE or token leaves the notes except through the exit fee and the large-exit hold, or as gas the EntryPoint spends. contracts/test/VaultGasFeeBypass.t.sol checks that a gas fee cannot be used to skip either.

How much is overpaidCopy Anchor Link

The gas fee is set to the operation's maximum cost: its limits at the bundler's maximum fee. An operation uses less than its limits and is charged less than its maximum fee, so it always overpays. The whitepaper's figures, from the prices of 3 November 2026, measured on the vault's first implementation:

Since the v2 upgrade an operation spends three notes, inserts two pairs of leaves instead of one and runs a larger verifier, so it uses more gas. The second pair alone adds about 800,000 gas to every spend, more than the larger verifier does. The SDK's end-to-end test measured, for the whole handleOps of one operation with the real proof:

validateUserOp alone used 4.94M to 5.12M, the most for a token's first exit, which writes the token's window. The SDK's verification gas limit is 6,000,000 to keep a margin above that. The gas fee of every operation rose accordingly.

The deposit and the stakeCopy Anchor Link

• Deposit. The vault's EntryPoint deposit receives every operation's gas fee in validation. Between bundles it holds only what operations overpaid, and anyone else's deposit for the vault. sweepFees withdraws all of it to the fee collector.
• Stake. addStake(unstakeDelaySec) forwards the HYPE sent with it to EntryPoint.addStake for the vault. Anyone can call it. The vault has no function that unlocks or withdraws stake.
• missingAccountFunds. The vault ignores it: its own deposit, topped up by the gas fee a line earlier, covers the prefund.

The bundlerCopy Anchor Link

No public ERC-4337 bundler serves Elysium, so voidcash runs one: Alto, Pimlico's open-source bundler, at https://bundler.voidcash.io. Its code and configuration are in services/bundler, and the choice of version and the security check behind it in docs/elysium/bundler.md.

The allowed methods are eth_chainId, eth_supportedEntryPoints, eth_estimateUserOperationGas, eth_sendUserOperation, eth_getUserOperationReceipt, eth_getUserOperationByHash, pimlico_getUserOperationGasPrice and pimlico_getUserOperationStatus.

Alto sits behind a gate (services/bundler/gate.mjs), the only public port. It forwards an operation only if its sender is the vault, its EntryPoint is v0.8 and it has no factory, paymaster or EIP-7702 authorization. It answers CORS for the app's origins only, limits each client address to 120 requests a minute and 20 estimates or sends a minute, caps request bodies at 64 KB, and passes on no client header.

Running with safe mode off is acceptable here because only the vault's operations get in, and the vault's validation is known. What can make a vault operation pass simulation and then fail on-chain is another transaction spending the same note first. With one operation per bundle, Alto's simulation of each bundle right before sending catches that. Without safe mode Alto also keeps no reputation, so the vault, everyone's sender, can never be throttled for one user's failures.

What the bundler can and cannot do:

• It sees the network address of each request, and can delay or drop an operation.
• It can be paid at most the operation's gas fee, and nothing beyond it.
• It cannot read a note, change a recipient, an amount or the gas fee, or spend a note without its owner's proof.

Anyone can run another bundler for the vault. Anyone can also submit through transact directly and pay the gas from their own address, which makes that address visible.

The SDK's submittersCopy Anchor Link

The SDK (packages/sdk/src/submitters.ts) sends operations through a Submitter, which prices, estimates and sends.

A private action runs in this order (PrivacyClient.privateSpend):

bundlerSubmitter takes an optional fallbackUrl. A plain HTTP refusal from a gateway moves it there for the rest of the session; a JSON-RPC error is the bundler's answer about the operation and is shown to the user. directSubmitter sends handleOps with a gas limit of 20,000,000.

Gas prices on ElysiumCopy Anchor Link

Elysium charges gas in HYPE and has no parent-chain data fee: data availability is AnyTrust, and the per-byte price is 0. Read on 3 November 2026:

The bundler's executors bid 1.5 times the base fee for their bundles, and Elysium charges only the base fee. The chain's owner can change its gas parameters; the constants page lists the values the code relies on.