The pool program

The pool is one Anchor program (Anchor 1.2.1). It holds the SOL behind every note, verifies a Groth16 proof for every transaction, and runs the buyback of $VOID. Its declared program ID is HjQyQZ3xewjsBb3w8JFGJSh2ztauV4f6X4o5CrZTobZm.

AccountsCopy Anchor Link

Every account is a PDA of the program, with a fixed seed: anyone can derive each address from the seeds below and the program ID.

Notes hold native lamports, so the pool itself has no token accounts. The treasury and the buyback are funded with their rent-exempt minimum at initialize, so small fee credits to them are accepted.

ConfigCopy Anchor Link

The launch parameters are a minimum deposit of 0.01 SOL (10,000,000 lamports), no shield fee, a 0.5% exit fee (50 bps) and a buyback share of 5,000 bps (half of every fee). The values in force are always the config account's: the app reads them on every sync.

InstructionsCopy Anchor Link

At initialization one key is the upgrade authority, the admin and the guardian.

transactCopy Anchor Link

Accounts, in order: payer (signer, writable), config, tree, vault, treasury, buyback, nullifier 0, nullifier 1 (both created here), recipient, relayer, system program.

Data, after the 8-byte discriminator: the proof (256 bytes), root_index (u8), two nullifiers and two commitments (32 bytes each, big-endian), then ExtData:

Checks, in order:

1. The current slot is at most deadline_slot (Expired).
2. The absolute ext_amount and the relayer_fee are at most MAX_AMOUNT (AmountTooLarge).
3. By direction: a shield needs deposits open, at least min_deposit (DepositTooSmall) and no relayer fee (DepositFee); a private transfer needs transfers open; an unshield needs exits open. Any relayer fee also needs exits open (Paused).
4. fee_bps equals the pool's current rate for the direction (FeeChanged).
5. The program computes extDataHash from the accounts and the ext data, and publicAmount = ext_amount - relayer_fee, reads the root at root_index, and verifies the proof (BadRoot, BadProof). See The circuit.
6. Anchor creates both nullifier accounts, paid by the payer. A spent nullifier's account already exists, so the transaction fails.

Then it inserts both commitments, emits Inserted, and moves SOL.

FeesCopy Anchor Link

fee              = |ext_amount| × fee_bps / 10,000                 rounded down
buyback share    = fee × buyback_share_bps / 10,000                rounded down
treasury share   = fee − buyback share                             the rounding goes to the treasury

fee_bps is shield_fee_bps for a shield, exit_fee_bps for an unshield, and 0 for a private transfer.

The notes pay |ext_amount| + relayer_fee for an unshield and relayer_fee for a transfer, which is what publicAmount makes the circuit balance. The payer of every transaction also pays the rent of its two nullifier accounts; for a relayed transaction the relayer is the payer, and its fee covers that rent.

The rate is part of the proof's ext data and must match the pool's: a fee change after a transaction was built makes the program refuse it, so no transaction is ever charged a rate the user was not shown.

Pause flagsCopy Anchor Link

The guardian or the admin sets flags; only the admin clears them. A relayed private transfer needs both transfers and exits open, since it pays the relayer from the vault. observe is not paused: it moves no SOL.

EventsCopy Anchor Link

The indexer reads both, and alerts on Exited amounts above a share of the vault.

LimitsCopy Anchor Link

There is no cap on how much can leave the vault per transaction or per time window, and no cap on the pool's size. Every exit emits Exited for monitoring.

ErrorsCopy Anchor Link

UpgradesCopy Anchor Link

The program is upgradeable, so a bug can be fixed in place without moving funds to a new program. The upgrade authority and the config's admin are one key, the developer's, with no multisig and no timelock.

That key can change every rule: the fees (within MAX_FEE_BPS with set_params, or beyond it with an upgrade), the verifying key, and where funds go. With an upgrade it can move the vault's SOL. Users of the pool trust whoever holds it. The guardian can only pause.

Every upgrade is visible on-chain: the indexer alerts when the program's ProgramData changes, as it does on every pause and parameter change. The 128 reserved bytes in Config let an upgrade add parameters without an account migration.