The relayer

Every Solana transaction has a fee payer, and the fee payer is public. If a user's wallet paid for a private transfer or an unshield, the transaction would show that wallet. So the app sends those transactions to a relayer, which submits them as the fee payer and is paid back from the notes. Shields need no relayer: the depositor's wallet is public in a shield anyway, and signs it once.

The relayer is run by the Voidcash team. The app uses the one it was built with.

A requestCopy Anchor Link

What it checksCopy Anchor Link

A refused request costs the relayer nothing: a simulation is free.

It never signs a transaction the user built. It rebuilds the transact instruction from the request, in a version 0 transaction with itself as fee payer, and adds only a compute budget (a 400,000-unit limit and its priority fee). It may compress the program's fixed accounts with its own address lookup tables.

The quoteCopy Anchor Link

quote = 2 × rent(8-byte account)                         the two nullifier accounts, whose rent stays locked
      + 5,000 + ceil(priority × 400,000 / 1,000,000)     the network fee, priority fee included
      + margin

The rent is read from the chain on every quote, and GET /v1/info always gives the fee in force. The relayer fee is the same for a transfer, a merge and an unshield.

What it can and cannot doCopy Anchor Link

The relayer cannot:

• change the recipient, the amount, the relayer account, the fee, the fee rate, the deadline or the ciphertexts: all are bound in extDataHash, and any change makes the proof fail;
• send the transaction after its deadline_slot: the program refuses it (Expired);
• spend a note or learn which notes a proof spends: it has no keys, and the proof shows only nullifiers;
• take more than its quoted fee, which the user's proof fixed.

The relayer can:

• refuse a request, or hold it until the deadline. The app then shows the error, and the notes stay unspent;
• see the request, which becomes public on-chain when it is sent, and the network address it came from.

It keeps no request logs: no IP addresses and no bodies. CORS is open only to the origins it is configured for.

Since the relayer account is bound in the proof, anyone who obtained a request could submit it themselves; the fee would still go to the relayer it names.

APICopy Anchor Link

Errors come back as { error } with the status codes above.

The buyback crankCopy Anchor Link

The relayer also runs the buyback's crank, from the same key. Every 4 seconds it reads the buyback state, the config and the buyback account, and:

• sends nothing while no pool is pinned, the buyback is paused, or the buyback holds less than one minimum chunk (0.01 SOL above its rent);
• sends observe once per observation interval (30 slots);
• sends buyback once a buy is due: a full ring of 15 observations, the latest within 90 slots, and 150 slots since the last buy.

The program pays callers nothing, so every crank transaction costs the relayer its own fee. At the default priority fee that is about 6,000 lamports for an observation (20,000 compute units) and 15,000 for a buy (200,000). Every transaction is simulated first and sent only if it passes, so a pumped price, a raised pool fee or a disabled pool costs nothing but the read.