Shielded Note

A shielded note represents private spendable value. Its commitment preimage contains eleven field elements. Four are reserved and inserted as zero during hashing. The pool stores only the note commitment as a leaf in its shared commitment tree. The opening remains private and is delivered to the key holder. The Key Derivation page defines nk, ivk, and the other keys used below.

The commitment

The note commitment is the Poseidon2 hash of the note opening in this canonical order:

commitment = Poseidon2(
                 amount,            note value, in the asset's base units
                 asset_id,          the asset, as a field element
                 d,                 address diversifier
                 pk_x, pk_y,        diversified address coordinates
                 secret,            per-note randomness
                 P,                 reserved, always zero
                 bitmap_0,          reserved, always zero
                 bitmap_1,          reserved, always zero
                 depth,             reserved, always zero
                 shieldTimestamp    when the oldest ancestor entered the pool
             )

The resulting note commitment is appended to MIP410 pool’s commitment tree.

The fields

Field	Holds
`amount`	The note’s value in the asset’s base units, range-checked to 128 bits so conservation sums cannot wrap.
`asset_id`	The MIP20 token address encoded as a field element. Bound to the token transferred during shielding and to the input notes during later spends.
`d`	The diversifier used to derive the address.
`pk_x, pk_y`	Coordinates of the note’s diversified address.
`secret`	Fresh per-note randomness, so two otherwise-identical notes get distinct commitments.
`P`	Reserved field. Always zero.
`bitmap_0, bitmap_1`	Reserved fields. Always zero.
`depth`	Reserved field. Always zero.
`shieldTimestamp`	A prover-supplied Unix timestamp accepted at shielding: no later than the inclusion block and at most 3,600 seconds earlier. A spend carries forward the minimum input value.

The proof for each action binds the opening to the action’s public values and input notes. A different value produces a different commitment and fails the proof.

The opening

The eleven fields form the note opening. During a shielded payment, the sender delivers the recipient note opening in an encrypted note memo addressed to the recipient’s incoming viewing key. The recipient wallet or a VASP with delegated viewing access recomputes the note commitment and compares it with the payment effect fixed at initiation. Shield and change note openings remain with their key holders.

Spending a note

Spending requires the ownership and authorization checks. Each note has a nullifier derived from its nullifier key and position in the commitment tree:

\mathrm{nullifier} = \mathrm{Poseidon2}(nk, \mathrm{leafIndex}, \mathrm{DOMAIN\_NULLIFIER})

\mathrm{leafIndex}

is the note’s position in the tree. During payment initiation, the nullifier remains sealed in the payment effect hash while the input lock ID reserves the note. The pool records the nullifier in the spent set when an Accept resolution or unshield spends the note. An nk holder who knows the note’s leaf index can connect its nullifier to its commitment; the public nullifier does not reveal the diversified address.

What the chain sees

Visibility	Data
Public	The note commitment and commitment tree root; input lock IDs from initiation; nullifiers when the note is spent. Accepted payments retain input locks permanently.
Private	The full note opening, including its address and randomness. Shielding discloses the deposited asset, amount, and timestamp; unshielding discloses the withdrawn asset, amount, and public destination.

Proofs read the opening and bind it to the public note commitment. The capability lattice defines which key bundles can recognize or spend notes, including the MIP410 authority’s regulatory viewing access.

Network fundamentals

Assets and payments

Privacy

Compliance

Contracts and automation

Data and signatures

Interoperability

The commitment

The fields

The opening

Spending a note

What the chain sees

​The commitment

​The fields

​The opening

​Spending a note

​What the chain sees

The commitment

The fields

The opening

Spending a note

What the chain sees