> ## Documentation Index
> Fetch the complete documentation index at: https://docs.metalntwx.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Shielded Note

> The private fields of a shielded note, its onchain commitment and the nullifier recorded when it is spent

A shielded note represents private spendable value. Its commitment preimage
contains eleven field elements. Four are reserved and inserted as zero during
hashing. The pool stores only the note commitment
as a leaf in its shared commitment tree. The opening remains private and is
delivered to the key holder. The [Key
Derivation](https://docs.metalntwx.com/reference/privacy/key-derivation.md) page defines `nk`, `ivk`, and the
other keys used below.

## The commitment

The note commitment is the Poseidon2 hash of the note opening in this canonical
order:

```text theme={null}
commitment = Poseidon2(
                 amount,            note value, in the asset's base units
                 asset_id,          the asset, as a field element
                 d,                 address diversifier
                 pk_x, pk_y,        diversified address coordinates
                 secret,            per-note randomness
                 P,                 reserved, always zero
                 bitmap_0,          reserved, always zero
                 bitmap_1,          reserved, always zero
                 depth,             reserved, always zero
                 shieldTimestamp    when the oldest ancestor entered the pool
             )
```

The resulting note commitment is appended to MIP410 pool's commitment tree.

## The fields

| Field | Holds |
| - | - |
| `amount` | The note's value in the asset's base units, range-checked to 128 bits so conservation sums cannot wrap. |
| `asset_id` | The MIP20 token address encoded as a field element. Bound to the token transferred during shielding and to the input notes during later spends. |
| `d` | The diversifier used to derive the address. |
| `pk_x, pk_y` | Coordinates of the note's [diversified address](https://docs.metalntwx.com/reference/privacy/key-derivation.md#addresses). |
| `secret` | Fresh per-note randomness, so two otherwise-identical notes get distinct commitments. |
| `P` | Reserved field. Always zero. |
| `bitmap_0, bitmap_1` | Reserved fields. Always zero. |
| `depth` | Reserved field. Always zero. |
| `shieldTimestamp` | A prover-supplied Unix timestamp accepted at shielding: no later than the inclusion block and at most 3,600 seconds earlier. A spend carries forward the minimum input value. |

The proof for each action binds the opening to the action's public values
and input notes. A different value produces a different commitment and fails
the proof.

## The opening

The eleven fields form the note opening. During a
shielded payment, the sender delivers the recipient note opening in an
encrypted note memo addressed to the recipient's incoming viewing key. The
recipient wallet or a VASP with delegated viewing access recomputes the
note commitment and compares it with the payment effect fixed at initiation.
Shield and change note openings remain with their key holders.

## Spending a note

Spending requires the [ownership and authorization
checks](https://docs.metalntwx.com/reference/privacy/key-derivation.md#spend-authorization). Each note has a
nullifier derived from its nullifier key and position in the commitment tree:

$$
\mathrm{nullifier} = \mathrm{Poseidon2}(nk, \mathrm{leafIndex}, \mathrm{DOMAIN\_NULLIFIER})
$$

$\mathrm{leafIndex}$ is the note's position in the tree. During payment
initiation, the nullifier remains sealed in the payment effect hash while the
input lock ID reserves the note. The pool records the nullifier in the spent
set when an `Accept` resolution or unshield spends the note. An `nk` holder
who knows the note's leaf index can connect its nullifier to its commitment;
the public nullifier does not
reveal the diversified address.

## What the chain sees

| Visibility | Data |
| - | - |
| Public | The note commitment and commitment tree root; input lock IDs from initiation; nullifiers when the note is spent. Accepted payments retain input locks permanently. |
| Private | The full note opening, including its address and randomness. Shielding discloses the deposited asset, amount, and timestamp; unshielding discloses the withdrawn asset, amount, and public destination. |

Proofs read the opening and bind it to the public note commitment. The
[capability lattice](https://docs.metalntwx.com/reference/privacy/key-derivation.md#the-capability-lattice)
defines which key bundles can recognize or spend notes, including the MIP410
authority's [regulatory viewing access](https://docs.metalntwx.com/start/privacy).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.