Shielded Transaction

A shielded transaction is a blockchain payment whose key details, who paid, who received and how much, are encrypted rather than published in the clear. The network still confirms that the transaction is valid, that the sender owned the funds and did not spend them twice, by checking a cryptographic proof instead of the underlying data. The term is most closely tied to Zcash, which launched in 2016 as the first major cryptocurrency to offer this kind of privacy using zk-SNARKs.

Shielded transactions contrast with the transparent transfers used by Bitcoin and most other blockchains, in which every amount and address is public and can be traced with blockchain analytics. They are one of several approaches to on-chain privacy, alongside the ring signatures and confidential amounts used by Monero. Assets that offer such features are often grouped as a privacy coin.

Imagine a public noticeboard where every payment in town must be pinned up for anyone to read. A normal blockchain payment is a card that says "Ann paid Ben 50". A shielded payment is a sealed envelope pinned to the same board, with a certificate from a trusted maths check stamped on the outside saying "the money in here was really Ann's, she has not spent it before, and the amounts add up".

Everyone can see that a valid payment happened, so the town's books still balance. But only Ann, Ben and anyone they choose to show can open the envelope.

In Zcash, shielded funds are held as encrypted "notes" in a shielded pool. To spend a note, a wallet creates a transaction that includes:

• Commitments. New notes are added to the chain as cryptographic commitments, which hide their value and owner but bind them so they cannot later change.
• Nullifiers. Each spent note reveals a unique tag that marks it as used, preventing double spending without revealing which note it was.
• A zero-knowledge proof. A zero-knowledge proof shows that the spender knows the keys for a real, unspent note and that inputs equal outputs plus fees.
• Encrypted memos. The recipient receives an encrypted copy of the note details and can include a short private message.

Transactions can move funds between the transparent and shielded parts of the network. Fully shielded transfers, from one shielded address to another, give the strongest privacy, while moving funds in and out of the pool reveals some information.

Zcash's design came from academic work on a protocol called Zerocash, published in 2014. The original "Sprout" version at launch in 2016 was slow and memory-hungry, so few users made shielded transfers. The "Sapling" upgrade of October 2018 made shielded transactions much faster, practical on mobile phones. Early versions relied on a "trusted setup" ceremony, in which secret values had to be destroyed to keep the system sound. The NU5 upgrade of May 2022 introduced the "Orchard" pool based on a proof system called Halo 2, which removed the need for a trusted setup, and brought in unified addresses. Similar techniques have been used by other projects building private payments or private smart contracts. Shielded transactions are larger and slower to create than transparent ones, because the wallet must compute a proof, and much of Zcash's engineering history has been an effort to bring that cost down far enough for everyday use on ordinary devices. Wallet software also has to scan the chain to find notes addressed to its owner, which made early light wallets slow to sync.

Zcash lets owners share a viewing key that reveals their incoming, and optionally outgoing, shielded transactions to a chosen party, such as an auditor, exchange or tax authority, without giving that party the ability to spend. This selective disclosure is presented as a way to combine privacy with regulatory obligations such as the travel rule. Exchanges that list Zcash sometimes support only transparent deposits and withdrawals.

Privacy features worry regulators and law enforcement, who argue they can help hide money laundering, sanctions evasion and ransomware payments. Several exchanges in Japan, South Korea and Europe have delisted privacy coins under pressure from supervisors, and the EU's anti-money laundering rules restrict anonymous crypto accounts. Supporters counter that financial privacy is normal in traditional banking, where account details are not public, and that transparent blockchains expose ordinary users' salaries and savings to anyone. For years, only a minority of Zcash transactions were fully shielded, which critics said weakened the privacy of those that were, since a small pool offers less cover. Use of shielded transfers rose after the NU5 upgrade and with wallets that shield by default, but the balance between transparent and shielded use continues to change.

• Zcash
• Zcash Improvement Proposals