Architecture

Independent vaults, shared proof state

The forest creates keyless child vaults and maintains a shared append-only Poseidon tree, global spent nullifiers, and payout reservations. Deposit principal stays in the selected vault. The forest coordinates settlement and separate protocol/storage fees.

A note deposited through vault A can withdraw from vault B’s available liquidity. One selected vault pays the proof-bound recipient directly. Principal does not travel through a sequence of vault-to-vault hops.

What a private note represents

A commitment is derived from a note’s secret, nullifier, and group domain. A note does not encode its origin vault. A Groth16 membership proof authorizes a spend without naming the input commitment.

Private note transfers append new output commitments without moving backing between vaults. The global nullifier set prevents the same input note being paid twice across the group.

Bind every payout destination

• The proof context binds the operation, group domain, selected payout vault, recipient, and disclosure reference.
• Native NEAR v2 and token-bound v3 use distinct domains. V3 also binds the token contract.
• Retries retain the original vault and recipient. They do not reset a nullifier or authorize redirection.
• Clients verify pinned registry/vault bytecode, empty access-key lists, configuration, and liquidity at a finalized block.

Group boundaries and capacity

Each group has a depth-8 tree with 256 total outputs, including transferred outputs. Capacity is shared across the group, not multiplied by its vault count. A full group can still process valid withdrawals.

Assets and groups have separate proof domains. More vaults distribute custody; they do not create a measured anonymity guarantee or private cross-group bridge.

Organization access is a separate service

The read-only settlement API serves one independently trusted on-chain group. The Organization API authenticates wallet principals and stores off-chain team membership in a separate database. Organization sessions and roles are never accepted as a private note, invoice signature or settlement policy.

Owner, Admin, Operator, Viewer and Auditor control workspace access. They do not grant a signing key, change a keyless vault or approve a payment. Organization membership does not verify a legal entity or change the hosting access policy.