Shielded Bitcoin dropped last month, and the first question everyone asked was “isn’t this just Zcash on Bitcoin?”
Short answer: no. The paper itself says it borrows Zcash’s architecture (notes, nullifiers, a note tree, ZK proofs, viewing keys). But the math underneath is different almost everywhere.
A few things that surprised me while going through it:
→ Bitcoin doesn’t check anything. Indexers replay every envelope in block order and ignore invalid ones. No new chain, no soft fork.
→ No value commitments. Zcash proves balance with commitments that add up in public plus a binding signature. Shielded Bitcoin just checks Σ in = Σ out inside one proof, with range checks so nothing wraps around the field.
→ No spend signature. The spending key goes straight into the proof, like Sprout did. So you can’t hand proving to a helper without handing over the power to spend.
→ The tree commits to the ciphertext itself, and the proof checks the encryption. Zcash never proves the attached ciphertext matches the note.
→ The nullifier includes the note’s tree position, closer to Sapling than to Orchard. After this year’s Orchard bug, “one note, one nullifier” inside the circuit matters more than ever.
I wrote it up layer by layer, starting from zero, with toy examples you can check with a calculator.
@Zcash@ZcashFoundation@allocinitxyz
https://t.co/6yO8BTBiV3