Zolar

Building an access instrument for shielded ZEC on Solana

[Zolar @zolarcash]

Zolar is a Solana engine for Zcash.

About 4.6M ZEC sits in the Zcash shielded pool, and none of it has ever been used as collateral for anything. Zcash was never built to run programs, so shielded ZEC has had exactly one job: sit still.

Zolar gives it a second one. Don't move the coin. Move the proof.

Your browser builds a zero knowledge proof of what you hold, and Solana reads a fact about it rather than a copy of it. No wrapped token, ever. No address Zolar controls ever holds what you own. Those two hold at every step, and they are the ones worth checking.

Live today: shielded and transparent balances read in your browser, keys that never leave it, shielding on chain, and encrypted history that follows you to a new device. BUY spends shielded ZEC on a real eSIM, settled on chain. PROVE builds a 5,120 byte proof over four real notes, and every proof after the first takes 31 seconds.

An attester checks one of those in 25 milliseconds and signs it, so a Solana program can read it. Building that set is next.

Zcash keeps your value. Solana puts it to work. Zolar is the instrument.

Website: https://t.co/qwVSH0VnKp

[Zolar @zolarcash]

Two things are being built on Zolar right now.

BUY now tells you where your payment is. Payment sent, confirmed on Zcash, payment received, seller releases credit, plan ready. While your wallet is still proving the payment, about half a minute, the screen says nothing has left your balance yet.

RECEIVE is the bigger one. You say how much SOL you want, and you get back a Solana address to hand out. Whoever pays sends SOL to it, a solver delivers ZEC, and it settles into Ironwood. You do not sign anything to be paid, and the ZEC arrives shielded rather than arriving and then being shielded.

Next is one small payment with real money, the way the first eSIM went.

[Zolar @zolarcash]

A shielded Zcash payment costs about 8 cents. Flat, whether you move $300 or a dollar.

That one number builds the whole Zolar BUY shelf. ZIP 317 sets the fee at 10,000 zatoshi and it does not scale, so it is 2.8% of a $3 ticket, 5.5% of a $1.50 one, and 17% of a 50 cent one. The shelf simply starts where the fee stops mattering.

Two more rules keep it clean. Retail price as an ordinary buyer, the same price you would pay yourself, so nothing here rides on a markup. And nothing cash-like, because that is the one thing that turns a purchase into a KYB form.

The eSIM clears all three on its own. $1.50 for 100 MB over seven days, no account, no email, no ID. We already bought one with 0.0023 ZEC, settled on chain.

The merchant learns what was bought and that it was paid for. Not a name, not a balance, because a shielded payment has no sender field anywhere in it.

[Zolar @zolarcash]

The eSIM shelf went from 5 destinations to 207 today. 196 countries and 11 regions, each one checked against live plans first, because 36 of the codes the catalogue lists answer with an empty shelf and no error.

Testing the buy path turned up two things. Zcash refused a transaction as a duplicate nullifier, so our wallet had offered a note the chain already saw spent. And the error we showed for it was u64 max losing precision on its way out of wasm.

Consensus caught the first one. Nothing moved, nothing was lost.

[Zolar @zolarcash]

A browser built a version 6 shielded Zcash transaction and put it on mainnet. 9,348 bytes, block 3,459,140. The transparent transfer that funded it was 241.

Halo 2 proof: ~16.5 s in a Web Worker, ~3.85 s native on one thread. 4.3x is the whole cost of moving proving into the browser.

Same Rust the CLI runs, compiled to WebAssembly.

[Zolar @zolarcash]

I proved I hold at least 0.01 ZEC in Ironwood without saying what I hold.

Here is the whole loop, on video. The browser walks Ironwood's commitment tree, pulls my note's Merkle path out of it, and a worker turns that into a proof. Out comes a JSON card small enough to read in a text editor. I opened that card back up in VERIFY and it passed.

The Solana account is inside the proof, not printed beside it. It travels as two of the eight public inputs, so the same card presented from a different account fails arithmetic rather than a check somebody has to remember to write. Raise the threshold in that file and it fails the same way.

No transaction sits behind any of this. Nothing moved and nothing was spent.

[Zolar @zolarcash]

Everyone says wrap the Halo 2 proof into Groth16 so Solana can check it. We measured that wrapper. It is not expensive, it does not exist.

5.84 billion constraints at the floor. A 2.6 TB proving key, off a measured slope of 448 bytes per constraint.

A Halo 2 verifier does not pay for the proof. It pays for the reference string it folds at the end: 8,192 terms at k = 13.

Two proofs from one run show it. Ours has 160 elements and verifies in ~23 ms. A one gate circuit has 40 and takes ~18 ms. Four times fewer elements, a fifth off the clock. The proof is not what verification costs.

So a quorum verifies the proof natively in ~25 ms and publishes it beside the signature. Anyone can re-check it.

Smaller one, same week. Our first real eSIM purchase left change in the wallet, and a Zcash wallet keeps change at your internal address while what you were
paid sits at the external one. The circuit commits one ivk, so the two halves could not share a proof. PROVE took ~31 s to find that out.

Now it says so at once, and proves the side worth proving.

[Zolar @zolarcash]

Official CA is now on https://t.co/3XXq5bnyZq, in the nav and on its own docs page.

6bcRsAHC9uUikmV27BBaMsuTR77TKEwYjV83tUmTpump

It's the only mint, and there is no second one.

[Zolar @zolarcash]

Here is the exact sentence the Zolar Layer 1 circuit proves.

There are up to four note commitments in the Ironwood tree at anchor X. Their values sum to at least N. I hold the key that can spend each of them. Their tags are T. This claim is for Solana account A.

Nine checks hold that up. Three are reused chip for chip from Zcash's own Orchard Action circuit. Two are ours, because a Zcash transaction never had a reason to ask about a floor. The rest exist only because the circuit adds up more than one note.

Twenty-one tests sit on it and sixteen of them assert something must fail. An honest path that looks flawless is exactly what the Orchard soundness bug looked like for four years.

It runs on a real note today. The scanner builds Ironwood's tree in the browser, takes the Merkle path out of it, and a worker turns that into a 5,120 byte proof in about 31 seconds. Nothing about which notes leaves your browser.

[Zolar @zolarcash]

10,000,000 $ZOLAR burned.

Verify it on chain:
https://t.co/sR7tBnRgOa

[Zolar @zolarcash]

No server holds your Zolar balance, so the browser goes and finds it.

Ironwood starts at block 3,428,143, which we located by binary searching tree state rather than by converting a fork date into a height. That makes the full span tens of thousands of blocks instead of 3.4 million.

A full restore in the browser is about 93 seconds. 30,171 blocks, 287,551 actions, two viewing keys, so 575,102 trial decryptions. Every sync after that is seconds, and a resume rolls back 100 blocks before it continues.

The balance stays blank until the scan finishes, and then it shows the real number including zero. A zero drawn before the scanner reads a block is how a wallet tells somebody their money is gone.

[Zolar @zolarcash]

Dex paid

[Zolar @zolarcash]

Please be patient. I will pay for the DEX Screener update for $ZOLAR and process it shortly.

[Zolar @zolarcash]

Sign in with Google, and Zolar derives a Zcash wallet inside your browser and hands you the 24 words.

That screen will not let you continue until you download them. Nobody at Zolar holds a copy, and it is a standard BIP 39 phrase, so Zashi or Zodl can restore the exact same wallet.

Then open the wallet tab and let it sync. Your browser scans the blocks itself, which is why the balance takes its time and why the keys never leave the tab.

Funding it today goes through that phrase. Import it into Zodl, take the transparent or the shielded address it shows you, send ZEC there, and Zolar has it on the next sync.

Receive is next, and it removes that step. Somebody pays your Solana account, and the ZEC settles into your shielded pool.

[Zolar @zolarcash]

A debit card does not move your bank account. The money stays at the bank, the shop gets an answer back, and nobody hands over the vault.

That is the shape we are building for shielded ZEC. Zcash holds, Solana executes, and Zolar is the instrument between them. It is the only one of the three that holds nothing, and no address we control ever holds your ZEC.

Every feature answers one question before anybody builds it. Does this move value, or does it extend access to value that stays where it is? Anything that ends with a second copy of somebody's ZEC has left the model, whatever the label on it says.

[Zolar @zolarcash]

Took wallet connect off the Zolar login on purpose. Google only now.

Your Zcash wallet is derived from a signature, and an external wallet is free to change what it signs.

Same person, same button, a different wallet at the end of it, and not one error along the way.

[Zolar @zolarcash]

The Zolar circuit as it stands today: four notes, nine checks, twenty-one tests.

Your browser builds a proof over a note you actually hold, 5,120 bytes of it, and checks the proof itself before showing you anything.

Getting that proof onto Solana is the next thing I write.

[Zolar @zolarcash]

Building Zolar on my own, and this is the whole idea in one line.

Your ZEC never leaves the shielded pool. Solana reads a fact about it instead.

So far that's 14 Rust crates and a Zcash wallet that lives entirely in your browser, shielding on chain included. Last week it bought a real eSIM with 0.0023 ZEC.

Everything after that is written down.

https://t.co/EU3QPLrQD8

[Zolar @zolarcash]

CA: 6bcRsAHC9uUikmV27BBaMsuTR77TKEwYjV83tUmTpump

Creator fees go straight into what Zolar runs on.

Your browser reaches Ironwood through https://t.co/kBScFg8Az5, which carries every block anyone syncs. Your history lives on https://t.co/M7QgqU9Oyk as encrypted rows, so it follows you to a new device.

The attester set comes next, and it runs on the same fuel.

Every fee goes back into the build.

[Zolar @zolarcash]

0.0421 ZEC sitting transparent. Ironwood 0. Orchard 0.

Shielding it from my phone means restoring the whole wallet first, and I've been waiting on that sync longer than I want to admit.

So we're building shield into Zolar. Approve it with your Solana account.