What we can do to your money.
A private balance is only as safe as the powers somebody else still holds over it. These are ours, read from the pool contract rather than described. Where the answer is yes, it says what it would take to make it no.
Yes. At least one lever that could stop you spending is still held. The detail is below.
Only by replacing the verifier, which is delayed and visible before it applies. The detail is below.
Every power, one at a time
Can anyone stop you spending or moving out what you hold?still held
Yes. The owner can restrict who may submit transactions, which would prevent you moving your own money out. It is switched off today.
To give this up: Calling sealRelayerControl() on the pool, which forces the restriction off and prevents it ever being set again.
Can anyone change the rule your payment has to satisfy?still held
Yes. Every proof commits to a screening root, and the owner can change it, which invalidates proofs in flight and, set to something you cannot satisfy, would stop you spending.
To give this up: Calling sealScreening() on the pool, which pins the root permanently.
Can anyone replace the code that decides whether a proof is valid?still held
Yes, behind a delay of 48 hours. A dishonest replacement could accept invalid proofs, which is how funds would be taken. The delay exists so the change is visible before it applies.
To give this up: Renouncing ownership, which also gives up the ability to fix the verifier if a flaw is found in it.
Is there an owner at all?still held
Yes: 0x184eA302ef14564E49192F718BBf97a100BF9689 holds the owner key.
To give this up: Renouncing ownership. The contract refuses to do this while the freeze above is still available, so that nobody can walk away leaving it switched on.
Everything above is read from the contract. Nothing here depends on trusting what we say about ourselves.
Why these can be given up separately
While the circuit is still changing, the ability to replace the verifier is a genuine safety mechanism: a flaw found in the circuit is fixable while that pointer exists, and unfixable once it does not. The power to restrict who may submit is not a safety mechanism for you. It is only ever a way to stop you spending. Forcing a single choice between the two would mean nobody ever gives up the second one, so the contract lets them go independently, and each is one-way.
The pool, as it stands
A private payment hides among the other notes in its pool, so the size of that crowd is what its privacy is worth. What those figures measure, and how anyone can rebuild them from the chain:
Notes are the crowd a payment hides in. Funders are the distinct addresses that have deposited, which is public by design and is the honest lower bound on how many separate parties are in the pool. A note count is not a customer count, and no count is a guarantee of privacy: with few funders and little traffic, timing and amounts can link a deposit to a withdrawal. Every figure can be rebuilt by anyone syncing the chain.
The machinery, measured
What an observer of the chain sees of a payment, and what the proof costs. Read off a live chain by a script, not typed; the generator refuses to write a block that contradicts the claim under it.
Both parties and the amount, permanently, to anyone who looks.
A commitment and a spent-marker, and 0 token transfers in that block. Submitted by the relayer, not the payer.
Both are ordinary transactions on an ordinary chain. The second carried 17,540 bytes of proof and ciphertext and moved no tokens at all. Your auditor still sees all of it, through a key you issue and can revoke.
The browser proves with four threads and every screen shows its own measured time beside the result. On one thread it takes around twenty seconds, and the screen says so while it happens rather than after.