Notes & nullifiers

Private value containers

A note records ownership, asset identity, value, blinding factors, and a binding to the action that created it. Only its commitment enters the pool’s Merkle tree; encrypted payloads support authorized discovery.

note = { owner, asset, value, owner_blinding, value_blinding, origin }
commitment = H(owner_commitment, value_commitment, origin)
nullifier = H(commitment, nullifying_key)

Membership and uniqueness

A spend proves that a note belongs to an accepted tree root and is controlled by the authorized sender. Its nullifier is published and recorded once. The contract rejects reuse without requiring the proof to reveal the original leaf.

Origin binding prevents ambiguous note identities and can support provenance-related proofs. In the reference construction, six input slots fund action and fee assets; unused slots use zero-valued dummy notes. Jammer’s final circuit capacity is not fixed.

Balance conservation

When both assets coincide, one combined conservation equation is sufficient. Arithmetic ranges and asset matching must be constrained so modular field arithmetic cannot create value.

inputs(action asset) = payment + action change + applicable fee
inputs(fee asset)    = fee + fee change

State reconstruction

The scanner reconstructs spendable state from commitments, payloads, and nullifiers. A stale scan can show an incorrect available balance; reorganization handling and deterministic replay are required for reliable recovery.