Three layers, one settlement guarantee.

The problem with one-layer privacy

Every privacy system on a transparent chain has the same structural flaw: the anonymity set lives in a contract someone can point at. Deposits into that contract are legible, withdrawals are legible, and the only thing hidden is the edge between them. That is enough to make a compliance desk freeze the position and not enough to protect a trading strategy.

Z-Relay sidesteps this by not asking the EVM to keep secrets. The settlement layer holds collateral and verifies proofs — two things it is genuinely good at. Confidentiality is delegated to a chain whose entire consensus is built around it.

Layer 1 — Origin and settlement

Robinhood Chain (Arbitrum Orbit · Nitro, chain ID 4663) is where value starts and where proofs land. The layer is responsible for four things:

• Custody. ZRelayEscrow.sol holds the deposit until the ring confirms the shielded output exists.
• Routing. Tokenized equities (NVDA, AAPL) and USDG are swapped into the bridge collateral asset through on-chain DEX liquidity before the note is minted.
• Signalling. A ShieldRequested event is the only instruction the relayer ring ever receives.
• Verification. ZcashAttestationVerifier.sol checks a Groth16 proof over BN254 in roughly 180k gas — cheap enough to sit inside an ordinary borrow or redemption flow.

Layer 2 — The relayer ring

The ring is a distributed set of nodes that observe the escrow, co-sign Zcash transactions and compress proofs. No single member can move funds: signing uses FROST, a flexible round-optimised Schnorr threshold scheme, so a 7-of-11 ring produces one ordinary-looking signature that no individual could have forged.

The ring also performs the step that makes on-chain verification affordable. A native Orchard proof is a Halo 2 argument over the Pallas and Vesta curves — elegant, recursive, and completely unverifiable inside the EVM's gas budget. Relayers verify it off-chain and emit a small Groth16 proof over BN254 attesting to three claims at once: that the transaction sits in a finalised Zcash block, that its nullifier is unspent, and that the viewing-key decryption matches the hash submitted on the EVM side.

Layer 3 — The privacy layer

Zcash does the part that cannot be faked elsewhere. Orchard note commitments enter a global Merkle tree; nullifiers prevent double-spends without revealing which note was consumed; and balances exist only as values recoverable by whoever holds the right key. Z-Relay adds nothing here and, importantly, changes nothing here — a note created through Z-Relay is an ordinary Orchard note, spendable by any Zcash wallet.

End-to-end lifecycle

sequenceDiagram
  User        ->> Escrow:     shieldAsset(token, amount, zAddr, memo) + gas surcharge
  Escrow      ->> DEX:        route token -> bridge collateral
  Escrow      -->> Ring:      ShieldRequested(depositId, ...)
  Ring        ->> Ring:       FROST round 1 - nonce commitments
  Ring        ->> Ring:       FROST round 2 - signature shares
  Ring        ->> Zcash:      broadcast Orchard output, note commitment sealed
  Zcash       -->> Ring:      block inclusion + Merkle path
  Ring        ->> Prover:     Halo 2 witness -> Groth16 proof (BN254)
  Prover      -->> Verifier:  submitAttestation(proof, publicInputs)
  Verifier    ->> Escrow:     release / mark depositId settled

Trust assumptions, stated plainly

Custody during transit

FROST ring, 7-of-11 threshold

Liveness failure

Escrow timeout refunds the depositor

Proof soundness

Groth16 / BN254, trusted setup per circuit

Privacy guarantee

Inherited from Zcash Orchard (Halo 2)

Censorship resistance

Any staked node may relay any event

Data availability

Ethereum blobs, via the Orbit stack

The honest summary: during the seconds a transfer is in flight, users trust that fewer than the threshold number of ring members are colluding. Once the Orchard note exists, they trust Zcash — and nothing else. That window is what staking and slashing exist to price.