Claimed
You reveal z
- You get 0zkUSDC in your Railgun note.
- The maker adds z to e and takes the ZEC.
The contract can only pay the note fixed at open.
How it works
A split key and an atomic swap.
Your ZEC stays shielded, your dollars land in Railgun, and nobody, including us, ever holds your money.
01 The split key
Your ZEC goes to a fresh shielded address whose spend key is e + z. The maker holds e. You hold z, made fresh from your seed for each swap.
The Ethereum contract stores only the public points E = e·G and Z = z·G, on the Pallas curve, so it can check a half when one is revealed.
Taking money out of the contract means revealing your half, which hands the other side what it needs to take the ZEC.
02 A swap, ZEC to 0zkUSDC
-
You and the maker
Quote and accept
The maker offers a price and proves it knows e without showing it. You send back Z, a proof you know z, and the exact Railgun note your dollars must go to.
-
Ethereum
The maker locks the dollars first
Before you send anything, the maker calls
open(), locking the USDC in the contract under E, Z, two deadlines and your payout note. The contract's source is open, and every swap is public on Etherscan. -
Your phone
You check before you pay
The app reads the swap back from Ethereum and only sends ZEC if every term matches.
-
Zcash
You send shielded ZEC
It goes to the joint address. Neither side can spend it yet.
-
Ethereum
The maker confirms
Once your ZEC has confirmed, the maker calls
ready(), giving up its right to cancel. It can only do this before t0. -
Ethereum
You claim
The app hands your claim to a relayer, and you can close the app. The relayer calls
claim(z)through Flashbots Protect, so z stays out of the public mempool until it lands. The contract checks z·G = Z, thenpayout()shields the USDC into your Railgun note, the only note it can pay. You never need ETH. -
Zcash
The maker takes the ZEC
Your half z is now public on Ethereum. The maker adds it to e and spends the ZEC. Both sides are paid.
03 Only two endings
Each one is fair to both sides.
Refunded
The maker reveals e
- The maker gets its USDC back.
- Your app adds e to your z and moves the ZEC back to you.
The maker can cancel before t0 if it never confirmed, or refund in the day after t1.
04 Why you don't have to trust anyone
The maker can't touch your ZEC without your half of the key. You only reveal that half by claiming, and the contract only pays the note you chose. With no owner or pause switch, nobody can change a swap once it opens.
Deadlines
Two deadlines, t0 and t1, cut every swap into windows, and in each only one side may act. A silent party can never trap the other.
If the maker never confirms
Once the maker confirms
One side at a time
The clock and the swap's stage alone decide who may reveal, so only one half is ever revealed and no reveal can be raced. One held up still lands any time before its window closes, and your claim goes out only with at least 5 minutes of its window left.
What if
- The maker goes offline after you pay
- You claim without it from t0.
- You send too little
- The maker cancels, which reveals e, so your ZEC comes back.
- Your phone is off for hours
- Once the maker confirms, the relayer claims for you. If your phone went off before that, the swap waits for your claim until t1, then the maker refunds, which brings your ZEC back.
- The relayer misbehaves
- It can't redirect anything. The payout note is fixed, and every request is signed by your swap key.
- A Railgun payout bounces
- The funds return to a vault for that swap and can be shielded again.
05 The other way, dollars to ZEC
The same split key and contract, with the roles swapped.
- You lock 0zkUSDC straight from Railgun, with a refund note that only pays you.
- The maker sends ZEC to the joint address.
- Your app checks the ZEC is really there before you sign
ready. - The maker reveals its half to take the USDC. Your app adds it to yours and moves the ZEC into your wallet.
Until you sign ready, you can take your dollars back. Once you do, the maker has until t1 to take them, and from t1 they're yours to take back again.
Compared with NEAR Intents
Two ways to swap ZEC for dollars.
Veylor still uses NEAR Intents for other assets. For ZEC and dollars, it uses the bridge.
| Compared on | NEAR Intents | Veylor's bridge |
|---|---|---|
| What Zcash shows | An unshield to a known NEAR deposit address, with the exact amount and time, public for good. | One ordinary shielded transaction. No amount, no destination, no unshield. |
| What the dollar side shows | USDC from a solver soon after, for about the same value. | USDC paid into your Railgun note, inside Railgun's shielded pool. |
| Linking the two legs | Amount and timing make the link. | No shared hash, unlike hash-locked swaps, and nothing visible on the Zcash side. |
| Your funds mid-swap | In someone else's transparent address, where they can be frozen, seized or lost. | Held by nobody. There's nothing to freeze. |
| When something breaks | A support ticket, and the refund may go to a transparent address. | A refund, built in, and if the maker goes quiet you claim without it from t0. |
| Who runs it | An operator. Its bridge issues your deposit address and holds the ZEC until a solver fills the trade. | A contract with no owner, admin key or pause switch. Anyone can be a maker on it. For now the app trades with one. |
| Censorship | The solver or operator can block you. | The maker can refuse to quote you, but can't take a swap's funds. At most it calls one off, which returns your ZEC. |
| What the other side sees | Your deposit, your payout address and your refund address. | The same. The maker sees its own swap, never your other notes. |
Where NEAR Intents is ahead
It's fire-and-forget, while the bridge needs your app open for part of each swap. It also has deeper liquidity, takes any amount, covers many chains, and is mature in production.
Try it
Swap without unshielding your ZEC.
On Android, and in beta on iPhone. The bridge runs on mainnet with real funds, so start small.