Private Transfers (Sapling)
What it is
Morana’s private layer uses Sapling from Zcash. For Z → Z transfers, it hides the amount and private addresses from outside observers. For T → Z and Z → T, the public side and the amount entering or leaving the pool remain visible. Each transaction carries a Groth16 proof that nodes verify without learning the hidden details.
There is no home-grown cryptography here. The proving parameters are the files from Zcash's public 2018 ceremony, which had about 90 participants. The wallet ships them inside the build and never downloads them from the network.
On the testnet the private layer is active from the first block.
What goes on chain
- A commitment to each new note (a note is a private coin) — an entry in a shared tree. It contains no amount and no address.
- A nullifier for each spent note — a "this note is spent" marker. It does not reveal which note was spent, but it makes spending the same note twice impossible.
- The proof and signatures that let nodes verify the transfer.
- One public number — how many coins the transaction moved into or out of the private pool.
Transfer types
| Transfer | What is visible | When to use it |
|---|---|---|
| T → T | everything: addresses and amounts | exchanges, pools |
| T → Z | the public input and the amount that entered the private pool | hiding coins |
| Z → Z | only the fact of a transfer and the fee | private payments |
| Z → T | the public output and the amount that left the pool | withdrawing to a public address |
A single transaction can carry both a public and a private part. The public inputs of such a transaction are signed under ZIP-243.
What stays hidden
- the recipient's private address;
- the amount;
- the memo — a short note encrypted for the recipient;
- the link between what you spend and what you create.
What everyone can see
- the fee;
- the block time and the transaction size;
- the fact that a private transfer happened;
- for T → Z and Z → T, how many coins entered or left the private pool.
Limits per transaction
Network rules allow at most 256 private inputs and 256 private outputs in one transaction. Nodes relay transactions with at most 10 private inputs and 10 private outputs.
Safeguards on top of the cryptography
Even a well-studied scheme can turn out to have a flaw. So the network has three safeguards that limit the damage if one is found:
- Pool count. The network keeps a separate count of how many coins sit in the private pool and never lets more leave than went in. This check runs before proof verification.
- Emergency switch. A new node release can close private transfers starting from a set block without touching public ones. There is no key that can do this without nodes upgrading.
- Replaceable pool. If needed, the current pool is closed to deposits and a new one is opened. Sealing preserves withdrawals, but an emergency shutdown of private operations suspends them too.
Sapling only
Morana uses Sapling only. Nodes never accept any other private-data format.
How the wallet does it
On every platform, the Morana wallet supports three operations with private funds: moving coins into the private pool (T → Z), sending a private transfer (Z → Z) and withdrawing to a transparent address (Z → T). The transaction and its proof are built on your device. Your keys never leave it; the node receives only the finished transaction.
A private operation costs more than a public transfer. The wallet shows the fee before you send.
If you pay a MORID name, the recipient has published a private address and you hold private funds, the wallet pays privately and shows you which route the payment took.