Skip to main content

Adoptable Elements from Related Protocols

For every protocol catalogued in Comparisons, we studied how it actually works and asked one question: which concrete element could zkCoins evaluate adopting? This section is the result — a deliberate scan of the field for ideas worth importing, with an honest account of what does not transfer.

These are candidates, not decisions

Everything here is a candidate to evaluate, not an accepted design choice. Each idea is rated for Fit (how naturally it maps onto Client-Side Validation + ZK + Bitcoin) and Effort (Low / Med / High / Research-grade). Adoption decisions happen later, per item.

The guardrail

zkCoins' identity is a rare combination — Bitcoin-anchored · Shielded (anonymity set) · Trustless. An element only qualifies if it strengthens one corner without forcing zkCoins to abandon another (no own chain, no own token, no custodian, no trusted hardware). Many of the richest-looking features in other systems fail this test; those are documented under each project's "Doesn't transfer" so we don't cargo-cult them.

Where each idea applies

Candidates are mapped to zkCoins' known roadmap gaps:

GapMeaning
S1Trustless receive — re-verify the full recursive proof on receipt (today the node only checks the inclusion proof)
S2Double-spend / nullifier accumulator — a verifier-queryable global spent-coin set (today enforced only in-circuit)
S5Trustless emission — issuance is node-signed and off-circuit today
DeliveryOff-chain transport of the value-bearing CoinProof bundle (Nostr direction)
Note-discoveryDetecting which incoming bundles are yours over an untrusted relay
RecoveryRestoring full state from seed + Bitcoin chain + an honest, replicated network
View-keysThe spend-vs-view split and delegated, scoped view grants
Addressing / UXReusable receiver addresses, payment URIs, offline receive
Economics / Anti-spamPaying to publish/store without doxxing; relay abuse resistance
Encoding / ExplorerOn-chain message format and a public commitment explorer
Multi-asset / State-sizeConfidential multi-asset support; bounding node/accumulator growth

Highest-priority shortlist

The ideas that recur across clusters or carry the most leverage:

  1. View-key hierarchy (spend-vs-view split). Zcash's FVK/IVK/OVK — independently validated by Monero, Firo, and Zano — is the textbook form of the proposed two-key model (operational key sees, spend key spends) and scoped view grants. Fit High · Effort Med.
  2. Note discovery over an untrusted relay. Zcash trial-decryption of key-private ciphertexts + Aztec deterministic note-tags + Penumbra Fuzzy Message Detection — three proven recipes for "find my own bundles without telling the relay which are mine." Directly powers the Nostr delivery + recovery scan. Fit High · Effort Med–High.
  3. Deterministic seed-based recovery. Cashu NUT-13 (derive secrets from seed, batch-scan with a bounded counter) maps almost 1:1 onto "seed re-derives keys + pull-tags." Fit High · Effort Med.
  4. Bitcoin-anchored spent-coin set (S2). The Tornado Cash public nullifier set and the Cashu spent-secret ledger show the interface of the accumulator zkCoins lacks; the open work is anchoring it to Bitcoin rather than a contract or a mint DB. Fit High · Effort Research.
  5. Broadcaster paid from shielded funds. Railgun's pattern — a third party publishes your transaction and is reimbursed from the value moved — is the cleanest way to pay the Bitcoin commitment fee without the spender revealing a funding UTXO. Fit High · Effort Med.
  6. Replicated availability as a precondition. Taproot Assets universe stores + Fedimint t-of-n replication + Plasma's "data loss = fund loss" lesson turn "honest + replicated network" from advice into an enforced replication factor with acknowledgements. Fit High · Effort Med.

Candidates by roadmap gap

View keys & the two-key model

ElementSourceFitEffortCluster
FVK/IVK/OVK key hierarchy (spend-vs-view split)Zcash (echoed by Monero, Firo, Zano)HighMedShielded ZK Chains
Viewing-key / read-grant UX (selective disclosure)ShadeHighLowOther Trust Models

Note discovery & delivery

ElementSourceFitEffortCluster
Trial decryption of key-private ciphertextsZcashHighMedShielded ZK Chains
Deterministic note tags (shared-secret + counter)AztecHighMedEVM Privacy
Fuzzy Message Detection (detection key, no false negatives)PenumbraHighHighShielded ZK Chains
Bearer-token serialization + offline hand-offCashu / ArkMed–HighMedEcash

Recovery & data availability

ElementSourceFitEffortCluster
Deterministic secrets from seed (NUT-13)CashuHighMedEcash
Universe-style federated proof store over the relay meshTaproot AssetsHighMedCSV on Bitcoin
t-of-n replication quorum for the bundle storeFedimintHighMedEcash
Replication-as-precondition + sender-holds-until-ACKPlasma / Intmax2HighMedStateless Rollups
Four-limitation CSV audit taxonomy (DA, coherence, discovery, integrity)ePrint 2025/569HighLowStateless Rollups
Compact light-client pull + client-side decryption (ZIP-307)ZcashHighHighShielded ZK Chains

Double-spend / nullifier accumulator (S2)

ElementSourceFitEffortCluster
Public, queryable nullifier setTornado CashHighResearchEVM Privacy
Spent-secret ledger as a double-spend oracle (interface shape)CashuHighResearchEcash
Proof-of-publication / non-publication checkSingle-use sealsHighResearchCSV on Bitcoin
Signature/transfer aggregation at publishing (BLS, mass transfers)Intmax2MedHighStateless Rollups

Trustless emission (S5)

ElementSourceFitEffortCluster
Open-mint terms grammar (cap + per-mint amount + height window)RunesHighResearchBitcoin Asset Overlays
Deterministic asset ID from genesis (no registry)Open Assets / OmniHighMedBitcoin Asset Overlays

Economics & anti-spam

ElementSourceFitEffortCluster
Broadcaster paid from shielded fundsRailgunHighMedEVM Privacy

Addressing & UX

ElementSourceFitEffortCluster
Diversified / stealth / sub-addresses (reuse without linkage)Zcash / Firo / MoneroMed–HighMedShielded ZK Chains
Payment-request URIs (ZIP-321)ZcashMedLowShielded ZK Chains
Blinded destination in invoice + one-shot addressesRGB / Taproot AssetsHighLow–MedCSV on Bitcoin
Offline / async receive via pre-signed transferArkHighMedEcash

On-chain encoding & explorer

ElementSourceFitEffortCluster
Self-describing tag/value encoding + invalid-message ruleRunesHighMedBitcoin Asset Overlays
Reorg-aware indexer (chaintip monitor + rollback)Runes / ordHighMedBitcoin Asset Overlays

Multi-asset confidentiality & state-size

ElementSourceFitEffortCluster
Blinded asset tags + per-asset balance constraintLiquid Confidential AssetsHighMed–ResearchOther Trust Models
Cut-through (drop spent intermediate state)MimbleWimbleHighResearchOther Trust Models

Cluster deep dives

Each page covers how the projects work, the full element-by-element analysis, and what explicitly does not transfer:

What does not transfer

A recurring theme across every cluster: the trust model of a system almost never transfers, only its mechanism. The full-history consignments of RGB/Taproot Assets break the anonymity set; the custody of Cashu, the federation of Fedimint/Liquid/Mercury, and the trusted hardware (TEE/SGX) of Shade all contradict trustlessness; the own-chain security budgets of Zcash/Monero/Namada and the EVM exit contracts of Tornado/Intmax2 have no Bitcoin-only analogue; and every transparent overlay (Omni, Counterparty, Runes) leaks exactly what zkCoins hides. The per-cluster pages spell each of these out.