Shielded Transactions
What are shielded transactions?
Morana's shielded layer is built on Sapling (ZIP-212), the same ZK-SNARK construction used in Zcash. When you move funds into a shielded (Z) address, all amounts, sender, and recipient information is hidden from public view. Only the nullifier (a cryptographic commitment that prevents double-spending) is recorded on-chain.
How value is hidden
Each shielded output creates a note commitment — a cryptographic hash stored in a global Merkle tree. Spending a note reveals only the nullifier (proving the note was spent), never the amount or address. A binding signature over the value balance ensures no coins can be created or destroyed in the shielded layer.
Transaction types
| Type | Privacy | Use case |
|---|---|---|
| T → T | None — public amounts and addresses | Exchanges, pools |
| T → Z | Input public, output private | Shielding coins |
| Z → Z | Fully private | Private payments |
| Z → T | Input private, output public | Unshielding for exchange |
What stays private
- Recipient Z-address
- Sent amount
- Memo field (up to 512 bytes, encrypted to recipient)
- The link between notes you spend and outputs you create
What is NOT hidden
- The fee paid (visible on-chain as a transparent value balance adjustment)
- The block timestamp and transaction size
- The fact that a shielded transaction occurred (the TX exists, just not its internals)
Sapling vs legacy shielded
Morana uses Sapling exclusively (version byte 0x02). The older Sprout/Overwinter scheme has been removed from the codebase — the shielded layer is clean with no dead code paths.
Using shielded transactions today
The table above describes what the protocol supports. What the desktop wallet currently exposes is narrower, and it is worth being exact about the difference:
| What you want to do | Available in the desktop app today |
|---|---|
| Receive to a shielded address | yes |
| Scan for and see your shielded notes and balance | yes |
| Read a memo sent to you | yes |
| Estimate the cost of a private send or an unshield | yes |
| Actually spend shielded funds (Z → Z, Z → T) | not yet |
| Actually shield transparent coins (T → Z) | not yet |
The spending path is implemented in the wallet core — proof generation is local, using a Groth16 prover on your own machine, so keys never leave it. It is simply not wired into the desktop application yet. We would rather say that plainly than let the table above read as a feature list.