Zylem · Zcash testnet
The data comes from this page's host as plain files: Rings of 4,096 real testnet blocks and history proofs made on a GPU. Your browser checks all of it with the same Rust code a Zylem client runs, so the host never has to be trusted.
A Ring is one file holding 4,096 consecutive Zcash blocks, about a day of the chain, packaged so any website can host it. Inside are the block headers, every transaction in the compact form wallets already download, short digests that let each transaction's ID be rebuilt, and the state the Ring starts from.
In about a minute you will check 4,096 real Zcash blocks in this browser and catch a server trying to fake a payment.
| # | Transaction ID (rebuilt) | v | Transparent | Sapling | Orchard | Ironwood |
|---|
These IDs were rebuilt here from the compact data and digests in the Ring, and together they produce this header's Merkle root. A server that changed any transaction could not make them match.
The full client check, block by block. This is what lets any mirror, CDN or stranger host Rings: a client accepts nothing it cannot rebuild.
Opens after step 1.
You rely on the cryptography and the code running in this tab, not on the host that served the file.
Look up a transaction by its ID among the IDs rebuilt in step 2. A server can only make a payment appear if the Ring's own data rebuilds that exact ID inside an authenticated block.
Opens after step 2.
Each button makes a copy of the open Ring altered the way a dishonest server would, then runs the step 2 check on it. The server would also publish a matching file hash, so only verification can catch it. The target follows the block opened in step 1; any transaction works.
Opens after step 3.
Adds a fake Ironwood action, as if someone had paid the wallet.
Leaves one transaction out of its block, so the wallet never sees it.
Swaps the starting Ironwood tree for another of the same size, so a wallet would build unspendable anchors.
A succinct proof of Zcash data stays small and quick to check however many blocks it covers. One SP1 proof states that every header in a range passed Equihash, its target and the difficulty rules, and commits to a 104-byte record of each block. Wrapped in Groth16, the whole claim fits in 356 bytes that a phone and a smart contract both verify.
Opens after step 4.
On mobile and on-chain
356 bytesThe proof wrapped in Groth16 over BN254. This browser verifies it in a few hundred ms, and SP1's own verifier contract accepted these exact bytes in a local EVM for about 304,000 gas. No contract is deployed on a chain yet. Its one extra assumption is SP1's Groth16 trusted setup.
Without a trusted setup
1.27 MBThe compressed STARK the wrap is made from. It needs no trusted setup and verifies here in a few dozen ms, for clients that want the fewest assumptions.
Your phone verifies it the way this page does. A contract that accepts it learns, from the proof alone, the Zcash block hash at the top of the range, the total work behind it and a commitment to every block's record, so bridges and other chains can build on Zcash without running a node.
| Same blocks, two ways | Check every header | Check the proof |
|---|
Light wallet vs Zylem
Today's Zcash light wallets download compact blocks from a light-wallet server and take them as given. Zylem gives the same wallets data they can check. Steps 2 to 5 above are the checks in the Zylem columns, run on this page.
| Light wallet today | Zylem, full Rings | Zylem, Rings with a proof | |
|---|---|---|---|
| Who you trust for balances and payments | The light-wallet server | No data server; your device verifies, from a checkpoint and the cryptography | No data server; your device verifies, also relying on SP1 and two pinned programs for the headers |
| Proof of work and difficulty | Not checked | Every header | Every header, inside the proof |
| Transaction IDs | Not rebuilt; compact data alone cannot rebuild them | Rebuilt and matched to the Merkle root | Rebuilt and matched to the proven Merkle root |
| A fake incoming payment | Shown as received | Refused (step 4) | Refused |
| A hidden payment | Missed without a sign | Refused (step 4) | Refused |
| A wrong tree state | Used; spends fail later | Refused (step 4) | Refused |
| Who can serve the data | A server you trust | Any host or mirror | Any host or mirror |
| Download per 4,096 blocks | compact data only | ||
| Runs on a phone | Yes | Yes | Yes |
| Works with today's wallet apps | Yes | Yes, by pointing them at zylem-proxy | Not yet: light Rings are measured, not shipped |