A Zcash governance trilogy, part 3 of 3.
Or navigating the dark forest without turning on all the lights
TL;DR: In a private system we cannot know who holds voting power, how many people sit behind it, or whom they are connected to. The answer is not to abolish the privacy. It is to bound what any vote can decide, so that capturing one voting mechanism cannot confer control over the whole system.
Part 1: An Ode to Rough Consensus.
Part 2: When We Disagree: Making Rough Consensus Work.
Part 3: Governance in a Shielded World.
Zcash is building a parallel financial system, outside of but adjacent to the existing one. Its governance, however, remains entirely inside human institutions.
That private financial system starts from a different assumption from the one we have become accustomed to elsewhere: privacy is normal. In such a system, private by default should be the ordinary situation, not a special mode for people with something to hide.
Traditional finance already runs part of its markets this way. Dark pools let large investors trade without displaying their orders, so that others cannot trade against them. Dark does not mean lawless. The orders are hidden, but the venue’s rules are published, trades are reported afterwards, and regulators publish how much trading goes dark.
But a dark pool’s participants are hidden only from the market. The operator knows who its subscribers are. In Zcash governance, there is no operator who knows who is voting the coins.
Privacy by law, privacy by design
Even the legal right to privacy is recent. American courts began recognising one after Warren and Brandeis argued for a “right to be let alone” in 1890. England took far longer, and for most of that time it protected confidences rather than privacy: your bank owed you a duty of confidentiality, but the law could always make it talk.
In most legal systems, privacy is a right granted and limited by law. In Zcash, it is also built into the system: disclosure happens with the user’s consent. A user can share a viewing key with an auditor, a tax authority or a counterparty. The protocol does not share it for them.
The law can still compel a person to disclose information, and Zcash privacy cannot prevent every information leak. But the protocol gives no central authority the ability to disclose everybody’s shielded transactions.
That creates a governance problem which is easy to miss when we borrow institutions from corporations, nation states or transparent token systems.
How do you make governance work when some of the people exercising power are deliberately invisible?
Coinholder-weighted voting has a legitimate place in Zcash governance. ZEC holders have economic power and a legitimate interest in how the system develops. But in a shielded system we cannot assume we know who those holders are, how many people sit behind a given amount of voting power, or whether apparently separate positions belong to separate people.
Economic power without a census
Coin-weighted voting has a property one-person governance lacks. It can measure economic control without first creating a registry of people. If a participant proves control of 10,000 ZEC, the mechanism can weight that signal as 10,000 ZEC without their name, nationality, employer, face or social graph. In a privacy-preserving system, that is a feature.
But we have to be precise about what was proved.
A valid vote proves control of voting power. It does not prove who is behind it, or by what right.
It does not tell us whether the person bought the ZEC, mined it, borrowed it, stole it, or holds it as a custodian. It does not tell us how many humans sit behind the position, or whether two positions belong to different people. A ZEC quorum is not a human quorum. That does not invalidate coinholder voting. It tells us what kind of instrument it is.
A community panel and a coin-weighted poll may agree. That is evidence from two mechanisms, not proof that two separate groups of people agree.
Control is not the same as rightful ownership
Suppose a large exchange or custodian is hacked and the attacker gains control of several hundred thousand ZEC.
The attacker can produce perfectly valid signatures. A voting system which asks only for proof of control cannot distinguish the attacker from the previous controller.
That is not a bug in Zcash’s cryptography. The cryptography answers the question it was designed to answer: does this party control the key? Governance is asking a different question: should this control confer political authority?
Corporate voting can lean on courts, registrars and enforceable arrangements to decide that shares were stolen or that a custodian must follow the beneficial owner’s instructions. We should not pretend that corporations have always known every human beneficial owner. Nominees, trusts, custodians, bearer shares and modern street-name ownership have long separated legal title, voting authority and ultimate economic interest. The difference is the legal machinery for resolving disputes about that separation. Zcash deliberately has no sovereign registrar of ZEC ownership and no court that can rewrite the blockchain.
That is why it matters so much what a vote can decide. If stolen coins can only sway one round of retroactive grants, their authority ends with that round. If the same stolen coins could vote to change the protocol’s rules, the damage could be permanent.
The blast radius could be of an entirely different magnitude if those coins could spend a large treasury, elect every seat on a grants committee, or vote to change the supply schedule. One stolen position could then redirect years of funding, or alter the money everyone else holds.
Governance needs a threat model too.
Trying to count people measures something different
One response to this is to try and add a one-person-one-vote poll among ZEC holders alongside coin-weighted votes. The idea is valuable because it makes the tension explicit. But it has to solve a hard problem first: establishing that each participant is a distinct person. A coin-weighted vote asks: how much participating ZEC supports this choice? A one-person-one-vote poll asks: how many participating humans support it? A one-person poll restricted to ZEC holders asks: how many participating humans who meet our definition of coinholder support it?
Those are different constituencies. Neither one fixes the other.
A coinholder is an economic constituency, not a citizenship class.
If any amount of ZEC admits you to the one-person electorate, ZEC has become an admission ticket. If there is a minimum balance, we have a wealth qualification. If weight rises with holdings, we are back toward coin voting. None of those is automatically illegitimate, but they are different political theories. Whoever designs such a poll is choosing who counts, and should say which theory it follows and why, rather than present the choice as a technical detail.
The harder problem is personhood. The chain cannot prove that two shielded positions are two distinct humans. A real one-person system needs some external mechanism: KYC, attestations, biometrics, social graphs, in-person ceremonies, or something not yet invented. Every one creates new attack surfaces and new privacy assumptions.
The governance system begins trying to recover information that the monetary system was deliberately designed not to reveal.
That should make us suspicious of the premise, not of the privacy.
Conflict rules need a face
Working on my draft ZIP on Zcash Community Grants (ZCG) association limits and conflicts of interest made one thing very clear. Every protection in it depends on knowing who someone is.
Association limits ask which organisation a committee member works for. Recusal asks whether a member has an interest in a grant. Disclosure asks what relationships a candidate has with the people running the election.
We can ask identifiable committee members to disclose whom they work for, advise or are paid by. Those claims can be checked and challenged. Coin holdings are different.
A person can prove they control at least a given amount of ZEC, but not that they control no more elsewhere. Compulsory disclosure of holdings would cost honest people their privacy without stopping dishonest ones.
But none of these protections can be applied to a shielded coinholder vote.
We cannot know whether the ZEC voting on a retroactive grant belongs to the applicant.
We cannot know whether the voting power behind a coinholder-elected ZCG seat came from one organisation, with its staff and its treasury acting together. We cannot know whether a custodian voted coins it holds for customers. The coin vote is valid either way.
We can check who sits on the ZCG committee. We cannot check who put them there.
Even a perfect personhood layer would not change this. Knowing that an anonymous voter is a unique human still tells us nothing about whom they work for, or whether they are the applicant. We could ask them, but unlike a committee member’s reply, their answer cannot be checked, and nobody can be held to it. That would take something approaching an identity and affiliations registry, which even the FATF Policy Development Group might think was overkill.
That is not a defect to be repaired. It is the privacy working as designed.
Every register of who people are and what they own becomes a target. This is not hypothetical.
In Denmark, beginning in June 2023, a junior municipal employee sold addresses and family details from the population register to criminals. He was convicted in March 2026 of helping facilitate 34 attempted serious assaults. In France, a tax official is accused of misusing confidential tax records from May 2024, including information about cryptocurrency investors, against the backdrop of a wave of violent attacks on crypto holders in France. The gendarmerie says these attacks have grown sharply since late 2024, partly because of large data leaks that exposed holders’ identities, wealth and addresses. Information collected for legitimate reasons can become a weapon.
So the protection has to move from the voter to the vote: what a coin vote may decide, how many seats it can fill, how large a treasury it controls, and how easily its results can be challenged.
The honest consequence for my own hybrid ZCG proposal is that a well-funded candidate, or their backers, could in principle buy a coinholder seat and nobody would see it. Why introduce seats that can be captured unseen? Because the problem they address is legitimacy, not capture.
The design accepts one risk to address another, then limits the reach of both.
That is exactly why coinholders should only elect two of five seats rather than all five, and why the association limits apply to whoever takes the seat.
And of course the person standing for a coinholder-elected seat is a known person, just like someone standing for a ZCAP-elected seat. The difference is the voters. ZCAP’s members are publicly listed and must meet eligibility criteria. Coinholder voters are unknowable.
Knowing who ZCAP’s members are does not make them representative either; it only makes them accountable.
Control is not representation
Mining shows the same problem in miniature. As set out in the previous article, When We Disagree, a pool may build templates for a large share of hashpower without any political mandate from the miners behind it. An exchange can control customer ZEC without owning its customers’ preferences. A pool can control block construction without owning its miners’ preferences.
Today we often bundle three things under “mining power”:
- hashpower, the physical capacity to perform proof of work;
- block construction, choosing which valid transactions and template to mine;
- consensus-rule selection, choosing the node software and rules under which a block is valid.
Pool architecture can put the second and third with the operator while the first sits with miners. Projects like Sovright’s Stratum V2 mining pool are trying to separate them differently. Governance should not build permanent categories around transient architecture. It should ask who can exercise which power, what constrains it, and how easily somebody else can challenge it.
Giving miners a voice runs into the same wall. One idea now being discussed is for miners to signal their preferences in the blocks they produce, recorded in each block’s coinbase. That signal can be verified. But what it measures is hashpower, not people. Make signals traceable to individual miners, and we may expose their revenue and invite coercion and vote-buying. Keep them anonymous, and we measure weight, not people.
Whether the weight is coins or hashpower, we can verify it. We cannot count the people behind it without giving up their privacy.
Privacy changes the right defensive strategy
If privacy prevents us from knowing whether political power is concentrated, one response is to demand more identity: every voter disclosed, every custodian’s beneficial owners enumerated, every miner registered, every participant linkable across votes.
That would make some governance problems easier. It would also rather miss the point of Zcash.
Identity-based protections are the wrong fit for an unlinkable system when the risk can instead be bounded by constraining the power itself.
There is a strong argument on the other side, and a privacy coin should take it seriously. Identifiable committees and foundations are chokepoints. They can be subpoenaed, sanctioned or arrested. One reply to Vitalik argued that when Tornado Cash was sanctioned and its developers arrested, token holders voted through the fixes that kept the protocol usable. A pseudonymous coin vote is harder to coerce than a doxxed committee, and that is one good reason coinholders need a route into governance at all.
Tornado Cash also shows the other edge. In May 2023 its token holders passed a disguised proposal that handed an attacker control of governance, with more votes than all legitimate holders combined. Control came back only because the attacker chose to return it. Anonymity can make coercion harder. Binding execution can make a captured vote harder to stop.
In June 2026, another disguised proposal was exposed by security researchers and rejected by participating TORN holders. This time, scrutiny and voting worked.
If a mechanism becomes unsafe whenever one unknown actor controls a large share of the vote, the first question is whether it has been given too much authority. Can we limit what it is allowed to decide? Can we cap or time-limit the money it controls, so there is no permanent prize to capture? Can decisions be staged so that no single vote instantly changes consensus rules?
Binding votes have a place, provided their powers are clearly defined and agreed in advance: electing a minority of seats on a grants committee, say, or deciding a round of retroactive grants. But no committee, community panel or coinholder majority should be sovereign over Zcash.
A majority of coins is not a mandate to rule.
The proposed hybrid ZCG ZIP tries to practise this. Before coinholders could elect a seat under it, my draft would require a public judgement that participation is broad, but it forbids counting protocol artefacts as voters and requires no disclosure of who voted or what they hold. It asks for the best evidence the private process can honestly produce, then caps what the result can decide.
If privacy prevents us from knowing whether power is concentrated, the answer is not to abolish privacy. It is to design institutions that remain safe when voting power is concentrated.
A vote may be captured. Zcash must not be.
If anonymity breaks the protection, redesign the protection instead of weakening the anonymity.
Make the people private. Make the rules public.
A privacy-preserving governance system should be unusually explicit about rules, because it can be deliberately ignorant about people.
Before a vote, publish what it can decide, how voting power and participation are measured, how abstentions count, and who will judge the result. Afterwards, publish enough evidence for outsiders to check that the stated rules were followed.
We may not know who controls a large shielded position. We can still cap the authority it receives, so that holding it confers no right to rule.
We may not know whether several voters are the same person. We can still avoid giving one advisory poll automatic power to rewrite the protocol.
We may not know who ultimately owns coins held by a custodian. We can still distinguish cryptographic control from political legitimacy.
We may not know who funded a coinholder-elected seat. We can still limit how many such seats there are.
We may not know who a grant’s users are. We can still ask for evidence of adoption that does not expose them.
We may not be able to identify every centre of power in advance. We can still keep institutions replaceable, treasuries bounded, decision processes public and software adoption voluntary.
Make the people private. Make the rules public.
Privacy-preserving governance should not require good actors to surrender their privacy in order to defend the system against bad actors. The dark forest does not become safe by turning on all the lights.
We need governance that works in the dark.
We need shielded money, not shielded rulers.
Sources
- ZCG Committee Organizational Independence and Conflicts of Interest, draft ZIP discussion: Process ZIP proposal: ZCG Committee Organizational Independence and Conflicts of Interest · Issue #1374 · zcash/zips · GitHub
- Reply to Vitalik on Tornado Cash token-holder votes after sanctions: caviar on X: "It depends. Take Tornado Cash as an example: when the core devs were arrested and the team had to walk away, it was token holders and community voters who kept the protocol alive. Because of the OFAC sanctions, most RPC providers started blocking Tornado Cash entirely. The community… / X
- The Block, Attacker uses malicious proposal to take over Tornado Cash governance, 21 May 2023: https://www.theblock.co/news/ecosystems/2023-05-21-attacker-uses-malicious-proposal-to-take-over-tornado-cash-governance-231637
- Vitalik Buterin, Moving beyond coin voting governance: Moving beyond coin voting governance
- Hybrid Election of the ZCG Committee, draft ZIP discussion: Process ZIP proposal: Hybrid Election of the Zcash Community Grants Committee · Issue #1360 · zcash/zips · GitHub
- Miner Signaling for Dev Fund Discussion 2024: Miner Signaling for Dev Fund Discussion 2024
- Sovright mining-pool testnet: Sovright's Mining Pool Testnet Is Live — Sovright
- Sovright mining-infra repository: GitHub - sovright/mining-infra: Stratum V2 for Zcash - decentralized mining pool protocol with Equihash support · GitHub
- Sovright Job Declaration client guide: mining-infra/docs/integration/jd-client-guide.md at main · sovright/mining-infra · GitHub
- Zebra mining documentation (coinbase data): Mining - The Zebra Book
- Yale Law Journal, The Evolution of Shareholder Voting Rights: The Evolution of Shareholder Voting Rights: Separation of Ownership and Consumption | Yale Law Journal
- FINRA, Where Do Stocks Trade? (dark pools and reporting): Where Do Stocks Trade? | Syndication
- Liquidnet, Form ATS-N filing (institutional membership and asset requirements, 2020): https://www.sec.gov/Archives/edgar/data/1110644/000111064420000004/primary_doc.xml
- Samuel D. Warren and Louis D. Brandeis, The Right to Privacy, Harvard Law Review (1890): “The Right to Privacy” by Louis D. Brandeis and Samuel D. Warren, Jr.. Career. Louis D. Brandeis.
- Tournier v National Provincial and Union Bank of England [1924] 1 KB 461 (banking confidentiality): Tournier v. National Provincial and Union Bank of England.
- Zcash documentation, Basics (viewing keys and selective disclosure): Zcash Basics — Zcash Documentation 6.12.2 documentation
- The Block, Tornado Cash DAO passes attacker’s proposal to hand back control, 27 May 2023: https://www.theblock.co/news/ecosystems/2023-05-27-tornado-cash-dao-passes-attackers-proposal-to-hand-back-control-232401
- Protos, Tornado Cash DAO faces malicious governance attack, researchers warn, 25 June 2026: Tornado Cash DAO faces ‘malicious’ governance attack, researchers warn
- PriFi.info, Tornado Cash profile (proposal 67 rejected: about 623,000 TORN against, none for, when voting closed on 30 June 2026): Tornado Cash profile | PriFi.info
- Foresight News, Tornado Cash suffers another governance attack (interim tally on 26 June 2026: 27,163 TORN against, 0 for): Tornado Cash Suffers Another Governance Attack: A Fake Proposal Targets $23 Million Community Treasury | HTX Insights
- Danish National Police (NSK), 27-årig dømt for at muliggøre personfarlig kriminalitet ved CPR-opslag, 18 March 2026: https://politi.dk/national-enhed-for-saerlig-kriminalitet/nyhedsliste/27aarig-doemt-for-at-muliggoere-personfarlig-kriminalitet-ved-cpropslag/2026/03/18
- Le Parisien, L’agente du fisc ciblait gardiens de prison et investisseurs en cryptomonnaie pour un mystérieux commanditaire, 6 January 2026: https://www.leparisien.fr/faits-divers/lagente-du-fisc-ciblait-gardiens-de-prison-et-investisseurs-en-cryptomonnaie-pour-un-mysterieux-commanditaire-06-01-2026-WYVSPSJXYFCUFND23GKKJR3D6Y.php
- Gendarmerie nationale, La stratégie de la gendarmerie face aux cryptorapts (partie 1/2), 12 September 2026: https://www.gendarmerie.interieur.gouv.fr/gendinfo/terrain/immersion/2026/la-strategie-de-la-gendarmerie-face-aux-cryptorapts-partie-1-2
- FATF, Guidance on Digital Identity (March 2020): https://www.fatf-gafi.org/content/dam/fatf-gafi/guidance/Guidance-on-Digital-Identity.pdf
- FINRA, OTC and ATS transparency data (published volumes for each dark venue): https://otctransparency.finra.org/
- Zcash Foundation, Zcash Community Advisory Panel (eligibility criteria; link to the public list of members): Zcash Community Advisory Panel - Zcash Foundation