By: Anton Livaja [*], Zooko Wilcox [†], Mark Henderson [†], Jason McGee [†]
[*] Caution, [†] Shielded Labs
Shielded Labs, Caution, Zec.rocks, and Stardust are preparing to deploy zero-indexer, a Trusted Execution Environment (TEE) enclave service that improves network privacy for Zcash users. We’re currently working with wallet partners and other indexer operators to integrate it into their existing infrastructure.
Today, when a wallet submits a transaction through an indexer such as lightwalletd or Zaino, an attacker can learn the user’s IP address and link it to their transactions and ZEC amounts. Once an attacker has that link, no other privacy defense helps. This matters for users still migrating funds from the Orchard pool to Ironwood, but the risk isn’t limited to the migration. Turnstile-crossing and CrossPay transactions face the same exposure, and network metadata makes it easier for outside observers to learn about or interfere with a user’s Zcash activity.
There are two ways to conceal the link. Wallets can route their traffic through an IP-level privacy layer. For example, ZODL and Vizor support Tor, while NozyWallet supports Nym. Wallets can also connect through a zero-indexer, which works just like existing indexers, but with improved privacy. Either technique offers pretty good protection on its own, but both together deliver defense in depth.
zero-indexer is part of Zero, Shielded Labs’ enterprise-grade Zcash infrastructure software for exchanges, mining pools, wallets, and other infrastructure operators. It is designed to work with existing wallets today, while allowing the privacy-sensitive routing and batching software to be independently verified.
How zero-indexer works
zero-indexer is built around two small enclaves: a shim and a hub. The shim sits in front of an operator’s existing indexer. Ordinary wallet requests are forwarded normally, while requests involving transfers out of the Orchard pool are routed to the hub.
The hub receives requests from participating shims without learning the user’s IP address. It collects transactions from multiple shims and, every 20 blocks (roughly 25 minutes), shuffles and broadcasts them to the Zcash network. Instead of watching one server receive and immediately broadcast a transaction, an observer must account for a separate hub, a time delay, and a batch containing transactions from potentially multiple operators.
The privacy benefit depends on real traffic. A batch containing many transactions provides a stronger anonymity set than a batch containing a few. A batch of one provides no batching anonymity: a malicious or compromised operator, or their network infrastructure provider, could link that user’s submission to the broadcast transaction. Even then, the user remains protected against a malicious or compromised hub, which never learns their IP address.
This also means that anyone who uses a zero-indexer is not only protecting themselves but providing cover traffic for everyone else, potentially including people who need it more than they do. zero-indexer will expose batch-size metrics so users and researchers can evaluate its protection based on actual usage.
We also plan to integrate Nym to add another layer of privacy between the shims and the hub. Today the hub can tell which operator forwarded a request. Routing that traffic through Nym will make it harder to determine whether a request came from Zec.rocks, Stardust, or another participating operator. This planned Nym routing is separate from a wallet routing its own traffic through Tor or Nym, whether that protection is built into the wallet or configured by the user via something like NymVPN. That user-side protection covers a different part of the path and still adds value.
What this means for users
For most wallet activity, users will not notice a change. When a user transfers funds out of the Orchard pool, however, the transaction is held and released as part of a shared batch every 20 blocks. It may appear on the network up to roughly 25 minutes later than expected, around 12.5 minutes on average. No additional action is required and the wallet does not need to stay open. Wallets such as ZODL that show a planned migration schedule will see this same small offset, trading a little speed for stronger network privacy.
Here are our recommendations for wallets on how to protect users’ network privacy.
Verification and trust
The shim and hub run inside hardware-attested Caution enclaves, powered by AWS Nitro. This means users don’t have to rely on Shielded Labs, Caution, or an operator saying the correct software is running: anyone can verify that the code handling their network metadata matches the version that was published and reviewed.
Ultimately, we want wallets to verify the enclave directly, so they can confirm they are connected to the expected zero-indexer software, and we’re working with wallet teams toward that integration. Until then, Shielded Labs is setting up independent auditors that will regularly verify known zero-indexer deployments and publish their status through a public website and API. Anyone will also be able to repeat the verification themselves.
What comes next
The next steps are to publish the shim and hub software, live attestation endpoints, and a registry of participating operators. For details, see our technical documentation. Over time, the goal is for more operators to contribute traffic to the shared batching layer, strengthening the anonymity set for everyone.
The Zcash protocol can hide what happens on the Zcash blockchain, but network infrastructure can still leak useful metadata. zero-indexer is designed to make the path between wallets and the Zcash network more private as well.
Free Nym Trial
For users who want additional network privacy today, Nym is offering Zcash users a free one-month trial of NymVPN. NymVPN can help protect a user’s IP address and network activity when interacting with Zcash infrastructure, complementing the protections provided by zero-indexer.