the question is simple. how do you measure privacy in a market where every participant is anonymous, every transaction is public, and every piece of state is verifiable by anyone with an rpc connection. the answer the cypherpunks arrived at, after forty years of work, was that the right way to measure privacy is the size of the anonymity set (the number of plausible senders any single transfer could have come from) and the linkability between the wallets that compose it. what follows is the construction of a solana token that takes that answer and turns it on itself.
in 1981 a cryptographer named david chaum published a paper in the communications of the acm titled untraceable electronic mail, return addresses, and digital pseudonyms. it described a mix network: a way to route messages so that no observer, however powerful, could link a sender to a receiver. a year later he published blind signatures for untraceable payments, and the idea of digital cash that nobody could trace was born. the construction was not complicated. it was a handful of public-key operations arranged so that the act of hiding was indistinguishable from the act of paying. what was difficult was noticing that the question existed at all. before chaum, privacy was something you were granted. after chaum, privacy was something you could prove.
the proof matured in 1985, when goldwasser, micali, and rackoff defined the zero-knowledge proof: a way to convince a verifier that a statement is true while revealing nothing beyond its truth. it took thirty years to make that practical for money. in 2014 a group of researchers published zerocash, a scheme for decentralized anonymous payments, and in 2016 it shipped as a live chain. the anonymity set stopped being a thesis and became a number you could read off the ledger. goldwasser and micali took the turing award in 2012 for the work the whole edifice rests on. it has been applied to messaging, to voting, to identity. it has never been applied to the holder distribution of a token, because no chain ever exposed that distribution at a resolution fine enough to support the calculation. now one does.
the maximum-entropy frontier of an anonymity set is the configuration in which every holder is maximally indistinguishable from every other. it is the point at which an observer learns the least possible amount from watching the chain. plotted in entropy-linkability space, with linkability on the horizontal axis and entropy on the vertical, the frontier traces a curve that bends up and to the left. every point on the curve is achievable. every point above it is mathematically impossible. every point below it is reachable but leaky, because at the same linkability a higher entropy is available somewhere on the curve.
the frontier of a token's holder set is constructed the same way, with one substitution. instead of treating each asset as a random variable, the protocol treats each shielded class as a random variable. a class is defined by a note-value bucket and a diversifier-age window, so a wallet holding between one hundred and one thousand tokens that first transacted between thirty and ninety days ago belongs to one specific class. each class has an entropy computed from the dispersion of behavior across its members, and the classes are linkable to each other because their members transact against each other and against the same external flow.
the protocol recomputes the frontier on every transfer. the computation uses a closed-form solution rather than an iterative optimizer, cheap enough to run inside the transfer hook's compute budget. the result is a single number per transfer: the leakage, in bits, between the holder set's current position and the nearest point on the maximum-entropy frontier. when the leakage is near zero, the protocol does nothing. when the leakage grows, the levy fires.
a class is the unit of measurement inside the protocol. each wallet is assigned to exactly one class based on its note value and its diversifier age in slots since first acquisition. the value buckets are spaced logarithmically: under one hundred, one hundred to one thousand, one thousand to ten thousand, ten thousand to one hundred thousand, one hundred thousand to one million, above one million. the diversifier-age windows are spaced the same: under one day, a day to a week, a week to a month, a month to a quarter, a quarter to a year, above a year. the cross product of six value buckets and six age windows yields a grid of thirty-six shielded classes.
the grid is not arbitrary. it is the smallest grid that captures the two axes that betray a holder: how much they hold and how long they have held it. small fresh wallets behave like noise. they are the cover. large old wallets are anchors. they are what an analyst tries to fingerprint. the linkability matrix across the thirty-six classes has a characteristic structure: high linkability between adjacent classes, low or negative linkability between opposite corners, and a dominant first eigenvector that captures the market-wide flow on any given day. that eigenvector is exactly what a chain-surveillance firm would extract first. the protocol extracts it first too, and prices against it.
the levy is the only thing the protocol does. on every transfer, the hook fires, updates the class assignments and the linkability matrix, computes the leakage between the holder set and the frontier, and applies a levy proportional to the square of that leakage. the levy is withheld from the input amount through the token-2022 transfer hook's standard return value, which the token program respects atomically before the balance is updated. a transfer that arrives while the set sits on the frontier pays nothing. a transfer that arrives while the set has been dragged off the frontier (a whale deshielding, a pattern becoming legible) pays a levy that scales quadratically with the bits it leaks.
the levy accrues in a shielded pool, a program-derived address controlled by the hook program and holding a single immutable allocation function. when the pool crosses a threshold set at deployment, it distributes in two parts. half goes to the holders whose individual trajectories are least linkable to the dominant class. these are the holders who are the cover, who deepen the anonymity set. the other half goes to holders weighted by diversifier age, the longest-shielded wallets taking the largest share.
a holder who blends in and stays the longest is paid the most. a holder who breaks the set and exits is paid nothing. the asymmetry is intentional. the protocol charges the wallets that leak and pays the wallets that hide, mediated by a measurement neither population can directly observe but both populations move.
ze-gent was deployed and immediately sealed. the upgrade authority was revoked in the same session the program was uploaded, so the bytecode at the address cannot be modified by anyone. and unlike the privacy systems it descends from, it carries no trusted setup: there is no ceremony whose secret parameters, if leaked, could forge the whole construction. no toxic waste to burn, because the proving lineage it draws on (halo 2, the system orchard runs on) eliminated trusted setup entirely. the frontier target is a hardcoded constant. the class grid is a hardcoded array. the levy curve is a hardcoded coefficient. there is no admin key, no migration function, no multisig over the pool, no governance that can be voted into existence later.
the only mutable state on chain is the class table, the linkability matrix, and the pool balance. all three are overwritten by the next transfer regardless of who sends it. anyone with an rpc connection can read all three, run the math themselves, and confirm exactly what the protocol is about to levy against the next transfer. the whitepaper is the documentation. the implementation page is the source. the chain is the runtime. the protocol does not need to be believed. it only needs to be read.