Break the link, pool by pool.
Spend a private note through a batched zero-knowledge epoch. The link between sender and receiver is severed — no amount ever touches the chain in clear.
The privacy pool, explained.
The mixer is the core privacy pool of Nox: per-user spend proofs, batched epoch proofs, and a TEE that never reveals amounts.
ZK epochs
Batched Plonky3 STARK proof (epoch_air) per asset, verifying conservation across the whole batch.
Per-user proofs
mix_spend_air proves ownership, Merkle membership, and computes the authorization commitment.
TEE coprocessor
tfhe-rs accumulates encrypted amounts homomorphically — no one outside the TEE ever sees individual amounts.
Opaque L1
lockPrivateIntent, finalizeEpoch, and settleEpochCommitments move only commitments and roots.
One epoch, four movements.
Mixing is not one transaction — it is a batched ceremony. Here is the sequence, in order.
Lock intents
Spenders submit lockPrivateIntent: their notes are pooled for the epoch. Only commitments appear on L1.
Prove per user
Each spender proves ownership and computes their authorization commitment with mix_spend_air.
Aggregate in TEE
The coprocessor sums amounts homomorphically — tfhe-rs adds ciphertexts without ever decrypting them.
Settle the batch
epoch_air verifies conservation for the whole batch; settleEpochCommitments mints change notes. Done.
Unlink yourself.
Pool funds with ZK proofs and vanish — change notes minted back as new private commitments.