Docs
How Zecured works
Every txid, vault id, block height and timing on this page comes from our recorded runs on Zcash testnet, on Base Sepolia (the live run of 27 October) and on Base Sepolia forks, written down in docs/TESTING.md. The addresses are shortened examples. Amounts are testnet ZEC (TAZ); 1 ZEC is 100,000,000 zatoshi (zat).
01 Overview
Zecured lets you use shielded ZEC on Base without unshielding it. Your ZEC stays in Ironwood, Zcash’s newest shielded pool. Base sees zero-knowledge proofs, salted commitments and a standard-size position, never a Zcash address, transaction or note.
Borrow against shielded ZEC
Pay a fresh 3-of-5 FROST vault from Ironwood. A proof of the deposit mints zZEC, a collateral receipt nobody can transfer, into Morpho Blue, and a fresh, gasless account borrows USDC against it. Close from collateral, or repay and take it all back, to a new shielded address.
Swap USDC into shielded ZEC
Your USDC waits in escrow on Base. A market maker pays your Ironwood address and proves the payment in zero knowledge before the USDC is released. No custodian and no signer; selling ZEC for USDC works the same way, from the command line.
The shared core is a Zcash light client on Base. ZcashHeaderRelay checks Zcash block headers on-chain, proof of work (Equihash) included. ZIP 221 history roots let a proof show that a block is in the chain without saying which one. RISC Zero zkVM programs (“guests”) prove deposits, swap payments, payouts and violations, and ZecuredVersions lists the verifiers each proof is checked with. Any contract can use the same light client to check a shielded Zcash payment, with no bridge.
02 Why it matters
Using ZEC in DeFi usually means taking it out of the shielded pool, and three steps then leave four links back to you.
The turnstile
Moving ZEC from the shielded pool to a transparent address publishes that address and the amount that crossed.
What anyone can readt1Q8…Lx9 receives 0.125 ZEC
The wrapper
A lock-and-mint bridge holds your ZEC and mints a token for it elsewhere. You trust it with the coins, and the lock and the mint can be matched by amount and time.
What anyone can readmint 0.125 wZEC to 0x7a3e…41c2
The gas
A new account on another chain needs gas, and the transfer that pays for it ties the account to a wallet you already use.
What anyone can read0x51c0…9e1a sends 0.002 ETH to 0x7a3e…41c2
Zecured has none of the three. The ZEC never leaves Ironwood, nothing is wrapped, and a paymaster pays the account’s gas. Every leak we considered is in the threat model. Shielded ZEC becomes collateral, so holders no longer choose between privacy and liquidity.
03 How a loan works
Five steps, seen from both chains at once. The dark panel is the shielded pool, blurred where it is encrypted: switch on the viewing key to read what the borrower can. The light panel is what Base records about the vault, as a block explorer shows it. Gold marks the only things that cross: proofs. The ids, blocks and timings are real, from several recorded runs (TESTING.md), so they do not all belong to one vault or one version of the contracts.
Step 1 of 5: Open
On Zcash
A fresh vault for this loan
Five signers run a key generation for a new 3-of-5 FROST vault with its own Ironwood address. All five sign that address and its viewing key, and your browser checks the five signatures before it shows you where to pay.
- Spend key3-of-5 FROST, new for this loan
- Vault addressencrypted
- Signed byall five signers
Nothing crosses
On Base
Nothing yet
The vault is opened off-chain. Base first hears of it when your deposit’s proof lands, so no transaction on Base comes before your deposit.
No transaction about this vault
In a recorded run: with one signer offline, opening a vault was refused within a second. A vault needs all five.
Step 2 of 5: Deposit
On Zcash
You pay the exact amount
From Ironwood notes you have held for a while (fresh ones could be matched by timing), you pay the vault exactly its amount, here 0.01 ZEC. It’s an ordinary Ironwood-to-Ironwood payment: nothing crosses a pool, so no amount is published.
- Amountencrypted
- Toencrypted
- Sendernot part of the note
- Pool crossingnone
Nothing crosses
On Base
Still nothing
Your Base account doesn’t exist yet. It’s a counterfactual Safe: its address is known, and it’s deployed only when you first borrow.
No transaction about this vault
Measured: in the browser, the signers saw the deposit with its confirmations 2 min 50 s after the broadcast.
Step 3 of 5: Prove, a proof crosses
On Zcash
A proof of your deposit
A RISC Zero zkVM program proves that your note is in a Zcash block covered by a later header’s history root (ZIP 221). The proof names only that later header, never your deposit’s block, transaction or note.
- Deposit’s blockencrypted
- The proof namesa later header
- Proving time28.1 s on one RTX 4090, plus about a minute to wrap it in Groth16
Deposit proof crosses
On Base
Minted on the proof alone
The header relay has already checked that header’s Equihash on Base. The Intake verifies the proof, waits a few headers, then mints zZEC, a receipt nobody can transfer, straight into your account’s Morpho position.
- HeaderAddeda later Zcash header, Equihash checked on-chain
- ActivationPendinga vault idamount 1,000,000a keyed depositTag
- VaultActivatedzZEC supplied to Morpho for the account
Measured live on Base Sepolia on 27 October: ten confirmations 4 min 38 s after the deposit’s block, the proof verified by RISC Zero’s router 6 min 33 s later (2 min 10 s of proving), and the loan active 2 min 32 s after that: about 14 minutes in all.
Step 4 of 5: Borrow
On Zcash
Your ZEC stays put
Nothing moves in the pool. The note sits in the vault; spending it takes three of the five signers, and every spend must be committed on Base first, or it is provable theft.
- Vaultencrypted
- Movednothing
Nothing crosses
On Base
Borrow from a fresh account
Your first UserOp deploys a fresh Safe, authorizes Zecured on Morpho Blue and borrows USDC. Our paymaster sponsors the gas, so the account never receives ETH and leaves no funding trail. The USDC comes from lenders on Morpho Blue, who earn its interest: a new market backed by Zcash collateral.
- UserOperationEventdeploy, authorize, borrowgas sponsored
- Borrowassets 4 USDCmarket zZEC/USDC, liquidation LTV 62.5 %
Measured: deploying, authorizing, borrowing and setting pre-liquidation terms took one sponsored UserOp of 729,131 gas.
Step 5 of 5: Close, a proof crosses
On Zcash
Paid back in shielded ZEC
Close from collateral: a market maker repays your debt and takes ZEC for it, and the rest goes to a new shielded address of yours, both in one Zcash transaction. Or repay in USDC and take it all back.
- To youencrypted
- To the market makerencryptedSent with ovk = None, so not even your viewing key reads it.
- Transactionsone
Inclusion proof crosses
On Base
Committed before it’s signed
The signers must record every payout on Base before they can sign it (a spend commitment), under a keyed reference and salted hashes of its recipients. Then they confirm it. A payout is final once proven in zero knowledge, or once its dispute window closes undisputed; a proof of its inclusion in a Zcash block settles any dispute.
- CloseReleaseyours + the market maker’s = the outstanding
- SpendCommittedpayoutRef 0xcdf694fd…inputTag 0xe43d283f…
- PayoutInclusionProvenunder a header planned in advance
Measured: after a 0.004 ZEC partial release of that 0.01 TAZ vault, the market maker and the borrower were paid in one Zcash transaction, block 4,488,453.
If the price falls
If ZEC falls too far, a liquidator repays part of the debt on Morpho and is paid in shielded ZEC from the vault, with no outgoing viewing key. The vault tracks what is still outstanding, and the rest stays yours, to take back by repaying or closing from collateral. Pre-liquidation is opt-in: your account can set gentler terms of its own, below the market’s liquidation threshold. A liquidation’s payout on Zcash testnet: dc7c669a…, block 4,518,234.
04 What Base sees
The same loan, once through a typical bridge and once through Zecured, as a block explorer shows it. Red marks what ties it to you.
Through a typical bridge
- ZcashShielded ZEC moved to a transparent addresst1Q8…Lx9 receives 0.125 ZEC
- ZcashSent to the bridget1Q8…Lx9 pays the bridge’s address
- BaseWrapped ZEC minted0.125 wZEC to 0x7a3e…41c2
- BaseGas for that wallet0x51c0…9e1a sends 0.002 ETH to 0x7a3e…41c2
Four links to you. Your Zcash address, the amount, the bridge deposit that matches the mint, and the wallet that paid the gas.
Through Zecured
- ZcashAn Ironwood-to-Ironwood paymentencrypted: no address, no amount
- BaseA deposit proofvault id, 0.125 ZEC (a standard size), a keyed tag, a later header
- BaseA borrowfrom a fresh Safe that never received ETH
- BaseA releaseto keccak256(salt || receiver); the salt stays off-chain
No link to your wallet. Still public, by design: the position itself, a fresh account’s collateral, debt and interest, and the time of each payout, which a random delay of several blocks blurs.
Checked by our leak scanner
The leak scanner gathers the Zcash identifiers of our own runs (txids, note commitments, nullifiers, addresses, keys), then searches every event, every calldata and every storage word of a deployment for them. It prints counts, never values, and fails on any match. In the live run on Base Sepolia it looked for 181 identifiers in 89 events and 60 transactions’ calldata; in our last fork run, for 302 in 77 events, 55 transactions’ calldata and 177 storage words. No match.
0 matches
05 The swap
No custodian, no signer, no wrapped ZEC. Your USDC waits in escrow on Base and moves only on a zero-knowledge proof that a shielded payment for that very order is in the Zcash chain.
Where the liquidity comes from. No liquidity pool and no bridge: a market maker fills each order from its own inventory, ZEC in its shielded wallet and USDC on Base. It quotes the ZEC/USD oracle price plus its spread and signs the quote under EIP-712 for one taker, so nobody else can take it. Anyone with ZEC and USDC can run one (swap/maker); on testnet it is ours, and the price is set by hand (MOCK). On mainnet the price would be Chainlink’s ZEC/USD, checked against API3’s. An order is capped at 200 USDC on testnet and 250 USDC in the mainnet beta.
-
1Lock
BaseYou lock USDC for a market maker’s signed quote. Base stores only keccak256(salt || receiver), never your address.
ZcashNothing yet.
-
2Pay
BaseNothing. The order waits in escrow.
ZcashThe maker pays your Ironwood address, with “ZSWP” and the order id at the start of the memo, and no outgoing viewing key.
-
3Prove
BaseThe maker submits the proof. The contract checks it against a Zcash header the relay verified.
ZcashThe proof covers the payment, its memo and your salted receiver, under a later header. The payment’s block stays hidden.
-
4Release
BaseA few headers later the USDC goes to the maker. If no proof came in time, it comes back to you.
ZcashThe ZEC is already in your wallet, shielded.
Measured live on Base Sepolia on 27 October: the order opened at 18:30:41, the maker paid at 18:32:45, its payment proven through RISC Zero’s router at 18:42:27, the order settled at 18:45:12 UTC. Any Ironwood address can receive.
06 Who you trust
Zcash’s shielded pool has no scripts, and a loan must stay liquidatable when its borrower is gone, so someone has to be able to spend the collateral: a fresh 3-of-5 FROST vault per loan, whose signers may pay only what Base has recorded. Three signers could still move a vault’s ZEC: the design makes that provable and slashable, not impossible. They see the vault’s notes and amounts, the Ironwood addresses it pays and the Base account it backs; never the depositor’s wallet or identity. Base checks them instead of trusting them.
-
One or two signers
Can’t move anything. In a recorded run two signers, switched to a compromised mode, signed a sweep; the other three refused, and nothing moved.
-
The coordinator
Holds no key share. It can delay work, but it can’t move ZEC, mint zZEC, or hand you a vault address the signers didn’t sign.
-
Three signers
Can move a vault’s ZEC, but not quietly. Every payout must be committed on Base before it’s signed, so a theft is provable in zero knowledge, and it slashes the bonds that repay its victims.
-
Signers who stop paying
Once a signer has acknowledged where a claim goes, a claim left unpaid for 24 hours (72 on mainnet) is paid to its owner from the bonds.
-
All five together
Could take every vault. That’s the trust that remains, and the reason mainnet needs five independent operators.
The theft demonstration
We let three signers steal, on a separate deployment labelled DEMO, with its own five signers and a 2-minute challenge window instead of 24 hours. Times are UTC, from the run of October 20, which went past midnight.
- sweep 43ea5e91, block 4,523,730
Signers 3, 4 and 5 sweep the vault to a wallet of ours. Nothing is committed on Base.
- Two minutes later
The borrower’s watchtower reads the vault with its viewing key and finds its note spent by a transaction no commitment names: violation F1.
- 64 s
The violation’s witness is built from the chain and the viewing key.
- 00:04:40 UTC
proveViolation lands. Its journal holds no Zcash transaction, note or address, and the vault freezes at once.
- 00:06:47 UTC
executeSlash, once the 2-minute window is over: all five bonds are slashed.
- 00:16:53 UTC
The incident closes at $1,265 per ZEC. The slashed bonds repay the victim’s debt and retire its zZEC.
- from 3 to 12.65 USDC
The victim’s account after it withdrew its equity: the full value of its 0.01 ZEC.
On this fork the violation’s seal came from the MOCK verifier; a real F1 seal passes RISC Zero’s router in the fork tests. On Zcash testnet one Equihash ASIC out-mines the whole network about 40 times over, so every guarantee here that rests on proof of work is demonstrative. The five demo signers are run by us: the bonds show the mechanism, not independent economic security.
07 A judge’s questions
- Isn’t this just a multisig?
- It’s a FROST threshold vault: one shielded address whose signatures look like a single signer’s, and every signer enforces a written policy on every payout. Two compromised signers can’t move funds (see Who you trust).
- Is zZEC a wrapped ZEC? Is this a bridge?
- No. zZEC is a non-transferable collateral receipt, minted only into Morpho, that no account ever holds; each position’s zZEC equals what its own vault holds. Neither product moves ZEC off Zcash: the swap pays real shielded ZEC and releases escrowed USDC on a proof of that payment.
- How do I pay interest without linking my identity?
- Close from collateral: a market maker repays the debt on Morpho and takes ZEC from the vault, and the rest returns to a new shielded address in the same transaction. No outside funds ever touch your account.
- How long does a loan take, and what does it cost?
- About 14 minutes in our live run on Base Sepolia: ten confirmations after 4 min 38 s, the proof verified by RISC Zero’s router 6 min 33 s later (2 min 10 s of proving), and the loan active 2 min 32 s after that. The account’s gas is sponsored; the vault keeps a 0.5 % opening fee in ZEC (waived below 20,000 zatoshi), and the Morpho market sets the interest.
- Isn’t a Zcash light client on Base a bridge?
- It is the opposite of a lock-and-mint bridge: no asset moves through it and nobody holds coins for it. It lets Base read Zcash headers, their proof of work checked on-chain, and verify zero-knowledge proofs about shielded transactions under them. Zecured uses it to mint a non-transferable receipt and to release escrowed USDC; any contract can use it to check a shielded payment.
More answers in the Judges’ FAQ.
08 Evidence
Every number on this page comes from a run you can repeat, on testnets and local forks.
On Zcash testnet
Ordinary Ironwood transactions: a block explorer shows nothing but shielded actions (the linked ones open on ZecBlock’s testnet explorer).
- A payout committed on Base before it was signed19eab8ea…block 4,490,655
- Close from collateral: market maker and borrower in one transactiona3d0f0e1…block 4,488,453
- A liquidation paid with no outgoing viewing keydc7c669a…block 4,518,234
- A swap’s shielded payment, sent from the command lined5aaef42…block 4,523,265
- The theft demonstration’s sweep, slashed on Base43ea5e91…block 4,523,730
- The live run’s deposit, 0.05 TAZ to a 3-of-5 vaulte5eaf50d…block 4,548,243
- The live run’s close: borrower and market maker in one transaction0e82a053…block 4,548,312
- The live run’s swap, paid by the makerfa6ce860…block 4,548,320
On Base Sepolia, live
The live run of 27 October, its proofs checked by RISC Zero’s deployed router (the links open Basescan).
- The deposit proven in zero knowledge0x92af7a0f…18:11 UTC
- zZEC minted into Morpho, 2.5 minutes later0xbfe27bc5…18:14 UTC
- Closed from collateral0xf9c5f4bc…18:21 UTC
- The swap settled on its payment’s proof0xd1c1989d…18:45 UTC
- The payouts’ delivery proven on Base0xee567c75…19:36 UTC
Real
- Shielded Ironwood transactions on Zcash testnet (NU7)
- 3-of-5 FROST vaults: re-randomized FROST over RedPallas, keys per ZIP 2005
- Every signer’s policy checks on every payout
- The Zcash header relay, verifying Equihash on Base: live on Base Sepolia on 27 October (an earlier version took Testnet headers there on 12 October)
- The deposit, violation and payment statements in the RISC Zero zkVM, with reproducible image ids; real Groth16 seals of the pinned guests pass RISC Zero’s router, live on Base Sepolia on 27 October and on forks
- Morpho Blue’s own deployment on Base Sepolia (live on 27 October, and on forks); the v3 contract suites (533 tests) also pass against mainnet’s Morpho Blue and RISC Zero router on a fork
- The contracts: zZEC, the Registry and its spend logic, the Intake, the settlement adapter, the bonds, the slasher, the compensator and the version registry; and the mainnet price feed, tested on the live Chainlink and API3 feeds
- Liquidation, close from collateral and refunds of non-conforming deposits
- Every payout committed on Base before it is signed; bonds, slashing, compensation, the liveness penalty and disputes; the watchtower
- Zecured Swap: the contract, the payment statement and the market maker
- Our own RPC, bundler and paymaster proxy, with a sponsorship allowlist
- The app’s pages, the same in the live build and in the judges’ replay
Mock, or run by us
- The five signers, all run by the team: the bonds show the mechanism, not economic security
- The market’s liquidity and bots: our deployer supplied the 100,000 MockUSDC; the market makers and the liquidator are ours (anyone can run them)
- The ZEC price on Base Sepolia: MockZecOracle behind DemoShockOracle, so the demo can show a liquidation, read by the coverage cap through DemoCapPrice; mainnet reads Chainlink and API3
- USDC on testnet: MockUSDC, a test token we mint (MOCK: no value), on the local forks and on Base Sepolia. The contracts take any 6-decimal USDC; the mainnet configuration names Circle’s USDC
- On the local fork: MockRiscZeroVerifier for the fork runs’ proofs, and mock-host where RISC Zero does not run (the live Base Sepolia run used RISC Zero’s router)
- On the local fork: Pimlico’s mock paymaster (tools/local-aa) sponsors UserOps behind our proxy’s allowlist
- The demo wallet, on a testnet only: it pays a vault testnet ZEC for a visitor who has none, takes back a closed loan’s ZEC and can receive a swap
- The swap payment fixture of the tests, which is synthetic
- Test-only mocks in the unit and symbolic tests, each labelled MOCK in the code
- The theft demonstration: its own deployment, labelled DEMO, with a 2-minute window
- No deployment kept running through judging: the README runs everything on a local fork
- The app’s replay for the judges, labelled DEMO: our live run of 27 October, replayed in your browser with no backend
The same two lists, with every contract and mock named: What is real and what is a mock, in the README.
09 Toward mainnet
The mainnet beta changes configuration, not code. Full mainnet also needs the designs not yet built (a dispute bond, per-signer reimbursement, the fixes in Known limitations), and what code can’t bring: independent operators, real bonds and liquidity, and an audit.
Done
Checked against mainnet
The v3 suites’ 533 contract tests on mainnet’s Morpho Blue and RISC Zero router, the real seals verified there, the relay run on 1,600 real Mainnet headers, the price feed read from live Chainlink and API3.
About November 5, 2026
NU7 on Zcash Mainnet
The relay’s activation height, the guests’ branch ids and the off-chain stack follow the upgrade.
Then
An invite-only beta
Unaudited and labelled so: a 1 ZEC cap, vaults of 0.05 and 0.1 ZEC, bonds of at least 300 USDC (five of about 510 open the whole cap at today’s price), and exits that never stop.
After an audit
Mainnet
Five independent operators with bonds of 50,000 USDC each, a 100 ZEC cap and 72-hour windows, after an audit of the contracts, the guests and the signer policy.
The vault design is written up as a draft ZIP, Shielded Collateral Vaults, for any wallet or chain to build on. What is still open, and how each gap would close, is in Known limitations and their designs.
10 Run it yourself
No deployment is kept running through the judging period. Three ways to see it: the video of the live run; the app’s replay plays that run, a whole loan and a swap, in your browser with nothing to install; or run everything on your machine (five signer processes, the coordinator, the contracts on a local fork of Base Sepolia and the app, paying real Zcash testnet notes from the faucet). Plan an afternoon for the local run; the README walks through it.