Zceipt proves one Zcash payment without handing over a viewing key. It then goes further: it proves facts about sets of payments (one payer, different payers, one wallet’s accounts, a delegated issuer, a total) without revealing the wallet’s history.

​
The contrast

1

Output disclosure: anyone who saw the payment can claim it

Reveal an outgoing viewing key’s output (what zreceipt and the ZIP 311 output-disclosure draft do) and the verifier learns who was paid and how much. It cannot tell the payer from anyone else who saw the payment. The verifier page’s Try a claim by someone who only saw it example shows this: same payment, another key, NOT PROVEN BY THE PAYER.
2

Spend authority: only the payer can make the receipt

A fresh Orchard Action proof for the note the payment spent, plus a signature by the key that spent it. This is the part of ZIP 311 that says TODO for Orchard. See spend authority.
3

Composability: prove relationships between payments

Same payer, different payers, one wallet’s sibling accounts, one of a published set of keys, a delegated issuer, a total across payments, a threshold treasury. See the overview.

​
What each step answers

​
Where it stands

Testnet and regtest only, and unaudited. Two of the proofs run on circuits this project modified or wrote, which no one else has reviewed. Status lists each proof with its evidence and its caveats.

Try it

Verify a real testnet receipt and an edited copy in minutes.

Technical note

The design in order: the forked circuit, tags, siblings, delegation.