Key concepts behind private balances and holder yield

Notes and commitments

Think of a note as a private record saying “this owner holds this much of this asset”. On chain it appears only as a commitment: a Poseidon hash added to an append-only Merkle tree inside the pool. Next to it the pool stores a ciphertext that only the owner’s viewing key can open.

Spending a note makes the pool record its nullifier. This second hash can be computed by the owner alone, and it marks the note as used without pointing to the commitment it came from. That is how the pool stops double spends while keeping the link between old and new notes hidden.

Each private transaction consumes one or two notes and always produces exactly two. Empty filler notes keep the shape the same, so a transaction does not reveal how many real notes it touched.

Vault shares

ORDEO notes are counted in vault shares, not in tokens. The vault holds the ORDEO backing all shares. A donation of ORDEO to the vault grows the backing while the share count stays put, so one share is worth more ORDEO than before.

This is why a shielded balance grows on its own without any transaction from you. Public ORDEO in a wallet stays the same. ETH notes are counted in wei and do not change.

Spending key and viewing key

Your wallet signs one fixed message. From that signature the app derives two keys:

• a spending key, used to prove you own a note and to spend it;
• a viewing key, used to decrypt the notes sent to you.

Because the signature from a given wallet never changes, you get identical keys on every device, and no backup is needed. The keys are held in the page’s memory alone; they are never saved or transmitted. Details are in the whitepaper.

Private address and key registry

Your private address starts with ordeo: and carries your public note key and your public viewing key. You can share it freely; it reveals nothing on chain.

If you also register your keys once in OrdeoKeyLedger, anyone can pay your ordinary 0x address privately: the app looks your keys up. Registering is a small public transaction that links your address to your note key. See Private address.

The bundler

A bundler is an off-chain service that submits your private transaction for you. Its address is the sender on chain and it pays the gas; you pay it a flat ORDEO fee taken from your notes. Your proof names the bundler and its fee, so it can only submit or refuse; it cannot change anything.

If no bundler answers, you can always submit from your own wallet. Then your wallet pays gas in ETH and appears as the sender.

Splitter, harvester and fees

OrdeoYieldSplit takes in the Pons creator share and sends half to the team and half to the holders’ side. That side is a wallet operated by the harvester, a scheduled job. It spends its half on ORDEO, which it adds to the vault as a donation, and it also keeps the bundler supplied with gas.

The pool also charges its own small fees. Those charged in ORDEO remain in the vault, where they add to every note’s yield; those charged in ETH are sent to the splitter. See Fees.

Privacy set and practice mode

Your privacy set means all the notes in the tree: any of them could be the source of a spend. At launch the set is small, and timing and amount patterns can still link actions. The habits in Staying private help.

Practice mode is how the app runs before the contracts are deployed: signed messages instead of transactions, and practice balances instead of real funds.