Vision
22 May
## min read

Decentralization is not a meme: Part 1

What do we mean by “decentralization”? Why Aztec takes decentralization seriously? In this post, we explore Aztec’s efforts around protocol decentralization: sequencer, prover, and upgrade mechanism.

Share
Written by
Lisa A.
Edited by

Many thanks to Cooper, Prasad, Rafal, Mahima, and Elias for the review.

Contents

  • What do we mean by “decentralization”?
  • Why Aztec takes decentralization seriously
  • Aztec’s efforts around protocol decentralization: sequencer, prover, and upgrade mechanismsome text
  • Request for proposal (RFP)
  • Sequencer
  • Prover
  • Conclusion

1) What do we mean by “decentralization”?

Decentralization in blockchain is one of the most speculative topics, often thought about as a meme.

Source
Source

The questions around decentralization are:

  • Which components should be decentralized (both at the blockchain and application layers)?
  • To what extent?
  • Is decentralization of a specific part of the network a must-have or just a nice-to-have?
  • Will we die if a specific part of the network is not decentralized?
  • Is it enough to have a decentralization roadmap or should we decentralize for real?

The goal of this article is to shed some light on what we mean by decentralization, why it matters, and how decentralization is defined and provided in the context of the Aztec network.

Before we start figuring out the true meaning of decentralization, we should note that decentralization is not a final goal in itself. Instead, it is a way to provide rollups with a number of desired properties, including:

  • Permissionlessness (censorship resistance as a consequence) – anyone can submit a transaction and the rollup will process it (i.e. the rollup doesn’t have an opinion on which transactions are good and which are bad and can’t censor them).
  • Liveness – chain operates (processes transactions) nonstop irrespective of what is happening.
  • Security – the correctness of state transition (i.e. transactions' correct execution) is guaranteed by something robust and reliable (e.g. zero-knowledge proofs).

In the case of zk-rollups, these properties are tightly connected with “entities” that operate the rollup, including:

  • Sequencer – orders and executes transactions –> impacts permissionlessness and liveness.
  • Prover – generates proof that the transactions were executed correctly –> impacts security and liveness.
  • Governance mechanism (upgrade mechanism) – manages and implements protocol upgrades –> impacts security, liveness, and permissonlessness.

Even though we said at the beginning of the article that decentralization is a speculative topic, it’s not overly speculative. Decentralization is required for permissionlessness, censorship resistance, and liveness, which are required to reach the system’s end goal, credible neutrality (at least to some extent). “Credible neutrality” means the protocol is not “designed to favor specific people or outcomes over others” and is “able to convince a large and diverse group of people that the mechanism at least makes that basic effort to be fair”.

Credible neutrality is a crucial element for rollups as well, which is why we're prioritizing decentralization at Aztec, among other things. Progressive decentralization is not an option; Decentralization from the start is a must-have as the regulatory, political, and legal landscapes are constantly changing.

In the next section, we will dive into the specifics of Aztec’s case, looking at its components and their levels of decentralization.

2) Why Aztec takes decentralization seriously

Aztec network is a privacy-first L2 on Ethereum. Its goal is to allow developers to build dapps that are privacy-preserving and compliant (in any desired jurisdiction!) at the same time.

For Aztec, there are two levels of decentralization: protocol and organizational.

At the protocol level, Aztec network consists of a number of components, such as the P2P transaction pool (i.e. mempool), sequencer, prover, upgrade mechanism, economics, Noir (DSL language), execution layer, cryptography, web SDK, rollup contract, and more.

For each of these, decentralization might have a slightly different meaning. But the root reason why we care about it is to provide safety for the developers and users ecosystem.

  • For the rollup contract and upgrade mechanism, the question is who controls the upgrades and how we can diversify this process in terms of quantity and geography.
    A good mechanism should defend the protocol from forced upgrades (e.g. by the court). It should also mitigate the sanctions risk, isolating this risk at the application level, not the rollup level.
  • For sequencer and prover, we also need quantity and geographical decentralization as well as a multi-client approach where users can choose a vendor from a distributed set that may have various different priorities.
  • For economic decentralization, we need to ensure that “the ongoing balancing of incentives among the stakeholders — developers, contributors, and consumers — will drive further contributions of value to the overall system”. It covers the vesting of power, control, and ownership with system stakeholders in such a way that the value of the ecosystem as a whole accrues to a broader array of participants.
  • For all software components, such as client software, we need to ensure that copies of the software are distributed widely enough within the community to ensure access, even if the original maintainers choose to abandon the projects.

When it comes to long-term economic decentralization, the desired outcome is power decentralization, which in turn can be achieved through geographical decentralization.

In the context of geographical decentralization, we particularly care that:

  • diversification among different jurisdictions mitigates the risk of local regulatory regimes attempting to impose their will.
  • when reasoning about extremes and black swan events, having a global system is attractive from the point of view of safety and availability.
  • intuitively, a system that privileges certain geographies cannot be considered neutral and fair.

For more thoughts on geographical decentralization, check out the articleDecentralized crypto needs you: to be a geographical decentralization maxi” by Phil Daian.

3) Aztec’s efforts around protocol decentralization: sequencer, prover, and upgrade mechanism

The decentralization to-do list is pretty huge. Decentralization mechanism design is a complex process that takes time, which is why Aztec started working on it far in advance and called on the most brilliant minds to collaborate, cooperate, design, and produce the necessary mechanisms that will allow the Aztec network to be credibly neutral from day one.

Request for proposal (RFP)

Since last summer, we’ve announced a number of requests for proposal (RFPs) to invite the power of community and the greatest minds in the industry to find a range of solutions for the Aztec network protocol design:

Everyone was welcome to craft a proposal and post it on the forum. For each of the RFPs, we outlined a number of protocol requirements that will decentralize and diversify each part of Aztec, making it robust and credibly neutral.

For each RFP, we got a number of proposals (all of them are attached in the RFPs’ comments). Proposals were discussed on the forum by the community and analyzed in detail by partners (e.g. Block Science) and the Aztec Labs team.

In this section, we will describe and briefly discuss the chosen proposals.

Sequencer Selection

Some of the desired properties

There are a number of desired properties assigned to the sequencer. These include:

  • Permissionlessness sequencer role – any actor who adheres to the protocol can fill the role of sequencer.
  • Elegant reorg recovery – the protocol has affordance for recovering its state after an Ethereum reorg.
  • Denial of services – an actor cannot prevent other actors from using the system.
  • L2 chain halt – there is a healing mechanism in case of block proposal process failure.
  • Censorship resistance – it’s infeasibly expensive to maintain sufficient control of the sequencer role to discriminate on transactions.

Other factors to be considered are

  • How the protocol handles MEV
  • How costly it is to form a cartel
  • Protocol complexity
  • Coordination overhead – how costly it is to coordinate a new round of sequencers

Sequencer mechanism

The chosen sequencer design is called “Fernet” and was suggested by Santiago Palladino (“Palla”), one of the talented engineers at Aztec Labs. Its core component is randomized sequencer selection. To be eligible for selection, sequencers need to stake assets on L1. After staking, a sequencer needs to wait for an activation period of a number of L1 blocks before they can start proposing new blocks. The waiting period guards the protocol against malicious governance attacks.

Block proposal mechanism

Stage 0: Score calculation

  • In each round (currently expected to be ~12-36ss), staked sequencers calculate their round-based score, derived from a hash over RANDAO and a public key.

Stage 1: Proposal

  • Based on the calculated scores, if a sequencer determines its score for a given round as likely to win, it commits to a block proposal.
  • During the proposal stage, the highest ranking proposers (i.e. sequencers) submit L1 transactions, including a commitment to the Layer-2 transaction ordering in the proposed block, the previous block being built upon, and any additional metadata required by the protocol.

Stage 2: Prover commitment – estimated ~3-5 Ethereum blocks

  • The highest ranking proposers (i.e. sequencers) make an off-chain deal with provers. This might be a vertical integration (i.e. a sequencer runs a prover), business deal with a specific 3rd party prover, or a prover-boost auction between all of the third party proving marketplaces.
    On the sequencers' side, this approach allows them to generate proofs according to their needs. On the network side, it benefits from modularity, enjoying all proving systems innovations.
  • Provers build proofs for blocks with the highest scores.
  • This stage will be explicitly defined in the next section dedicated to the proving mechanism.

Stage 3: Reveal

  • At the end of the proposal phase, the sequencer with the highest ranking block proposal on L1 becomes the leader for this cycle, and reveals the block content, i.e. uploads the block contents to either L1 or a verifiable DA layer.
  • As stages 0 and 1 are effectively multi-leader protocols, there is a very high probability that someone will submit a proposal (though it might not be among the leaders according to the score).
    In the event that no one submits a valid block proposal, we introduce a “backup” mode, which enables a first-come, first-served race to submit the first proof to the L1 smart contracts. There is also a similar backup mode in the event that there is a valid proposal, but no valid prover commitment (deposit) by the end of the prover commitment phase or should the block not get finalized.
  • If the leading sequencer posts invalid data during the reveal phase, the sequencer for the next block will build from the previous one.

Stage 4: Proving – estimated ~40 Ethereum blocks

  • Before the end of this phase, it is expected for the block proof to be published to L1 for verification.
  • Once the proof for the highest ranking block is submitted to L1 and verified, the block becomes final, assuming its parent block in the chain is also final.
  • This would trigger new tokens to be minted, and payouts to the sequencer, prover commitment address, and the address that submitted the proofs.
  • If block N is committed to but doesn't get proven, its prover deposit is slashed.

The cycle for block N+1 can start at the end of the block N reveal phase.

How Fernet meets required properties

How Fernet meets required properties

Property
How Fernet addresses it
Permissionlessness sequencer role
Anyone who locked some funds on L1 can propose a block after a waiting period. 
Elegant reorg recovery
On L2, reorg is not possible as a new block can be proposed strictly after the previous block was finalized. However, L1 reorg might impact L2.
L2 chain halt
Relying on the Ethereum copy of Aztec network state between the last finalized epoch and the current safe block.
Censorship resistance
In order to censor a transaction, it must be the case that an entity can “guarantee” that they are repeatedly selected as sequencer while the transaction to be censored is awaiting processing. The VRF selection process will prevent such a guarantee.
MEV
For the public domain, MEV is extracted by the sequencer responsible for the current slot. In the private domain, there is no direct MEV extraction. However, there might be some probabilistically extracted MEV, though its feasibility will depend on the dapps landscape deployed on the chain.
Protocol complexity: engaged mechanisms can be adjusted over time because of modularity
The Aztec protocol design assumes modularity, allowing it to choose any prover and DA mechanisms and adjust them later if needed. 
Cost for private and public function calls
For public functions, call costs depend directly on the specific executed opcodes (as for any other rollup). For private function calls, there is a fixed cost for every state update and proof verification.

For a detailed analysis of the protocol's ability to satisfy the design requirements, check this report crafted by an independent third party, Block Science.

Prover

Context

In the previous section, we mentioned that at stage 3 proofs are supplied to the blocks. However, we didn’t explicitly define the specific prover mechanism.

To design a prover mechanism, Aztec also initialized an RFP after the sequencer mechanism was chosen to be Fernet (as described in the previous section).

Without going into too much detail, one should note that the Aztec network has two types of proofs: client-side proofs and rollup-side proofs. Client-side proofs are generated for each private function and submitted to the Aztec network by the user. The client-side proving mechanism doesn’t have any decentralization requirements, as all the private data is processed solely on the user’s device, meaning it’s inherently decentralized. Covering client-side proof generation is outside the scope of this piece, but check out one of our previous articles to learn more about it.

The Aztec RFP “Decentralized Prover Coordination” asked for a rollup-side prover mechanism, the goal of which is to generate proofs for blocks.

In particular, it means the sequencer executes every public function and the prover creates a proof of each function’s correct execution. That proof is aggregated into a kernel proof. Each kernel proof is aggregated into another kernel proof and so on (i.e. as a chain of kernel proofs). The final kernel proof is aggregated into a base rollup proof. The base rollup proofs are aggregated into pairs in a tree-like structure. The root of this tree is the final block proof.

Desired properties
There is a row of desired properties assigned to the prover mechanism. Among those:

  • Permissionlesness – anyone can run an Aztec prover.
  • The prover of each block can be recognized to be rewarded or slashed by the protocol.
  • Recovery mechanism in case provers stop supplying proofs.
  • Flexibility for future cryptography improvements.


Prover mechanism

The chosen prover mechanism is called “Sidecar” and was suggested by Cooper Kunz.

  • It is a minimally enshrined commitment and slashing scheme that facilitates the sequencer outsourcing proving rights to anyone, given an out-of-protocol prover marketplace. This allows sequencers to leverage reputation or other off-protocol information to make their choice.
  • In particular, it means anyone can take a prover role. For example, it can be a specialized proving marketplace, or a vertically integrated sequencer’s prover, or an individual independent prover.
  • After the sequencer chooses its prover, there is a Prover Commitment Phase by the end of which any sequencer who believes they have a chance to win block proposal rights must signal via an L1 transaction the prover’s Ethereum address and the prover specifies its deposit.
  • After the prover commits, the block content is revealed by the sequencer. Going with this specific order (i.e. first prover commitment then revealing block content) allows one to mitigate potential MEV-stealing (if sequencers have to publish all data to a DA layer before the commitment) and proof withholding attacks (i.e. putting up a block proposal that seems valid but never revealing the underlying data required to verify it).
  • The prover operates outside of Aztec protocol and the Aztec network. Hence, after the prover commitment stage, the protocol simply waits a predetermined amount of time for the proof submission phase to begin.

How Sidecar meets required properties

How Sidecar meets required properties

Property
How Sidecar addresses it
Permissionlessness
Anyone can run a prover.
Prover recognizability
Prover posts commitment to L1.
Recovery mechanism
Reorgs are not possible within the current design. 
Flexibility
There is no hard commitment to one specific proving system. 

Conclusion

Decentralization is neither a sentiment nor a meme. It’s one of the core milestones on the way to credible neutrality. And credible neutrality is one of the core milestones on the way to a long-lasting, secure, and robust Ethereum ecosystem.

If the network is not credibly neutral, the safety of users’ funds cannot be long-term guaranteed. Furthermore, if the network is not credibly neutral, the developers building on top of the network can’t be sure that the network will be there for them tomorrow, the day after tomorrow, in a year, in ten years, etc. They have to trust the network team that they are good, reliable people, and will continue maintaining the network and will fulfill all their promises. But what if that is not the case? Good intentions of a small number of people are not enough to secure hundreds of dapps, the thousands of developers building them, and the millions of users using them. The network should be designed in a credibly neutral way from the first to the last bit. Without compromises, without speculation, without promises.

That is what we are working on at Aztec Labs: systematically decentralizing all of the network’s components (e.g. sequencer and prover) with the help and support of a wide community (e.g. through RFP and RFC mechanisms) and top-notch partners (e.g. Block Science).

That is why, especially in the early days, Aztec prioritizes safety over other properties (e.g. impossibility of reorg attacks by design and unrolling upgrade mechanism allowing sequencers to have enough time to battle-test the mechanism before any assets come to the network).

Besides technical and economical decentralization, Aztec also considers its legal aspect that comes in the form of a foundation that is a suitable vehicle to promote decentralization.

If you want to contribute to Aztec’s decentralization – fill in the form.

This was the first part of the piece on Aztec’s decentralization. In the second part (coming soon), we will cover the upgrade mechanism.

Sources:

Read more
Aztec Network
Aztec Network
28 Oct
xx min read

Your Favorite DeFi Apps, Now With Privacy

Every time you swap tokens on Uniswap, deposit into a yield vault, or vote in a DAO, you're broadcasting your moves to the world. Anyone can see what you own, where you trade, how much you invest, and when you move your money.

Tracking and analysis tools like Chainalysis and TRM are already extremely advanced, and will only grow stronger with advances in AI in the coming years. The implications of this are that the ‘pseudo-anonymous’ wallets on Ethereum are quickly becoming linked to real-world identities. This is concerning for protecting your personal privacy, but it’s also a major blocker in bringing institutions on-chain with full compliance for their users. 

Until now, your only option was to abandon your favorite apps and move to specialized privacy-focused apps or chains with varying degrees of privacy. You'd lose access to the DeFi ecosystem as you know it now, the liquidity you depend on, and the community you're part of. 

What if you could keep using Uniswap, Aave, Yearn, and every other app you love, but with your identity staying private? No switching chains. Just an incognito mode for your existing on-chain life? 

If you’ve been following Aztec for a while, you would be right to think about Aztec Connect here, which was hugely popular with $17M TVL and over 100,000 active wallets, but was sunset in 2024 to focus on bringing a general-purpose privacy network to life. 

Read on to learn how you’ll be able to import privacy to any L2, using one of the many privacy-focused bridges that are already built. 

The Aztec Network  

Aztec is a fully decentralized, privacy-preserving L2 on Ethereum. You can think of Aztec as a private world computer with full end-to-end programmable privacy. A private world computer extends Ethereum to add optional privacy at every level, from identity and transactions to the smart contracts themselves. 

On Aztec, every wallet is a smart contract that gives users complete control over which aspects they want to make public or keep private. 

Aztec is currently in Testnet, but will have multiple privacy-preserving bridges live for its mainnet launch, unlocking a myriad of privacy preserving features.

Bringing Privacy to You

Now, several bridges, including Wormhole, TRAIN, and Substance, are connecting Aztec to other chains, adding a privacy layer to the L2s you already use. Think of it as a secure tunnel between you and any DeFi app on Ethereum, Arbitrum, Base, Optimism, or other major chains.

Here's what changes: You can now use any DeFi protocol without revealing your identity. Furthermore, you can also unlock brand new features that take advantage of Aztec’s private smart contracts, like private DAO voting or private compliance checks. 

Here's what you can do:

  • Use DeFi without revealing your portfolio: trade on Uniswap or deposit into Yearn without broadcasting your strategy to the world
  • Donate to causes without being tracked: support projects on Base without linking donations to your identity
  • Vote in DAOs without others seeing your choices: participate in governance on Arbitrum while keeping your votes private
  • Prove you're legitimate without doxxing yourself: pass compliance checks or prove asset ownership without revealing which specific assets you hold
  • Access exclusive perks without revealing which NFTs you own: unlock token-gated content on Optimism without showing your entire collection

The apps stay where they are. Your liquidity stays where it is. Your community stays where it is. You just get a privacy upgrade.

How It Actually Works 

Let's follow Alice through a real example.

Alice wants to invest $1,000 USDC into a yield vault on Arbitrum without revealing her identity. 

Step 1: Alice Sends Funds Through Aztec

Alice moves her funds into Aztec's privacy layer. This could be done in one click directly in the app that she’s already using if the app has integrated one of the bridges. Think of this like dropping a sealed envelope into a secure mailbox. The funds enter a private space where transactions can't be tracked back to her wallet.

Step 2: The Funds Arrive at the DeFi Vault

Aztec routes Alice's funds to the Yearn vault on Arbitrum. The vault sees a deposit and issues yield-earning tokens. But there's no way to trace those tokens back to Alice's original wallet. Others can see someone made a deposit, but they have no idea who.

Step 3: Alice Gets Her Tokens Back Privately

The yield tokens arrive in Alice's private Aztec wallet. She can hold them, trade them privately, or eventually withdraw them, without anyone connecting the dots.

Step 4: Alice Earns Yield With Complete Privacy

Alice is earning yield on Arbitrum using the exact same vault as everyone else. But while other users broadcast their entire investment strategy, Alice's moves remain private. 

The difference looks like this:

Without privacy: "Wallet 0x742d...89ab deposited $5,000 into Yearn vault at 2:47 PM"

With Aztec privacy: "Someone deposited funds into Yearn vault" (but who? from where? how much? unknowable).

In the future, we expect apps to directly integrate Aztec, making this experience seamless for you as a user. 

The Developers Behind the Bridges 

While Aztec is still in Testnet, multiple teams are already building bridges right now in preparation for the mainnet launch.

Projects like Substance Labs, Train, and Wormhole are creating connections between Aztec and major chains like Optimism, Unichain, Solana, and Aptos. This means you'll soon have private access to DeFi across nearly every major ecosystem.

Aztec has also launched a dedicated cross-chain catalyst program to support developers with grants to build additional bridges and apps. 

Unifying Liquidity Across Ethereum L2s

L2s have sometimes received criticism for fragmenting liquidity across chains. Aztec is taking a different approach. Instead, Aztec is bringing privacy to the liquidity that already exists. Your funds stay on Arbitrum, Optimism, Base, wherever the deepest pools and best apps already live. Aztec doesn't compete for liquidity, it adds privacy to existing liquidity.

You can access Uniswap's billions in trading volume. You can tap into Aave's massive lending pools. You can deposit into Yearn's established vaults, all without moving liquidity away from where it's most useful.

The Future of Private DeFi

We’re rolling out a new approach to how we think about L2s on Ethereum. Rather than forcing users to choose between privacy and access to the best DeFi applications, we’re making privacy a feature you can add to any protocol you're already using. As more bridges go live and applications integrate Aztec directly, using DeFi privately will become as simple as clicking a button—no technical knowledge required, no compromise on the apps and liquidity you depend on.

While Aztec is currently in testnet, the infrastructure is rapidly taking shape. With multiple bridge providers building connections to major chains and a dedicated catalyst program supporting developers, the path to mainnet is clear. Soon, you'll be able to protect your privacy while still participating fully in the Ethereum ecosystem. 

If you’re a developer and want a full technical breakdown, check out this post. To stay up to date with the latest updates for network operators, join the Aztec Discord and follow Aztec on X.

Aztec Network
Aztec Network
22 Oct
xx min read

Bringing Private Over-The-Counter (OTC) Swaps to Crypto

Transparent OTC Trades Are Holding the Industry Back

OTC trading is fundamental to how crypto markets function. It enables better price negotiations than what you'll find on public order books and facilitates trading of illiquid assets that barely exist on exchanges. Without OTC markets, institutional crypto trading would be nearly impossible. But here's the massive problem: every single OTC transaction leaves a permanent, public trace. 

Let's say you're a fund manager who needs to sell 1,000 BTC for USDC on Base. In a traditional OTC trade, your Bitcoin leaves your wallet and becomes visible to everyone on Bitcoin's blockchain. Through cross-chain settlement, USDC then arrives in your Base wallet, which is also visible to everyone on Base's blockchain. 

At this point, block explorers and analytics firms can connect these transactions through pattern analysis. As a result, your trading patterns, position sizes, and timing become public data, exposing your entire strategy.

This isn't just about privacy; transparent OTC creates serious operational and strategic risks. These same concerns have moved a significant portion of traditional markets to private off-exchange trades. 

Why Traditional Finance Moved to Private Markets

In TradFi, institutions don't execute large trades on public order books for many reasons. In fact, ~13% of all stocks in the US are now traded in dark pools, and more than 50% of trades are now off-exchange. 

They use private networks, dark pools, and OTC desks specifically because:

  • Strategy Protection: Your competitors can't front-run your moves
  • Better Execution: No market impact from revealing large positions
  • Regulatory Compliance: Meet reporting requirements without public disclosure
  • Operational Security: Protect proprietary trading algorithms and relationships

While OTC trading is already a major part of the crypto industry, without privacy, true institutional participation will never be practical. 

Now, Aztec is making this possible. 

Moving Whale-Sized Bags Privately on Aztec

We built an open-source private OTC trading system using Aztec Network's programmable privacy features. Because Aztec allows users to have private, programmable, and composable private state, users aren’t limited to only owning and transferring digital assets privately, but also programming and composing them via smart contracts.

If you’re new to Aztec, you can think of the network as a private world computer, with full end-to-end programmable privacy. A private world computer extends Ethereum to add optional privacy at every level, from identity and transactions to the smart contracts themselves. 

To build a private OTC desk, we leveraged all these tools provided by Aztec to implement a working proof of concept. Our private OTC desk is non-custodial and leverages private smart contracts and client-side proving to allow for complete privacy of the seller and buyer of the OTC.

How It Actually Works

For Sellers:

  1. Deploy a private escrow contract (only you know it exists at this stage)
  2. Initialize contract and set the terms (asset type, quantity, price)
  3. Deposit your assets into the contract
  4. After it’s been deployed, call a private API (the order book service)

For Buyers:

  1. Discover available orders through our privacy-preserving API
  2. Select trades that match your criteria
  3. Complete the seller's partial note with your payment
  4. Execute atomic swap – you get their assets, they get your payment

The Magic: Partial Notes are the technical breakthrough that make collaborative, asynchronous private transactions possible. Sellers create incomplete payment commitments that buyers can finish without revealing the seller's identity. It's like leaving a blank check that only the right person can cash, but neither party knows who the other is.

Privacy guarantees include: 

  • Complete Privacy: Neither party knows who they're trading with
  • Strategy Protection: Your trading patterns stay private
  • Market Impact Minimization: No public signals about large movements
  • Non-custodial: Direct peer-to-peer settlement, no intermediaries

Key Innovations

Private Contract Deployment: Unlike public decentralized exchanges where smart contracts are visible on the blockchain, the escrow contracts in this system are deployed privately, meaning that only the participants involved in the transaction know these contracts exist.

Partial Note Mechanism: This system uses cryptographic primitives that enable incomplete commitments to be finalized or completed by third parties, all while preventing those third parties from revealing or accessing any pre-existing information that was part of the original commitment.

Privacy-Preserving Discovery: The orderflow service maintains knowledge of aggregate trading volumes and overall market activity, but it cannot see the details of individual traders, including their specific trade parameters or personal identities.

Atomic Execution: The smart contract logic is designed to ensure that both sides of a trade occur simultaneously in a single atomic operation, meaning that if any part of the transaction fails, the entire transaction is rolled back and neither party's assets are transferred.

Build with us!

Our prototype for this is open-sourced here, and you can read about the proof of concept directly from the developer here

We're inviting teams to explore, fork, and commercialize this idea. The infrastructure for private institutional trading needs to exist, and Aztec makes it possible today. Whether you're building a private DEX, upgrading your OTC desk, or exploring new DeFi primitives, this codebase is your starting point. 

The traditional finance world conducts trillions in private OTC trades. It's time to bring that scale to crypto, privately.

To stay up to date with the latest updates for network operators, join the Aztec Discord and follow Aztec on X.

Aztec Network
Aztec Network
15 Oct
xx min read

Your Private Money Yearns for a Private Economy

Watch this: Alice sends Zcash. Bob receives USDC on Aztec. Nobody, not even the system facilitating it, knows who Alice or Bob are.

And Bob can now do something with that money. Privately.

This is the connection between private money and a private economy where that money can actually be used.

Zcash has already achieved something monumental: truly private money. It’s the store of value that Bitcoin promised (but made transparent). Like, digital gold that actually stays hidden.

But here's the thing about gold - you don't buy coffee with gold bars. You need an economy where that value can flow, work, and grow. Privately.

Money Under the Mattress

While other projects are trying to bolt privacy onto existing chains as an afterthought, Zcash is one of the oldest privacy projects in Web3. It's achieved what dozens of projects are still chasing: a truly private store of value.

Total Shielded ZEC Value (USD): Sep 16 - Oct 14 | Source: zkp.baby/

This is critical infrastructure for freedom. The ability to store value privately is a fundamental right, a hedge against surveillance, and a given when using cash. We need a system that provides the same level of privacy guarantees as cash. Right now, there's over $1.1 billion sitting in Zcash's shielded pool, private wealth that's perfectly secure but essentially frozen.

Why frozen? Because the moment that shielded $ZEC tries to do anything beyond basic transfers: earn yield, get swapped for stablecoins, enter a liquidity pool, it must expose itself. The privacy in this format is destroyed.

This isn't Zcash's failure. They built exactly what they set out to build: the world's best private store of value. The failure is that the rest of crypto hasn't built where that value can actually work.

The Privacy Landscape Has an Imbalance

What happens when you want to do more than just send money? What happens when you want privacy after you transfer your money?

Private Digital Money (i.e., “Transfer Privacy,” largely solved by Zcash):

  • Zcash: est. 2016
  • Everyone else: building variants of digital money at the transaction or identity level
    • Monero
    • Ethereum privacy pools
    • 0xbow
    • Payy
    • Every privacy stablecoin project
    • Every confidential L2
    • Every privacy project you've ever heard of

Private World Computer (i.e., After-the-Transfer Privacy):

  • Aztec

Everyone else is competing to build better ways to hide money. Zcash has already built the private store of value, and Aztec has built the only way to use hidden money.

The Locked Liquidity Problem

Here's the trillion-dollar question: What good is private money if you can't use it?

Right now, Zcash's shielded pool contains billions in value. This is money in high-security vaults. But unlike gold in vaults that can be collateralized, borrowed against, or deployed, this private value just sits there.

Every $ZEC holder faces two impossible choices:

  1. Keep it shielded and forfeit all utility
  2. Unshield it to use it and forfeit all privacy

Our demo breaks this false sense of choice. For the first time, shielded value can move to a place where it remains private AND becomes useful.

The Private World Computer

Here's how you can identify whether you’re dealing with a private world computer, or just private digital money:

Without a private world computer (every other privacy solution):

  • Receive salary privately → Can't invest it
  • Store savings privately → Can't earn yield
  • Send money privately → Recipient can't use it privately

With a private world computer (only Aztec):

  • Receive salary privately → Invest it privately
  • Store savings privately → Earn APY privately
  • Send payment privately → Recipient spends it privately

This is basic financial common sense. Your money should grow. It should work. It should be useful.

The technical reality is that this requires private smart contracts. Aztec is building the only way to interact privately with smart contracts. These smart contracts themselves can remain completely hidden. Your private money can finally do what money is supposed to do: work for you.

What We Actually Built

Our demo proves these two worlds can connect:

  1. The Vault: Zcash
  2. The Engine: Aztec (where private money becomes useful)

We built the bridge between storing privately and doing privately.

The technical innovation - "partial notes" - are like temporary lockboxes that self-destruct after one use. Money can be put privately into these lockboxes, and a key can be privately handed to someone to unlock it. No one knows who put the money in, where the key came from, or who uses the key. You can read more about how they work here. But what matters isn't the mechanism. 

What matters is that Alice's Zcash can become Bob's working capital on Aztec without anyone knowing about either of them.

As a result, Bob receives USDC that he can:

  • Earn yield on
  • Trade with
  • Pay suppliers with
  • Build a business on
  • All privately

Why This Required Starting from Scratch (and 8 years of building)

You can't bolt privacy onto existing systems. You can't take Ethereum and make it private. You can't take a transparent smart contract platform and add privacy as a feature.

Aztec had to be built from the ground up as a private world computer because after-the-transfer privacy requires rethinking everything:

  • How state is managed
  • How contracts execute
  • How proofs are generated
  • How transactions are ordered

This is why there's only one name building fully private smart contracts. From the beginning, Aztec has been inspired by the work Zcash has done to create a private store of value. That’s what led to the vision for a private world computer.

Everyone else is iterating on the same transfer privacy problem. Aztec solves a fundamentally different problem.

The Obvious Future

Once you see it, you can't unsee it: Privacy without utility is only the first step.

Every privacy project will eventually need what Aztec built. Because their users will eventually ask: "Okay, my money is private... now what?"

  • Zcash users will want their $ZEC to earn yield
  • Privacy pool users will want to do more than just mix
  • Private stablecoin users will want to actually… use their stablecoins

This demo that connects Zcash to Aztec is the first connection between the old world (private transfers) and the new world (private everything else).

What This Means

For Zcash Holders: Your shielded $ZEC can finally do something without being exposed.

For Developers: Stop trying to build better mattresses to hide money under. Start building useful applications on the only platform that keeps them private. 

For the Industry: The privacy wars are over. There's transfer privacy (solved by Zcash) and after-the-transfer privacy (just Aztec).

What’s Next? 

This demo is live. The code is open source. The bridge between private money and useful private money exists.

But this is just the beginning. Every privacy project needs this bridge. Every private payment network needs somewhere for those payments to actually be used.

We're not competing with transfer privacy. We're continuing it.

Your private money yearns for the private economy.

Welcome to after-the-transfer privacy. Welcome to Aztec.

Aztec Network
Aztec Network
8 Oct
xx min read

Aztec: The Private World Computer

Privacy has emerged as a major driver for the crypto industry in 2025. We’ve seen the explosion of Zcash, the Ethereum Foundation’s refocusing of PSE, and the launch of Aztec’s testnet with over 24,000 validators powering the network. Many apps have also emerged to bring private transactions to Ethereum and Solana in various ways, and exciting technologies like ZKPassport that privately bring identity on-chain using Noir have become some of the most talked about developments for ushering in the next big movements to the space. 

Underpinning all of these developments is the emerging consensus that without privacy, blockchains will struggle to gain real-world adoption. 

Without privacy, institutions can’t bring assets on-chain in a compliant way or conduct complex swaps and trades without revealing their strategies. Without privacy, DeFi remains dominated and controlled by advanced traders who can see all upcoming transactions and manipulate the market. Without privacy, regular people will not want to move their lives on-chain for the entire world to see every detail about their every move. 

While there's been lots of talk about privacy, few can define it. In this piece we’ll outline the three pillars of privacy and gives you a framework for evaluating the privacy claims of any project. 

The Three Pillars of Privacy 

True privacy rests on three essential pillars: transaction privacy, identity privacy, and computational privacy. It is only when we have all three pillars that we see the emergence of a private world computer. 

Transaction: What is being sent?

Transaction privacy means that both inputs and outputs are not viewable by anyone other than the intended participants. Inputs include any asset, value, message, or function calldata that is being sent. Outputs include any state changes or transaction effects, or any transaction metadata caused by the transaction. Transaction privacy is often primarily achieved using a UTXO model (like Zcash or Aztec’s private state tree). If a project has only the option for this pillar, it can be said to be confidential, but not private. 

Identity: Who is involved?

Identity privacy means that the identities of those involved are not viewable by anyone other than the intended participants. This includes addresses or accounts and any information about the identity of the participants, such as tx.origin, msg.sender, or linking one’s private account to public accounts. Identity privacy can be achieved in several ways, including client-side proof generation that keeps all user info on the users’ devices. If a project has only the option for this pillar, it can be said to be anonymous, but not private. 

Computation: What happened? 

Computation privacy means that any activity that happens is not viewable by anyone other than the intended participants. This includes the contract code itself, function execution, contract address, and full callstack privacy. Additionally, any metadata generated by the transaction is able to be appropriately obfuscated (such as transaction effects, events are appropriately padded, inclusion block number are in appropriate sets). Callstack privacy includes which contracts you call, what functions in those contracts you’ve called, what the results of those functions were, any subsequent functions that will be called after, and what the inputs to the function were. A project must have the option for this pillar to do anything privately other than basic transactions. 

From private money to a private world computer 

Bitcoin ushered in a new paradigm of digital money. As a permissionless, peer-to-peer currency and store of value, it changed the way value could be sent around the world and who could participate. Ethereum expanded this vision to bring us the world computer, a decentralized, general-purpose blockchain with programmable smart contracts. 

Given the limitations of running a transparent blockchain that exposes all user activity, accounts, and assets, it was clear that adding the option to preserve privacy would unlock many benefits (and more closely resemble real cash). But this was a very challenging problem. Zcash was one of the first to extend Bitcoin’s functionality with optional privacy, unlocking a new privacy-preserving UTXO model for transacting privately. As we’ll see below, many of the current privacy-focused projects are working on similar kinds of private digital money for Ethereum or other chains. 

Now, Aztec is bringing us the final missing piece: a private world computer.

A private world computer is fully decentralized, programmable, and permissionless like Ethereum and has optional privacy at every level. In other words, Aztec is extending all the functionality of Ethereum with optional transaction, identity, and computational privacy. This is the only approach that enables fully compliant, decentralized applications to be built that preserve user privacy, a new design space that we see as ushering in the next Renaissance for the space. 

Where are we now? 

Private digital money

Private digital money emerges when you have the first two privacy pillars covered - transactions and identity - but you don’t have the third - computation. Almost all projects today that claim some level of privacy are working on private digital money. This includes everything from privacy pools on Ethereum and L2s to newly emerging payment L1s like Tempo and Arc that are developing various degrees of transaction privacy 

When it comes to digital money, privacy exists on a spectrum. If your identity is hidden but your transactions are visible, that's what we call anonymous. If your transactions are hidden but your identity is known, that's confidential. And when both your identity and transactions are protected, that's true privacy. Projects are working on many different approaches to implement this, from PSE to Payy using Noir, the zkDSL built to make it intuitive to build zk applications using familiar Rust-like syntax. 

The Private World Computer 

Private digital money is designed to make payments private, but any interaction with more complex smart contracts than a straightforward payment transaction is fully exposed. 

What if we also want to build decentralized private apps using smart contracts (usually multiple that talk to each other)? For this, you need all three privacy pillars: transaction, identity, and compute. 

If you have these three pillars covered and you have decentralization, you have built a private world computer. Without decentralization, you are vulnerable to censorship, privileged backdoors and inevitable centralized control that can compromise privacy guarantees. 

Aztec: the Private World Computer 

What exactly is a private world computer? A private world computer extends all the functionality of Ethereum with optional privacy at every level, so developers can easily control which aspects they want public or private and users can selectively disclose information. With Aztec, developers can build apps with optional transaction, identity, and compute privacy on a fully decentralized network. Below, we’ll break down the main components of a private world computer.

Private Smart Contracts 

A private world computer is powered by private smart contracts. Private smart contracts have fully optional privacy and also enable seamless public and private function interaction. 

Private smart contracts simply extend the functionality of regular smart contracts with added privacy. 

As a developer, you can easily designate which functions you want to keep private and which you want to make public. For example, a voting app might allow users to privately cast votes and publicly display the result. Private smart contracts can also interact privately with other smart contracts, without needing to make it public which contracts have interacted. 

Aztec’s Three Pillars of Privacy

Transaction: Aztec supports the optionality for fully private inputs, including messages, state, and function calldata. Private state is updated via a private UTXO state tree.

Identity: Using client-side proofs and function execution, Aztec can optionally keep all user info private, including tx.origin and msg.sender for transactions. 

Computation: The contract code itself, function execution, and call stack can all be kept private. This includes which contracts you call, what functions in those contracts you’ve called, what the results of those functions were, and what the inputs to the function were. 

Decentralization

A decentralized network must be made up of a permissionless network of operators who run the network and decide on upgrades. Aztec is run by a decentralized network of node operators who propose and attest to transactions. Rollup proofs on Aztec are also run by a decentralized prover network that can permissionlessly submit proofs and participate in block rewards. Finally, the Aztec network is governed by the sequencers, who propose, signal, vote, and execute network upgrades.

What Can You Build with a Private World Computer?

Private DeFi

A private world computer enables the creation of DeFi applications where accounts, transactions, order books, and swaps remain private. Users can protect their trading strategies and positions from public view, preventing front-running and maintaining competitive advantages. Additionally, users can bridge privately into cross-chain DeFi applications, allowing them to participate in DeFi across multiple blockchains while keeping their identity private despite being on an existing transparent blockchain.

Private Dark Pools

This technology makes it possible to bring institutional trading activity on-chain while maintaining the privacy that traditional finance requires. Institutions can privately trade with other institutions globally, without having to touch public markets, enjoying the benefits of blockchain technology such as fast settlement and reduced counterparty risk, without exposing their trading intentions or volumes to the broader market.

Private RWAs & Stablecoins

Organizations can bring client accounts and assets on-chain while maintaining full compliance. This infrastructure protects on-chain asset trading and settlement strategies, ensuring that sophisticated financial operations remain private. A private world computer also supports private stablecoin issuance and redemption, allowing financial institutions to manage digital currency operations without revealing sensitive business information.

Compliant Apps

Users have granular control over their privacy settings, allowing them to fine-tune privacy levels for their on-chain identity according to their specific needs. The system enables selective disclosure of on-chain activity, meaning users can choose to reveal certain transactions or holdings to regulators, auditors, or business partners while keeping other information private, meeting compliance requirements.

Let’s build

The shift from transparent blockchains to privacy-preserving infrastructure is the foundation for bringing the next billion users on-chain. Whether you're a developer building the future of private DeFi, an institution exploring compliant on-chain solutions, or simply someone who believes privacy is a fundamental right, now is the time to get involved.

Follow Aztec on X to stay updated on the latest developments in private smart contracts and decentralized privacy technology. Ready to contribute to the network? Run a node and help power the private world computer. 

The next Renaissance is here, and it’s being powered by the private world computer.