Program reference

The numbered program (Anchor). Proofs are Groth16 over BN254, verified with groth16-solana over the alt_bn128 syscalls; commitments use Poseidon (sol_poseidon syscall).

Accounts

Account	Seeds	Holds
`Pool`	`["pool"]`	Configuration: protocol fee bps, number fee, relayer fee cap, the swap program; signs vault movement.
`Vault`	`["vault", mint]`	One token account per mint, controlled by the Pool. SOL as wSOL.
`Tree`	`["tree"]`	The incremental Poseidon tree of notes, ledgers and records, with a history of recent roots.
`Nullifier`	`["nullifier", nullifier]`	A spent marker, including the one-time ledger and number nullifiers.
`NumberCounter`	`["number_counter"]`	The next number, starting at 1.
`Number`	`["number", n]`	The account tag, the opened slot and the Proof count.
`Proof`	`["proof", n, sequence]`	The number, the sequence, each stat's disclosure and the slot it was verified at.
`Fee authority`	`["protocol", mint]`	A program address no key signs for; protocol fees accrue to its token account.

Instructions

Instruction	What it does
`initialize`	Creates the Pool, the tree and the SOL vault with their configuration.
`deposit`	Moves SOL from a wallet into the SOL vault and inserts a SOL note; the first deposit also creates the ledger.
`swap`	Verifies the proof, spends the input note and the ledger, swaps through the swap adapter, takes the fee on the SOL leg, inserts the output and change notes, seals the record and re-creates the ledger with it pending.
`withdraw`	Spends SOL notes and pays any recipient from the SOL vault; change stays shielded.
`take_number`	Proves a ledger and its opened slot, takes the number fee, consumes the account's one-number nullifier and assigns the next number.
`publish_proof`	Spends and re-creates the ledger, folds its pending record, checks every disclosure and writes the next Proof under the number.

Circuits

One circuit per action (deposit, swap, withdraw, take number, prove), written in circom + snarkjs. Verifying keys are embedded in the program. The program finishes the output note's and the record's commitments on chain from the amount the swap actually returned, while the circuit commits to everything else.