Private UTXO brings privacy and a direct leader reward. Almost everything else gets harder: a proof becomes mandatory for every move, layer 2s lose their compression, pools stop working, wallets must follow the whole chain, the leader proof time is unknown, and nodes may no longer fit on light hardware. Mainnet needs the private base, pools and a rebuilt zone SDK for LEZ, which in my view pushes it to around October 2027 rather than March 2027. This is a rough personal estimate that still needs David's approval. Compression can come after mainnet as an upgrade.

The two designs compared

The public baseline is PR 457 and 458. Notes are visible, a sequencer needs the owner's signature to move a note, and the chain checks it only if someone challenges. The private design is PR 480. Notes are hidden, and every move is proven on chain.

In public, notes created and spent again inside the same inscription are never recorded, only the net result: 32 bytes per consumed note and 40 bytes per final note. 245 kB is the worst case, where every payment spends a fresh note and leaves two final notes. In private, every step is recorded, so the 580 kB do not shrink. Proof times were measured on a 24-core i9 laptop.

What we gain

The gains are real but few: privacy and a direct leader reward.

Privacy. Nobody sees amounts or owners, and a spend cannot be linked to the note it spends.

A direct leader reward. Today the leader's reward is delayed to the next epoch and pooled with all other leaders, only to hide which block it came from. With private notes this detour is useless. The leader gets its reward, plus the fees and tips of its block, directly in that block. The incentive is simpler and stronger, and a whole operation (LEADER_CLAIM) disappears with its proof.

Challenges, collateral and watchtowers also disappear from channels. This is not a gain: they disappear only because every move must now be proven, as explained below.

What we lose and what gets harder

The cost is high. Several points below are not only performance costs, they are risks for mainnet itself: the leader proof time, light hardware, and the rebuild of the zone SDK for LEZ.

A proof becomes mandatory for every move. In public, a sequencer posts its moves, and the next inscription can reuse the new notes right away. A proof is only needed if someone challenges, or if the zone wants a move final earlier than 2 to 3 days. The zone chooses. In private, every single move must carry its proof, always. What was flexible becomes mandatory, for every zone.

Layer 2s lose their compression. In public, a sequencer nets all its users' moves into one inscription, and the chain only checks that no token is created. Notes created and spent again inside the same inscription are never recorded. For a zone with 2,000 payments a day, that is at most about 245 kB a day, and usually far less. In private, the chain cannot see amounts, so every user move must be posted alone with its proof: about 580 kB a day for the same zone, at least 2.4 times more, since every intermediate step is recorded. A move in a channel then costs the chain as much as a move on the ledger. Without compression, a layer 2 brings little or nothing.

No more optimistic model. In public, a cheating sequencer only hurts its own channel, and everyone can see it. In private, an undetected cheat could create hidden value and inflate the whole supply. Every move must therefore be proven before it is accepted, never checked afterwards.

No pools. An AMM pool belongs to nobody, but a private note can only be moved by its owner. A pool would have to sit under the sequencer's key, and the sequencer could empty it at any time, without anyone seeing. The public design already supported pools. In private, they must be designed again from scratch.

The leader proof time is unknown. Today the leader proof takes about 0.7 s on 1 thread and 0.17 s on 25 threads or more, on a 24-core i9 laptop. The private leader proof must also show that the note is in its set and that it was never spent, inside a tree that can hold 2^32 entries. It is not built yet, so nobody knows its time. A private transfer, which is simpler, already takes about 1.45 s on 1 thread. Our Blend and block timing analyses assume a leader proof under 1 second. If that no longer holds, those analyses must be redone, and leaders on modest machines may struggle to produce their block in time.

Light hardware may no longer be supported. In public, the node only keeps live notes. In private, it must keep every spent-note marker forever, sorted, on disk instead of in RAM. The 100 GB we plan for the blockchain on a Raspberry Pi will fill up faster, and proofs that take over a second on a 24-core i9 will take much longer on a small ARM board. Nobody has measured it yet. If a Raspberry Pi can no longer run a node or a leader, our decentralization story loses credibility.

Wallets become full nodes. To spend, a wallet must keep proving that its notes are in a set that changes every block, so it must follow the whole chain. Asking a server for this data would reveal which notes it owns, and lose the privacy we are paying for.

LEZ may no longer bring anything new. LEZ is a private execution zone: private state with commitments and nullifiers, programs that own accounts, and a proof of execution that replaces the owner's signature. A private L1 with pools has exactly that model, and if the plan is to add multi-token notes, composable programs and general execution to the L1 as well. LEZ would then replicate the L1 one layer higher. Its only remaining role would be scaling, but before compression every LEZ move that touches LGO must be posted again on the L1 with its own proof, so LEZ saves no space on chain. It would also double the work for every bridged move: two nullifier sets, two key schemes, two proofs.