LibraryPrivacy2022Design paperCorpus record
Penumbra: a shielded zone for a Cosmos-style chain
Penumbra. Penumbra Labs.
Penumbra publishes a shielded chain: amounts and trading intents are hidden, while a public nullifier set still prevents double spends.
A reading of the project's public design document. Not a copy, not a benchmark, and not an offer.
Penumbra publishes a shielded chain: amounts and trading intents are hidden, while a public nullifier set still prevents double spends.
- Evidence
- Primary paper
- Re-measured
- No
- Assumptions
- 3
- Records linked
- 6
01 Claim ledger
What the paper is allowed to say
Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.
Claim 01 · Paper model
The defect
Shielded does not mean the consensus validators disappeared. It means the state they agree on is a commitment, not a plaintext ledger.
Claim 02 · Paper model
The proposal
Penumbra publishes a shielded chain: amounts and trading intents are hidden, while a public nullifier set still prevents double spends.
Claim 03 · Paper model
The mechanism
Notes and nullifiers are the privacy machinery. The consensus the docs name still orders blocks.
Claim 04 · Paper model
The bound
This note does not assert that the chain is running or how much value is inside.
02 Three cuts
Observation, model, falsifier
A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.
01 The defect
Observation
What the study says
Shielded does not mean the consensus validators disappeared. It means the state they agree on is a commitment, not a plaintext ledger.
Model
What has to hold
You are reading the Penumbra protocol specification, not a wallet's privacy copy.
Falsifier
What would retire it
What state is public besides commitments and nullifiers?
02 The proposal
Observation
What the study says
Penumbra publishes a shielded chain: amounts and trading intents are hidden, while a public nullifier set still prevents double spends.
Model
What has to hold
You are reading the Penumbra protocol specification, not a wallet's privacy copy.
Falsifier
What would retire it
What state is public besides commitments and nullifiers?
03 The mechanism
04 The bound
03 Sequence
One action, as an operating tape
- 01Notes and nullifiers are the privacy machinery. The consensus the docs name still orders blocks.
- 02A shielded pool for trades is an application of the note system. The pool's invariant has to be proved inside the circuit, not assumed because the chain is private.
- 03IBC out of a shielded zone is a disclosure event. The moment value crosses, the privacy claim changes, and the spec should say how.
04 Load-bearing
The argument, and where a pitch drops it
What the name has to mean
The cut
Penumbra publishes a shielded chain: amounts and trading intents are hidden, while a public nullifier set still prevents double spends.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
This note does not assert that the chain is running or how much value is inside.
What actually moves
The cut
A shielded pool for trades is an application of the note system. The pool's invariant has to be proved inside the circuit, not assumed because the chain is private.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
This note does not assert that the chain is running or how much value is inside.
What a later deployment may change
The cut
IBC out of a shielded zone is a disclosure event. The moment value crosses, the privacy claim changes, and the spec should say how.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
This note does not assert that the chain is running or how much value is inside.
05 Register
What has to be true
Model · Not re-measured
You are reading the Penumbra protocol specification, not a wallet's privacy copy.
Model · Not re-measured
The document is the one at the source URL. A marketing page with the same brand is not this text.
Model · Not re-measured
No price, supply, yield, or adoption figure is added by this desk.
06 Divergence
What happened after the paper
This is not Zcash and not Aztec. The note format is its own.
A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.
07 Pre-mortem
What to check before you use the idea
- 0 of 3 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.
08 Anatomy
The paper, in the order a builder needs
The problem it names
Shielded does not mean the consensus validators disappeared. It means the state they agree on is a commitment, not a plaintext ledger.
What the design proposes
- Notes and nullifiers are the privacy machinery. The consensus the docs name still orders blocks.
- A shielded pool for trades is an application of the note system. The pool's invariant has to be proved inside the circuit, not assumed because the chain is private.
- IBC out of a shielded zone is a disclosure event. The moment value crosses, the privacy claim changes, and the spec should say how.
How the mechanism is specified
- Notes and nullifiers are the privacy machinery. The consensus the docs name still orders blocks.
- A shielded pool for trades is an application of the note system. The pool's invariant has to be proved inside the circuit, not assumed because the chain is private.
- IBC out of a shielded zone is a disclosure event. The moment value crosses, the privacy claim changes, and the spec should say how.
What this page does not treat as proven
Why the desk still reads it
Penumbra publishes a shielded chain: amounts and trading intents are hidden, while a public nullifier set still prevents double spends.
09 Lexicon
Terms, opened into the record
- Shielded note
- A commitment to value. The value is not on the public ledger.
- Nullifier
- The marker that prevents a note being spent twice. It is designed not to reveal which note.
10 Repository
Every linked record on this page
Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.
This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.
Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.