03 - Network State Conference 2026 - Sean Bowe on Scaling Zcash

So, I'm Sean Bo. I'm the executive director of Tachion and um I was here about a year ago in Singapore and we announced that we were going to hire for a a team of cryptographic engineers to work on sort of the next iteration of uh Zcash's cryptography. And uh we we did we hired these fantastic engineers from like Celestia and Penumbra and um Espresso and we've been working really hard for the last year or so on uh essentially scaling Zcash. We're we're taking the cryptography that's uh at this at the core of the private payments that take place in our protocol and we're removing all the cryptographic bottlenecks that are on the inside. So, if I had to really describe what we're doing kind of briefly is that we're basically taking snarks, which are these things that we have uh inside of Zcash, and we're um uh adding something called a recursive proof to them. And uh these are really cool. I can explain real briefly. So uh one example of this is just sort of an illustration is that you can basically so right now in Zcash when you send private payments uh invariably you're going to have multiple different things happening inside your transaction. And so the proofs that you put inside them are quite large. They're like 7 kilobytes on average for like a standard payment. Um, and sometimes they're a little bit larger because of random reasons that aren't that interesting. Um, inside of our thing because we use recursive proofs, these proofs prove that other proofs have validated properly. And that's sort of the essence of how they work. Um, so it's like proofs all the way down. The proofs can prove other instances of themselves and so and so on. And you can build all sorts of crazy applications with this. And one simple example is just this. So in Tachion uh when you create a transaction uh it is actually doesn't have a marginal increase in cost uh size of the transaction. Um so it actually in in our specific design it's not any larger than uh what we do in orchard already. Um so we can do the same principle with multiple transactions in a block. So uh a minor will take a trans uh all the transactions and take all the proofs out or these things called stamps and combine them together into one proof uh an aggregate that's about 17 kilobytes in size. And uh we can shove as many transactions as possible into the block. Actually the uh the with the current block size or the block size that we're going to have in less than a month uh you should be able to at least do about 150 TPS with that. uh but the real goal is just to enable the uh sort of asmtoic um improvement here. Now we can do something similar or or something totally different actually but using similar technology using these recursive proofs where right now we have this uh state uh increase in our transaction or in our uh like our validators on our network. Um, and we can actually reduce this and make it so that all of the clients are responsible for for proving that this uh that these that these objects haven't existed on the chain in order to prove that we haven't double spent uh using the same recursive proofs and as a result there's a cap on the actual uh state growth. So uh this is just another example of what we can do with the recursive proofs. And this actually these two sort of remove all the asmtoic uh costs uh like the the unfortunate asmtotic costs to the to shielded transactions in Zcash. Um so uh just real quick like uh basically in inside of our construction this is a a standard proposal that we're posting uh for how these things work. Um, they're actually quite a bit simpler than how they they work in in Zcash today. Uh, I don't really have that much time to go into them, but this thing on the bottom, the stamp, is the thing that uh actually gets removed from all the transactions. So, you're only left with this stuff in the top. And it's actually really cool that you get a fully shielded transaction, like a super private transaction in Zcash, and you only need this stuff on the top. It's actually quite small. Uh so we also simplify the way the protocol works. So whenever there are new things happening in the chain instead of having this big Merkel tree like we have in Zcash today, we actually just add it to a hash chain called the anchor chain. Um and so the user is basically trying to prove that they haven't spent their money in the time since uh they their money was created. Um and so the way that they do that they do that with the recursive proofs. They get these certificates. So after new transactions are accepted on chain uh the uh anchor chain is processed by different nodes using recursive proofs and these things are put into buckets and uh these buckets are are turned into certificates that can be used for uh uh proving non-inclusion in the chain. So um so over the next few months uh we have a specification for everything that's done now. We have the recursive proofs that are finished. We have uh test net that's running uh that we haven't put publicly yet, but we're going to be doing that by the end of the month. Um we're going to be doing formal verification. We did a bunch of that last uh uh over the summer for another protocol for Ironwood that Zuko was talking about just now. Um and then we're kind of parallelizing and sort of really aggressively auditing and optimizing and and and scheduling everything so that we can get this stuff shipped into uh into Zcash. So, uh, I don't have a thank you side, but there you go. Thanks,