The ledger

Who controls what

Each contract and wallet, what it does, and exactly who can change it. “No owner” means nobody can: not us, not anyone.

Where the money sits

• The privacy pool

  No owner

  ZipPrivacyPool

  Holds every zipped ZC and the tree of notes. Coins leave only with a zero-knowledge proof, or by ragequit to the wallet that deposited them.

  Who controls it. No owner. The ZC holder rewards it earns (ETH) go to a treasury address fixed at deployment.

  • The Entrypoint's owner can wind it down: no new deposits, while withdrawals and ragequits keep working. It can't be undone.
  • Anyone may call harvest(), which can only send the pool's ETH rewards to that fixed treasury address.

  Address

  At launch

  ETH

  —

  ZC

  —

  ETH rewards waiting

  —

• The Entrypoint

  2-of-3 Safe

  Entrypoint (0xbow privacy-pools-core)

  The front door: takes deposits, relays withdrawals, and stores the approved-deposit (ASP) roots that private withdrawals must prove against.

  Who controls it. A 2-of-3 Safe holds the owner role. The postman's key can only publish ASP roots.

  • Owner Safe: upgrade the Entrypoint, register or remove a pool, change a pool's minimum deposit and fee settings, wind a pool down, withdraw Entrypoint fees. An upgrade can change anything the Entrypoint does; ragequit lives in the pool itself, so it can't be taken away by one.
  • Postman: publish a new ASP root, which decides which deposits may be withdrawn privately. It can't move coins, and a depositor who isn't approved can always ragequit.

  Address

  At launch

  ETH

  —

  ZC

  —

  ETH rewards waiting

  —

• ZC

  Not a zipcoin contract

  The existing ZC token (ERC-20)

  The currency. zipcoin adds no new token.

  Who controls it. Not a zipcoin contract. zipcoin has no power over the token.

  Address

  At launch

• Payments

  No owner

  ZipPay

  Pays a shop from a zipped note and settles the sales tax in the same proof: part burned, part to the couriers, the rest to the treasury's share.

  Who controls it. No owner. The tax rate, the split and where each part goes were fixed at deployment.

  Address

  At launch

  ETH

  —

  ZC

  —

  ETH rewards waiting

  —

• Treasury liquidity bands

  2-of-3 Safe

  ZipLiquidityBands

  Receives the treasury's share of the sales tax and adds it to ZC's pool as fixed one-sided ZC bands above the launch range only (never below it), by fixed rules, when a courier triggers it. Fees, and any ETH it receives, go to the treasury Safe.

  Who controls it. The treasury Safe (2-of-3), within limits fixed at deployment.

  • Anyone: deposit (within the caps and the minimum interval), collect fees to the Safe, claim the contract's own ETH rewards.
  • The Safe only: set the caps (never above the ceilings fixed at deployment), band weights and the share of ETH passed straight to the Safe; pause; forward everything to the Safe; withdraw. Every exit pays the Safe and nothing else.

  Address

  At launch

  ETH

  —

  ZC

  —

  ETH rewards waiting

  —

• The treasury Safe

  2-of-3 Safe

  Safe multisig

  The project treasury. It receives the bands' fees and exits and the pool's harvested ETH rewards, and pays the running costs.

  Who controls it. A 2-of-3 Safe: any payment needs two of its three signers.

  Address

  At launch

  ETH

  —

  ZC

  —

  ETH rewards waiting

  —

Everything else

• Shops

  No owner

  ZipMerchants

  Shops stake ZC to be listed and sign every invoice. A shop caught asking to be paid around the tax loses its stake: half to whoever caught it, half burned.

  Who controls it. No owner.

  Address

  At launch

  ETH

  —

  ZC

  —

  ETH rewards waiting

  —

• Couriers

  No owner

  ZipCouriers

  Couriers bond ZC and publish an address. They carry proofs, hold them for a random while, and are paid the couriers' share of the tax. A courier that breaks a signed promise can be slashed by anyone holding the receipt.

  Who controls it. No owner.

  Address

  At launch

  ETH

  —

  ZC

  —

  ETH rewards waiting

  —

• Badges

  No owner

  ZipBadges

  Lock ZC for a while to earn a tier you can prove without saying who you are. The stake goes back into the pool as a new note when the lock ends.

  Who controls it. No owner.

  • One slashing address was fixed once, at deployment, and can never be changed.

  Address

  At launch

  ETH

  —

  ZC

  —

  ETH rewards waiting

  —

• Anonymous posts

  No owner

  ZipSignal

  Posts from inside a group ("someone with a tier-3 badge says..."), a few per member per day, with no way to link two of them.

  Who controls it. No owner, and it holds no funds.

  Address

  At launch

  ETH

  —

  ZC

  —

  ETH rewards waiting

  —

• Polls

  No owner

  ZipPolls

  Burn ZC to ask a group a question and pay members to answer. Answers are public and countable; who answered isn't.

  Who controls it. No owner.

  Address

  At launch

  ETH

  —

  ZC

  —

  ETH rewards waiting

  —

• Broadcasts

  No owner

  ZipBroadcaster

  Burn ZC to be heard. The burn is the signal readers rank messages by.

  Who controls it. No owner.

  Address

  At launch

  ETH

  —

  ZC

  —

  ETH rewards waiting

  —

• Doorstep

  No owner

  ZipDoorstep

  Burn ZC at someone's door, with an optional gift that can never dwarf the burn.

  Who controls it. No owner.

  Address

  At launch

  ETH

  —

  ZC

  —

  ETH rewards waiting

  —

• Private sends

  No owner

  ZipRezip

  Spends a note and deposits the value again for the recipient, so the coins never leave the pool.

  Who controls it. No owner.

  Address

  At launch

  ETH

  —

  ZC

  —

  ETH rewards waiting

  —

• Zip addresses

  No owner

  ZipAddressRegistry

  Maps a wallet to a public encryption key, so anyone can send to it privately.

  Who controls it. No owner. Each wallet manages its own entry.

  Address

  At launch

  ETH

  —

  ZC

  —

  ETH rewards waiting

  —