# Zcash via NEAR Intents

Markdown version of https://ethbeat.org/privacy/projects/zcash-near-intents

## Summary

**Warning:** This route has no Ethereum contracts. Real-time monitoring is not supported.

- Metrics: Not tracked. Data tracking is not available for this project.
- Tracked on: Ethereum
- Attributes: Bridged, ZK, Transfers, Any amount
- Reference app: Zodl v3.15.0 (most private of 6 checked)

### Risks

- Privacy: Link privacy. Public observer: Link private (sentiment: good); Chain analyst: Link private (sentiment: good); Network observer: Link at risk (sentiment: warning); Privileged insider: Link exposed (sentiment: bad); Future adversary: Link exposed (sentiment: bad).
- Trusted setup: Transparent setup (sentiment: neutral). Transparent setup: No trusted setup and no additional setup-related trust assumptions.
- Exit window: None (sentiment: bad). The NEAR Intents multisig upgrades the Verifier and the Rainbow Bridge multisig the Zcash bridge, both instantly. The Ethereum funds sit in an EOA the operator controls. This protocol fails the walkaway test: users cannot fully use it if every centralized participant disappears. The custodial bridge operator executes every Ethereum deposit and withdrawal offchain. For the Zcash light client on NEAR, anyone staking 1,000 NEAR can relay after seven days, unless the Rainbow Bridge multisig rejects them.
- Reproducibility: Partially reproducible (sentiment: warning). The Verifier, the bridge token, the Zcash bridge and Zodl are open source, but Zodl's App Store builds cannot be rebuilt from that source. The bridge backend, the 1Click API and the solver relay that every Ethereum leg needs are closed.

### About

A shielded ledger round trip: Zodl swaps Ethereum funds into shielded ZEC and back through NEAR Intents, which custodies the Ethereum side.

### Links

- Website: https://near-intents.org, https://z.cash, https://zodl.com
- Docs: https://docs.near-intents.org, https://zips.z.cash/protocol/protocol.pdf
- Explorer: https://nearblocks.io/address/intents.near, https://nearblocks.io/address/zcash-connector.bridge.near, https://etherscan.io/address/0x2CfF890f0378a11913B6129B2E97417a2c302680
- Repository: https://github.com/near/intents, https://github.com/Near-One/btc-bridge, https://github.com/Near-One/btc-light-client-contract, https://github.com/defuse-protocol/defuse-frontend, https://github.com/zodl-inc/zodl-ios
- Social: https://x.com/near_intents, https://x.com/zodl_app
- Other: https://docs.near-intents.org/security-compliance/terms-of-service, https://docs.near-intents.org/security-compliance/risk-and-compliance, https://mpc-operators.nearone.org/

## Protocol description

Zodl, a Zcash wallet, lets users move funds from one Ethereum address to a new one through Zcash's shielded pool, which hides the path. Its swap screen uses NEAR Intents to turn Ethereum assets into shielded ZEC and, later, ZEC back into Ethereum assets. Both Ethereum transfers and every swap on NEAR are public.

Users trust the NEAR Intents operator, which holds the Ethereum funds in a custodial bridge, screens every swap and can freeze balances. Two NEAR multisigs upgrade the contracts instantly, and NEAR's MPC network signs every Zcash payout. Leaving needs the operator, which runs the Ethereum side of every swap.

### Flow

1. **Ethereum to NEAR Intents.** Each quote from the operator's 1Click API comes with a fresh Ethereum deposit address. The user sends ETH or an ERC-20 there. The operator's custodial bridge, named Proof-of-Authority (PoA), sweeps the funds into its treasury [`0x2CfF…2680`](https://etherscan.io/address/0x2CfF890f0378a11913B6129B2E97417a2c302680). It then mints a wrapped token on NEAR whose memo names the Ethereum transaction hash.
2. **Swap to ZEC.** Market makers quote offchain through a relay the operator runs. The winning quote settles in the Verifier contract [`intents.near`](https://nearblocks.io/address/intents.near), whose balances and swaps are public NEAR state.
3. **Withdraw into Zcash.** The wrapped ZEC is burned through the Zcash connector `zcash-connector.bridge.near`. The connector builds a transaction from bridge funds and has NEAR's MPC network sign it. The payout goes to a shielded address that Zodl creates for every swap, and the burn message publishes it. The connector requires an all-zero outgoing viewing key so that it can check the payout, so anyone can decrypt its address and amount.
4. **Inside Zcash.** The ZEC sits in the shielded pool, where transfers hide sender, recipient and amount. Every amount that enters or leaves the pool is public, so a round trip of similar size within a short time pairs up.
5. **Back to Ethereum.** Zodl pays ZEC from the pool to a fresh transparent deposit address of the connector. A relayer proves the deposit to the Zcash light client `zcash-client.bridge.near`, and the wrapped ZEC is minted and swapped. The operator then pays the Ethereum address from its treasury.

### App

Zodl, formerly Zashi, is rated with its built-in Tor switched on manually. It syncs from public lightwalletd servers, which serve the Zcash chain to light wallets, zec.rocks by default. Each sync looks up the transparent addresses of every account in the wallet over one Tor connection. The custom server setting can move all of this to a lightwalletd the user runs.

### Custody

The Ethereum leg is custodial. The operator's deposit and treasury addresses are EOAs, and the operator mints the wrapped tokens on NEAR. The Verifier lets the NEAR Intents multisig and one single-key account freeze any account, which the operator uses for compliance holds. On Zcash, the connector holds funds at MPC-derived addresses and checks deposits against the light client. Relayers post Zcash block headers, credit deposits and request withdrawals. Anyone can become one by staking 1,000 NEAR and waiting seven days, unless the Rainbow Bridge multisig rejects them. The roles are listed under [upgrades and governance](https://ethbeat.org/privacy/projects/zcash-near-intents#upgrades-and-governance).

### Compliance

Intents Technology Ltd. (British Virgin Islands) screens every quote against the NEAR Intents AML portal, Binance AML, AMLBot, PureFi and TRM Labs. Its [terms](https://docs.near-intents.org/security-compliance/terms-of-service) let it delay, block or freeze bridged funds and collect IP and wallet addresses. Market makers pass KYB, end users swap without an account.

### Fees

The Verifier charges 1 pip (0.0001%) per swap. Zodl adds a 0.67% app fee to each quote, which it [shares with the 1Click API](https://docs.near-intents.org/resources/fees). Each leg also pays a bridge withdrawal fee, 0.000035 ETH on Ethereum and 0.00047 ZEC on Zcash on 2026-10-08.

## Privacy

**What the protocol promises:** Hides which funds leaving Ethereum come back as which, by passing through Zcash's shielded pool. Everything on Ethereum and NEAR is public.

**Apps**

- **[Zodl](https://zodl.com)** v3.15.0 (Reference): The ratings assume this app, since 2026-09-16 · Source [75b83d7](https://github.com/zodl-inc/zodl-ios/tree/75b83d7601573e165e2dacdfaffb69750dadd05f)
- **NEAR Intents web app** (Leaks more): Every swap runs through an account named after the connected wallet, whose one ZEC deposit address links all its round trips publicly. Fix: Swap through a fresh 1Click deposit address per quote, as Zodl does. · [Source](https://github.com/defuse-protocol/defuse-frontend/blob/594085d3c7e60ce912fb62b768b12f46c4917510/src/components/DefuseSDK/features/deposit/components/DepositUIMachineProvider.tsx#L112-L121)
- **Cake Wallet** (Leaks more): Its built-in Tor skips the Zcash wallet, so the lightwalletd server gets each transaction it sends with the user's IP. Fix: Route the Zcash wallet's lightwalletd connections through the built-in Tor. · [Source](https://github.com/cake-tech/cake_wallet/blob/196f5a15a9f180602767c56968dcb30114d0b15e/cw_zcash/lib/src/zcash_wallet.dart#L155-L179)
- **Brave Wallet** (Leaks more): The wallet is disabled in Tor windows and has no Tor setting, so Brave's Zcash and swap servers get the user's IP. Fix: Offer a Tor setting that covers the wallet's Zcash sync and swap requests. · [Source](https://github.com/brave/brave-core/blob/7bfa200812971b7811541ae6e5b72620abebe3a7/browser/brave_wallet/brave_wallet_context_utils.cc#L17-L20)
- **Unstoppable Wallet** (Leaks more): Routes every swap through Unstoppable's own server, which records each leg's payout and refund addresses and deposit transaction hash. Fix: Request quotes and report deposits to the 1Click API directly. · [Source](https://github.com/horizontalsystems/unstoppable-wallet-android/blob/d6661c8d0dc02d259767f58b7cd73cabb877da18/walletkit/src/main/java/io/horizontalsystems/walletkit/modules/multiswap/providers/USwapProvider.kt#L1375-L1399)
- **Zkool** (Leaks more): Pays swaps only to the account's transparent address, which adds a public shielding step. Fix: Pay each swap to a fresh shielded address. · [Source](https://github.com/hhanh00/zkool2/blob/59a558fb7383c03b3633f015b33ef120cfbc3bdc/lib/services/swap_quote.dart#L37-L41)

[How we pick the reference](https://ethbeat.org/publications/privacy-methodology#reference-app)

Ethereum is public by default. Each protocol is rated on its main privacy promise, like hiding who paid, who received, how much, or which deposit became which withdrawal. Against each adversary, the colour says whether it holds for a careful user with the app's own settings: green yes, yellow only with significant extra work, red no. Fields marked at risk stay private only under the condition in their note.

### Public observer

Link private (sentiment: good)

**Who:** Everyone with a block explorer and some basic tools. Sees every public onchain event, but does no correlation beyond following links. Examples: A curious counterparty, an employer, a journalist.

Zcash's shielded pool hides which payout into it funds which later exit. Everything up to the pool edge is public: the Ethereum deposit and the NEAR entries that credit, swap and withdraw it. The bridge encrypts each payout so that anyone can decrypt its Zcash address and amount.

**Inside**

- Sender: private
- Recipient: at risk. Payout notes are decryptable by anyone, so a reused address ties payouts together.
- Amount: private
- Asset: exposed. Only ZEC exists inside the pool, and the assets swapped from and to are public on NEAR.
- Link: private

**Sources**

- [Custodial bridge mint carries the Ethereum transaction hash in its memo](https://nearblocks.io/address/eth.omft.near)
- [Withdrawal message names the target Zcash address](https://github.com/Near-One/btc-bridge/blob/66d239120981ba58ae92f73dc6860e0369b4ad28/contracts/satoshi-bridge/src/api/token_receiver.rs#L12-L18)
- [Payouts are encrypted to an all-zero outgoing viewing key](https://github.com/Near-One/btc-bridge/blob/66d239120981ba58ae92f73dc6860e0369b4ad28/contracts/satoshi-bridge/src/zcash_utils/orchard_policy.rs#L11-L64)
- [Zodl creates a fresh shielded address for every quote](https://github.com/zodl-inc/zodl-ios/blob/75b83d7601573e165e2dacdfaffb69750dadd05f/secant/Sources/Features/SwapAndPayForm/SwapAndPayStore.swift#L908-L955)

### Chain analyst

Link private (sentiment: good)

**Who:** Scrapes all public data and correlates it: timing, amounts, gas and wallet fingerprints, address clusters. Examples: Chain analytics firms, ZachXBT, data brokers.

Only the amount and timing of a round trip can pair a payout into the pool with a later deposit to the bridge. Deposit addresses are fresh per quote and spent together with the bridge change address, which marks every exit as NEAR Intents.

**Advice:** Hold the ZEC in the pool for days, split or merge it with other shielded funds, and swap back amounts that match no payout.

**Inside, compared with a public observer**

- Asset: exposed
- Link: at risk. Round-trip amount and timing across the pool edge pair a payout with a later deposit.

**Sources**

- [Kappos et al., An Empirical Analysis of Anonymity in Zcash (USENIX 2018)](https://arxiv.org/abs/1805.03180)
- [Deposit address derived per quote from the deposit message](https://github.com/Near-One/btc-bridge/blob/66d239120981ba58ae92f73dc6860e0369b4ad28/contracts/satoshi-bridge/src/deposit_msg.rs#L50-L53)
- [Bridge change address and UTXO set](https://nearblocks.io/address/zcash-connector.bridge.near)

### Network observer

Link at risk (sentiment: warning)

**Who:** Sits between the user and the services and sees traffic only: ISPs, VPNs, Tor exits, public RPCs and relayers. Ties requests to a user by content, session or timing: what they name, a shared IP or login, and when they arrive. Services the operator runs count as the insider. Examples: Infura or Alchemy, a Tornado relayer, a wallet vendor selling telemetry, Google captcha or analytics in the dapp frontend.

Each sync sends the account's transparent addresses to lightwalletd before fetching its transactions, so lightwalletd can tie the payout and the exit to the account. With Tor on, each 1Click request and each sent transaction gets its own circuit, and sync lookups go over Tor while blocks download directly. Tor hides the user's IP from the lookups, not the addresses they name.

**Advice:** Turn on Tor in Zodl and point it at a lightwalletd server the user runs.

**Inside, compared with a public observer**

- Recipient: private
- Asset: exposed
- Link: at risk. Private only with Tor on and the user's own lightwalletd server.

**Sources**

- [Zodl syncs with the Slipstream engine](https://github.com/zodl-inc/zodl-ios/blob/75b83d7601573e165e2dacdfaffb69750dadd05f/secant/Sources/Models/WalletConfig.swift#L14-L25)
- [Each sync opens one connection and looks up the account's transparent addresses first](https://github.com/zodl-inc/slipstream/blob/3bd434ce6023a000cc377634d8cd2b184161857a/core/src/engine.rs#L246-L282)
- [Blocks download directly, lookups go over isolated Tor circuits](https://github.com/zodl-inc/slipstream/blob/3bd434ce6023a000cc377634d8cd2b184161857a/core/src/connector.rs#L17-L22)
- [Each sent transaction gets its own Tor circuit](https://github.com/zodl-inc/zodl-swift-wallet-sdk/blob/191d0347186a1c6fcd207eead24a891049444041/Sources/ZcashLightClientKit/Transaction/EndpointSubmitter.swift#L26-L41)

### Privileged insider

Link exposed (sentiment: bad)

**Who:** Holds an operator role, custodies funds, receives keys or plaintext by design, or delivers the app: upgrade admin, custodian, view key holder, enclave operator, association set provider, hosted prover, registry, frontend host. Examples: A compliance backdoor key, a DAO with an upgrade key, a KMS committee, an ASP operator, a custodial bridge.

The operator custodies both legs in transit and can freeze any account or deposit, setting the terms on which the user's funds return. Over Tor, its 1Click API sees each leg only as NEAR publishes it, with a fresh shielded address per swap. It holds no key into the shielded pool.

**Inside, compared with a public observer**

- Recipient: private
- Asset: exposed
- Link: at risk. The operator can freeze either leg and set the terms of its release.

**Sources**

- [1Click terms: IP and wallet data, screening, custody (2026-10-30)](https://docs.near-intents.org/security-compliance/terms-of-service)
- [Any account can be locked by the multisig or a locker](https://github.com/near/intents/blob/fa44ede9e874931c39a6c4246de82bc40f4f8d99/defuse/src/contract/accounts/force.rs#L19-L33)
- [Owner-only mint of the wrapped Ethereum assets](https://github.com/near/intents/blob/fa44ede9e874931c39a6c4246de82bc40f4f8d99/poa-token/src/contract.rs#L79-L81)
- [Zodl sends its partner key and a fresh refund address with each quote](https://github.com/zodl-inc/zodl-ios/blob/75b83d7601573e165e2dacdfaffb69750dadd05f/secant/Sources/Dependencies/SwapAndPay/sources/Near1Click.swift#L313-L352)

### Future adversary

Link exposed (sentiment: bad)

**Who:** Harvest now, decrypt later. Holds every byte ever published and runs the known quantum attacks: elliptic curves, pairings and RSA fall. Hashes, symmetric ciphers and post-quantum schemes stand until an attack on them is known. Examples: An intelligence agency archiving chain data today, then anyone once a break is public.

Whoever breaks elliptic-curve cryptography recovers an account's incoming viewing key from any of its payout addresses, which are public on NEAR. All of the account's rotated addresses share that key, so it decrypts every note the account ever received. Those include the change notes of its exits, which join both legs of every round trip. ZIP 2005's quantum recoverability protects only funds.

**Inside, compared with a public observer**

- Sender: at risk. Spends are found through the change notes they pay back to the same account.
- Recipient: exposed
- Amount: exposed
- Asset: exposed
- Link: exposed

**Sources**

- [Orchard key agreement on the Pallas curve](https://zips.z.cash/protocol/protocol.pdf#concreteorchardkeyagreement)
- [ZIP 2005: quantum recoverability of funds](https://zips.z.cash/zip-2005)
- [Payouts are encrypted to an all-zero outgoing viewing key](https://github.com/Near-One/btc-bridge/blob/66d239120981ba58ae92f73dc6860e0369b4ad28/contracts/satoshi-bridge/src/zcash_utils/orchard_policy.rs#L11-L64)

## Risk summary

### Funds can be stolen if
1. the custodial bridge operator's mint key or its Ethereum treasury key is compromised.
2. the NEAR Intents multisig deploys a malicious [upgrade](https://ethbeat.org/privacy/projects/zcash-near-intents#upgrades-and-governance) of the Verifier, with no delay.
3. the Rainbow Bridge multisig deploys a malicious [upgrade](https://ethbeat.org/privacy/projects/zcash-near-intents#upgrades-and-governance) of the Zcash connector, its token or the light client, with no delay.
4. a threshold of the NEAR MPC nodes colludes to sign Zcash transactions from bridge addresses.

### Funds can be frozen if
1. the NEAR Intents multisig or the single-key account locker freezes the user's account in the Verifier.
2. the custodial bridge operator holds a deposit or withdrawal for a compliance review.
3. the relayers stop and the Rainbow Bridge multisig rejects anyone who stakes to replace them.

### Privacy can be lost if
1. the operator, which custodies both legs, makes the release of either depend on who the user is (see privileged insider).
2. the lightwalletd server Zodl syncs from ties the payout and the exit to the account through the transparent addresses each sync sends (see network observer).
3. elliptic-curve cryptography is broken, which recovers each account's viewing key from its payout addresses on NEAR (see future adversary).

## Upgrades & Governance

The route touches three governed systems on NEAR, each can change instantly. The Ethereum side runs on EOAs.

### NEAR Intents Verifier (`intents.near`)

`intents.sputnik-dao.near`, a 3/5 multisig, holds the `DAO` role and is super admin, so it can grant every other role. Upgrades go through `ctl-intents.near`, a controller whose only admin is the same multisig, and deploy at once. Two EOAs there can apply a release the multisig added or roll back to the previous one. Seven accounts hold `PauseManager` and can halt all swaps and withdrawals, and only the multisig can resume them. One EOA holds `UnrestrictedAccountLocker` and can lock any user account. A locked account keeps receiving deposits, while its intents and withdrawals stop until the multisig unlocks it.

### Custodial "PoA" bridge (`omft.near`, `eth.omft.near`)

The `poa-factory` contract `omft.near` deploys one token per bridged asset. It mints on the signal of `TokenDepositer`: `bridge-mng.near`, an EOA, and `int-mnt-dao.sputnik-dao.near`, a 3/3 multisig. NEAR takes every mint on trust. The NEAR Intents multisig is super admin.

### Zcash connector (`zcash-connector.bridge.near`, `zec.omft.near`, `zcash-client.bridge.near`)

`rainbowbridge.sputnik-dao.near`, a 3/5 multisig, governs the connector, the token's controller and the light client, and sets the bridge fees. `bridge-ops.near` can stage code and pause the connector, and `pm.bridge.near` can pause it. `omni-relayer.bridge.near`, `intents-relayer.near` and `bridge-ops.near` prove deposits against the light client, whose headers `zcash-relayer.near` relays. Withdrawals are signed by the NEAR MPC network `v1.signer` (11/16, see the [MPC operators page](https://mpc-operators.nearone.org/)) on request of a relayer. These four hold roles that make them relayers, and the multisig can reject anyone else who applies. Anyone can refund a deposit the connector never credited, once the light client holds its block. The refund waits two days. Without a refund address in the deposit message, it waits 100 years unless the multisig shortens that. The multisig or `omni-relayer.bridge.near` can reject the refund until then.

## Trusted setup

Risk levels follow the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381). Yellow (medium risk): all contributions are published and the final output can be verified, the ceremony client is open source, there were at least 30 contributions, participation was open to the public and announced, and participants are publicly identified. Green (lowest risk): everything required for yellow, with at least 150 contributions. Red (highest risk): at least one requirement for yellow is not met. N/A: the proof system needs no trusted setup.

### Transparent setup

- Risk: N/A (no trusted setup)
- Proof systems: Halo2 (Plonk)

Transparent proving systems require no trusted setups and have no additional setup-related trust assumptions.