Depth

—m

10 · log₂(N) · N = unspent notes

Privacy is collective: when ten people share a pool a withdrawal could belong to any of ten deposits, and when a million do, any of a million. Every deposit makes every other one harder to follow — so the honest way to state progress is a count, not a date and not a promise.

notes—

capacity1 048 576 notes, and then it is full

the scale

0 m1 note. the surface, where being alone is the same as being visible

70 m128

100 m1 024

140 m16 384

200 m1 048 576 — the veil is full, and this is where sunlight stops

reserves

Anyone can replay this from events, at any block, without learning who holds what. held ≥ owed is the whole claim.

USDT0—

USDH—

XAUt0—

grains

Every leg the chain can see is a whole number of grains. 11 437.22 going in and 11 437.22 coming out an hour later is a line no proof system repairs, so the protocol does not let you draw it: amounts inside the veil are free, amounts in the open are coarse.

lineage

Each deposit is given a lineage by the contract, not by its depositor. On the way out you can prove your lineage belongs to a published set — one that excludes flagged deposits — without saying which member you are.

universal setevery lineage. always available

published sets—

if every set excludes youunwind to the address that deposited, no set, no fee

A filter that could also lock would not be a filter, it would be a custodian. That exit has no governor, no pause and no setter.

settlement domains

Elysium settles into HyperEVM — in this protocol's own vocabulary, a floor below the floor. A note carries its domain inside the proof, and both domains share one commitment set, so money that comes up from the deeper chain joins everybody else's crowd instead of starting a lonely second pool.