This study compares a wallet bundle that proves public logic and ownership with a separated construction that proves only secret knowledge. Native admission checks transparent arithmetic, HistoryStep proves the canonical transition, and owner batching keeps one authorization capsule nearly flat from one to 1,020 inputs.
What must the wallet prove?
A transparent transaction body already exposes balances, counts, slots and output arithmetic to native validation. The private witness contributes one fact that the body cannot reveal: knowledge of the secret controlling the selected inputs.
The experiment tested whether separating those responsibilities could remove a wallet-side public-logic proof without weakening the accepted-block transition.
In the earlier baseline, the wallet supplied two proofs. A scalable transparent argument of knowledge (STARK) proved the public transaction arithmetic. A separate authorization proof based on the Goldwasser–Kalai–Rothblum (GKR) protocol, called AuthGKR, proved knowledge of the owner secret. The block proof later reconstructed the same public arithmetic, so that part was being proved twice.
The separated design carries that private ownership proof in an authorization capsule: a randomized proof object bound to the transaction and its selected inputs.
The separated construction
State is the authenticated set of current unspent outputs and consensus counters. HistoryStep is the recursive proof carried by an accepted block; it verifies the block's exact transition from its parent State to its child State.
- mempool admission derives and checks the public predicate from the transaction body;
- the wallet proves knowledge of the owner secret for the selected authenticated inputs;
- the authorization statement is verifier-derived and cannot be replaced by a wallet-selected variant;
- HistoryStep reconstructs the public logic in order and proves the resulting State transition.
Strict decoding rejects trailing bytes, unknown variants and a proof for a different transaction shape. Mutation tests changed the body, owner, secret set and proof fields independently and required rejection.
Experiment 1. Remove the duplicated public proof
The first benchmark used one-to-eight-input standard transactions and a twenty-five-input consolidation shape. Timings cover the authorization proof; the wallet-side public STARK contribution is zero in the separated design.
| Scenario | Prove median | Verify median | Wallet bundle |
|---|---|---|---|
| Standard 1 input / 2 outputs | 76.02 ms | 15.93 ms | 117.75 KiB |
| Standard 4 inputs / 8 outputs | 78.90 ms | 13.84 ms | 120.85 KiB |
| Consolidation 25 inputs / 2 outputs | 269.69 ms | 40.27 ms | 165.47 KiB |
This benchmark belongs to the tested auth-only geometry rather than PagedSpend, the final wire format that splits a large transaction into fixed-capacity physical pages. Its useful result is comparative: deleting the redundant proof did not delete public validation; it moved authority to the native admission rule and canonical block proof.
Experiment 2. Scale by owners, not pages
Inputs derived from one master secret are grouped under one logical authorization statement. PagedSpend can represent 1–128 physical pages, up to 1,020 inputs and 256 outputs, while the wallet constructs one freshly randomized authorization capsule: the proof object showing that the owner's secret controls all selected inputs.
The table reports the median (p50) and the 95th percentile (p95) across the measured runs.
| Inputs | Pages | Capsule p50 / p95 | Complete local path p50 / p95 |
|---|---|---|---|
| 1 | 1 | 218.99 / 341.71 ms | 228.30 / 352.47 ms |
| 100 | 13 | 204.43 / 243.58 ms | 217.32 / 255.46 ms |
| 1,020 | 128 | 199.98 / 250.82 ms | 233.06 / 285.81 ms |
Intent bytes grow from roughly 56.81 KiB to 96.50 KiB because public fan-in grows. Capsule size remains around 56 KiB and capsule time stays within the measured sample variance. Proof cost follows distinct owners rather than physical transaction pages.
Security and privacy boundary
The capsule hides the spending secret and randomizes each proof. It is not a confidential-transaction proof: owners, values, slots and transaction structure remain public while the body is available. Public arithmetic remains transparent because hiding it would add proof cost without changing ownership security.
Result
Prove private knowledge once per owner. Check transparent transaction logic natively at admission and prove it once in the canonical block transition.
The same separation applies beyond this wallet: zero knowledge should cover the secret-dependent relation, not duplicate deterministic checks that the final proof authority must reconstruct anyway.