The Railgun Protocol

Railgun is an open-source, audited privacy protocol that runs entirely on-chain. Anon uses Railgun as its cryptographic privacy layer.

Shielded Pools

At the heart of Railgun is a set of smart contracts that maintain a shielded pool — a shared encrypted balance sheet. When you shield tokens, they enter this pool. When you unshield, they leave. Inside the pool, balances and transfers are hidden from external observers.

The pool is implemented as a Merkle tree of encrypted notes. Each note represents a spendable balance commitment. Only the holder of the corresponding spending key can generate a valid proof to spend a note.

How a Private Transfer Works

1. Sender creates a new encrypted note addressed to the recipient, spending their existing notes
2. A zero-knowledge proof is generated that proves:
   • The spent notes existed in the Merkle tree (without revealing which notes)
   • The sender knows the spending key for those notes
   • The amounts balance (no funds created from thin air)
   • The new note is well-formed
3. The proof and encrypted ciphertext are submitted to the Railgun contract
4. The contract verifies the proof and updates the Merkle tree

The private transfer protects its internal note data. Public inputs and outputs, including shield and unshield addresses and amounts, remain visible; network services can also receive request metadata.

Supported Networks

Proof of Innocence (POI)

Railgun works with Private Proofs of Innocence to check funds against list-provider datasets. Anon tracks proofs and spendability during wallet synchronization; a confirmed shield can still require additional checks before spending. These checks do not establish universal legal compliance. See Compliance & POI.

Audits

Railgun's smart contracts and cryptographic circuits have been audited by multiple independent firms. Audit reports are available on the Railgun GitHub.