Layer-Two Shielded Assets
What they are, what they are good for, and what they cannot do.
An ordinary note with a name attached
A shielded asset is a Zcash note carrying a memo that names it. Not a token, not a smart contract, not a second chain — one ordinary shielded note of a fixed, recognisable size, with a small amount of text riding along inside it.
Sending it spends that exact note and reproduces the memo byte for byte on the new one. Custody moves; identity does not. Because it is an ordinary shielded note underneath, it inherits Zcash's privacy exactly — no new cryptography, and nothing added to the protocol.
"Layer two" here means built on top of Zcash using what Zcash already provides, rather than changing Zcash. That is the source of both its strengths and every one of its limits below.
What they are good for
Art and editions
A piece, or a numbered run of them. Each identifier binds the artwork's hash to the issuer's key, so anyone can confirm the image is the one the asset names and that it came from that issuer. The size of the edition is closed on chain.
Gifts
Something that arrives privately and stays private. No marketplace account, no public ledger entry naming who gave what to whom.
Certificates and membership
Anything issued by someone identifiable, held by someone who would rather not be identified. The issuer publishes the issuance; each holder after that stays private. Tickets: later. (Issuers: mint to your own wallet first, then send. The first address an item is minted to can be read with the collection's published viewing key.)
Proof you were there
Attendance, membership, recognition. Things whose value comes from who issued them, which is exactly what this can establish.
What they are not good for
This is the part most projects leave out, so it is worth being direct about.
✗ Currencies and stablecoins. They split and merge: paying 3 of 10 turns one note into a 3 and a 7. Only one half keeps the trail; the other can never be checked. Zcash's rules balance ZEC, not your asset. That is what protocol-level assets (ZSAs) are for.
✓ Items held whole. A collection is closed on chain, so anyone can count it. With Wake (not yet externally reviewed), a postcard proves it descends from its mint; a copied memo, or the wrong half of a split, does not pass.
The limits, plainly
- Anyone can copy a memo. The network does not stop it. The wallet's Check tells you who issued a collection, and Wake tells the copy apart from the real postcard. Wake is not yet externally reviewed.
- Without your own node, your provider’s word. A wallet without its own node takes the chain’s answers from its provider. Balances, lineage and collection checks are then only as good as that provider’s answers, and the wallet says so: the send screen reads “Chain answers from: your provider”, and a lineage checked that way is marked “via your provider”, never “Verified”. Run your own node and the wallet checks the chain itself.
- Lineage has a shape. Each transfer of a postcard carries one knot: about 47 KB, recognisable on chain as a knot transfer. Known limits.
- Supply is not enforced by Zcash. A collection is closed on chain; anything issued after that fails the Check (✗). Visible, not impossible.
- Ownership is never provable. Shielded notes do not reveal who holds them. That is Zcash working as designed, and no engineering here changes it — you can prove an asset exists and who created it, never who has it now.
- A careless wallet can destroy one. An asset lives in a note of a small, fixed value, which to an ordinary wallet looks like loose change waiting to be swept into a fee. A wallet that does not protect them will eventually spend one by accident.
- The artwork hash is not the asset id. The id is computed from the collection's key and the item's description; the image's SHA-256 is part of that description. A matching image proves the picture, not who issued it or that your note is the genuine one.
Why do it this way at all
Because it works today. No protocol change, no waiting for a network upgrade, no bridge to another chain and nothing to trust with custody. Assets have been issued, delivered and verified on Zcash mainnet using nothing but what the network already offers.
And if Zcash gains native asset support, the carrier mechanism becomes unnecessary and should retire. The provenance layer survives — because a native asset leaves a buyer asking exactly the same question this answers: which issuer is this, and should I believe them?