zattoo: A Supply Pinned to One Hundred Million Zats

A zat is one hundred millionth of one ZEC. It is the unit in which Zcash counts, the way a satoshi is the unit in which Bitcoin counts, and it has no existence on Solana. The program described here borrows the unit without borrowing the coin. At initialization the program records the number 100000000 in its state account and declares that this number is the total zats pinned to the mint. From that moment the mint's circulating supply, whatever it is, is understood as representing exactly that many zats, and the exchange rate between units of the mint and zats is the pin divided by the supply. Because the supply can only fall, the number of zats each unit represents can only rise.

When a fill moves an amount of the mint, the program computes how many whole zats the amount represents at the current rate, and finds that the amount almost never divides evenly. The remainder is called dust. The program does not round dust up and it does not carry it forward. It burns the dust from the amount that moved, so that the party receiving the fill receives a whole number of zats and the supply loses the fraction. Over many fills the dust accumulates into a quantity the site reports as dust burned. The quantity is not large per fill and it does not need to be, because its direction is fixed.

Fees from trading accrue to the program's reserve account. The reserve is expressed in zats by converting the fee value to units at the current price and then to zats at the current rate. The reserve has one purpose: divided by the supply it gives a floor, the value per unit the reserve could cover if every unit were presented at once. The floor is drawn under the reading on the front page. The gap between them is the only thing the site has to say about the market.

The program accepts exactly one kind of external instruction. A shielded transaction on Zcash sent to the program's unified address may carry a memo of up to five hundred and twelve bytes. The program reads the first eight bytes of the memo as a little endian unsigned integer and treats it as a zat weight. A memo with a positive weight is a request to move weight from the reserve toward the floor. A memo with zero weight is ignored. The sender is never read, because the program does not have the key to read it, and because the rule was written so that it would not matter who sends.

The program keeps a chain of Zcash block headers inside its own account, appended by a relayer called the witness. The witness has no key and no authority; it can only append a header that correctly extends the chain, and anyone may be the witness. A memo is acted on only after the header of the block that contains it has been appended, so that the Solana side never acts on a claim about Zcash that has not been proven in the Solana program itself. This is the slowest part of the design and it is meant to be.

Every buy appends a leaf to a commitment tree held in the program's state. The leaf is a hash of the fill and its zat count. Every sell spends a leaf and publishes its nullifier, and the program burns the nullified zats from the reserve side so that a round trip through the mint always costs the supply. The tree is a record and a cost at the same time.

Nothing here is a claim about value. The claim is that a denomination can be enforced, that a supply can be bound to a number and only move away from it in one direction, and that every part of the binding can be verified from outside by reading accounts that anyone can read.