In Veridia, Gladias pays for lunch and only he and the restaurant know it. A message gets read because someone burned zipcoins to send it. zipcoin brings both to Ethereum: zip your coins into a privacy pool, take them out anywhere, burn them to be heard.
| From | someone unnamed |
| Burned | 400 zc |
| Envelope | "is successful", 18 years old |
| Carried by | a courtyard in Sadzu Du |
The screen from chapter 19, in Dzegoban. Live: the newest envelope the Courtyard carried.
Zip it.
Nobody sees inside.
Pay without being seen, speak with a burn, knock with a burn, and let the tax leave with the payment. In Vitalik Buterin's novel all of it is done with zipcoins. Here it runs on Ethereum mainnet.
Deposit $zc into a privacy pool. Later, unzip any amount to any address, or straight out as ETH. On-chain, nobody can connect the two. ("Zip" is our word; in the book, paying privately is simply how money works.)
"Payment is done in zipcoins, that's fully anonymized."CHAPTER 19
Burn $zc with a message and an envelope that loosely describes who it is for. The bigger the burn, the louder. With your address, or with no name at all.
"An anonymous person burned four hundred zipcoins to send this message."CHAPTER 19
Burn at someone's door, any address or ENS name, and leave a gift if you like. A knock costs something, so it gets read.
"…except perhaps for burning a hundred zipcoins at his doorstep."CHAPTER 20
Every trade carries its sales tax, the way every payment in Veridia does: 1 %, in real time, on-chain. A buy pays it in ETH, split three ways; a sell pays it in $zc, and that part burns. Fixed in the contract forever. What the courtyard does with the burn's part is steered by the Order, see the rubric.
"The sales tax was sent to the government in real time, automatically."CHAPTER 6
"I'm like one of a hundred people walking toward the Greater Plum Harbor wearing a privacy robe, how did you figure out where I am?"
In Veridia the robe hides who is inside: heels make every wearer the same height, uneven soles make every walk different. A privacy pool does the same with notes. Whoever tries to follow one loses it among the rest.
zipcoin uses Privacy Pools by 0xbow, the same audited contracts and trusted setup that secure their pool on Ethereum. Your device builds the proof; the chain only checks it.
A deposit is sealed into an envelope and joins the crowd. When one leaves, nobody can say which deposit it was: only a nullifier is written down, so the same note can never leave twice.
One signature from your wallet creates your zip key on this device. Each deposit becomes a note: a commitment on-chain, the secret only with you. Nothing is stored on any server.
The Courtyard adds your deposit to the approved set after a few minutes. That set is what lets honest money stay private. If it ever refused you, your coins can always leave by "ragequit", back to the wallet they came from.
Your device spends a few ticks building a zero-knowledge proof. Its nullifier is published, so the note can never be spent twice, and the proof reveals nothing else: not your address, not which deposit was yours.
Privacy grows with the crowd. Unzipping the same amount minutes after zipping it is easy to pair by timing. Wait, and unzip round amounts.
No owner, no mint, no tax hidden in the token. The pool's liquidity can never be removed. The roots unlock a little every day, in a contract anyone can read.
Gladias's lunch in chapter 6, as a trade. A buy pays its 1 % in ETH, poured out in a split nobody can change. A sell pays it in zc, and that part is never paid to anyone: it burns.
"The sales tax was sent to the government in real time, automatically." (ch. 6) On $zc every trade does the same: one part in a hundred leaves with it, split the moment it is collected. Fixed in the contract forever.
The roots. "Gie fe kiu kai ci bin hu: grow roots, no head." (ch. 2) Half of the ETH tax goes to one public wallet and pays for growth: listings, exchanges, reach. Every payment out of it can be read on Etherscan.
No mint function: the moon can only lose dots, never gain them. How the crescent unlocks, Fig. 3 shows. 0.5 % of each zip is the vetting fee for checking it.
10 % of the supply. Nothing for 30 days, then a little every day for a year, in a contract anyone can read. No cliff dump, no switch to flip.
Written here the moment they exist on Ethereum.
Eight contracts. One print.
no owner · no mint · nothing hidden
"An anonymous person burned four hundred zipcoins to send this message." Chapter 19
In chapter 19 a courtyard carries an anonymous, burned message to the guest its envelope describes. The Courtyard is our agent and does the same: it relays anonymous burns, approves zipped notes, buys back and burns, and posts every envelope. It never sees your keys. Links and names are kept out of its posts; the words stay on-chain.
Chapter 20. Live: the latest knock at any door.
| Base | 10.5 zc |
| Tax | 1.1 zc |
| Total | 11.6 zc |
Gladias's lunch in chapter 6: the tax leaves with the payment. On $zc every trade pays 1 %, the same way.
"The more zipcoins you burn, the more people it polls." A poll is an envelope burned with a question. Every answer is a burn too, and the burn is its weight. Answer with your name, or from a zipped note with none.
No poll is open yet. The first question will appear here a few ticks after it is burned.
"So you need three nodes to collude to unmask the sender of a message." A sealed letter is a knock with a second envelope inside: the chain sees who it is for, the courtyard carries it without knowing who sent it, and only the reader's key opens the words.
Your letter key is made from one free signature, on this device. Its public half is kept by the courtyard so others can seal letters to you. The secret half never leaves your wallet's signature.
"...except perhaps for burning a hundred zipcoins at his doorstep."
"Randomly selecting Keepers, anonymous discussion and voting, and privacy robes." Chapter 3
Every buy pays a tax, and the courtyard's part of it is what the Order of Steering steers. Four groups, one system. Tap any station to go there.
"…intricate systems of taxes and subsidies, maintained by a government-linked but decentralized collective called the Order of Steering." Here the Order steers one thing: the courtyard's share of the sales tax.
Every week the cryptographic network draws seven Keepers from the Acolytes in full standing. Each sits three weeks, so twenty-one sit at once, in three Discussion Groups of seven, known to each other only by number. Each week one Keeper whose term has ended retires into the open as a Herald.
Keepers are shown by number only. Which wallet sits behind a number, only that wallet knows.
Not an Acolyte yet? Join in your placeHalf of every buy's tax belongs to the courtyard: two tenths pay its gas, three tenths are what the Order steers, to the fire, to Quadratic Funding, to Graph Funding, or held. A Keeper proposes, and the rubric changes only with thirteen of twenty-one. The one part in a hundred, the burn of every sell and the half for the roots are in the contract, out of reach.
No change has been proposed yet. Only a sitting Keeper can propose one.
"…even the Keepers don't know who each other are."Snowmoon · chapter 7
Holders propose something worth paying for. Quadratic Funding listens to the crowd. Graph Funding asks a few people, drawn at random, to judge one small part of the graph each.
Support is a burn, from your wallet or unnamed from a note. The pot matches by the square of the sum of the square roots, so ten people burning a little count for more than one burning a lot. No proposal takes more than a third. Sentinels give each proposal a tier; Tier 4 gets nothing.
No proposal yet in this round.
"For each node on the graph, the cryptographic network randomly selects a committee, that makes the decision of what weights the edges right below that node get." A project placed under two nodes is paid along both paths.
The graph opens with the first draw: a root, and three nodes under it. Sitting Keepers can add more.
Proposed something in Quadratic Funding? Place it under one or two nodes.
The Courts are not part of the Order: they hear a tier a proposer disputes, or a payment someone in the Order thinks should not be made in full. The bounty pays anyone who can prove who sits in a seat.
The first block after a case is filed draws five Acolytes, never the sides, never the Sentinels who gave the tier. Two pairs talk in rooms that never hear each other, the Tiebreaker listens to no one, and the middle of the five views is the judgement. Two appeals at most: "it just selects another random sample". A case in bad faith bars its bringer for four cycles.
No case has been brought yet. Cases open once the Sentinels drawn on Monday 26 October give their first tiers, and once the first funding round closes on Monday 2 November.
Signed with your wallet; the judges never see who brought it. A payment under a case waits until the judgement is final.
"…by clearly having enough information to claim a large bounty by ratting out his role to the Order's cryptographic network, and choosing not to do that." To sell a vote you must prove your seat, and the proof is worth more to whoever receives it.
Did a sitting Keeper or Sentinel prove their seat to you with a signed message? This is the message they would have signed:
zipcoin · the Order of Steering I sit as Keeper N.
(or I sit as a Sentinel.) Paste the signature. If it holds, the seat is revoked and refilled at the next draw, that wallet is never drawn again, and the bounty is paid to you from what the Order holds.
"If judging wasn't anonymized, randomly selected and split into two and a half groups each round, I'm sure they would find a way to threaten or bribe the judges too."Snowmoon · chapter 21
A Herald, retired into the open, convenes a citizens' assembly on one topic. Emerald writes what was said, and the Keepers read it in their booth.
"For those who are new to this assembly, welcome and thank you for coming. I'm Alagael, I've been a Herald for seven years." The Herald opens the assembly session by session; citizens take a seat and are placed at a table of ten.
Only a Herald convenes an assembly. The first Herald retires into the open at the second draw, on Monday 2 November.
"An audio program from Emerald, the local AI running from Gladias's hand device." Here Emerald answers what you ask about zipcoin, writes the summary of every proposal, and once a week a broad listen report of everything the courtyard carried.
Ask me about zipcoin: zipping, the Order, anything on this page.
Emerald writes its first broad listen report at the first draw: what the burned words of the week said, as themes, without a single name.
"Heralds are Order members - Keepers or Sentinels - that get randomly selected each year to retire, to be a sort of ambassador." (ch. 6) Here, one each week. A Herald may show a name; until then, only the number.
Nobody applies for a seat. Join once as an Acolyte, and the cryptographic network may draw you as a Keeper, a Sentinel, a judge or onto a committee. Everything you are asked to do appears here, and only you can see it.
An Acolyte holds at least 1,000,000 zc or a hand device, and joins with one free signature. Choose your track in secret: it is never shown to anyone.
For every open change, say whether thirteen Keepers will pass it. Your prediction score decides your standing.
You are not sitting as a Keeper this cycle.
You are not sitting as a Sentinel this cycle.
"His hand device spent a tick collecting nullifiers and generating a zero-knowledge proof." Chapter 6
1,000 hand devices of Veridia, bought by burning $zc: nobody is paid, the coins are gone. Every screen hides a line and a key, woven into the picture itself. 21 more belong to the courtyard and are never sold: each Keeper of the Order who completes a term receives one, and between them they keep one sentence.
The devices open soon. When they do, the price is a burn: every $zc spent goes to 0x…dEaD. Then hold yours here, read its key, and open the doors.
Drop your device's picture here (or try one of the pictures above). The hand device reads the line and the key hidden in its screen. Nothing is uploaded.
> waiting for a picture
One free signature proves the device is yours. The doors stay open on this device for 30 days.
The first holder to open the second door signs first.
In the book a wallet is not a single key. It is guarded by people who do not know each other, and any four of six can bring it back. Your zipped notes follow your wallet, so a wallet that can be recovered keeps its notes too. Plan your circle here; nothing you type leaves this page.
Every old wallet carries coins nobody trades anymore, airdrops nobody asked for, and permissions given years ago. The hand device reads your wallet and sorts it: what can still be sold, what is only dust, and what is most likely a trap. Bury the dust, sell what is left, take back the permissions.
Read through the courtyard from public chain data: token transfers, published code, a simulated trade. Nothing is stored. The courtyard, Etherscan and honeypot.is see which address was read, so read a wallet you don't zip from.
Hidden because their name carries a link or a promise, they imitate a known token, a simulated sell fails, or they arrived uninvited with unpublished code. Never visit a site a token names, and never try to sell them. The hand device leaves them alone: touching them only costs gas, and some are made to trap whoever does.
Each token is sent to 0x…dEaD, one confirmation each. On Ethereum a burn returns nothing and costs a little gas; there is no rent to reclaim as on Solana.
Sold on Uniswap, straight to ETH. Shown only when the ETH you get is clearly more than the gas. Each sale approves exactly the amount sold, nothing more.
Contracts you once allowed to move your tokens or NFTs. Unknown ones with no limit are marked. Revoking costs a little gas and gives nothing back but safety.
Six pieces, drawn so far. Holders of $zc or of a hand device score them from -3 to +3. As in the book's vote on buildings, every ballot is "shifted, stretched or squeezed so that the total average of the votes becomes zero": one wallet, one equal voice.
When a piece is made, its delivery goes like this: you pay from a zipped note, your address is sealed to the tailor's letter key, and the courtyard carries the sealed address without being able to read it. Try the seal here; nothing is sent.
> the sealed address appears here
Every word burned with $zc is carried here. Zip your coins, speak, join the Order, or simply read.
zipcoin ($zc) brings the money of Vitalik Buterin's novel Snowmoon to Ethereum. In Veridia, money is private, words cost something, and a collective drawn at random steers the taxes. Here all three run on mainnet.
Four parts, fifteen stations. Tap any line to go there.
Everything Snowmoon describes, where it lives here, and whether it runs. The words are the book's own.
Zip and unzip through a privacy pool, with a zero-knowledge proof.
The sales tax that leaves with the paymentch. 6live1 % of every trade, split in the contract the moment it is paid.
Burning to send a messagech. 19liveAn envelope with a loose description of its reader; the burn is its weight.
Burning at a doorstepch. 20liveKnock: burn $zc at someone's address, with a message.
Burning to pollch. 27live"The more zipcoins you burn, the more people it polls."
Envelopes in envelopesch. 9liveSealed letters: the chain sees the door, only the reader's key opens the words.
Nullifiers as namesch. 6liveThe Order calls each member by the first digits of a nullifier.
Cryptographic sortitionch. 1liveThe seed is the hash of the first block after the deadline: anyone can redo the draw.
Acolytes and the prediction scorech. 1liveMembers in training predict the Keepers; the top tenth stand in full standing.
Keepers and Discussion Groupsch. 7 · 23live21 seats, seven new each cycle, three groups of seven, known only by number.
The rubric, thirteen of twenty-onech. 23liveWhat the courtyard's share does: fire, Quadratic Funding, Graph Funding, held.
Sentinels and tiersch. 1 · 23liveThree groups of three give every funding proposal Tier 1 to 4.
Quadratic Fundingch. 1 · 3 · 11liveMany small burns outweigh one large one; no proposal takes more than a third.
Graph Fundingch. 3 · 17liveA committee drawn for every node weighs the edges below it; paths add up.
The Courtsch. 6 · 21 · 23liveFive judges, two pairs and a tiebreaker, the median decides; appeal draws again.
The bounty on a revealed seatch. 1 · 20liveWhoever proves a sitting member's role is paid, and the seat is revoked.
Heraldsch. 6liveOne Keeper whose term ended retires into the open each cycle.
Citizens' assembliesch. 3 · 6liveA Herald convenes, citizens sit at tables of ten, the Keepers read the results.
Broad listen reportsch. 8 · 10 · 11liveOnce a week Emerald listens to every burned word and writes what it heard.
Emerald, the AI on the hand devicech. 1liveAnswers questions and writes the summary of every proposal.
Social recoverych. 6 · 16livePlan a circle of guardians and create it as a Safe; any four of six bring it back.
The calendar of Dzegoch. 19liveSnowmoon to Frostime: the roots unlock along the year of the book.
A mixnet for physical goodsch. 9book onlyOnly the last of three nodes knows the address. Carrying parcels needs real couriers.
Voting keys from a Key Allocation Groupch. 15book onlyMade by meeting three of five people in person. No website can stand in for that.
The obfuscated circuitch. 9 · 15book onlyUsable obfuscation does not exist yet; the courtyard keeps the votes until the close.
Steganography with language modelsch. 19book onlyEvery reader would need the exact same model.
Senate committee approvalch. 23book onlyzipcoin has no Senate, so only the score and the holding count.
Most of zipcoin needs nobody's word: the tax, the burn, the supply, the pool and the proofs are in contracts. Four things still lean on people, and they are said here plainly.