# tacit chain: exploring the edge of fast, private, future-proof crypto

Source: https://x.com/z0r0zzz/status/2119595794601062531?a=DIk02Mto8uO_4BDVEPs&s=46
Kiwi News: https://news.kiwistand.com/stories/tacit-chain-exploring-the-edge-of-fast-private-future-proof-crypto?index=0x6af185c942665a04c1d07612d27fe3e6d9b1288dc5c67b7fc3c2fa38220b50c1a4a36048
Submitted by misha on 2026-11-09 UTC, 2 upvotes, 0 comments

## Summary

Tacit Chain is a prototype privacy payments zk-rollup on Ethereum, built by its developer to keep payments private today and resistant to future quantum attacks. Payments are batched into blocks by a rotating "leader" and validated by zk-proofs before Ethereum accepts them, so invalid batches cannot land. Once funds are on the chain, the article says payment amounts and identities are not traceable, and memos are sealed with ML-KEM, the NIST-selected post-quantum standard. The author says a merchant sees a payment as received immediately and it is final on Ethereum in about a minute.

## Article

The white whale of crypto is "can I buy a cup of coffee with it." ☕

This is a pretty good metric. (A) coffee is everywhere, and (B) if a merchant refuses a crypto payment for being too slow or not money enough, then that crypto has failed.

The thing about blockchains is that while they serve the remittances and savings use cases pretty well (no matter how slow they are), payments do indeed need to be fast to work in person.

After all, you are staring at the merchant. And they are staring at you. Nobody is going to be very impressed to hear that you are sending them very secure ultrasound money. "Just you wait. I am my own bank." They want the money, and for you to go on your way.

But just going faster won't help reach parity with legacy finance. Privacy is important too. You don't want to buy groceries just to end up leaking your life story and get wrench attacked on your way home. Or ten years later because a supercomputer tracked your spending.

Which brings me to Tacit Chain, which is my implementation of a payments zk-rollup that keeps your transactions private today, and has future-proofing against advanced machines breaking that privacy deeper in the future (i.e., 'post-quantum').

But first let's go through some of the tech that brought us here, and informs my choice of design so it doesn't seem random or arbitrary for sake of hype:

Sidechains

An easy way to get faster blockchain payments is to simply clone the assets of a slower, stronger chain that you want onto a ledger you or a consortium control. So you lock your coins on the main chain, get the same amount on the "sidechain" as pegged IOUs, and can then spend faster and leave whenever you want (ideally). Liquid does this for Bitcoin (federation of companies holding the coins in a multisig).

They have varying trust assumptions. This is because "sidechain" is such a broad concept as to be almost meaningless. I could sit at a bar and have a napkin and have people send money to my EOA and then "settle up" when people exit. And that would probably qualify in some ways. Of course sidechain providers will do their best to do certain security and ops improvements, like using a multisig rather than hot wallet to compete (since anyone can draw on a napkin). But the chief thing here is that the main chain does not know what is happening on the sidechain, and cannot protect you.

I also like to think of sidechain balances as gift cards for this reason. You send a company money and they give you a virtual balance you can spend with them. They could nuke that balance at any time, but we more or less trust rational business incentives. So as long as opsec is decent and the counterparty is not insane or a total scammer, a sidechain is not the worst solution. But can we do better?

State channels

Another speedup method is to keep the blockchain out of your payments until you actually settle up. Like a bar tab. You and the merchant (or a route of channels between you) lock some money into a shared account on the main chain, then pass signed IOUs like messages. If someone tries to settle with an older balance, you show the newer signed slip and override it. Lightning is the popular example of this kind of "state channel".

This kind of system works fairly well for payments, and is relatively trustless, while inconvenient (users have to monitor and stay online to catch cheating).

Ok, so far we have gift cards and bar tabs. Still following with me?

Rollups

This is what people commonly think of when they think of fast blockchains.

You run a second ledger like a sidechain with whatever rules and speed you want, and then submit records as compressed batches.

You know fruit rollups? The tasty fruit snack?

This snack solved the scaling issue with holding a bunch of fruit in your pocket. And most importantly, you can check if you are being scammed by the company by unrolling the snack and seeing if there are real pieces of fruit inside.

Same concept as blockchains.

optimistic rollups

Just batching transactions and posting them to Ethereum isn't enough to prove they were honest, though. After all, I could post a batch that says everybody's balances check out while quietly crediting myself a million credits. Skittles in the fruit roll. So how do we deal with skittles?

"Optimistic" rollups treat transactions as valid by default, and so don't require any advanced cryptography to submit. They are happy to see you transact. This is how Base and Robinhood can be so fast: proving is cheap but exit is slow.

Specifically, the sequencer is a trusted operator who decides the order, and it (or a partner service) posts the batches and the claimed results from their "L2" onto Ethereum. Whoever posts a result can't just cheat, though, unlike a sidechain. If a batch has junk in it, like a double spend or balances that don't add up, anyone can replay it, point at the bad entry, and 'win the dispute' on Ethereum. The party who posted the bad claim loses its deposit, and the person who caught it gets paid. Game theory.

So the incentives are mostly aligned in making a fast, efficient and secure blockchain possible by "inheriting the security of mainnet" with skin-in-the-game. Because the mainnet, like a court system, has the power and security to settle the dispute fairly as a neutral power if people abuse the optimism of the L2 (after all, if you settle the dispute on the sequencer's own rollup, that is like going to their house to sue them. Good luck with that!) This dispute system as well is why there is the aforementioned exit delay (you need to give people time to catch cheating).

But what if we don't want to play these games? Is there a way to keep using math and computers here?

Short answer: Yes.

zk rollups

Another way to prove a batch is valid, and keep the efficiency of a rollup, is to attach a zk-proof. A prover computes the proof before the batch is submitted, and Ethereum checks it on arrival. So instead of posting the compressed batch "optimistically" and waiting about a week to see if anyone challenges it (which is why exits from most optimistic L2s are slow), the batch simply won't land on mainnet if it isn't valid.

Tacit Chain

This is the approach I have taken with a prototype for a private payments rollup, Tacit Chain.

Payments are a great scope because they lower the computation required. Users prove their own sends, and block batches are something a community of GPUs can handle, which is what we are doing. Tacit payments are collected into blocks by the "leader", our version of a sequencer: whoever's turn it is to order payments and post them to Ethereum, into a verifier contract (TacitBlocks.sol) that records each block and checks its validity for withdrawals. A 1000 TAC seat earns you scheduled turns as leader, and if the leader is idle, anyone can step in after ten minutes. The leader is paid in TAC, which is what powers this rollup as the currency. Provers earn TAC through the rewards program for proving blocks, which is useful work rather than throwaway puzzle hashing. Anyone with a GPU can join.

Notably: once your money is on the chain, payments are not traceable in amount or identity. It's a black box built on zk-proofs: your own device proves a payment is valid, so the rollup can verify it without ever seeing who sent it, who got it, or how much. A second proof then checks that the whole batch of those payments was processed correctly before Ethereum accepts it.

shield-to-earn

Transaction fees are also in TAC, and users hold "shares" when they enter. That accounting lets us pay you to stay, which helps boost the anonymity set. A slice of every payment, plus a small fee whenever someone leaves, stays in the shared pool instead of going to a middleman, so every share is worth a little more after each send. Once you're in, nobody can see your shares. Interestingly, the more the chain gets used, the more your TAC share grows, and fees can come down too as the chain gets busier, since every payment in a block splits the cost of landing it on Ethereum. There is no protocol rake, and anyone can run a leader and earn the fees on payments sent to it. As TAC gains value, leaders and provers also need to sell fewer TAC to cover their ETH gas and GPU costs.

So basically, Tacit Chain is a privacy zk-rollup that allows quicker and cheaper payments with the same security as Ethereum, and pays you, too.

how to enter

You can enter the chain from Ethereum without even needing gas if you hold TAC, which has been airdropped. If you do not hold TAC you can buy it from DEX or earn it by doing tasks or proving transactions. This works through an EIP-2612 permit meta-tx. From Bitcoin, you can enter through the "fast bridge", an atomic swap with a liquidity provider, or the regular bridge. The goal with Tacit Chain and TAC is to provide an invisible way to move across both of these major blockchains and then leverage the privacy protocols of Tacit Finance in a more integrated manner. Regardless of what you hold. Socially and technically Tacit provides a third way beyond Bitcoin or Ethereum maximalism into a community that just wants results. And I specifically do not want another blockchain that fragments BTC or ETH liquidity or dapps. A zk-rollup with its own native currency, bridged trustlessly to Ethereum and connected to Bitcoin through our bridge, with immutable privacy pools to shield users on both chains for all of their assets (BTC, BTC-based tokens, ETH, ERC20s, etc.). That's how I'm approaching this.

how to exit

You don't need to wait a week. You can exit back to the ERC20 form of TAC instantly. This ERC20 TAC can then be shielded in the Tacit bridge and sent back to Bitcoin or used in its internal DeFi, such as LP and swaps.

post-quantum privacy

It is one thing to maintain privacy today. It is another to do so tomorrow. Since transactions are onchain they will always be a record for the future so with Tacit Chain I have made the memos attached to user payments resistant to quantum computing which threatens to break current cryptography methods. A payment memo is basically the encrypted note that tells the recipient "you got paid, here's how much." We seal these notes with ML-KEM (won the NIST competition for the first post-quantum cryptography (PQC) standard). So even if someone scrapes every payment on the chain today and waits for a quantum computer, the memos won't just open.

stage 2

By my reading, Tacit Chain clears the stage 2 criteria for an L2.

Control: TacitBlocks and TacitSeats (core contracts) have no owner, upgrade path or multisig. The verifier, the block key, the delays and the token are all immutable, and the verifier is a pinned SP1 Groth16 leaf, not an upgradeable gateway. Stage 2 asks for a 30-day exit window before unwanted upgrades, and here there are no upgrades to be warned about.

Proving: it's a validity rollup, so there's no fraud-proof actor set to decentralize. Only the turn-holder can land a block for 10 minutes after each landing. After that anyone can land one.

Getting out: force() queues an exit on Ethereum. A block that skips an entry older than the 1-hour FORCE_DELAY reverts with QueueOverdue(), so the leader can't stall you for more than about an hour plus the window.

Data: the lists go to Ethereum as calldata, and the node can rebuild the full state from them.

One dependency: hops and migrations go through the confidential V1 pool, so they trust V1 pool's construction (it is also immutable without upgrade path that can rug balances). Exits to Ethereum are a plain TAC transfer out of the contract and don't have a dependency.

future improvements

Payments are a good start. Paying for coffee has been achieved in this way. A merchant sees your payment as received the instant you send it, and it's final on Ethereum in about a minute. With more participants and an active prover pool with good machines, that gets closer to 30 seconds, and with blobs (already built in) the cost drops under a cent. Merchants can then withdraw TAC to Ethereum as soon as the block lands. They can also withdraw it to Bitcoin. And if they don't want to hold TAC, they can swap via our DEX for whatever currency they want inside our confidential pool, too. And the point - again - is that this zk-rollup design offers default privacy that is hard to break well into the future.

Running programs and internal smart contracts are also an interesting direction, as well as adding other assets. For this reason Tacit Chain has a migrate operation that can upgrade into new versions (but only if the user opts in) - and the best part - these upgrades can be done without breaking your anonymity (which note moved and how much).

I will be monitoring and working with the community (join the discord) to introduce improvements and hardening changes to any such new versions. Until then follow @tacitfi for other updates and product announcements related to confidential crosschain DeFi, and our various privacy-preserving tools.