Compact Shielded CSV Limits One-Coin Ledger Records to 96 Bytes

Compact Shielded CSV would put a 96-byte record on-chain for a payment spending one coin, shifting larger cryptographic proofs to users’ wallets as developers explore quantum-resistant payment designs.

The proposed record contains three 32-byte hashes. A nullifier identifies the coin being spent, a commitment represents the transaction, and a “degriefer” links the spend to the owner’s secret key. For each additional input, the record grows by two hashes, or 64 bytes.

The sender would pass a proof to the recipient, whose wallet checks the payment history. Network nodes would store the three hashes without verifying an on-chain signature or proof. That makes the 96-byte figure a measure of ledger data for a single-input payment, not the total information users must handle.

For comparison, the smallest ML-DSA signature in a U.S. post-quantum digital-signature standard is 2,420 bytes. The figures cover different parts of a transaction: Compact Shielded CSV’s figure counts only the on-chain record, while users would still need to generate, deliver, store and verify proofs.

A formal model examines whether the design prevents double spending and excess coin creation, and whether valid coins can be spent under the model’s assumptions. It does not measure transaction fees or wallet speed, so the smaller ledger record does not establish that payments would cost less or process faster.

The proposal also has unresolved trade-offs. Nodes would need to maintain a growing index of past spending attempts, which cannot be pruned under the current design. Proof delivery poses another problem: a recipient could claim that an off-chain payment proof never arrived.