RWAs, stables, and more — verified by the parties to a payment, not by a consensus network. Shielded transfers, auditable supply, anchored to Bitcoin with a 64-byte footprint. No fork.
Eighty seconds: mint, anchor, off-chain transport, scan-first verification, batching — and what you trust.
Rendered with Remotion from
web/animation.
Bitcoin provides ordering and availability. Everything else — amounts, coins, validity proofs — moves directly between sender and recipient, and the recipient verifies it client-side.
The issuer signs a mint and anchors it on Bitcoin: MINT ∥ asset_id ∥ V
— amount and asset public, so anyone can audit supply. New coins go out as
hiding commitments; owners stay private.
A transfer anchors only the spent coins' nullifiers (64 opaque
bytes). The coins themselves — plus a recursive proof of their entire ancestry —
travel off-chain to the recipient, e.g. over Signal.
The recipient verifies one constant-size proof (valid issuance →
conservation-respecting history) and one Bitcoin anchor (first occurrence of the
nullifier, k confirmations). Accept or reject — done.
The real CLI against a real bitcoind (regtest):
every anchor is a broadcast Bitcoin transaction carrying a 64-byte
OP_RETURN record — no demo chain, no mocks.
captured 2026-08-01 11:34 UTC · regtest · opencsv-rs@aaadae9
gettransaction shows 6 confirmations).
VERIFIED); re-anchoring the
same nullifiers loses to first occurrence (REJECTED); the
public supply audit sums mints − redeems from chain data.OpenCSV extends Shielded CSV's client-side validation with the predicates an RWA actually needs.
Where OpenCSV sits among RWA and client-side-validation designs.
| Client-side validation | Shielded transfers | Auditable supply | Issuer-gated issuance | Trustless light verification | Fork-free on Bitcoin | |
|---|---|---|---|---|---|---|
| ERC-20 (Ethereum) | no | no | yes | yes | trusted RPC | n/a |
| RGB | yes | partial | per-contract | yes | full history rescan | yes |
| Taproot Assets | yes | partial | issuer proofs | yes | issuer proofs | yes |
| Zcash | no (own chain) | yes | no | no | lightwalletd (trusted) | no |
| Shielded CSV | yes | yes | no | no | full scan or trusted indexer | yes |
| OpenCSV | yes | yes | yes | yes | compact filters + PoW, on-device | yes |
The last two columns are where OpenCSV earns its keep. Issuer-gated issuance and auditable supply make it an RWA scheme rather than a bearer asset. The deeper one is light verification: in plain Shielded CSV, checking a double-spend means scanning every nullifier the chain has ever carried (or trusting someone who did) — fine on a desktop, impossible on a phone. OpenCSV's marker output makes anchor blocks discoverable through the same compact block filters light wallets already sync, so a phone proves "this coin was never spent before" with proof-of-work and a few kilobytes per block — no trusted server, no full scan. That's the difference between client-side validation as a theory and client-side validation that runs in your pocket.
From paper to a payment that arrives like a text message.
Scheme specification, security analysis, comparison. You are here.
opencsv-core + opencsv-pcd: Poseidon2 commitments and
nullifiers over BabyBear, mint/transfer/redeem predicates as hand-written AIR,
in-circuit FRI recursion. Transfers verify two predecessor proofs in-circuit:
56 KB proofs, 3.6 ms verification, constant in history length
(~3 s proving, release, 64-core Xeon). The full flow — mint → shielded transfer →
double-spend rejected → redeem → public supply audit — passes end to end.
Lean 4 mechanization of the protocol logic: inflation soundness, conservation, nullifier uniqueness, receiver correctness. Sorry-free; all cryptographic hardness isolated in labeled axioms.
Consignments delivered as E2E-encrypted Signal messages; a payment arrived on a physical iPhone and rendered +100 USD · verified; the phone proved a transfer on-device (~1 s) and the CLI verified it. Both directions over production Signal, audits agreeing.
A protocol-constant marker output makes anchor blocks discoverable
via compact filters. A real consignment was verified with no RPC and
no indexer — 320 filter bytes + 1,140 block bytes for the window —
and an anchor hand-crafted with raw bitcoin-cli from the
spec was discovered by the scan engine purely via the filter walk.
Two implementations, one protocol, zero coordination.
On-device sync bandwidth, battery, and receive latency on real phones on signet; mainnet beta after that.