Skip to main content

Unshield

Unshielding takes value out of the pool and puts it back on a public address. It is the exit, and it is the one operation that makes an amount visible again.

What happens​

  1. You choose an amount and a destination address. The destination is an ordinary public address — your own, or someone else's.
  2. Your wallet builds a proof that you own a note worth at least that much, that it exists in the Merkle forest, and that the arithmetic balances.
  3. The note is consumed. Its nullifier is published, so it can never be spent again.
  4. The public balance is credited to the destination address.
  5. If you withdrew only part of the note, the remainder comes back to you as a new private note — see change notes below.

What this reveals​

An unshield is public by design. The recipient and the amount have to be visible — they are a normal balance change on a normal address.

VisibleHidden
The destination addressWhich note was spent
The amount receivedWhere that note came from
That an unshield happenedYour other notes, and your total balance
The nullifierAny link between this and your earlier deposits

The nullifier is not traceable to the commitment it spends, so the withdrawal does not point back to the deposit that funded it.

Withdrawing to an address that is already yours

If you unshield to the same public address you originally shielded from, anyone comparing the two transactions can infer they belong to the same person — the chain did not reveal it, the address reuse did. Withdraw to a fresh address when the link matters.

Partial withdrawals and change​

You do not have to withdraw a whole note. The circuit enforces that the note's value is fully accounted for:

note_value  =  amount  +  fee  +  change
  • amount — what the public recipient actually receives.
  • fee — the gasless relay fee, taken inside the pool.
  • change — the remainder, returned to you as a new private note. It is 0 for a total withdrawal.

The change note is a normal shielded note: new commitment, new blinding, no link to the note it came from. Your wallet picks it up automatically.

The fee​

The fee is deducted inside the pool, from the note being spent. You never pay gas from a public balance, which is what allows an account with no public tokens to withdraw at all.

The net amount after the fee is what the recipient receives — so a withdrawal of 100 with a fee of 1 credits 99 to the destination.

Who receives the fee depends on how the transaction was submitted, exactly as for a transfer:

Submitted viaCredited to
ShieldedPool precompilewhoever signed that EVM transaction and paid its gas
Signed extrinsicthe signer's registered EVM address
Unsigned extrinsicthe block author

Submitting unsigned needs no wallet and publishes no EVM transaction naming you. An unshield reveals its recipient and amount either way — but submitting unsigned withholds who withdrew. See choosing a submit route.

Multi-asset​

Each unshield withdraws one asset. Notes are asset-tagged, so a vault holding ORB and USDT withdraws each separately — there is no conversion, and no single call that empties everything.