Four roots define one canonical block state.
Accounts, contract code, storage and public asset balances.
Append-only Merkle commitment to all shielded notes.
Authenticated set of consumed notes for global double-spend prevention.
Asset-adapter liabilities, locked reserves and pending settlement queues.
H = Hash(height ∥ parentHash ∥ evmRoot ∥ noteRoot ∥ nullifierRoot ∥ reserveRoot ∥ validatorSetHash)Validators sign the same composite state. A mismatch in any root produces a different block hash and cannot be finalized as the same block.
Private values; public validity.
anchor_rootnullifiers[]commitments[]public_deltafeenote_plaintextsspending_keysMerkle_pathsrandomnessrecipient_keys01 MerklePath(note) → accepted_anchor_root02 Nullifier(note, spend_key) ∉ spent_set03 Ownership(spend_key, note) = true04 Σ value_in − Σ value_out − fee = public_delta05 Range(value) ∧ CanonicalEncoding(all_fields)06 Domain(proof) = chain_id ∥ circuit_versionPrivate note value, recipient, sender linkage and spending key.
Commitments, nullifiers, proof bytes, public value delta and fees.
Network anonymity, IP privacy and resistance to timing correlation.
Bitmap-gated BFT finality.
2,100 Bitmap lock + BTC-denominated bond
Leader orders valid public and shielded transitions.
Validators independently execute and compare composite roots.
A supermajority locks one valid block candidate.
The finalized state becomes the parent for the next height.
The chain periodically commits its finalized state to Bitcoin.
Bitcoin anchoring makes later history rewriting externally detectable. It does not make the EVM chain inherit Bitcoin consensus or eliminate bridge and validator trust assumptions.