the protocol, stated plainly.

zecco moves a tokenized stock position out of public view without moving it out of public accounting. the position is burned on robinhood chain, and the holder keeps a shielded note on zcash that only they can read.

two properties hold at the same time. the total ever burned is verifiable by anyone from public data. the identity of who burned what is not recoverable from that data.

the stock token is sent to the burn contract and destroyed. the contract emits exactly two values that matter to the protocol: a commitment hash and the amount burned.

the mint is not emitted. the holder is not emitted. nothing links the burn to the note that later appears on zcash.

the commitment is a hash over four inputs: the mint, the amount, a salt chosen by the holder, and the burn transaction. together these four are the opening.

the holder derives the commitment on their own machine and publishes only the hash. the opening is what proves ownership later, and it is never transmitted.

a note lands in the holder's zcash shielded pool carrying the opening. the viewing key reads it. without that key the note is indistinguishable from every other leaf in the tree.

the tree itself is built only from burn events observed on robinhood chain, in the order they were emitted.

notes outstanding equals tokens burned, at every block. both sides are public quantities, so the equality can be checked by anyone at any time without permission or cooperation.

supply cannot drift from burns without the drift being visible in public data on both chains.

there is no privileged key, because there is nothing for one to sign. the holder derives their own commitment; no authority approves it.

the indexer replays public burn events and rebuilds the tree. it holds no secret and grants no permission. if it reports a wrong root, independent rebuilds disagree with it. if it disappears, anyone rebuilds the same root from the same events.

live. the burn contract is deployed at 0x1b9b99df6314c9fa84e595706208effd3f6283d4.

the app published on this site runs entirely on simulated data held in the browser, so the flow and the invariant can be inspected without spending anything.