# Private Assets
**URL:** https://forum.tezosagora.org/t/private-assets/2123
**Category:** Research and Development
**Tags:** sapling, tokens
**Created:** [August 18, 2020, 7:10pm UTC](https://forum.tezosagora.org/t/private-assets/2123 "2020-08-18T19:10:01Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@sophia](https://forum.tezosagora.org/u/sophia)
#### Post date: [August 18, 2020, 7:10pm UTC](https://forum.tezosagora.org/t/private-assets/2123/1 "2020-08-18T19:10:01Z")
As of recent weeks, Tezos for the first time has a [public testnet](https://forum.tezosagora.org/t/dalphanet-was-launched/2089) running a protocol that allows users to take part in privacy-preserving transactions. Along with this comes a client hardcoded to work with an [example contract](https://gitlab.com/metastatedev/tezos/-/blob/sapling-integration/src/lib_sapling/test/sapling_contract.tz) making use of new Michelson primitives that verify zkSNARKs with Zcash’s Sapling cryptography. The client currently only works with this one contract, although multiple versions of the contract may be originated on-chain. This contract represents a simplistic version of something like a private form of XTZ, hereafter referred to as “ztez”. First, let’s run through how it works on a high level (a more detailed description is available in [Nomadic Labs’s documentation](https://gitlab.com/metastatedev/tezos/-/blob/sapling-integration/docs/developer/sapling.rst)):
> Its storage is a `sapling_state` and it has one entrypoint that takes as a parameter a pair of a `sapling_transaction` and optional `key_hash` for forwarding funds upon withdrawal. Both `sapling_transaction` and `sapling_state` types are opaque from the standpoint of Michelson and must be constructed and introspected, respectively, off-chain as is done here by the client.
>
> The Sapling transaction is constructed by one of three client commands that take sender and recipient addresses and generates a zkSNARK. At least one of sender and recipient must be a Sapling address generated with an additional client command. Sapling addresses are prefixed with `zet1` and correspond to UTXOs in a specific `sapling_state`. When both sender and recipient are`zet1` addresses, the zkSNARK is written to disk locally and can be passed to the example ztez contract from any transparent account at a later time.
>
> When the sender is a `tz1` or `KT1` address the amount proven in the zkSNARK is negative and a corresponding balance in XTZ is included with the Sapling transaction. When the recipient is a `tz1` or `KT1` address, the amount proven in the zkSNARK is positive and it’s paired with the transparent address to receive a corresponding XTZ transfer. In both cases the example ztez contract is called immediately rather than writing the transaction to disk with a separate forge command.
>
> It should be noted that the Sapling circuits have no notion of Tezos address types and are agnostic to the denomination of the balance they’re proving. The client described here only takes `tz1` or `KT1` addresses in its shielding command in order to bundle XTZ inside the `sapling_transaction` type and does not allow this to be distinct from the amount proven in the zkSNARK. This means that the example ztez contract should never fail in the case of deposits.
>
> The client can also check the balance of a given `zet1` account in a given version of the example ztez contract. No functionality is currently provided to use viewing keys distinct from spend authority as would be necessary for regulatory compliance.
Looking forward to how these features can be generalized for use on mainnet in the future, a few points should be made:
1. As a smart contract platform where native transactions and fee payments are transparent, **one of the most compelling use cases for privacy on Tezos lies in private tokens**. This means generalizing the Sapling-related client commands and decoupling them from any specific contract.
2. Even more than economic incentives, **the key to building large anonymity sets is usability.** We see this in Zcash, [which has recently seen its number of private transactions double month to month after releasing its first two mobile wallet](https://cointelegraph.com/news/zcash-fully-shielded-transactions-jump-70-to-new-record-in-april).
3. Given the speed of innovation in zero knowledge cryptography and the fact that many private transaction schemes may not even require upgrades to the protocol, **any private token standard should be agnostic to specific privacy-preserving technology** (as is the case for [zkERC20](https://github.com/ethereum/EIPs/issues/1724)). This can work with a metadata standard ([TZIP-16](https://gitlab.com/tzip/tzip/-/blob/master/proposals/tzip-16/tzip-16.md)) to specify the cryptographic engine and storage location.
While it’s exciting to finally see private transactions on the horizon for Tezos, considerable work still needs to be done in order for them to be usable by contract and tooling developers. Important open questions remain:
- What features are important for private assets?
- How can we more easily and securely onboard new users when so much off-chain machinery is required?
Sapling is a good start for representing private tokens on Tezos. Thankfully we’re also adding Michelson instructions for operations on the BLS12-381 pairing-based curve that can be used to implement future zero knowledge schemes capable of representing other types of assets without the necessity of a protocol upgrade.
---
### Author:  [@TezosGovernance](https://forum.tezosagora.org/u/TezosGovernance)
#### Post date: [July 7, 2021, 7:54pm UTC](https://forum.tezosagora.org/t/private-assets/2123/2 "2021-07-07T19:54:25Z")
Hi was a private-token standard finally created?
---
### Author:  [@sophia](https://forum.tezosagora.org/u/sophia)
#### Post date: [July 9, 2021, 8:19pm UTC](https://forum.tezosagora.org/t/private-assets/2123/3 "2021-07-09T20:19:12Z")
> [@TezosGovernance](#):
>
> Hi was a private-token standard finally created?
No. Sapling isn’t really suitable for private tokens. At best, you can have multiple shielded pools with different tez exchange rates. But you can’t have admin functions and you can’t trade between the pools without unshielding.