Zcash Community Grants · Infrastructure proposal

Bridge shielded Zcash to Ethereum, trusting no one.

Skyhook lets an Ethereum contract verify that a shielded Zcash payment happened, and act on it. There's no custodian and no validator committee, and the sender stays private. Its first application, the Skyhook Bridge, swaps shielded ZEC trustlessly, and is what this grant completes. This site is the full research proposal behind it.

Read the proposal

1Alice locks ETH in the Skyhook contract
2Bob pays Alice in shielded ZEC
3Proof: the expected txid was mined and is final
4The contract releases the ETH to Bob

Live beta Automated Sepolia ETH → testnet ZEC atomic swaps, tested publicly by forum members. Research paper IACR ePrint 2026/2210, submitted to Financial Cryptography 2027. Official application The application as submitted to ZCG. Every number on this site is read from it.

The ask

$255,000 for a bridge anyone can run.

Research, contracts, wallet libraries and a mobile prototype, delivered as open source and published papers.

$255,000

Requested from ZCG

39 weeks

From approval to final milestone

Milestones, each with acceptance tests

Apache 2.0

Open-source license

The problem

Every way out of the shielded pool asks you to trust someone.

No major bridge in or out of shielded Zcash is fully trustless today. Each one puts a party between you and your funds.

See the full comparison →

THORChain and MayaTransparent ZEC only, held in vaults by node operators who can halt trading by vote.
NEAR IntentsTransparent ZEC at the protocol level, and an operator that has held one user's $589,000 for over two months.
red·bridgeWrapped ZEC under guardian custody. A deposit only counts once the guardians recognise it.
Skyhook BridgeAn Ethereum contract checks the Zcash transaction and its finality itself. No custodian or committee can block a valid swap.

How it works

Ethereum checks the Zcash transaction itself.

A Zcash transaction ID is the root of a hash tree (ZIP 244). The contract rebuilds that root from only the parts it needs to check. Everything else stays folded, and private.

Alice locks ETH
Her request states what she expects in return: an amount of ZEC, paid to her shielded address.
Bob pays in shielded ZEC
An ordinary shielded transaction. His note and his address are never revealed.
Bob proves the payment
He opens only the leaves the contract checks. Change any leaf and the txid changes, so the proof fails.
The contract checks finality
A rollup of Zcash blocks, built by anyone and checked with FlyClient sampling, proves the txid was mined and is final, and the ETH goes to Bob. No stakers or committees are involved.

5-MINUTE READ

How it works, basically explained

The one trick behind Skyhook, with a four-leaf tree and small numbers instead of 256-bit hashes.

Read the explainer → WHAT YOU CAN BUILD

Options and conditional swaps

Open-recipient options anyone can execute before expiry, and conditional payments like a car loan, the swaps ZCG committee member GGuy described in The future of atomic swaps.

Try them → OUTCOME

Liquidity without lock-up

Any shielded ZEC holder can fill requests for ETH and earn the spread just by staying online. Their ZEC is never locked, and as senders they are never identified.

Providing liquidity → OUTCOME

Programmable, private swaps

ESMASTe lets a swap carry a hidden script, revealing only the branch that runs, similar to Taproot.

ESMASTe →

Status

What exists today, and what this grant builds.

Much of the system already runs on testnets. Each milestone page says exactly what is built and what the grant pays to finish.

Already running

Live todayETH → TAZ atomic swap betaFully automated and tested publicly on the forum. It reveals the recipient's address, never a viewing key, until Milestone 3 hides it.
Live todayLiquidity server and aggregatorServes quotes, builds intents and drives fills against a live deployment.
Built & testedClient-side cryptographyA WebAssembly crate for keys, note opening and commitments. Golden tests pass 8 for 8.
Built & testedESMASTe execution layerThe virtual machine contract, SingletonRunner and assembler, with measured gas profiles.
PublishedResearch paperIACR ePrint 2026/2210, under submission to Financial Cryptography 2027.

Funded by this grant

M1 · $20,000 The Reverse Direction Built: The client-side cryptography exists and is tested. Remaining: The reverse-direction interface and its end-to-end integration with a browser wallet remain.
M2 · $40,000 Programmability Built: The execution layer is implemented and tested. Remaining: The authoring layer and its interface remain.
M3 · $55,000 Full Privacy Built: The machinery the hiding circuit must fit within is in place and verified. Remaining: The circuit itself has not been built, and no circuit code exists yet.
M4 · $45,000 Mobile Built: The portable core exists in Rust. Remaining: Everything mobile-specific remains to be built: the Android prototype, the Kotlin bindings, the Swift bindings, and the demonstration inside the Zkool2 fork, which depends on all three.
M5 · $35,000 Liquidity That Runs Itself Built: The system to be standardized is already running. Remaining: The formal artifacts remain to be produced: the published standard, the packaged self-hosting binary, the reference libraries for wallets and protocols, and the third-party integration demonstrations.
M6 · $35,000 Documentation and Papers Built: The documentation deliverable is substantially this site: the mechanism sections, the roadmap, the glossary and the references are complete, and the build fails on any broken cross-reference. Remaining: Final polish continues across the site, bringing every page to a uniform standard of completeness and accuracy.

Roadmap

6 milestones over 39 weeks, each accepted by reviewers.

Acceptance means a committee member operates the deliverable themselves: a swap in a browser, a program in an interface, a key missing from the transaction data.