Reviewer FAQ
Is Skyhook a bridge?
Not exactly. Skyhook is the mechanism: a way for a contract on another chain to verify that a shielded Zcash payment happened and is final. The Skyhook Bridge is one application of it, a protocol for trustless swaps, and the one this grant completes. Other applications, such as minting on payment or contracts that accept ZEC directly, use the same mechanism. See Skyhook and the Skyhook Bridge.
Is this an HTLC swap?
No. Hash time-locked contracts need a time-locked script on both chains, which is why earlier ZEC swaps, such as XCAT in 2017, only worked with transparent addresses. Skyhook puts no script on the Zcash side at all: the payment is an ordinary shielded transaction, and the contract on Ethereum verifies it by rebuilding its ZIP 244 transaction ID. Only the Ethereum side locks anything.
Is it an adaptor-signature swap?
No. Adaptor-signature ("scriptless script") swaps work by revealing a secret when a transaction is broadcast, so the swap can be completed from what appears in the mempool. Near a timeout, that exposes them to front-running and to miners being bribed to delay or reorder transactions. Skyhook reveals no such secret, and a mempool-only transaction is useless to it: a claim is accepted only against a payment that is mined and final, proven from the block itself.
What exists today?
A fully automated Sepolia ETH → testnet ZEC swap bridge, run publicly on the forum, and the research paper on IACR ePrint. An ESMASTe prototype is under active development, and the committee can ask for a demo. The grant pays for everything else on the roadmap.
What stops someone from mining their own fake block?
Finality. Before a contract accepts a transaction, Skyhook requires full FlyClient sampling of the chain's history (about 30 sampled blocks for a 100-block stretch, 150 for 1,000 and only 250 for 100,000), plus the transaction's main block and the three blocks after it. That holds even if nobody checks anything off-chain. Parties who check the chain themselves can instead agree on a trusted root at quote time. See Chain Finality.
Who supplies finality proofs, and what does that cost?
Anyone. A "validator" builds a rollup of Zcash blocks, with no stake or permission, and earns a share of the fees of every transaction that uses it; an invalid rollup is never joined, so its builder only loses gas. Blocks themselves are submitted by trustless oracles, which earn a share of a rollup's fee for the blocks it reuses, never more than half of it. With those blocks stored, a whole rollup costs about 2.7–2.9M gas for a typical gap, roughly four cents on Base, plus a little more for each transaction it finalizes. With no oracles or validators at all, a swap can still finalize itself, submitting every block over several transactions for a few dollars at most.
What if oracles stop, or overcharge?
Then swaps route around them. Any rollup can instead be root-anchored: its participants agree on a block root at quote time and prove each sample under it, so the rollup always finalizes in a single transaction, about 5 to 13M gas, without any oracle, and pays oracles nothing for those samples. That caps what oracles can charge. Fully sampled rollups stay the default, and a root-anchored rollup never becomes the starting point for one.
Is anything trusted?
One parameter, and only in quotation marks: each bridge has a minimum difficulty floor, because Zcash's difficulty adjustment can't be replicated effectively on Ethereum. Participants check real difficulty off-chain and refuse bad rollups whatever the floor says, and a stale floor can at worst invite spam. Each deployment sets and updates its own floor, for example through a DAO or multisig. See the difficulty floor.
Who runs the bridge?
Whoever deploys it. The grant funds open, reusable contracts, a public good in the way Uniswap v2 is, rather than a single bridge operated by the team. Each deployer, such as the Zcash Foundation, sets its own parameters, and anyone can redeploy their own copy while still reusing an existing deployment's block store and oracles, so no deployment is a chokepoint.
Who holds the funds, and who could stop a swap?
No one holds them: escrow releases only on a proof of payment, or refunds after the request's refund time, and the protocol has no administrative key. Deployers control a few parameters, and frontends, wallets and liquidity servers can apply their own policies. See Policy and compliance.
What does a swap reveal?
Only the recipient's public key, that is, their address, and the amount. Never a viewing key: an address can receive payments but cannot decrypt any transaction, reveal a balance or spend anything, unlike a leaked UFVK, which would expose a wallet's whole history. The sender, and the note they spend, stay private even without zero-knowledge proofs. The test web wallet uses a fresh diversified address for every swap, so swaps can't be linked to each other. Until Milestone 3, parties who need to hide the amount too can verify a NIZK off-chain and agree on the note commitment between themselves. Milestone 3 adds a NIZK so that the recipient key doesn't appear in the transaction data either.
Which chains does it support?
Ethereum first, with Base as the bridge's home network because of its relaxed limits. The mechanism works with any Turing-complete chain, and a Solana version could follow in a later grant extension.
What happens at the next network upgrade?
NU7 is expected to shorten block times and move to a ZSA-compatible format, which needs more testing and research. The team already carried the bridge through the Ironwood (v6) transition. See Ironwood.
What if zero-knowledge proofs are too expensive on mainnet?
That's why Base is the home network. And NIZKs stay optional: users can choose to swap without them.
Does Skyhook change Zcash itself?
No. It doesn't modify any upstream repository. Code that others may reuse ships as independent crates and packages.
How will the committee know a milestone is done?
By operating it themselves. Each milestone has acceptance criteria a non-team member can check directly: a swap in a browser wallet, a program built in the interface, a transaction with no recipient key in it. See the roadmap.
What license is the code under?
Apache 2.0, so other projects can reuse it, but not the bridge's name or trademarks. The paper is CC BY-NC; its authors are on the team and waive copyright for this work.