From Sidechains to zk-Rollups: Tacit Chain Wants to Redesign Payments with Default Privacy

Author: ross.wei (@z0r0zzz)

Translated by AididiaoJP, Foresight News

Whether crypto payments actually work has a very practical test standard: can you buy a cup of coffee with it? Coffee shops are everywhere; if merchants reject it because it is too slow or does not feel like "money," then that payment method has not passed the test.

Blockchains are already sufficient for remittances and savings; a slight delay is tolerable. Offline payments are different. You watch the merchant, and the merchant watches you. No one wants to hear you explain, "This money is secure, I am my own bank." Merchants just want to get paid and let you leave.

Therefore, payments must be fast, but speed alone is not enough. Privacy is equally critical. Leaking your daily routine from a single grocery purchase, being targeted and facing personal threats, or having your transaction records retrieved by supercomputers ten years later—all of these disqualify a payment system as usable.

Tacit Chain was built to address this issue: a payment-focused zk-rollup prototype designed not only to handle today's transaction privacy but also to reserve "post-quantum" protection for more advanced machines in the future.

Image: The classic meme "Hide the Pain Harold," often used to jokingly depict the awkward situation of waiting for a payment to go through.

A Cup of Coffee is the Hard Metric for Crypto Payments

First, let's look at scaling solutions. The most direct approach is a sidechain: mapping mainnet assets onto a faster ledger controlled by a consortium or operator. Users lock coins on the mainnet and receive an anchored voucher on the sidechain for faster spending, with the ideal scenario allowing withdrawals at any time. This is how Liquid handles Bitcoin, entrusted to multi-signature custody by a group of companies.

However, trust assumptions for sidechains vary widely, and the term "sidechain" itself is too broad. A common analogy is: keeping tabs on napkins at a bar and settling up afterward, which counts as a sidechain in a sense. The mainnet has no idea what happens on the sidechain and cannot protect you.

A sidechain balance resembles a gift card: a company gives you a spendable virtual balance that could theoretically be voided at any moment, relying solely on the operator's rational incentives and basic risk controls as a safety net.

State channels resemble bar tab credit. Users and merchants, or routers on a channel, first lock funds into a shared mainnet account, then use signed messages to pass IOUs. If either party attempts to settle with an old balance, the other produces a newer signed proof to overwrite it. The Lightning Network is a prime example. It is relatively trustless and suitable for payments, but requires users to monitor online to prevent cheating, which compromises convenience.

From Optimistic Rollups to zk-Rollups: Trade-offs Behind Withdrawal Speeds

Rollups are the solution people most often think of when discussing "fast blockchains." They run a separate ledger, compress transactions into batches, and submit the records to the main network. The Fruit Roll-up analogy fits perfectly: a snack packs fruit into a small pouch, but you need to be able to open it to check if it contains real fruit. In blockchain terms, batch submissions must be verifiable.

Image: Schematic of a strawberry Fruit Roll-up snack, illustrating how the author uses it as an analogy for Rollups compressing transactions into packages that can be opened and verified.

Optimistic rollups assume transactions are valid by default, resulting in low submission costs and high speeds, benefiting user experiences like those on Base and Robinhood, but with slow withdrawals. Sequencers determine order, and operators or partners send batches and results to Ethereum.

If a batch contains double-spends or balance mismatches, anyone can replay it, point out errors, and win the dispute on Ethereum. Malicious parties forfeit their deposits, while challengers receive rewards. The catch is that this mechanism requires a challenge period, meaning user withdrawals often take about a week.

zk-rollups take a different path: generating validity proofs before submission, which Ethereum verifies upon receiving the batch. If the proof fails, the batch never lands on the mainnet. It eliminates the "assume valid, then challenge" model, avoiding lengthy dispute waits.

Image: Schematic drawn by Messari showing the ZK Rollup transaction batching and SNARK/STARK proof submission process to the mainnet.

Tacit Chain: Treating Payments as a "Black Box" Backed by Proofs

Tacit Chain follows the zk-rollup path but narrows its scope to payments. Payment scenarios have lower computational demands, making it suitable for users to prove their own sent transactions, with the GPU community handling block batches.

User devices prove a payment is valid; during rollup verification, it does not need to know who sent what to whom or the exact amounts. A second proof then checks that the entire batch was processed correctly before Ethereum accepts it.

The sequencing role is called the "leader" in Tacit, essentially a rotating sequencer. When it is their turn, they sequence payments and submit them to the Ethereum verification contract TacitBlocks.sol. The contract records blocks, verifies validity, and enables withdrawals.

Holding a 1000 TAC seat grants rotation eligibility according to the schedule; if the current leader goes inactive, anyone can take over after 10 minutes. Leaders are charged in TAC, which also serves as the native currency of this rollup.

Provers earn TAC through reward programs by performing useful proofs rather than wasting compute on hash puzzles. Anyone with a GPU can join.

Fees are also paid in TAC. Upon entry, users hold "shares," allowing the protocol to reward holders and expand the anonymity set. A portion of each payment and a small fee per withdrawal remain in a shared pool instead of going to intermediaries. Thus, with every transaction, each share becomes slightly more valuable.

Increased on-chain usage drives share prices up and may lower fees: the more payments per block, the lower the Ethereum landing cost allocated to each individual transaction.

The protocol takes no cut; anyone can run a rotation node and earn fees from payments routed to it. Once TAC appreciates, leaders and provers need to sell less TAC to cover ETH gas and GPU costs.

Image: Tacit Prove GPU prover node dashboard and block proof reward breakdown interface.

Entry and Exit: Instant Withdrawals and Cross-Chain Bridges for ETH and BTC

To enter Tacit Chain, users can come from Ethereum. Holding airdropped TAC allows entry without even needing gas, completed via an EIP-2612 permit meta-transaction. If lacking TAC, users can buy it on a DEX or earn it by completing tasks and proving transactions. For Bitcoin entries, options include a "quick bridge" with atomic swaps against liquidity providers, or a standard bridge.

The goal is not to create another chain that fragments BTC and ETH liquidity and dapps. Tacit aims to build a zk-rollup with a native currency, trustlessly bridged to Ethereum, and connected to Bitcoin via a bridge. It will then use immutable privacy pools to shield assets from both chains, including BTC, BTC derivatives, ETH, ERC-20 tokens, etc.

Image: Tacit Chain cumulative share appreciation and fee distribution explanation interface.

Withdrawals do not require a week-long wait. Users can instantly withdraw back to TAC in ERC-20 form, then shield this portion into the Tacit bridge to convert back to Bitcoin, or use it for internal DeFi activities like providing liquidity or swapping.

Forced withdrawals operate on a separate queue: `force()` queuing on Ethereum; if a block skips an entry past the 1-hour `FORCE_DELAY`, it triggers a `QueueOverdue()` rollback. This ensures leaders can delay at most ~1 hour, plus the window period.

Quantum-Resistant Privacy: On-Chain Records Today Remain Unopenable Tomorrow

Maintaining today's privacy is one thing; maintaining tomorrow's privacy is another. Once transactions hit the chain, they become permanent records. Tacit Chain formats the memos attached to user payments in a quantum-computing resistant manner. Memos can be understood as encrypted messages to payees stating, "You received money, here is the amount."

These memos are encapsulated using ML-KEM. ML-KEM won the NIST post-quantum cryptography standard competition. Even if someone scrapes all on-chain payments today and waits until quantum computers mature to decrypt them, the memos should not be easily accessible.

The author considers Tacit Chain to meet Level 2 "Phase 2" standards. Regarding control, core contracts like TacitBlocks and TacitSeats lack owners, upgrade paths, or multisig setups; validators, block keys, delays, and tokens are all immutable.

Validators are hardcoded as SP1 Groth16 verification leaves, functioning as non-upgradable gateways. Phase 2 mandates a 30-day withdrawal window before unwanted upgrades; here, there are no upgrades to warn about.

At the proof level, it is a validity rollup with no need for decentralized fraud proof participants. Within 10 minutes of each landing, only the rotating leader can submit blocks; afterward, anyone can.

For exits, `force()` queues on Ethereum. Data-wise, data is emitted to Ethereum as calldata, enabling nodes to reconstruct the complete state based on it.

One dependency is that cross-pool jumps and migrations must pass through the Confidential V1 pool, requiring trust in the V1 pool's construction. The V1 pool is equally immutable, lacks upgrade paths, and cannot have balances drained. Withdrawing to Ethereum involves standard in-contract TAC transfers, independent of V1.

The Future: Coffee Purchases Are Already Possible, Next Steps Include Lower Costs and Optional Migration

Payments are just the beginning. Buying coffee with this setup is already feasible: merchants see the receipt instantly upon sending, with final confirmation on Ethereum around 1 minute later. As participant and prover pools grow stronger, confirmation times can drop near 30 seconds; blobs are already built-in, potentially lowering costs below 1 cent.

Merchants can withdraw TAC to Ethereum or Bitcoin. If they prefer not to hold TAC, they can swap it for desired currencies within the confidential pool of the internal DEX.

More distant roadmaps include running programs and internal smart contracts, as well as integrating other assets. To accommodate this, Tacit Chain features a `migrate` operation for version upgrades, but only occurs when users opt-in. Crucially, upgrades do not compromise anonymity: which memos moved and by how much remains unexposed.