In fact, by reimagining how ownership is proven and offloading verification work directly to users’ devices, the protocol achieves an on-chain footprint far lighter than even today’s legacy blockchains.
At the core of the quantum scalability problem lies a traditional design choice: storing heavy digital signatures on a public ledger for every full node to check. Compact Shielded CSV abandons on-chain signatures entirely, replacing them with a novel cryptographic construct termed the degriefer.
In practice, a single-input transaction recorded on the blockchain consists of three concise 32-byte hashes totaling just 96 bytes: a nullifier to prevent double-spending, a transaction commitment, and the degriefer itself.
“The degriefer is just a hash over the coin’s nullifier, the owner’s secret key, and the transaction spending the coin,” Ilie explained. “By adding this little hash onchain, the sender can now construct an offchain zero-knowledge proof against it.”
Neutralizing Front-Runners and Griefing Attacks
Because constructing the accompanying ZK proof requires the owner’s secret key as a private input, malicious relayers and front-runners are mathematically dead-ended. “An attacker can frontrun a transaction, but he cannot construct a valid ZK proof, so for sure he cannot benefit from this,” noted Ilie.
Furthermore, if an attacker broadcasts a conflicting transaction to stall the spend, the legitimate owner can effortlessly unmask the attempt. “The user can ZK-prove the frontrunning transaction is an invalid griefing attempt by showing that his actual secret key hashed with the nullifier and attacker’s transaction does not produce the degriefer posted by the attacker,” Ilie emphasized.
Therefore, rather than forcing every node across the globe to download, execute, and archive every piece of transaction history forever, Compact Shielded CSV shifts the responsibility of storing and verifying proof data to the specific users involved in a transaction.
From an end-user perspective, operating a wallet on Compact Shielded CSV feels similar to using a lightweight Bitcoin SPV client. “It just needs connection to at least one honest node,” said Ilie. To confirm an incoming payment, the wallet checks the proof’s public parameters against on-chain data and validates the ZK proof locally. “For example, for a STARK ZK proof, even on a phone, [verification] takes under 100 milliseconds,” he added.
Generating an outgoing payment proof requires slightly more computation, but Ilie expects this to speed up as proving circuits mature. Crucially, because the architecture relies on constant-size recursive proofs, historical transaction depth never penalizes the edge user. Addressing concerns about storing post-quantum proofs off-chain, Ilie observed:
“The proofs are indeed larger than signatures and slower to generate and verify, but that’s only a burden when the whole network has to store and validate them. Because this is a client-side validation protocol, each user only stores, verifies, and proves only the coins they personally care about, which is very manageable.”
To put the storage footprint into perspective, Ilie said that “a photo on your phone is 20–40× larger than one proof,” adding that sending payments requires “less bandwidth and storage than sending a picture.”
Zero State Bloat
As transaction histories grow, traditional edge devices often suffer from state bloat. Under Compact Shielded CSV, however, light clients store zero transaction history beyond the constant-size proofs for their own unspent coins. “For anything else, such as checking whether a nullifier has a conflicting spend, it simply queries full or archival nodes,” Ilie pointed out, adding that “history growth does not affect the size of proofs or verification time at all.”
Contrary to the prevailing belief that quantum resistance leads to high network congestion and expensive fees, Ilie argued that Compact Shielded CSV is significantly more efficient than today’s non-quantum networks:
“Rather surprisingly, our scheme is far lighter and faster than even traditional chains rather than heavier. We would have much lower transaction fees and far less network congestion, not only while being fully post-quantum, but also compared to the status quo.”
