Tacit Chain: How to Use Privacy zk-rollup for Fast Payments, Default Privacy, and Quantum Resistance, and Compare Scalability Trade-offs.

Written by: @z0r0zzz

Compiled by: AididiaoJP, Foresight News

The practical standard for determining whether cryptocurrency payments work is simple: Can you buy a cup of coffee? Coffee is everywhere; if merchants find it too slow or not enough like "money" and refuse to accept it, this payment method fails the test.

Blockchain is sufficient for remittances and savings, a little slowness can be tolerated. Offline payments are different. You stare at the merchant, and the merchant stares back at you. No one wants to hear you explain, "This money is very safe; I am the bank." The merchant just wants to receive the money and let you go.

So payments must be fast, but that's not enough. Privacy is equally critical. Buying groceries once could leak your life trajectory, potentially leading to being targeted or facing personal threats; or spending records from ten years later being revealed by a supercomputer is not considered usable payment. Tacit Chain addresses this issue: a payment-based zk-rollup prototype, designed to offer transaction privacy today, while reserving "post-quantum" protection for more advanced machines in the future.

A Cup of Coffee as a Hard Standard for Cryptocurrency Payments

First, let’s look at speed-up solutions. The most direct approach is sidechains: mapping mainchain assets to a faster ledger controlled by a consortium or operator. Users lock coins on the mainchain, receive a stable certificate on the sidechain, spend faster, and ideally can exit whenever they want. Liquid does this for Bitcoin, managed by a group of companies using multisig.

However, the trust assumptions of sidechains vary significantly, and the term "sidechain" is too broad. A common analogy is: keeping tabs at a bar with napkins and settling up later could somehow count as a sidechain. The mainchain doesn't know what happens on the sidechain, nor can it protect you. Sidechain balances are more like gift cards: a company gives you a virtual balance to spend that can theoretically be canceled at any time, relying solely on the rational incentives and basic risk control of the operator.

State channels resemble bar tabs. Users and merchants, or routers on a channel, lock money into a shared account on the mainchain and afterward use signed messages as IOUs. Whoever settles with old balances, the other party presents an updated signed receipt to override it. The Lightning Network serves as a representative. It is relatively trustless, suitable for payments, but requires users to be online to monitor and prevent cheating, which compromises convenience.

From Optimistic Rollup to zk-rollup: The Trade-offs Behind Exit Speed

Rollup is the most common solution people think of when discussing "fast blockchains." It runs another ledger, compresses transactions into batches, and submits records to the main network. The analogy to fruit roll-up is apt: a bag of snacks presses fruit into small pockets, but you must be able to open it and check whether there's real fruit inside. Correspondingly, for blockchains, it must be verifiable post-batch submission.

Optimistic rollup assumes transactions are valid by default, so submission costs are low, and speeds are high, benefiting experiences like Base and Robinhood. However, exits are slow. The sequencer determines the order, and the operators or partners send the batches and results to Ethereum. If there are issues like double spends or mismatched balances in a batch, anyone can replay and point out the errors, winning disputes on Ethereum. Wrongdoers lose their deposits, and challengers receive rewards. The downside of this mechanism is that it needs time for challenges, so users often wait about a week to exit.

zk-rollup takes a different approach: it generates validity proofs before submission, so when Ethereum receives the batch, it checks the proof. If the proof fails, the batch cannot be settled on the main network at all. It doesn't require "optimism first, challenges later," eliminating the long dispute waiting period.

Tacit Chain: Making Payments a "Black Box" with Proofs as a Safety Net

Tacit Chain follows the zk-rollup route but narrows down to payments. Payment scenarios require less computational load, making it suitable for users to prove their own payments, processed by the GPU community managing block batches. When the user's device proves a payment is valid, the rollup doesn't need to know who sent what or how much. Subsequently, a second proof verifies that the entire batch of payments is processed correctly before Ethereum accepts it.

The role of the sequencer in Tacit is called "leader," understood as a rotating sequencer. When it's someone's turn, they are responsible for ordering payments and submitting them to Ethereum's verification contract TacitBlocks.sol. The contract records blocks, checks validity, and is used for withdrawals. Holding 1000 TAC gives eligibility to rotate; if the sequencer isn't working, anyone can take over after 10 minutes. The sequencer charges in TAC, which is the currency of this rollup. Provers earn TAC through a reward program for useful proofs, not wasting computing power on hash puzzles. Anyone with a GPU can join.

Fees are also in TAC. When users enter, they hold "shares," allowing the protocol to reward retainers and expand the anonymity set. A portion of each payment and a small exit fee are retained in a shared pool instead of given to intermediaries. Therefore, every time you make a payment, each share becomes slightly more valuable. The more it's used on-chain, the more shares grow, and fees may drop: the more payments in a block, the lower the Ethereum landing costs per payment. The protocol takes no cut, and anyone can run a sequencer node to earn payment fees sent to them. Once TAC appreciates, sequencers and provers sell less TAC to cover ETH gas and GPU costs.

Both Ends: Instant Exits and Bridges Across ETH and BTC

Entering Tacit Chain can be done from Ethereum. Holding airdropped TAC, you may not even need gas, completing transactions via the EIP-2612 permit meta-transaction. If you don't have TAC, you can buy it on DEX, or earn it through tasks or trading proofs. To enter from Bitcoin, you can use a "fast bridge" for atomic swaps with liquidity providers or take the conventional bridge.

The goal is not to create a chain that fractures BTC, ETH liquidity, and dapps. Tacit aims to create a zk-rollup with native currency that connects to Ethereum trustlessly and links to Bitcoin; then use immutable privacy pools to obscure BTC, Bitcoin derivative tokens, ETH, ERC20, and other assets across the two chains.

Exiting also doesn't require a week. Users can instantly return TAC in ERC20 form, then shield that TAC in the Tacit bridge to send back to Bitcoin, or use it for internal DeFi, such as LP and trading. Forced exits follow another queue: force() queues on Ethereum; if any block skips an entry exceeding 1 hour FORCE_DELAY, it triggers QueueOverdue() rollback. Thus, sequencers can delay at most about 1 hour, plus the window period.

Quantum-resistant Privacy: Today’s On-chain Records Should Not Be Opened Tomorrow

Maintaining today's privacy is one thing, while keeping tomorrow's privacy is another. Once transactions are on-chain, they become permanent records. Tacit Chain formats customer payment accompanied by notes (memo) in a quantum-resistant manner. The memo can be understood as an encrypted message for the payee: "You've received money, and the amount is..." These memos are encapsulated with ML-KEM. ML-KEM won the NIST post-quantum cryptography standard competition. Even if someone captures all on-chain payments today, the memos shouldn't be easily accessed by quantum computers when they are matured.

The author believes that Tacit Chain meets the L2 "second phase" standards. In terms of control, core contracts like TacitBlocks and TacitSeats have no owner, upgrade paths, or multisig; validators, block keys, delays, and tokens are immutable. Validators are fixed as SP1 Groth16 verification leaves, not upgradeable gateways. The second phase requires a 30-day withdraw window prior to unwanted upgrades for users; no upgrades are available to provide warnings here.

On the proof level, it is a validity rollup with no set of decentralized fraud proof participants required. Within 10 minutes after landing, only sequencers can submit blocks; afterward, anyone can submit. On the exit level, force() queues on Ethereum. From a data standpoint, data is sent as calldata to Ethereum, and nodes can reconstruct the complete state from it. One reliance is that cross-pool jumps and migrations go through the confidential V1 pool, so trust must be placed in the construction of the V1 pool. The V1 pool is also immutable, without upgrade paths, and cannot withdraw balances. Exiting to Ethereum is a normal TAC transfer within the contract, not dependent on V1.

The Future: Coffee is Already Buyable, Next Steps are Lower Costs and Optional Migrate

Payments are just the starting point. Buying coffee this way is already possible: merchants see the payment at the moment you send it, approximately confirmed on Ethereum about 1 minute later. As participants and proof pools strengthen, confirmation times can approach 30 seconds; blobs are already built-in, and costs could drop below 1 cent. Merchants can withdraw TAC to Ethereum or Bitcoin. If they don’t want to hold TAC, they can exchange it for desired currency within the internal DEX's confidential pool.

Further directions include running programs and internal smart contracts, as well as integrating other assets. For this, Tacit Chain has designed a migrate operation that can upgrade to new versions, but it only occurs when users choose to join. More critically, upgrades do not compromise anonymity: which memo moved or how much moved will not be exposed.