Proof of innocence
Most privacy tools force a choice: give up privacy, or accept that your funds sit in the same undifferentiated pool as everyone else's — including flows you'd never want to be associated with. Murk is built so you don't have to choose.
Every private action in Murk carries a zero-knowledge proof that the money behind it descends from an approved source. Not a claim you make. Not a certificate you're handed. A mathematical proof, checked by the Solana program before the transaction is allowed to land — and one that reveals nothing about which source, which note, or which deposit.
This model is usually called proof of innocence. It comes from the Privacy Pools line of work (Buterin, Soleimani, Illum, Nadler and Schär), and it is live on other chains as Railgun's PPOI and 0xbow's Privacy Pools. Murk is a Solana-native implementation of it.
Why this is the point, not the paperwork
A privacy pool that admits anything eventually becomes a pool nobody reputable wants to stand in. Its users can't explain where their money came from, because the tool deliberately destroyed the ability to explain it.
Murk keeps that ability and hands it to you:
- You get privacy you can actually use. Amounts, balances, counterparties and holdings stay hidden — and you can still demonstrate that your funds are not from a sanctioned or flagged source.
- Ordinary people, businesses and institutions can hold a position here. Payroll, treasury, trading — the things that need privacy most are also the things that can't afford to be indistinguishable from illicit flow.
- Nothing is surveilled to make it work. No one traces the transaction graph. No one learns your balance, your counterparties or which origin you used. The exclusion happens inside your own proof, on your own device.
- You are never locked in. Whatever the approved list says, an unconditional exit always returns your funds to you.
Being able to prove your funds are clean is a feature you keep in your pocket, not a hoop you jump through. Nothing in the normal flow asks you for it — the wallet builds the proof for you, every time.
The four moving parts
| Part | What it does | Page |
|---|---|---|
| Deposit screening | Checks a deposit's source against sanctions data before it can enter the pool. | Deposit screening |
| Origins & association sets | Every deposit gets a hidden lineage label; every private spend proves that label is on the approved list, in zero knowledge. | Association sets |
| The ASP | Curates the approved list off-chain and posts its root on-chain. Can censor future private spends; can never touch funds. | How the ASP works |
| Revocation | Lets a source found illicit later be dropped from the list, cutting off everything descending from it. | Revocation |
| Emergency exit | The unconditional escape hatch out of the pool, at the cost of publishing that lineage. | Emergency exit |
What this does and does not claim
Being precise here matters more than sounding good, so:
- Murk screens deposits against the OFAC sanctioned-address data, proves approved-set membership on every private spend, supports retroactive revocation, and always leaves you an unconditional exit. Those are properties of the running system, verifiable on-chain.
- Murk is not a licensed money service, is not "regulator-approved", does not perform KYC, and does not by itself satisfy any obligation you personally have. Using Murk does not make a transaction lawful, and no exchange or counterparty is obliged to accept funds because they came through it.
- The approved list is curated by a party (see How the ASP works). That party can decline to vouch for a lineage. It can never take, freeze, redirect or read your funds.
You remain responsible for complying with the law where you live — see Limitations.
Where to go next
→ Association sets — the mechanism, in plain terms
→ How the ASP works — who curates the list, and what they can and cannot do
→ Emergency exit — your guaranteed way out, and its honest cost