Relayer & indexer
Two helper services make Murk fast and gasless — but neither can take or forge your funds, and you can operate without them.
The relayer
When you spend, someone has to submit the transaction and pay gas. If you did it from your own wallet, that would link your public address to the private action. The relayer submits on your behalf and pays gas, so your wallet never touches the pool.
- It's reimbursed by a fee baked into your proof, which pays a fixed on-chain recipient — the relayer can't redirect or inflate it.
- It cannot forge a spend — the proof, destination, and amount are all fixed inside the verified proof.
- It cannot read your note contents.
- You can self-submit instead (Settings → Use relayer off) for SOL transfers and withdrawals, paying only your own gas.
What it sees: that a spend of some coarse kind happened, plus your IP and request timing. Logs are scrubbed of signatures, nullifiers, mints, and destinations.
The indexer
The chain has everything, but scanning it from scratch is slow. The indexer ingests the three on-chain event types — new leaves, spent nullifiers, and encrypted note blobs — and serves them to wallets.
- It's a cache of public on-chain data — everything it serves is a re-projection of chain events.
- Your wallet computes Merkle paths and nullifier checks locally, so it never tells the indexer which notes are yours.
- If the indexer is down, the wallet can read the tree root directly from the chain, and — with an archival RPC — rebuild your notes from chain events alone.
The bottom line
The relayer is a gas + privacy convenience; the indexer is a cache. The trust anchor is the on-chain program. See Self-custody & recovery for how you stay in control even if both disappear.