ZSA Hub
Zcash Shielded Assets (ZSAs)
Zcash Shielded Assets (ZSAs) bring arbitrary user-defined assets (stablecoins, tokens, NFTs) into Zcash's shielded pool, so they inherit the strongest privacy in the crypto space. The protocol is called OrchardZSA. QEDIT designed and built it. This page is the canonical reference for what it is, why it matters, the multi-year R&D behind it, and every spec, audit, and resource available on the topic.
Status
Audited · feature testnet
Activation
Community decision
Funding
ZCG grants
Since
2021 · 5+ years
What are Zcash Shielded Assets?
OrchardZSA extends Zcash's Orchard shielded protocol so that any user-defined asset can be issued, transferred, and burned inside the same shielded pool as ZEC, with the same privacy guarantees. Where most chains expose the sender, receiver, amount, and asset type of every token transfer, a ZSA transfer reveals none of them.
OrchardZSA is a full protocol, not a feature. It defines new issuance keys and asset identifiers, a note and commitment structure for custom assets, Action Groups and a new transaction format, consensus rules for supply tracking and finalization, and an updated fee model. It is specified across interdependent ZIPs, independently audited, and implemented across multiple repositories of the Zcash stack, from the halo2 proving system to the Zebra node.
The implementation is complete and is kept up to date as the upstream code evolves. It is ready to be merged into the main Zcash repositories behind a feature flag. Whether ZSAs activate on Mainnet is now a decision for the Zcash community.
What private assets can you build with ZSAs?
One protocol, a wide surface of applications.
Private stablecoins
Move dollar- or euro-pegged stablecoins with full shielded privacy, rather than on transparent ledgers that leak every payment.
User-defined tokens
Anyone can issue a custom fungible asset on Zcash, with supply tracking and optional finalization enforced by consensus.
Shielded NFTs or RWAs
Non-fungible assets and real world assets, issued and transferred privately.
Wrapped & bridged assets
Represent assets from other chains as ZSAs, with burn-based off-boarding for secure bridging.
Private asset swaps
Atomic, decentralized swaps between shielded assets, with no trusted intermediary and no exposure of the trade.
Controlled issuance
Transaction controls let issuers attach rules to assets, supporting compliance use-cases while preserving privacy.
Shielded assets improve blockchain privacy
Zcash offers the strongest financial privacy in the world. Using zero-knowledge proofs, it cryptographically proves a transaction is valid without revealing the sender, receiver, or amount. Unlike other protocols, which rely on privacy add-ons or trusted third parties, Zcash was designed with a privacy-first mindset.
Today, those privacy guarantees only apply to ZEC (Zcash's native token) - not the stablecoins, tokenized assets, or NFTs people actually want to move privately.
ZSAs change that. They bring arbitrary assets into Zcash's shielded pool, giving stablecoins, tokens, and NFTs the same privacy as ZEC, and turning the world's most private network into a home for the entire asset economy.
The R&D behind it
Five years of protocol design, implementation, audit and integration by QEDIT, funded by Zcash Community Grants, with reviews and contributions from core Zcash developers.
2021
The proposal
ZSAs (then UDAs) were proposed on the Zcash Community forum as a way to bring user-defined assets to Zcash's shielded pool for DeFi.
Original proposal →2022
Specification
OrchardZSA was specified across ZIP 226 (transfer and burn) and ZIP 227 (issuance), extending the Orchard protocol with custom assets.
ZIP 227 →2023
Implementation
The OrchardZSA transfer protocol was implemented in the orchard crate.
Monthly grant updates →2023 - 2024
Asset Swaps and Action Groups
ZIP 228, led by QEDIT, introduced Action Groups: Actions and proofs grouped by a shared anchor, so parts of a transaction can be built against different chain states. This enables peer-to-peer swaps, matchers and transaction relays. Demonstrated end to end in QEDIT's zcash_tx_tool: a matcher-mediated swap between two parties, settled on a test node.
Swaps grant thread →2024-2025
Zebra integration
Core integration of ZSA into Zebra's codebase, including v6 transaction format adaptation and comprehensive testing protocols.
Zebra ZSA Integration grant →2025
Independent audit
Least Authority audited the OrchardZSA protocol, commissioned by Zcash Community Grants as Zcash Ecosystem Security Lead. The report was positive, and every recommendation was addressed and confirmed in the final report.
Audit report →2025
Integration for NU7
ZSAs were earmarked as viable for NU7. Action Groups and burns were front-loaded into the v6 transaction format, and the implementation went through successive review rounds, with issuance isolated behind a feature flag.
ZSAs in NU7 thread →2026
Feature-branch testnet
ZSAs moved to a long-term feature branch with a public testnet, so builders can issue and transfer shielded assets ahead of any activation decision.
Feature testnet grant →Jun - Oct 2026
Rebased onto NU6.2 and NU6.3 Ironwood
Two network upgrades changed the base protocol. OrchardZSA was rebased onto both, and the ZSA transaction format was re-specified on the new extensible base, with Action Groups carried over.
Today
Community decision
Complete, audited and current with the latest network upgrade. The code is being moved into dedicated branches in the main Zcash repositories. Activation on Mainnet is a decision for the Zcash community.
Arborist call, 15 October 2026 →
ZSA was funded by several Zcash Community Grants over 5+ years. Over that period, every network upgrade changed the ground beneath ZSAs: NU6, NU6.1, the NU6.2 circuit fix, the NU6.3 Ironwood pool, and two redesigns of the v6 transaction format. Each one meant updating and rebasing OrchardZSA across orchard, halo2, sinsemilla, sapling-crypto, librustzcash, Zebra, zcash-test-vectors, the ZIPs and zcash_tx_tool, then taking the result back through upstream review. Big thanks and love to @daira, @str4d, and everyone involved for their reviews and guidance throughout the years ♥.
Research threads
ZSAs are the core, but the effort extends into the cryptographic primitives that make a private asset economy usable.
Asset Swaps
Atomic, decentralized swaps of shielded assets directly on Zcash. Action Groups let two parties exchange custom assets in a single transaction without a trusted intermediary and without revealing the trade. ZIP 228 has been merged into the Zcash ZIPs repository.
Hash Time-Locked Contracts (HTLCs)
HTLCs on Zcash enable cross-chain atomic swaps and conditional payments, a building block for trust-minimized bridging and interoperability with shielded privacy.
Transaction Controls
Mechanisms that let assets carry transfer rules and acceptance conditions, supporting compliance and controlled issuance while keeping transactions shielded.
Specifications
The OrchardZSA protocol is defined across several ZIPs, linked below.
ZIP 226 - Transfer and Burn of Zcash Shielded Assets →
How custom assets are transferred and burned under OrchardZSA.
ZIP 227 - Issuance of Zcash Shielded Assets →
Issuance keys, asset identifiers, and the issuance bundle.
ZIP 228 - Asset Swaps for Zcash Shielded Assets →
Action Groups and the swap protocol built on them.
ZSA transaction format and digests (draft ZIP) →
The ZSA transaction encoding, digests and Action Groups, re-specified on the ZIP 248 extensible format.
Security & Audits
OrchardZSA has been independently audited.
Code & Tooling
Shipping ZSAs meant changing multiple separate repositories and taking each change through upstream review.
orchard →
OrchardZSA circuit, bundles, issuance and Action Groups.
halo2 →
Gadget changes the ZSA circuit depends on, merged upstream.
librustzcash →
Transaction building, formats, digests and wallet support.
zebra →
Parsing, validation and global asset state for the node.
zcash-test-vectors →
Reference test vectors
sapling-crypto →
Zcash Sapling cryptography.
sinsemilla →
A collision-resistant circuit-efficient hash function
zcash_note_encryption →
Note encryption interfaces & convenience methods for the Sapling and Orchard Zcash Protocols
zips →
ZIPs 226, 227, 228 and the ZSA transaction format draft.
zcash_tx_tool →
End-to-end issuance, transfer, burn and swap flows against a live node.
Talks & Videos
Presentations and walkthroughs on ZSAs from QEDIT and the Zcash community.
Grants & Community
The proposals, grants, and discussion that funded and shaped the work.
All ZSA threads on the Zcash forum →
Every forum thread mentioning ZSAs.
Zcash Shielded Assets: Asset Swaps and Beyond →
Grant proposal / discussion.
Let's bring stablecoins to ZSAs →
Grant proposal / discussion.
Zcash Shielded Asset Swaps and Transaction Acceptance →
Grant proposal / discussion.
Grant Application - Zebra ZSA Integration →
Zcash Community Grants tracking issue.
Grant Application - ZSAs in NU7, H2 2025 extension →
Zcash Community Grants tracking issue.
Grant Application - OrchardZSA finalization →
Zcash Community Grants tracking issue.
Feature Branch Testnet and Compatible Developer Tooling →
Grant proposal / discussion.
FAQ
When will ZSAs ship?
The implementation is complete. What remains is maintenance: rebasing it onto upstream as the Zcash codebase moves, as was done for the NU6.3 (Ironwood) upgrade. OrchardZSA is specified, independently audited and implemented across the Zcash stack. It is ready to be merged into the main Zcash repositories behind a feature flag, so it can sit in the codebase without changing behaviour until it is switched on. Activating ZSAs on Mainnet requires a network upgrade, and which features a network upgrade includes is decided by the Zcash community. ZSAs are not part of NU7.
NU7 scope →Why has it taken several years?
ZSAs change how value is issued and moved, so they touch consensus-critical code in multiple repositories, from the halo2 proving system to the Zebra node. Each change has to pass upstream review by the teams that maintain those repositories. Over the same period the base protocol kept moving: the zcashd deprecation, NU6.1, the NU6.2 circuit fix, the NU6.3 Ironwood pool and two redesigns of the transaction format. Every one of these required updating and rebasing the ZSA implementation, then taking it back through review.
NU6.3 Ironwood →What applications will ZSAs enable?
ZSAs make Zcash a home for private versions of the assets people actually use. That includes stablecoins that move with full shielded privacy (and, via transaction controls, with compliance where it's required), private and atomic asset swaps directly on Zcash, tokenized real-world assets and NFTs that stay confidential, and wrapped or bridged assets brought over from other chains. In short, any asset that benefits from strong privacy becomes possible on the world's most private financial network.
Is OrchardZSA audited?
Yes. Least Authority completed an independent security audit of the OrchardZSA protocol, with the final report completed in January 2025. The report is linked in the Security & Audits section above.
How can I start building with ZSAs?
Start with the specifications (ZIPs 226, 227 and 228) and QEDIT's zcash_tx_tool for constructing and testing ZSA transactions on the feature testnet, all linked above. If you're planning an integration or have a specific use-case in mind, get in touch - we designed the protocol and are happy to help.
Work with QEDIT
ZSAs are one product of the same core disciplines we bring to every engagement: designing cryptographic protocols, auditing the systems that implement them, and proving them correct.
Security Audits for Zero-Knowledge & Cryptographic Systems
We find the bugs that matter in ZK circuits, proof systems, and cryptographic protocols, before they reach production.
ServicesFormal Verification for Cryptographic & Zero-Knowledge Systems
We prove cryptographic systems correct with machine-checked proofs in Lean. No critical edge case left to chance.
ServicesCryptography Engineering & Protocol Design
We design cryptographic protocols from specification to implementation.
Building with ZSAs?
We designed the protocol. Talk to us about issuance, transfers, swaps, or integrating ZSAs into your application.
Get in touch