Nullifier

The nullifier resolves a tension specific to private systems: guaranteeing that each note is spent only once without giving up anonymity. In the canonical commitment-plus-nullifier scheme, the user generates two random secrets when depositing, computes a commitment as the hash of both, and inserts it into an on-chain Merkle tree. The commitment is recorded, but nothing yet ties it to an identity.

When withdrawing or spending, the user publishes a zero-knowledge proof that they know a commitment belonging to the Merkle tree and that the nullifier derives from that commitment, without revealing which leaf it is. The contract then publishes the nullifier hash and stores it in a list of already-used markers. If the nullifier was already recorded, the operation is rejected as a double-spend; if not, it executes and is logged. Although the nullifier is public, there is no way to link it back to the original deposit commitment.