The rules

Lethe, LETHE

• 1,000,000,000 LETHE, minted once, to the Ferry, for the pool. Nothing is minted after.
• A plain token: no tax, no gate, no owner, no pause.

The pool's hook

• Every crossing of the ETH and LETHE pool pays one obol: 1% of the ETH the trade moves, buy or sell, rounded up. The pool's own LP fee is 0%.
• The obols wait as ETH inside Uniswap's PoolManager. Anyone may call pay(); the ETH goes only to the owner.
• A trade that names its ETH fills completely or reverts, so no obol is charged on ETH that did not move.
• The pool opens once: only the Ferry may open it, only at tick 200280 (2.0062 ETH for the billion), and only the Ferry's one band may ever be added.

Where notes are kept

• Notes of three measures: 1M, 10M and 100M LETHE. Each is a leaf of a Poseidon tree of depth 20, room for 1,048,576 notes.
• Forget from your wallet, or straight from ETH in one transaction (an exact buy through the pool, the obol included, the change returned). The spring computes each leaf itself from your note's hash and the measure you pay for.
• Remember with a proof made in your browser. The LETHE goes to the address the proof names, or is sold for ETH in the same transaction. A relayer, if you use one, takes only the fee your proof names, and only that relayer can send it.
• Each note is spent once, by either way out. The spring takes no fee.

The way out that needs only the hash

• Step one, mark: record a hash of the note's secrets and its recipient, and the recipient, against the note's nullifier hash. Nothing secret is shown.
• Step two, at least an hour (300 blocks) later, recall: show the secrets. The spring pays the recipient of the earliest mark they open. Marks are kept in order, so a mark someone makes from secrets they saw in your recall comes after yours and is never paid first, however long your recall takes to land.
• Once any mark on a note is an hour old, proofs for that note are refused, so nobody can race your recall with a proof made from the secrets you just showed. Until then a pending withdrawal still lands, whoever marked the note.
• It names the note: the exit is public. It is the only way out after the machine.

The tripwire

• A point on BLS12-381 made from a hash, so nobody knows its logarithm. Whoever shows it takes the jar, and from that block the spring refuses every proof and every new note.
• Anyone may add ETH to the jar. Nothing else takes it out. The machine.

The launch and the two engines

• The Ferry opens the pool in one transaction at a 2 ETH valuation, puts the whole billion in as one band, and mints the band's NFT to the owner.
• The Tablet verifies proofs with Ethereum's BLS12-381 precompiles (EIP-2537); its key was made from Ethereum's KZG ceremony. Check it.
• The Hasher is the Poseidon permutation the tree is built with.

One obol, and nothing else

• The owner: 1% of the ETH side of every trade, the spring's own buys and sells included, paid in ETH.
• The band's NFT is the owner's. With a 0% LP fee it earns nothing.
• The spring: nothing. A relayer: only the fee you write into your proof.

One check, and what happens when it fails

Forgetting checks the sender, and every way out checks the recipient, against the Chainalysis sanctions oracle on Ethereum. If the oracle ever stops answering, the check passes: a dead dependency must never freeze the notes.

Stated plainly

• Your privacy is the crowd: the notes of your measure still in the spring when yours leaves. Timing, amounts and the addresses you use outside the proof can still link you.
• Whoever learns a note's nullifier hash before it leaves (a relayer you hand a proof to, a watcher of your pending withdrawal) can mark it. It cannot take the note, but once that mark is an hour old the note can only leave by the public exit. This site never sends a nullifier hash anywhere: it reads every spent and marked one and checks yours here.
• The tripwire helps only if the first person with the machine trips it before forging proofs.
• Proofs trust Ethereum's KZG ceremony: one honest participant among about 141,000 is enough.
• The pool's only depth is the owner's band, and nothing in the contracts stops the owner removing it. Liquidity removed can never be put back, by anyone.
• The tree holds 1,048,576 notes and a spent note keeps its leaf, so anyone willing to pay the gas could fill it; then nobody could forget again. Notes already in it would still leave.
• A note is a bearer secret. Whoever holds it can take what it holds, and nobody can bring back one that is lost.

On Ethereum