From Sidechains to zk-Rollups: Tacit Chain Aims to Redefine Payments with Default Privacy

How Tacit Chain uses privacy zk-rollups to balance fast payments, default privacy, and quantum resistance, while comparing trade-offs in scalability.

Written by: @z0r0zzz

Compiled by: AididiaoJP, Foresight News

The viability of cryptocurrency payments can be measured by a very practical standard: Can you buy a cup of coffee? Coffee is ubiquitous; if merchants find it too slow or not sufficiently like "money" and refuse to accept it, then this payment method has failed.

Blockchain is sufficient for remittances and savings, where a little slowness can be tolerated. Offline payments are different. You are watching the merchant, and the merchant is watching you. No one wants to hear you explain, "This money is very secure; I am the bank." Merchants just want to receive the money and let you go.

Thus, payments must be fast, but speed alone is not enough. Privacy is equally crucial. If buying groceries exposes your life trajectory, you could be targeted or face personal threats; or if your consumption records are retrieved by a supercomputer ten years later, that is not a usable payment method. Tacit Chain addresses this issue: a payment-oriented zk-rollup prototype that aims to ensure transaction privacy today while reserving "post-quantum" protection for more advanced machines in the future.

A Cup of Coffee: The Hard Metric for Cryptocurrency Payments

First, let's look at the acceleration solutions. The most direct approach is sidechains: mapping main chain assets to a faster ledger controlled by a consortium or operator. Users lock coins on the main chain and receive a pegged certificate on the sidechain, allowing for quicker spending and ideally enabling withdrawal at any time. Liquid does this for Bitcoin, managed by a group of companies using multi-signature custody.

However, the trust assumptions of sidechains vary greatly, and the term "sidechain" itself is too broad. A common analogy is: keeping tabs with napkins at a bar and settling up later can, in some sense, also be considered a sidechain. The main chain does not know what happens on the sidechain and cannot protect you. Sidechain balances are more like gift cards: companies give you a virtual balance that can theoretically be voided at any time, relying solely on the rational incentives and basic risk controls of the operators.

State channels are like running a tab at a bar. Users and merchants, or routers on a channel, first lock money in a shared account on the main chain, then use signed messages to pass IOUs. Whoever settles with the old balance, the other party presents an updated signed certificate to overwrite it. The Lightning Network is a representative example. It is relatively trustless and suitable for payments, but users must monitor online to prevent cheating, which compromises convenience.

From Optimistic Rollups to zk-Rollups: Trade-offs Behind Exit Speed

Rollups are the most common solution people think of when discussing "fast blockchains." They run a separate ledger, compress transactions into batches, and then submit the records to the mainnet. The analogy of fruit rolls is quite fitting: a pack of snacks compresses fruit into small pockets, but you must be able to open it and check if it contains real fruit. Correspondingly, after batch submission, it must be verifiable.

Optimistic rollups assume transactions are valid by default, so submission costs are low and speeds are high, benefiting experiences like Base and Robinhood. However, exits are slow. The sequencer determines the order, and the operator or partner sends batches and results to Ethereum. If there are issues like double spending or balance discrepancies in the batch, anyone can replay and point out errors, winning disputes on Ethereum. Malicious parties lose their deposits, and challengers receive rewards. The problem is that this mechanism requires a challenge period, so users often have to wait about a week to exit.

zk-rollups take a different approach: they generate validity proofs before submission, allowing Ethereum to check the proof when receiving the batch. If the proof fails, the batch cannot be recorded on the mainnet. It does not require "optimistic first, challenge later," thus avoiding lengthy dispute waits.

Tacit Chain: Making Payments a "Black Box" with Proofs as a Safety Net

Tacit Chain follows the zk-rollup route but narrows the scope to payments. Payment scenarios have lower computational requirements, making it suitable for users to prove their own payments, with the GPU community handling block batches. User devices prove a payment's validity without needing to know who sent it to whom or the amount. A second proof then checks that the entire batch of payments is processed correctly before Ethereum accepts it.

The role of the sequencer in Tacit is called "leader," which can be understood as a rotating sequencer. When it's someone's turn, they are responsible for ordering payments and submitting them to the Ethereum verification contract TacitBlocks.sol. The contract records blocks, checks validity, and is used for withdrawals. Holding 1000 TAC gives a seat, allowing for rotation eligibility; if the leader does not perform, anyone can take over after 10 minutes. Leaders charge in TAC, which is also the currency of this rollup. Provers earn TAC through a reward program, providing useful proofs rather than wasting computational power on hash puzzles. Anyone with a GPU can join.

Fees are also in TAC. Users hold "shares" upon entry, and this ledger allows the protocol to reward retainers, expanding the anonymity set. A portion of each payment and a small fee for each exit will remain in a shared pool, rather than going to intermediaries. Thus, with each transaction, each share becomes a little more valuable. The more on-chain usage, the more shares increase, and fees may decrease: the more payments in a block, the lower the Ethereum landing cost per payment. The protocol does not take a cut, and anyone can run a sequencer node to earn payment fees sent to them. After TAC appreciates, sequencers and provers can sell less TAC to cover ETH gas and GPU costs.

Entry and Exit: Instant Withdrawals and Bridges Across ETH and BTC

To enter Tacit Chain, you can start from Ethereum. Holding airdropped TAC, you may not even need gas, completing transactions through EIP-2612 permit meta-transactions. If you do not have TAC, you can buy it on a DEX, or earn it by completing tasks or proving transactions. To enter from Bitcoin, you can use a "fast bridge" for atomic swaps with liquidity providers or a conventional bridge.

The goal is not to create a chain that separates BTC, ETH liquidity, and dapps. Tacit aims to create a zk-rollup with a native currency that bridges trustlessly with Ethereum and connects with Bitcoin; then use immutable privacy pools to shield BTC, BTC derivative tokens, ETH, ERC20, and other assets across both chains.

Exits do not take a week either. Users can instantly revert to TAC in ERC20 form, then shield this portion of TAC in the Tacit bridge, converting back to Bitcoin or using it for internal DeFi, such as providing liquidity and exchanging. Forced exits follow a different queue: force() queues on Ethereum; if a block skips entries exceeding 1 hour of FORCE_DELAY, it triggers QueueOverdue() to roll back. Thus, sequencers can delay at most about 1 hour, plus a grace period.

Quantum-Resistant Privacy: Today's On-Chain Records Should Not Be Opened Tomorrow

Maintaining today's privacy is one thing; maintaining tomorrow's privacy is another. Once transactions are on-chain, they become permanent records. Tacit Chain makes the notes (memo) attached to user payments quantum-resistant. These notes can be understood as encrypted messages to the recipient: "You received money, and how much it is." These notes are encapsulated using ML-KEM, which won the NIST post-quantum cryptography standard competition. Even if someone captures all on-chain payments today, they should not be easily opened when quantum computers mature.

The author believes Tacit Chain meets the L2 "second phase" standards. In terms of control, core contracts like TacitBlocks and TacitSeats have no owners, upgrade paths, or multi-signatures; validators, block keys, delays, and tokens are immutable. Validators are fixed as SP1 Groth16 verification leaves, not upgradable gateways. The second phase requires a 30-day exit window before any unwanted upgrades; there are no upgrades to warn about here.

In terms of proof, it is a validity rollup, without a set of decentralized fraud-proof participants. Within 10 minutes of landing, only the sequencer can submit blocks; afterward, anyone can submit. For exits, force() queues on Ethereum. Data is sent to Ethereum as calldata, allowing nodes to reconstruct the complete state. One dependency is that cross-pool jumps and migrations must go through the confidential V1 pool, thus requiring trust in the construction of the V1 pool. The V1 pool is also immutable, with no upgrade paths, and cannot withdraw balances. Exiting to Ethereum is a regular TAC transfer within the contract, not relying on V1.

The Future: Coffee Can Be Bought, Next Steps Are Lower Costs and Optional Migration

Payments are just the starting point. This method can already be used to buy coffee: merchants see the payment at the moment you send it, and it is confirmed on Ethereum about 1 minute later. As participants and the proof pool strengthen, confirmation times can approach 30 seconds; blobs are already built-in, and costs can drop below 1 cent. Merchants can withdraw TAC to Ethereum or Bitcoin. If they do not want to hold TAC, they can exchange it for the desired currency in the confidential pool of the internal DEX.

Further directions include running programs and internal smart contracts, as well as integrating other assets. To this end, Tacit Chain has designed a migrate operation that can upgrade to a new version, but only occurs when users choose to join. More importantly, upgrades do not compromise anonymity: which notes moved and how much will not be exposed.