Architecture
A browser wallet signs on Horizen. Vela connects those public requests to a Nova private ledger, then publishes authenticated results and encrypted account updates.
The system at a glance
Local encrypted vault, public transaction signing, private-key derivation, encrypted state recovery and balance display.
Public deposits, custody, request IDs, completion records, application state roots, claimable balances and claims.
Follows confirmed requests, dispatches execution, submits completion and indexes encrypted events.
Processes the private ZEN ledger and returns signed results with encrypted per-wallet updates.
Vela is designed as a confidential coprocessor for EVM applications. The main chain retains settlement and public contract state, while application execution runs in the Vela environment. Official Vela introduction
One request, two layers of state
- Prepare locally. The wallet validates the selected chain, processor, application, token and available balance. The user reviews the action and amount.
- Sign and journal. The browser records the pending intent and locally calculated transaction hash, then makes a single broadcast attempt. It reconciles an uncertain result rather than automatically creating a new transaction.
- Confirm on Horizen. The processor records the request. A shield also moves publicly approved ZEN into custody.
- Execute through Vela. The manager dispatches the confirmed request to the executor. The Nova application updates the private ledger.
- Publish completion. The processor authenticates the result and records completion, state changes and encrypted account events.
- Recover the account view. Each wallet decrypts its own updates and refreshes its private balance. An unshield makes funds claimable; a separate claim transfers public ZEN out of custody.
Pending and completed transactions appear in Private wallet activity. The user can check an existing transaction’s progress without repeating the transfer. Cross-tab locking serializes writes from the same browser wallet.
Wallet identity and recovery
The app creates its own wallet. Public keys and signing secrets are controlled in the browser; connecting an external extension is currently disabled. The same 0x address identifies the public wallet and its registered private account.
| Layer | Implementation |
|---|---|
| Recovery phrase | 24-word BIP-39 phrase; Ethereum BIP-44 account path m/44′/60′/0′/0/0. |
| Local vault | AES-256-GCM encryption with a 96-bit IV and authenticated metadata. |
| Password derivation | PBKDF2-HMAC-SHA-256, 600,000 iterations, with a 128-bit salt. |
| Backup | Encrypted JSON export or recovery-phrase restoration. An encrypted backup file needs its own password to decrypt. |
| Private identity | Receiving/encryption keys and routing material derive from the same phrase, scoped to the chain, processor, application and account. |
| Activation | Register once for this deployment identity in each wallet. A new deployment or application identity can require registration again. |
The browser vault protects the wallet’s signing material. ZEN that has been shielded is held by the processor and subject to the private application’s execution and withdrawal model. Those are separate trust boundaries.
Custody and the pilot limit
The mainnet processor accepts the canonical Horizen ZEN token for this pilot. The 1 ZEN cap is shared across the deployment’s custody; it is not a per-wallet limit. Pending processing and claimable balances must also be considered before another deposit.
ETH pays Horizen transaction gas and request fees. It is not enabled as a shieldable asset in this mainnet deployment. Public approval grants an exact ZEN allowance; the following shield consumes that allowance and makes the deposit.
| Operation | Public custody | Private ledger |
|---|---|---|
| Shield + completion | ZEN moves into the processor | Depositor receives private ZEN |
| Private send | Total backing stays in custody | Private balance moves between registered accounts |
| Unshield + completion | Released amount becomes publicly claimable | Selected amount is deducted; the rest stays private |
| Claim | Processor transfers ZEN to the public recipient | No further deduction from the already reduced private balance |
From pilot to a production deployment
The mainnet test establishes the wallet lifecycle. The next engineering work concerns the security and operation of the service that supports it.
- Adopt a supported Vela/Nova release and verify attestation, code identity and execution-key binding.
- Review the processor, private application and browser integration independently, including custody authority and token admission.
- Validate recovery, withdrawals and service availability under failed requests, reorgs and restarts.
- Define operating controls, monitoring, upgrade responsibilities and deposit limits for a broader beta.
- Confirm upstream licensing and distribution terms before a production release.
Deployment addresses, reviewed source references and evidence identifiers are listed in the technical reference.