Two contracts, one interface.

1// SPDX-License-Identifier: MIT2pragma solidity ^0.8.24;3 4import {IERC20} from "@openzeppelin/contracts/token/ERC20/IERC20.sol";5import {SafeERC20} from "@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol";6 7/// @title ZRelayEscrow8/// @notice Locks EVM assets and signals the relayer ring to mint the9///         equivalent value as a shielded Orchard note.10/// @dev    The contract holds no protocol seed capital. Each user forwards a11///         flat native-ETH surcharge that funds the relayer's own gas and the12///         Zcash miner fee, so the ring is self-sustaining from block one.13contract ZRelayEscrow {14    using SafeERC20 for IERC20;15 16    address public owner;17    address public relayerAddress;18 19    uint256 public flatGasSurcharge = 0.0002 ether;20 21    event ShieldRequested(22        bytes32 indexed depositId,23        address indexed token,24        address indexed sender,25        uint256 amount,26        bytes recipientZAddress,27        bytes memo28    );29 30    error InsufficientGasCoverage();31    error SurchargeTransferFailed();32 33    constructor(address _relayer) {34        owner = msg.sender;35        relayerAddress = _relayer;36    }37 38    /// @notice Escrow `amount` of `token` and request an Orchard shielding.39    function shieldAsset(40        address token,41        uint256 amount,42        bytes calldata recipientZAddress,43        bytes calldata memo44    ) external payable returns (bytes32 depositId) {45        if (msg.value < flatGasSurcharge) revert InsufficientGasCoverage();46 47        // Forward the surcharge with call() — transfer()'s 2300-gas stipend48        // breaks for smart-contract relayer wallets.49        (bool sent, ) = payable(relayerAddress).call{value: msg.value}("");50        if (!sent) revert SurchargeTransferFailed();51 52        IERC20(token).safeTransferFrom(msg.sender, address(this), amount);53 54        depositId = keccak256(55            abi.encodePacked(block.chainid, block.number, msg.sender, amount, memo)56        );57 58        emit ShieldRequested(59            depositId,60            token,61            msg.sender,62            amount,63            recipientZAddress,64            memo65        );66    }67}

1// SPDX-License-Identifier: MIT2pragma solidity ^0.8.24;3 4/// @title ZcashAttestationVerifier5/// @notice Verifies a Groth16 proof that a Zcash shielded claim holds, without6///         running Halo 2 verification on-chain.7contract ZcashAttestationVerifier {8    /// @dev Zcash block anchors the relayer ring has attested to.9    mapping(bytes32 => uint64) public anchorHeight;10 11    /// @dev Anchors older than this many blocks are rejected as stale.12    uint64 public constant ANCHOR_WINDOW = 720;   // ≈ 24h of Zcash blocks13 14    error StaleAnchor(bytes32 anchor);15    error UnknownAnchor(bytes32 anchor);16 17    /// @notice Verify a viewing-key attestation.18    /// @param claimHash  keccak256(viewingKeyCommitment, predicate, msg.sender)19    /// @param minBalance The threshold asserted by the proof, in zatoshi.20    /// @param zkProof    Groth16 proof: 3 BN254 group elements, abi-encoded.21    function verifyViewingKeyAttestation(22        bytes32 claimHash,23        uint256 minBalance,24        bytes calldata zkProof25    ) external view returns (bool) {26        (bytes32 anchor, uint256[8] memory proof) = _decode(zkProof);27 28        uint64 height = anchorHeight[anchor];29        if (height == 0) revert UnknownAnchor(anchor);30        if (block.number - height > ANCHOR_WINDOW) revert StaleAnchor(anchor);31 32        // Public inputs bind the proof to this claim, this threshold and the33        // anchor — so an attestation cannot be replayed elsewhere.34        uint256[3] memory input = [35            uint256(claimHash),36            minBalance,37            uint256(anchor)38        ];39 40        return _verifyProof(proof, input);41    }42}

1// SPDX-License-Identifier: MIT2pragma solidity ^0.8.24;3 4interface IZRelayVerifier {5    function verifyViewingKeyAttestation(6        bytes32 claimHash,7        uint256 minBalance,8        bytes calldata zkProof9    ) external view returns (bool);10}11 12contract PrivateCreditVault {13    IZRelayVerifier public immutable verifier;14 15    event CollateralVerified(address indexed borrower, uint256 verifiedBalance);16 17    constructor(address _verifier) {18        verifier = IZRelayVerifier(_verifier);19    }20 21    /// @notice Unlock an undercollateralized USDG loan by proving a shielded22    ///         ZEC balance — without revealing the address or its history.23    function verifySolvencyAndBorrow(24        uint256 requestedLoan,25        bytes32 claimHash,26        uint256 minBalanceProof,27        bytes calldata proof28    ) external {29        bool ok = verifier.verifyViewingKeyAttestation(30            claimHash,31            minBalanceProof,32            proof33        );34        require(ok, "Z-Relay: invalid shielded balance proof");35 36        emit CollateralVerified(msg.sender, minBalanceProof);37        // ...continue with loan issuance on Robinhood Chain38    }39}

// The three integration patterns, in order of how often you will want them.

// 1. Gate an action on a proven shielded balance.
require(
    verifier.verifyViewingKeyAttestation(claimHash, 100e8, proof),
    "insufficient shielded collateral"
);

// 2. Settle a payout directly into a shielded pool.
IERC20(usdg).approve(address(escrow), amount);
escrow.shieldAsset{value: escrow.flatGasSurcharge()}(
    usdg, amount, recipientZAddr, memo
);

// 3. React to settlements from your own indexer.
event ShieldRequested(
    bytes32 indexed depositId,
    address indexed token,
    address indexed sender,
    uint256 amount,
    bytes recipientZAddress,
    bytes memo
);