What a Solana mixer is actually doing

Nothing is hidden from the chain. The deposits are simply made indistinguishable from one another.

Solana's ledger is fully public and TornadoSol does not change that. What it changes is whether the public record is useful: it turns a set of deposits into a set of lookalikes, so following the money runs out of road at the pool.

Depositing

Your browser draws two random numbers — a nullifier and a secret — and hashes them into a single commitment with Poseidon. The commitment is all the chain receives. It is appended as a leaf to a Merkle tree twenty levels deep, and your SOL joins a shared vault. The two random numbers never leave the page; together they are your note.

The anonymity set

Every deposit in a pool carries the same amount and a hash that discloses nothing. Four hundred deposits in, yours is one of four hundred indistinguishable entries. That count is the anonymity set, and it is the entire quantity of privacy on offer. Cryptography guarantees the set is genuine; it cannot make the set larger.

Withdrawing

To take money out you build a Groth16 zero-knowledge proof of one claim: I know the nullifier and secret behind some leaf of this tree. Your secrets and your Merkle path are private inputs. Three values go public — the tree root, a nullifier hash, and a hash binding the recipient, relayer and fee. The word doing the work is some: the proof establishes that a valid leaf exists and that you hold its secrets, without indicating which.

Spending once

The contract verifies the pairing check on chain, confirms the root is recent, and creates an account keyed to the nullifier hash. Presenting the same note again fails, because that account already exists. The nullifier hash derives from the nullifier alone, never the commitment, so it records that a note was spent without revealing which leaf it came from.

Why a stranger can submit your withdrawal

The recipient address, the relayer and the exact fee are hashed together and bound into the proof. Change any of them and verification fails. That is what makes it safe for a relayer to broadcast on your behalf — it cannot redirect the payment or inflate the fee, only decline to send.

A crowd only conceals you from people standing outside it. If most of the pool belongs to whoever runs it, they can recognise their own withdrawals and reach yours by elimination — so the number worth reading is how many independent deposits share your pool.

More: the real costs, or how public Solana actually is.