ZKas — Roadmap & Strategy

The fungible private cash of the Kaspa economy — minted beside every Kaspa block, private by mandate, impossible to taint or freeze.
The reachable wedge: it's the money Kaspa miners earn for free and spend with un-flaggable privacy. Merged mining is the only on-ramp that exists today — so it is the go-to-market. Everything below is grounded in what the code actually supports. Grow circulation, harden the core, and add contracts only when there are users to use them.

Why this wins on the real substrate

Mandatory privacy ships today

The whole chain is one anonymity set. Unlike opt-in Zcash — where the shielded pool is tiny and using it flags you — on ZKas privacy is the only mode, so no coin can ever be tainted, frozen, or delisted as "tainted." Absolute fungibility, already in base consensus.

Distribution is already solved

No peg, no CEX, no fiat ramp needed to reach the first users: every merged-mining Kaspa miner already receives ZKas at the coinbase at ~0 marginal cost. The one faucet that works — a channel we control.

The combination is uncopyable

Monero: own-PoW island, no borrowed security. Zcash: opt-in, weak fungibility. Kaspa: fully transparent. Only ZKas = mandatory privacy + inherited Kaspa PoW & miner base + 1 BPS + ~0 fees. No rival holds all four.

A complete cash product, no vaporware

Shielded payments, 512-byte memos (invoices/receipts), diversified addresses, send-time viewing-key disclosure (prove income when you choose), NUMS burn. A finished private-payments stack — the story writes itself from what's already merged.

Free security ride

Merged mining inherits Kaspa's hashrate and security budget — the bootstrap problem that kills small privacy coins is solved by construction. A private chain that is genuinely expensive to 51%.

Honest about the ceiling

Consumer reach is gated on an on-ramp that's blocked on external Kaspa. So the near-term target isn't consumers — it's miners who hold, and the payment economy among them. We build for that reality, not around it.

The plan — three tracks, sequenced by what the code and the market allow

Track legend: Grow seed circulation · Harden de-risk the core · Build new capability. Each item notes effort and whether it needs a consensus fork.

Now — this quarter
Seed miner circulation · harden soundness & anonymity · ship the two cheap no-fork wins
Mining-to-hold funnel
One-command "mine ZKas with your Kaspa rig," payout into a held wallet, one-tap claim in the app. Metric: distinct wallets holding a mined balance, WoW.
Groweffort M
Fix the merged-mining indexer + court pools
Repair zkmm_indexer (it misses the /zkas/ coinbase format and undercounts); surface ZKas rewards as visible payouts on our pool + K1Pool + rustykaspa; land 1–2 mid/large Kaspa pools — the single biggest needle-mover.
Growops
★ Delta-audit the shielded circuit + supply turnstile
The cheapest catastrophic-risk buy on the board. We forked audited zcash-orchard, so audit only the delta, and add a value-balance/turnstile invariant so counterfeiting is at least detectable at coinbase/peg boundaries. Do it before real value flows.
Hardentargeted
Thicken temporal anonymity
Foundation/pool emits timed decoy self-sends; enforce fixed batching/timing in the reference wallet. Cheap, no consensus change — breaks the thin-volume deanonymization spiral early.
Hardenno fork
OVK-recoverable send + keyless disclosure verifier
Highest leverage per effort. The send path already returns the disclosure — this is UX + a stateless verifier. Turns "shielded" into a sellable feature: receipts, proof-of-payment, prove-your-income-when-you-choose.
Buildno forkeffort S
Wire FROST-RedPallas threshold signing
The FROST + DKG code already ships in the zakura-reddsa dependency, just uncalled. Wiring it unlocks multisig wallets, org/treasury custody, and key-loss recovery — big product surface, integration-only.
Buildno forkeffort M
Message discipline
Every surface: "Private cash, mined with Kaspa, un-taintable." Land the fungibility / anti-flagging contrast vs Zcash opt-in. Viewing keys = the compliance answer. When asked how to get ZKas: "mine it."
Narrative
Later — bigger bets & external unlocks
Pay these costs only when volume warrants, or when an external blocker clears
Cross-curve DLEQ → BTC/KAS atomic swaps
Greenfield crypto that extends adaptor sigs across curves for trustless swaps to Bitcoin/secp chains — without the dormant peg. Reach beyond the miner base once contracts exist.
Buildno forkeffort L
Per-note relative timelock
Robust refund timeouts, vaults, Lightning-style channels — but it's the one major circuit hard fork (new note field, new Halo2 public input, regenerated keys). DLCs work without it via absolute timeouts, so pay this only when live volume demands it.
Buildmajor forkeffort L
KAS↔ZKAS peg ("private KAS")
Built and tested on our side; dormant, blocked on Kaspa exposing token-level settlement. Not our timeline to unblock — keep it off the box and flip it the day Kaspa ships the primitive.
external (Kaspa)
Post-quantum migration commitment
Harvest-now-decrypt-later is the long-term existential risk for any privacy coin. Publish a credible PQ-migration plan now; build later — the timeline almost certainly exceeds this window, so spend no engineering on it yet.
Hardenwatch

Must de-risk first — or nothing else matters

The three that decide whether ZKas lives
  1. On-ramp cold start (existential). Mining is the only entry; the peg is blocked on external Kaspa; a mandatory-privacy coin has no CEX path. The only levers we control are merge-mining-pool recruitment and P2P/atomic-swap liquidity. If non-mining acquisition and wallet growth don't move in 1–2 quarters, the chain is a closed loop. Do not stake the plan on the peg.
  2. Silent circuit counterfeiting. Under mandatory privacy a soundness bug is invisible and unrecoverable. The delta-audit + supply turnstile above is the cheapest insurance — close it before value flows, while the ledger is still small.
  3. Anonymity-set thinness. The product is privacy; thin volume lets timing correlation defeat it. Decoy traffic + fixed batching is a cheap, no-fork way to break the chicken-and-egg with cold start.

Deliberately parked — honesty about what we're NOT doing

Impossible on ZKas (no VM / single asset) — stop implying them: on-chain AMM, order book, continuous perps, native stablecoin. These belong to the covenant layer or a big fork, never the base chain.

Bad-ROI / blocked: a uniqueness/anti-double-pledge registry (the nullifier set is a MuHash — no non-membership proof without a full SMT swap); the KAS peg as a promise (blocked externally); cross-chain swaps as a near-term claim (no DLEQ yet).

The trap: building the DeFi/markets layer before there is demand. It consumes the exact runway the on-ramp and audit need. Adaptor sigs, oracle, timelocks stay in "Next/Later" and ship on-demand.

Strong messaging, but not the flagship yet: "Glass Ledger payments rail" and "settlement for the debanked-but-legal economy" both presume users can acquire ZKas — which they can't yet except by mining. They become true downstream, after the miner-seeded economy has circulation. Lead with "private cash, mined with Kaspa" now.

ZKas roadmap — grounded in a code-verified capability audit (Sept 2026). Sequenced by what the protocol supports and what the market allows. Priorities update as circulation, the audit, and the anonymity set mature.