zava
Walkthrough

How Zava works.

Four steps from your first payment to your first loan. Every step runs on Stellar. Every proof is cryptographic. Every private thing stays private.

01

Collect your salary privately

Share your Zava wallet address with clients. They pay you in USDC on Stellar — instant, borderless, and never routed through a bank you don't own.

  • Freighter derives a wallet-bound `secret` on first connect. It stays in your browser; the private key never leaves your device.
  • Each incoming payment lands as a Soroban token transfer — 3-5 second finality, sub-cent fees. Nothing in the transfer ties back to your identity.
  • You keep the option to convert to local currency, hold, or move on to the next step. Zava never sees the funds.
↓
02

Save consistently

Deposit a portion of each payment into your Zava vault. Each deposit is recorded as a cryptographic commitment — not an amount, not your address, not a timestamp bound to you.

  • The vault stores `commitment = pedersen_hash([secret, amount])` — an opaque leaf in a Merkle tree. Two observers see the same tree; only your wallet can decrypt which leaves are yours.
  • A parallel `nullifier = pedersen_hash([secret, week_number])` is registered — reusable at withdraw time, and forced to unique per-deposit so no one can double-count.
  • Every deposit event also carries an AES-GCM encrypted note that only your scan key can decrypt. Wipe localStorage, sign in again, re-scan events — everything comes back.
↓
03

Prove without revealing

When you're ready for credit, Zava's browser prover generates a zero-knowledge proof that you saved at least $X for at least N weeks. Nothing else.

  • The proof runs in a Web Worker (`@aztec/bb.js@0.87.0` byte-identical to the CLI `bb 0.87.0`) — off your main thread, taking 5–15 seconds on a modern laptop.
  • The proof reveals only: the range threshold you claim, the number of weeks proven, and the commitments/nullifiers being spent. Amounts stay private witnesses inside the circuit.
  • Every proof is exactly 14,592 bytes with a keccak Fiat-Shamir transcript. If you can produce this proof, the on-chain verifier accepts it. If you can't, no partial credit — the check is cryptographic, not gray-area.
↓
04

Unlock credit

Submit the proof to `ZavaCredit`. The contract verifies it on-chain via a real UltraHonk verifier running on Stellar's Protocol 26 BN254 host functions, then issues you a tier + loan cap.

  • The verifier runs full Sumcheck + Shplemini + a BN254 pairing check — the actual math, not a byte-length stub.
  • Loan eligibility scales as `active_weeks × range_threshold × tier_multiplier`. 8 weeks unlocks Medium (2×), 12 weeks Low (4×), 24 weeks VeryLow (6×).
  • The `CreditRecord` writes to chain with a 90-day expiry. Lenders query it directly. They see a tier, they see a loan cap — they never see the numbers behind it.

That's all four.

Everything you've just read runs on Stellar testnet today. Real UltraHonk verification, live on Protocol 26 BN254 precompiles.