03
The factor is public, your balance is not
Rebase is the rare payout mechanism that is already shaped for privacy. The payout is one global write, not a credit to every account, so there is nothing per holder to hide in the first place.
The model
Notes hold shares, not balances
A staked position is a fixed quantity of shares. Your balance is shares × index, where index is a single global scalar. Nothing about your position changes when a rebase happens, only the multiplier does.
The epoch
One write, everyone paid
At the close, with D distributed across S total shares, the contract performs index += D / S. That is the entire rebase. It costs the same whether ten wallets are staked or ten thousand.
Why privacy is free here
The shielded set never moves
If positions are commitments in a Merkle tree, the index update touches none of them. The root does not change, no note is rewritten, no proof is regenerated. Value accrues to positions the chain cannot see, at no extra cost per epoch.
Contrast a claim based farm. There, paying N stakers means N credits or N claim transactions, and every claim is a public event that links an address to a position and a moment. Saturn has no harvest button, so there is no per holder footprint at payout to begin with.
3.1
What an epoch still has to publish
Verification is aggregate. Four public values let anyone recompute the factor without learning a single position.
TTreasury balance at closeReadable at a public address. The ceiling on what the epoch can pay.public
DAmount distributedWhat actually moved out of the treasury into the pool this epoch.public
STotal shares stakedThe denominator. Aggregate only, and it reveals no individual position.public
iIndex before and afterCheck that the new index equals the old one plus D over S. That is the whole audit.public
?Who holds which sharesNot required by any step of that check, and not published.private
3.2
Where a shielded pool leaks, and the fix
Every shielded pool leaks in the same four places. These are the ones the design closes, and how.
01Entry and exitArbitrary amounts in and out can link a deposit to a withdrawal. Closed with fixed deposit denominations.fixed
02The anonymity setYou are hidden among every other position in the pool. The set grows with each position that joins, and so does the privacy.grows
03TimingEntering and leaving within one epoch narrows who you could be. Positions that sit across several epochs blend in.guided
04GasA fresh address needs gas, and funding it from an old one relinks the two. Handled with a relayer.relayer
The order of play. The token launches first. Public staking follows, with every epoch recorded on chain and listed in the Observatory below. Shielded staking comes after that, built on the same index, so the four numbers you use to audit an epoch today are the same four you will use then.
