Core concepts
Relayers
A proof severs the link cryptographically. A relayer keeps it severed at the network layer, by being the one who submits.
Why someone else submits
Solana transactions have a fee payer and a signer, and both are public. If you submitted your own withdrawal, your wallet would appear in the transaction that released the funds, and an observer would not need to break any cryptography to connect you to it.
So a relayer submits instead. Relayers are independent operators who receive a completed proof and broadcast the on-chain transaction. Because they submit it and not you, your wallet is never linked to the transaction.
What a relayer can and cannot do
| Action | Possible? | Why |
|---|---|---|
| Change the destination | No | The destination is bound into the proof; altering it makes the on-chain transaction fail. |
| Change the amount | No | Same. The amount is part of what the proof authorises. |
| Spend your funds | No | Spending requires the secret behind a note, which the relayer never receives. |
| Learn which deposit you spent | No | The proof does not reveal it to anyone, the submitter included. |
| Decline to serve you | Yes | This is the whole of a relayer's power. You go to another one. |
A relayer is a courier, not a custodian
Who can be a relayer
Relayers are a permissioned set per pool. That is a deliberate trade-off: an open set maximises censorship resistance, while a permissioned set keeps the submitters of a pool accountable and its service predictable. Because a relayer cannot alter or steal anything, the cost of that trade-off is bounded to availability.
Gasless deposits
Relayers also make it possible to enter the pool with no SOL at all. On the gasless deposit path the relayer covers the network fee, so a wallet holding only a token, and no SOL for gas, can still deposit.
- The path is rate-limited per wallet, because it spends the relayer's own funds.
- It changes who pays for gas. It does not change what the program verifies or what the proof authorises.
Relayers in private execution
In private execution the relayer does one extra job: it funds a fresh, single-purpose wallet out of your private notes so that wallet, not yours, can interact with the external venue, and later sweeps the proceeds back into a new private note. It still cannot redirect either leg.