Protocol Study #3.5 — Trees, Anchors, and the Nullifier Set (Notes, Commitments, and Nullifiers, Part 2)

​@shieldedmark here 👋

​Trying to get through three foundational sections of the protocol in one session was perhaps a bit too ambitious.

​Part 2 picks up where we ran out of runway: the incremental Merkle tree the commitments actually live in, the anchor-depth knob and its reorg-vs-anonymity-set tradeoff. We'll also cover the rules that make Zcash's nullifier set work: disjointness across Sprout/Sapling/Orchard, the intra-transaction collision rule, and why the chain never removes anything.

​The unifying question: why does Zcash spend by adding to a set instead of removing from one, the way Bitcoin does?

​Spec §3.8 and §3.9, read with Sapling and Orchard side by side.

​Recorded and translated by Zcash Brazil.