EVM shielded-pool proposal replaces relayers with reciprocal note roles

A research post published September 19 wants to eliminate the relayer in EVM shielded pools by baking a reciprocal payment rule directly into each shielded note. The mechanism runs on two hidden roles: “locomotive” and “wagon.”

The structural problem ismsg.sender. On the EVM, the account broadcasting a transaction has to fund it from a visible, transparent address — which means shielded pools today depend on external relayers to submit transactions on behalf of users who can’t surface their spending account. The post cites a June 2026 Railgun measurement: 1,049 self-broadcast withdrawals were traced back to their depositors through the gas payer alone.

That same measurement found 124 relayer-like addresses handling 89% of relayed volume, leaving 11% outside that group (100% – 89%). In the desk’s assessment, that concentration may itself become a privacy signal.

The proposal’s fix is to make broadcast obligations travel with the note itself. Each commitment carries a role bit, though nothing about that role appears in on-chain readable data. A note is born either a locomotive or a wagon. Spending it flips the replacement.

Locomotive is the broadcaster. Spending a locomotive note means submitting a bundle containing both the owner’s proof and a stranger’s wagon proof, covering gas for both. The replacement note comes out a wagon, passing the next broadcast obligation along.

Wagon is the reverse. Its owner publishes a proof off-chain and waits for a locomotive holder to bundle it into a broadcast. Once spent, the replacement becomes a locomotive. The proposed circuits enforce accounting on-chain: the locomotive circuit makes the wagon count rise by one; the passenger circuit makes it fall.

Each locomotive proof is bound to a broadcaster chosen by the note owner — either the owner themselves or a professional — while the role assignment stays off the readable ledger entirely.

The simulation reports the proposal’s operating costs. Steady-state modeling shows 1.009x to 1.012x gas per useful transaction: 0.9% to 1.2% overhead above baseline. Median wait is seven blocks. Users can set a patience cap; at the 95th-percentile patience level the post reports, overhead ranges from 0.5% to 2.7%. A 25% minority of low-patience wagon responders keeps waits short for everyone else in the simulation.

There’s a fallback for when supply gets lopsided. Withdrawals drain locomotives, which can shrink the pool of users available to broadcast for wagons. A wagon holder can pay twice the normal amount through a “drain” mechanism to flip to locomotive status. The post describes this as engaging specifically when account exposure is most costly, including when professional broadcasters withdraw under pressure.

The passenger race adds another gas wrinkle. If the contract checks nullifiers before verifying proofs, the race costs 1.3% additional gas. Verifying proofs first drives that number to 21% more. The implementation choice determines whether the priority is cheaper duplicate protection or earlier proof validation — the proposal does not offer both simultaneously.

What this proposal doesn’t claim matters. It doesn’t enlarge the anonymity set. It doesn’t resist censorship by block builders. The specific, bounded target is the direct dependence on a gas-paying account visible to anyone watching the chain, addressed by keeping locomotive and wagon roles off-chain entirely.

Circuits and contract are specified but unimplemented. If implementation does follow, the pitch is avoiding relayer fees per broadcast while accepting off-chain waiting, reciprocal obligations, and those potential race-related gas costs.

If deployed, users would trade relayer dependence for waiting, reciprocal broadcast obligations and potentially higher gas in the proof-ordering case.

EETH$2,641.46▲2.31% was priced at $2,642.57, up 5.7% over 24 hours (CoinGecko), according to CoinGecko at the time of writing. No causal connection to this proposal is established.