Shielded pools on the EVM depend on relayers because msg.sender has to pay gas from a funded transparent account. The June 2026 Railgun measurement (arXiv:2606.25926) shows both exits of that dependency: 1,049 self-broadcast withdrawals linked to their depositor through the gas payer, and 124 relayer-like addresses serving 89% of relayed volume. Zcash never had this problem; it is an artefact of the account model, not of ZK.
This is a proposal to replace the relayer market with reciprocity embedded in the note itself. Each shielded note carries a role bit inside its commitment: locomotive or wagon. To spend a locomotive you must broadcast a bundle containing your proof and one stranger’s wagon proof, paying gas for both; your new note is born a wagon. To spend a wagon you publish your proof off-chain and wait for a locomotive; your new note is born a locomotive. No ledger of favours, no token, no fee field: the debt is the bit. Formally, the locomotive circuit enforces Δ(#wagons) = +1 and the passenger circuit Δ = −1, under two verifying keys so the role never appears on-chain, and each locomotive proof is bound to a broadcaster the owner designates (themselves, or a professional).
Population simulation (Python stdlib, seed 1, five seeds for robustness): in steady state the overhead is 1.009x–1.012x gas per useful transaction with a 7-block median wait; the wait has a hard cap chosen by each user (p95 = patience) at 0.5%–2.7% overhead. Two things the circuit does not reveal and the dynamics do: withdrawals are a sink of locomotives (a ratchet that drives waits unbounded unless there is a valve, the drain: a wagon pays 2x and becomes a locomotive), and the Volunteer’s Dilemma of decentralised relayers does not disappear but relocates to the wagons, where a 25% minority of low-patience responders keeps everyone’s waits short. The passenger race costs +1.3% gas if the contract checks nullifiers before verifying proofs, +21% if it verifies first.
What I am not claiming: it does not enlarge the anonymity set, does not resist block-builder censorship, and the fallback engages exactly when exposing an account is most costly: when professionals withdraw under pressure, users take over broadcasting from their own funded accounts. Trade-offs are in §9; open problems in §11. Circuits and contract are specified, not implemented.
Paper, prior-art annex and simulator (MIT): https://doi.org/10.5281/zenodo.22837049
Reproduce the base case: python3 tractor_vagon.py --ticks 4000 --depositos 0.35 --f-retiro 0.10 (SHA-256 e55249d7…ee64e47).
Three things I would most like broken:
-
The invariant. Is there any way to obtain a wagon without a paid broadcast, or to submit someone else’s locomotive proof, given Δ = ±1 under two verifying keys plus
sender_commit = H(designated_address)? §4.2–4.4 has the constraints; the 2→2 case table is where I expect a hole if there is one. -
Co-presence. A bundle puts two strangers’ transactions in the same block with the roles hidden. Does that leak more than a relayed transaction leaks today, under the Railgun heuristics? I have not measured it and I would rather be told it is bad than assume it is fine.
-
The fallback tension. With designated broadcasters, in normal times this is just a relayer network with a latency cap; its only distinctive property is surviving the market’s disappearance, at the cost of pushing exposure onto users at the worst moment. Is a mechanism whose value shows up only under pressure worth its cost in the circuit and the note format?
I will fold corrections into the next version on the same record.