Shielded pools on the EVM depend on relayers because msg.sender has to pay gas from a funded transparent account. The June 2026 Railgun measurement (arXiv:2606.25926) shows both exits of that dependency: 1,049 self-broadcast withdrawals linked to their depositor through the gas payer, and 124 relayer-like addresses serving 89% of relayed volume. Zcash never had this problem; it is an artefact of the account model, not of ZK.
This is a proposal to replace the relayer market with reciprocity embedded in the note itself. Each shielded note carries a role bit inside its commitment: locomotive or wagon. To spend a locomotive you must broadcast a bundle containing your proof and one stranger’s wagon proof, paying gas for both; your new note is born a wagon. To spend a wagon you publish your proof off-chain and wait for a locomotive; your new note is born a locomotive. No ledger of favours, no token, no fee field: the debt is the bit. Formally, the locomotive circuit enforces Δ(#wagons) = +1 and the passenger circuit Δ = −1, under two verifying keys so the role never appears on-chain, and each locomotive proof is bound to a broadcaster the owner designates (themselves, or a professional).
Population simulation (Python stdlib, seed 1, five seeds for robustness): in steady state the overhead is 1.009x–1.012x gas per useful transaction with a 7-block median wait; the wait has a hard cap chosen by each user (p95 = patience) at 0.5%–2.7% overhead. Two things the circuit does not reveal and the dynamics do: withdrawals are a sink of locomotives (a ratchet that drives waits unbounded unless there is a valve, the drain: a wagon pays 2x and becomes a locomotive), and the Volunteer’s Dilemma of decentralised relayers does not disappear but relocates to the wagons, where a 25% minority of low-patience responders keeps everyone’s waits short. The passenger race costs +1.3% gas if the contract checks nullifiers before verifying proofs, +21% if it verifies first.
What I am not claiming: it does not enlarge the anonymity set, does not resist block-builder censorship, and the fallback engages exactly when exposing an account is most costly: when professionals withdraw under pressure, users take over broadcasting from their own funded accounts. Trade-offs are in §9; open problems in §11. Circuits and contract are specified, not implemented.
Paper, prior-art annex and simulator (MIT): https://doi.org/10.5281/zenodo.22837049
Reproduce the base case: python3 tractor_vagon.py --ticks 4000 --depositos 0.35 --f-retiro 0.10 (SHA-256 e55249d7…ee64e47).
Three things I would most like broken:
The invariant. Is there any way to obtain a wagon without a paid broadcast, or to submit someone else’s locomotive proof, given Δ = ±1 under two verifying keys plus sender_commit = H(designated_address)? §4.2–4.4 has the constraints; the 2→2 case table is where I expect a hole if there is one.
Co-presence. A bundle puts two strangers’ transactions in the same block with the roles hidden. Does that leak more than a relayed transaction leaks today, under the Railgun heuristics? I have not measured it and I would rather be told it is bad than assume it is fine.
The fallback tension. With designated broadcasters, in normal times this is just a relayer network with a latency cap; its only distinctive property is surviving the market’s disappearance, at the cost of pushing exposure onto users at the worst moment. Is a mechanism whose value shows up only under pressure worth its cost in the circuit and the note format?
I will fold corrections into the next version on the same record.
| # | Наименование новости | Тональность | Информативность | Дата публикации |
|---|---|---|---|---|
| 1 | Public-mempool gas sponsorship needs escrow, a bond, or trust | 0 | 6.46 | 14-09-2026 |
| 2 | Mempool Account Transaction Capacity from Historical Activity (MATCHA) | 0 | 9.38 | 22-09-2026 |
| 3 | EIP-8411: what segmented payload diffusion is made of | 0 | 8.61 | 17-09-2026 |
| 4 | [IDEA] Native Ethereum Delegation (NED) - Protocol-Routed Delegation With Split-Neutral Allocation and Coverage-Bounded Consensus Amplification | 0 | 13.6 | 13-08-2026 |
| 5 | Evidence Review Framework for Project Applications in Decentralized Guilds/Agent Systems | 0 | 8 | 19-09-2026 |
| 6 | Etheorem update: the complete executable consensus specs written in Lean 4 | 0 | 4.8 | 21-09-2026 |
| 7 | Deterministic Random Number in EVM for Independent Recomputability | 0 | 12.36 | 30-07-2026 |
| 8 | Cryptographic canaries and backups | 0 | 8.77 | 18-09-2026 |
| 9 | When Data Binds Execution: Dynamic Simulation of EIP-7999’s Multidimensional Fee Market | 0 | 10.98 | 16-09-2026 |
| 10 | All Core Devs - Consensus (ACDC) #183, July 23 2026 | 0 | 15.18 | 13-07-2026 |