Asset mapping

Two assets cross the bridge, and each is native on exactly one side. Keeping that straight explains every mint and burn in the system.

The mapping

            Solana L1                      ZUL L2
            ---------                      ------
SOL         native                         wSOL (SPL token,
            held in bridge vault    <-->   L2 bridge mints/burns)

ZUL         SPL-ZUL (token,               native lamports
            L1 bridge PDA is        <-->   (the gas unit)
            mint authority)

SOL

• Deposit: SOL locks in the L1 vault PDA → the L2 mints wSOL to the recipient. wSOL is a standard SPL token on ZUL, usable anywhere SPL tokens work — including the shielded pool.
• Withdraw: burn wSOL on L2 → claim releases SOL from the vault after the window. Vault balance always ≥ outstanding wSOL supply; the invariant is auditable on both chains.

ZUL

• Exit: native ZUL locks on L2 → the claim mints SPL-ZUL on Solana (the bridge PDA is the L1 mint authority). ZUL exists on L1 only as this bridge-minted token.
• Deposit: SPL-ZUL sent to the bridge is burned on L1 and credited as native lamports on L2. Burn-and-credit (rather than vault-and-release) keeps the L1 token supply equal to exited value — no idle wrapped supply.

Inside the shielded pool

The pool is multi-asset from genesis: notes carry an asset_idfor ZUL or wSOL. The id is public at the pool's edges (the vault movement reveals it anyway) but private inside transfers — the circuit enforces asset consistency without disclosing which asset moved. One anonymity set per asset; see Privacy limits on why that matters when sets are small.