6. The RFCs

PRIVATE SESSION . zkAPI for the pool . Ethereum . sessionevm.xyz . x.com/session_evm

SESSION

1. Supply

1,000,000,000 SESSION are minted once, in the constructor, to whoever deploys this contract (the Launcher, which places them in the pool and hands the rest to its deployer). No mint function exists.

2. Authority

There is none. No owner, no admin, no pause, no blacklist, no trading switch, no proxy, no upgrade.

3. Transfers

Free. A transfer costs gas and nothing else. The toll is charged on swaps by the pool's hook (the Meter), never on a transfer.

4. Burn and permit

burn and burnFrom MAY be called by any holder: supply can only fall. EIP-2612 permit is supported, so approving the Server for a deposit MAY be a signature.

5. Hidden balances

SESSION deposited into the Server becomes a hidden balance: a note only its holder can spend, earning the cover (RFC 2, section 6). The token contract itself knows nothing of this; to it the Server is an ordinary holder.

Not advice. SESSION can go to zero.

The header of privatesession/PrivateSession.sol, its first 30 lines, as built on 2026-10-02.

PRIVATE SESSION . zkAPI for the pool . Ethereum . sessionevm.xyz . x.com/session_evm

Private Usage Credits for the Pool

Abstract

zkAPI (the Ethereum Foundation and the Open Anonymity Project, October 2026) lets a person pay for a metered API without being known: deposit once into a vault, then authorize bounded usage with zero-knowledge proofs instead of an identity. This contract applies the idea to the most used API on Ethereum, a Uniswap pool, and puts the server on chain. Value enters in public and leaves in public, to the address it came from. In between, every session of trading is authorized by a proof that names no note, no deposit and no person. PRIVATE SESSION is not affiliated with zkAPI or its authors.

1. Conventions

The key words MUST, MUST NOT and MAY are to be read as in RFC 2119. Amounts are in wei. "SESSION" is the token (RFC 1); "a session" is a private trading session (section 4).

2. Notes

A note is (tag, s, eth, tok, accE): tag the address that deposited, s a secret only its holder knows, eth and tok its hidden balances, accE the cover accumulator when it was made. Its leaf is H(3, H(2, tag, b), eth, tok, accE) with (b, nf) = Perm(1, s, 0, 0, 0), H one Poseidon permutation (width 5, BLS12-381 scalar field) read at state[0]. Leaves live in a four-way Poseidon tree of depth 10 (1,048,576 leaves); a full tree is followed by a fresh one, so the protocol never runs out of room. Every root any tree has ever had stays valid: a proof MAY name any of them. Spending a note publishes its nullifier nf, which MUST NOT have been published before.

3. Deposit

Anyone MAY deposit ETH and SESSION. The note's tag is the depositing address, written by this contract, so the note can only ever be withdrawn to that address. A deposit is public: who, how much, when.

4. Sessions

A spend proof (section 7) moves part of a note into a session: a public, ownerless account holding the reserved ETH and SESSION and a program of up to eight orders, each a swap on the pool with an amount, a minimum output, an optional price limit, an optional price trigger, and a time window. Anyone MAY fire an order whose conditions hold and is paid for it from the session (section 8). An order that would fill below its minimum MUST NOT fire. When every order has fired, or the session expires (at most 30 days after opening), anyone MAY close it: what it holds becomes a fresh note owned by the same tag, as a leaf whose owner commitment was fixed, and proven, when the session opened. A session MAY be topped up from another note of the same tag. Nothing on chain says whose a session is.

5. Withdrawal

A spend proof MAY instead pay out of a note directly, and then only to the note's tag: the address that made the deposit it descends from. Nothing can be withdrawn anywhere else. No value moves between tags except through the pool, as a trade.

6. Cover

The Meter (RFC 3) charges 2% of the ether leg of every swap and sends it here. Tolls stream over one day to hidden SESSION: a note earns floor(tok x (acc - accE) / 2^64), settled into its change when it is next spent. Nothing streams while fewer than 1,000,000 SESSION are hidden; what would have streamed is carried into the next day. A note earns only while its tokens are hidden, never while they sit in a session. Floors all round toward this contract: what is owed never exceeds what came in.

7. The proof

PS-PLONK over BLS12-381: KZG commitments against Ethereum's own powers of tau from the EIP-4844 ceremony (141,416 contributions), checked by the EIP-2537 precompiles. No setup was made for this protocol, and no one holds a secret that could forge a proof unless every ceremony contributor did. Public inputs: root, nullifier, change leaf, ethOut, tokOut, owner out, accUsed, isWithdraw, withdraw tag, noChange, action. The action binds the proof to what it is used for (the program, the session, the relayer and fee cap, a deadline), so a proof MUST NOT be usable for anything else.

8. Relayers and keepers

Whoever submits a proof MAY be paid by it, up to the cap the proof names and never more than the gas it spent times (basefee + 1 gwei). Whoever fires or closes a session is paid the same way from the session, at most 0.003 ETH a call. The calldata repaid is the call's exact canonical length, and a call carrying any byte more MUST be refused, so the submitter cannot pad its way to the cap. Gas is counted as the call spends it, before the refund the chain gives back for a closed session's cleared storage: an open that leaves its session running is repaid within 0.3% of its receipt, a call that closes one 2% to 8% above it (measured on a mainnet fork). Nobody can be paid more than that, so no relayer can be used to move value. A close is repaid on a fixed estimate of the gas its return note's climb burns (760,000), within the same cap. The cap is a ceiling, not a promise: above a base fee of about 2.4 gwei it no longer covers a fire that also closes the session, and such a session waits for anyone willing to close it, its owner included.

9. What is private, and what is not

Private: which note paid for a session, which sessions belong together, and which deposit a withdrawal's value travelled through. Public: every deposit and its depositor, every session (its program, its trades, its balances), every withdrawal and its destination, the total hidden. A session opened from the depositing wallet itself is that wallet's in public; it SHOULD be submitted from another address or through a relayer. Amounts are visible: a session that reserves exactly what was deposited points at the deposit. It hides behaviour, never ownership. It is not a mixer.

10. Limits

No owner, no admin, no pause, no upgrade. Not audited. Proofs are made in the browser: about 3 seconds in a desktop browser (measured), longer on a phone. The anonymity set is the set of unspent notes: small at first.

The header of privatesession/Server.sol, its first 90 lines, as built on 2026-10-02.

PRIVATE SESSION . zkAPI for the pool . Ethereum . sessionevm.xyz . x.com/session_evm

The Meter: a Toll on Every Swap

Abstract

The Uniswap v4 hook on the one ETH / SESSION pool (flags 0x20CC). Every swap pays 2% of its ether leg. The toll is sent in the same swap to the Server (RFC 2), which streams it over a day to every hidden SESSION balance: the crowd that hides a trader is paid by the trading.

1. Conventions

The key words MUST, MUST NOT and MAY are to be read as in RFC 2119.

2. The toll

Every swap MUST pay 2% of its ether leg, whoever sends it: wallets, routers, bots, and the Server's own private sessions alike. Private and public trading pay the same; privacy is not bought with the toll. The rate on the four shapes of swap: exactly 2.00% on exact-in buys and exact-out sells, where the ether amount is named and the toll is taken from it before the swap; about 2.04% on exact-in sells and 1.96% on exact-out buys, where it is taken from the ether that actually moved, after the swap. A buy that names its ether and is stopped early by its own price limit still pays 2% of the ether it named.

3. The pool

Native ETH / SESSION, 0.30% LP fee, tick spacing 60, opened within 50 ticks of OPENING_TICK: the price is pinned, not the caller, so nobody can open the pool anywhere else first. A swap on an empty pool, a swap that would end with no liquidity in range, and a swap ending outside -887220 to 887220 MUST be refused. The liquidity bits are clear: adding and removing liquidity never touches the Meter.

4. Authority

None. No owner, no settings, nothing it can be told to change.

The header of privatesession/Meter.sol, its first 34 lines, as built on 2026-10-02.

PRIVATE SESSION . zkAPI for the pool . Ethereum . sessionevm.xyz . x.com/session_evm

Opening Day, in One Transaction

Abstract

Deploying this contract is the launch. The proof verifier and the Poseidon contract are pure and stateless and are deployed first, by anyone; their addresses are passed in. Then, in this constructor, in order, or not at all:

1. SESSION is deployed: 1,000,000,000 minted to this contract (its CREATE nonce 1).
2. The Meter (the pool's hook) is deployed with CREATE2 at a salt that lands it on an address carrying exactly the flags 0x20CC (nonce 2). It is told the Server's address in advance.
3. The Server is deployed (nonce 3) and MUST be exactly where the Meter was told.
4. The ETH / SESSION pool is initialized at the opening tick.
5. Full-range liquidity is added through Uniswap's PositionManager with the attached ether and this contract's SESSION. The position (an ordinary Uniswap LP NFT, removable by its holder), any ether left over, and every SESSION not placed in the pool go to the deployer.

It keeps nothing and has no functions. A launch planned for a different nonce fails a check and reverts whole.

The header of privatesession/Launcher.sol, its first 26 lines, as built on 2026-10-02.