What is a Vault?
A vault is an on-chain address that holds your deposited ZEC (or BTC/DOGE when those chains join NEXUS). When you deposit, your coins go into the vault on L1 (the original blockchain). NEXUS credits you with an equal amount of vZEC (or vSAT/vDOGE) on the NEXUS layer. When you withdraw, your vTokens are burned and your real coins come out of the vault. Your L1 vault balance always equals your NEXUS balance — 1:1, verifiable by anyone at any time. Zcash vaults are live now. Bitcoin and Dogecoin vaults are fully implemented and will go live when those chains join the NEXUS execution layer.Two Spending Paths
Every vault has two ways it can be spent:Vault Structure by Chain
Zcash Vault (Transparent P2SH) ✅ Live
Zcash vaults use P2SH (Pay-to-Script-Hash) — a standard multisig address type. This is the active vault type on NEXUS today.Bitcoin Vault (Taproot / P2TR) 🔄 Coming soon
Bitcoin vaults use Taproot — Bitcoin’s modern address format that supports multiple spending conditions.Dogecoin Vault (P2PKH + CLTV) 🔄 Coming soon
Dogecoin vaults use the standard P2PKH format with a CheckLockTimeVerify (CLTV) escape:Escape Hatch Waiting Periods
All chains use the same ~2-week security window, calibrated to each chain’s block time:
The waiting period gives the protocol time to detect and dispute fraudulent state before funds leave. This is the same principle used by Lightning Network payment channels.
Deposit Flow
Code Example
Withdrawal Flow
Code Example
Vault Address Derivation
Your vault address is derived from your public key combined with the protocol’s public key. This means:- Your vault address is unique to you — nobody else can deposit into your vault
- The address is deterministic — you can always re-derive it from your key
- The protocol can always verify which vault belongs to which user
Security Properties
NEXUS does not hold your private key. You hold it. The vault is a 2-of-2 multisig — NEXUS holds one key, you hold the other. Neither party alone can move funds.