Wallet Types

Hush uses a sophisticated multi-wallet architecture to maintain privacy. Behind the simple interface you interact with, several types of wallets work together to break on-chain links and protect your activity. Understanding these wallet types helps you appreciate how Hush maintains privacy while staying user-friendly.

Use Cases Overview

Each wallet type in Hush serves a specific purpose in the privacy architecture. Here's when each type is used:

Main Wallet - Long-term SOL storage in Privacy Cash protocol, cryptographic ownership of private UTXOs, recovery via BIP39 mnemonic phrase. Never directly receives or sends funds publicly.
Temporary Wallets - One-time receive addresses for incoming SOL and tokens, swap intermediary wallets, breaking linkability between sender and main wallet. Auto-deleted after 7 days or after processing completes.
Public Shard Wallets - Store tokens received from external sources (sends, swap inputs), visible on-chain with public transaction history, use fee wallet for transaction costs.
Private Shard Wallets - Store tokens from internal swap outputs, maintain privacy for tokens not yet sent externally, pay their own fees directly from shielded balance. Convert to public shard when sending tokens externally.
Fee Wallets - Pay transaction fees for public operations (receives, public shard transactions), automatically funded from shielded balance, prevents linking transactions to main wallet.
DApp Wallets - Isolated accounts for dApp interactions, each dApp gets unique wallet, funded via private transfer from shielded balance, exportable private keys for external connections.
Bridge Temporary Wallets - Specialized wallets for cross-chain bridges, two-step process (shielded balance → bridge temp → bridge service), prevents bridge service from seeing main wallet, auto-deleted after bridge completes.

Main Wallet

Your main wallet is the permanent identity you create using a 12-word recovery phrase. This wallet follows the BIP39 standard, making it compatible with other Solana wallets if you ever need to recover elsewhere.

However, your main wallet never directly receives funds or makes public transactions. Instead, it owns your shielded SOL balance within the Privacy Cash protocol. When you shield SOL, the main wallet becomes the cryptographic owner of private UTXOs that only you can spend using zero-knowledge proofs.

You can also view your main wallet's shielded SOL balance on Privacy Cash's website.

Temporary Wallets

Temporary wallets are single-use addresses created for receiving funds. Each time you generate a receive address in Hush, you create a new temporary wallet with a fresh keypair that has no connection to your main wallet or any previous temporary wallet.

When someone sends you SOL or tokens, they send to a temporary wallet address. Once the funds arrive, Hush automatically processes them in the background. SOL gets shielded to your private balance, and tokens get distributed across your shard wallets. After processing completes successfully, the temporary wallet is deleted.

Temporary wallets exist for a limited time (7 days). If funds never arrive, the wallet eventually gets cleaned up. If the amount received is too small to shield (less than 0.003 SOL), the temporary wallet is converted into a shard wallet. This lifecycle ensures you don't accumulate hundreds of unused wallets while maintaining privacy through address non-reuse.

Shard Wallets

Shard wallets are the distributed storage system for your SPL tokens. Instead of holding all tokens in one account where anyone can see your complete holdings, Hush spreads tokens across multiple independent shard wallets. Each shard is a normal Solana account with its own keypair, unrelated to your main wallet or other shards.

Hush uses two types of shards: public shards and private shards. Public shards hold tokens that arrived from external sources - tokens that someone sent you or that you received from a swap input. Private shards hold tokens from internal operations - the output of swaps you executed within Hush.

This distinction matters for privacy. Private shards remain internal to your wallet until you send tokens externally, at which point those shards are marked as public (since they become visible on-chain). The separation helps Hush optimize gas costs and maintain stronger privacy for tokens that haven't left your control yet.

By default, Hush maintains 4 shard wallets per main wallet (3 public, 1 private). The wallet automatically scales the number of shards based on your token holdings, but caps the total to prevent excessive gas costs. When you have too many shards, the consolidation workflow helps merge them back down to an optimal number.

Shard Distribution Strategy

When tokens arrive, Hush randomly distributes them across your available shards. This randomization is crucial because it prevents patterns from emerging. If Hush always filled shards in order or used a predictable algorithm, blockchain analysis could potentially correlate activities by observing the distribution patterns.

The distribution ensures each shard gets a meaningful amount while avoiding dust that would be too small to use. For example, if you receive 100 tokens and have 3 public shards, Hush might split them as 42, 31, and 27 rather than exactly 33.33 each. The slight randomization adds privacy without impacting usability.

Private Shard Conversion

When you send tokens from a private shard to an external recipient, the private shard becomes visible on-chain through the send transaction. To maintain the privacy boundary, Hush automatically converts the private shard to a public shard during the send operation.

The conversion process preserves the existing keypair and tokens - only the shard type changes. The converted shard gets a new public shard index (even numbers: 0, 2, 4, 6...), and Hush generates a fresh private shard with a new keypair to replace it (odd numbers: 1, 3, 5, 7...). This ensures you always have private shards available for internal operations while maintaining proper shard distribution.

This conversion happens atomically during the send operation - your token balances are preserved, and the process is transparent. The keypair stays the same (same public key), but the shard is now marked as public since it has visible on-chain activity. This design maintains the privacy boundary: private shards remain internal until exposed, and you always have private shards ready for future internal operations.

Fee Wallets

Fee wallets pay for blockchain transaction fees throughout your Hush operations. Like shards, these are independent wallets with no cryptographic link to your main wallet. The separation is essential because if your main wallet paid fees, every transaction would link back to it on-chain.

Hush maintains one fee wallet per main wallet for public operations like external receives and public shard transactions. Private shards pay their own fees directly from the shielded balance, maintaining the privacy boundary between your public and private activity.

Fee wallets are automatically funded from your shielded balance when they run low. Hush privately withdraws SOL to top them back up when needed. This happens transparently before any operation that needs fees, so you never have to manually manage these wallets or worry about running out of gas.

Fee Wallet Top-ups

Fee wallet top-ups happen automatically before operations that require fees - swaps, sends, receives, and other public operations. Hush checks the fee wallet balance before each operation and calculates if a top-up is needed based on the estimated transaction fees.

When a top-up is required, Hush withdraws SOL from your shielded balance using the Privacy Cash protocol. The withdrawal amount accounts for Privacy Cash withdrawal fees, and a minimum withdrawal amount is enforced (typically 0.01 SOL). The fee wallet receives SOL after withdrawal fees are deducted. Any surplus SOL remains in the fee wallet for future operations, so there's no waste.

There's an important distinction in how fees are paid: public shards use the fee walletto pay transaction fees, while private shards pay their own fees directly from the shard's SOL balance. If a private shard lacks sufficient SOL for fees, it's automatically funded from the privacy pool first. This maintains the privacy boundary between public and private operations - public operations use the shared fee wallet, while private operations remain self-contained.

The total cost of an operation includes both transaction fees and any withdrawal fees needed for top-ups. If your shielded balance is insufficient for a top-up, the operation will fail with a clear error message guiding you to shield more SOL. All fee wallet management is automatic - you never need to manually fund or manage these wallets.

DApp Wallets

DApp wallets are isolated accounts you can create for interacting with decentralized applications. Each DApp wallet has its own keypair and receives funds through a private transfer from your shielded balance. This isolation prevents DApps from seeing your main wallet or linking your DApp activity back to your other transactions.

When you create a DApp wallet, Hush lets you name it for easy identification (like "Trading Bot" or "NFT Marketplace"). You can then export the private key to connect this wallet to external DApps, just like you would with a normal wallet. The difference is that this wallet has no on-chain connection to your main holdings.

You can create multiple DApp wallets, each funded separately. This lets you segregate different activities - one wallet for DeFi, another for NFTs, and so on. Each wallet operates independently, and blockchain observers cannot link them together or trace them back to your main Hush wallet.

When you're done with a DApp wallet, you can send any remaining balance back to your main wallet through a private transaction, then delete the DApp wallet. Or you can keep it active indefinitely for ongoing use with specific applications.

Bridge Temporary Wallets

When you bridge SOL to other blockchains (like ZCash), Hush creates a specialized bridge temporary wallet. This works similarly to regular temporary wallets but is specifically designed for the bridge workflow.

The bridge process privately sends SOL from your shielded balance to the bridge temporary wallet. That wallet then sends to the bridge service's deposit address. This two-step process ensures the bridge service never sees your main wallet, and blockchain observers cannot link the deposit back to your holdings.

After the bridge completes successfully, the bridge temporary wallet is deleted. If the bridge fails or times out, any refunded SOL is automatically returned to your shielded balance, maintaining privacy throughout the error recovery process.

How Wallet Types Work Together

The power of Hush's architecture comes from how these wallet types interact. When you receive tokens, a temporary wallet accepts them, then shards store them long-term. When you swap, shards provide the input, a temporary wallet executes the swap, and shards (or your shielded balance) receive the output.

Throughout all operations, fee wallets pay transaction costs without exposing your main wallet. DApp wallets let you interact with the ecosystem while maintaining separation. Each wallet type plays a specific role in the privacy system, and together they create strong protection without requiring you to manage the complexity.

From your perspective, you just see balances and make transactions. The multi-wallet choreography happens automatically behind the scenes. This is the core philosophy of Hush: uncompromising privacy with familiar UX.