There is no hidden account balance stored onchain. The pool emits encrypted recovery records; the browser decrypts matching records and checks each candidate. Only notes that belong to the selected pool, match their commitments, reach an accepted root, and remain unspent count toward your available balance.

​
Candidate note pipeline

Only a candidate that passes every row contributes to available balance.

​
Worked example

Suppose local recovery finds three candidates:
If note B has not updated locally but the pool already records its nullifier, it stays excluded. The onchain spent state wins over local storage.

​
Wallet-derived recovery

The Transfer Console asks a browser EOA wallet to sign chain-and-pool-bound EIP-712 typed data. It canonicalizes the signature, verifies the recovered signer, and feeds the exact signature bytes into HKDF-SHA-256. Chain and pool bind the wallet recovery root; the bundle commitment binds the per-note key. The onchain CommitmentInserted event carries a fixed 144-byte encrypted payload. AES-GCM authenticated data binds chain, pool, runtime, template-set hash, and bundle commitment. After decryption, the client reconstructs the bundle, matches the externally recorded commitment, and checks each child against onchain spent state. Public ciphertext is a discovery record, not plaintext spend authority. Wallet signature bytes, derived recovery keys, decrypted bundle secrets, and proof witnesses stay in the trusted browser.

​
Bearer fallback

A valid bearer export can restore its note in a compatible clean browser, sometimes without the original wallet. Protect it like something that can spend funds, not like an ordinary app backup. Wallet-only durability depends on exact signature-byte reproducibility. Canonicalizing one valid signature cannot make two different valid signatures identical. The optional bearer recovery note provides an independent fallback when a wallet returns different bytes or stops supporting the request.

​
What private balance includes

Private balance is the total of locally restored, spendable notes. Deposits, withdrawals, amounts, timing, commitments, nullifiers, submitters, and destinations still appear in public chain activity. Your balance can take time to appear while Nullark catches up with RPC data, scans missing logs, validates recovery material, or refreshes an old root. None of that changes the contract state. Use Restore private balance for the recovery steps and Nullifiers and spent state to understand when a note is definitively spent.