Anchor Service
The anchor service submits commitment roots to Solana. It is the only process that holds the anchoring authority keypair.
for each wallet with pending leaves:
evaluate seal policy
advance Merkle tree
submit root
confirm batch
An error for one wallet does not stop the rest of the sweep.
Seal policy
A batch is sealed when either condition is met:
| Condition | Default |
|---|---|
| Pending leaves | 64 |
| Oldest pending leaf | 5 minutes |
Writes return before anchoring. A new memory can return anchored: false until the next eligible sweep completes.
Anchoring one wallet
1. Advance the tree
The service loads the persisted incremental tree and appends unseen leaves in O(log n) time per leaf.
If the tree is missing or its leaf count is invalid, the service rebuilds it from the ordered leaf set.
2. Save the tree
The save is conditional on the previous leafCount. A concurrent update causes the save to fail and the wallet is retried on a later sweep.
No database lock is held during RPC calls.
3. Ensure the commitment account
If the wallet has no commitment account, the service submits init_user. The account PDA is derived from ['user', owner].
4. Commit with nonce retry
The service reads the current nonce and submits:
commit_root(new_root: [u8; 32], new_count: u64, expected_nonce: u64)
A nonce mismatch triggers a fresh read and retry. The default limit is three attempts.
Batch state machine
| State | Meaning |
|---|---|
pending | Batch row created |
submitted | Transaction sent |
confirmed | Transaction confirmed and leaves marked anchored |
failed | Attempt failed and leaves remain pending |
Batch fields
| Field | Meaning |
|---|---|
merkleRoot | Rolling root over the log |
leafRangeStart | Always 0 |
leafRangeEnd | Highest covered index |
memoryCountAfter | Covered leaf count |
nonce | Expected onchain nonce |
txSignature | Submitted transaction |
status | Batch state |
Every root covers the full log, so leafRangeStart remains 0.
Cost
One transaction commits one root, count, and nonce. A full 64-leaf batch amortizes the transaction fee across all 64 leaves.
The onchain account remains 129 bytes as the log grows.
Operations
Run one anchor service. Multiple services are safe because of nonce checks, but they create failed transactions and duplicate work.
The authority should be funded, isolated from API processes, and monitored. A compromised authority can submit an incorrect root or stop anchoring. It cannot decrypt memory.
Failure behavior
| Failure | Result |
|---|---|
| RPC unavailable | Leaves remain pending |
| Nonce mismatch | Retry with current nonce |
| Tree save conflict | Retry on a later sweep |
| Invalid persisted tree | Rebuild from leaves |
| Confirmation timeout | Later rolling root covers the same leaves |
Next: Networks.