Private Withdrawal - Veilify

function shieldedWithdrawal(ShieldedWithdrawalParams calldata params, bytes calldata proof)
    external nonReentrant whenWithdrawalsNotPaused;

Params

struct ShieldedWithdrawalParams {
    bytes32[6] noteNullifiers;
    bytes32    txNullifier;
    bytes32    root;
    bytes32    noteChangeCommitment;
    bytes32    noteFeeChangeCommitment;
    bytes32    value;
    bytes32    recipientAddress;
    bytes32    coinId;
    bytes32[9] ciphertextChange;
    bytes32[9] ciphertextFeeChange;
    GasFee     gasFee;
    bytes32    nullifiersHash;
    bytes32    fee;
    bytes32    feeTokenAddress;
}

Field	Description
`value`	Gross amount leaving the notes
`recipientAddress`	Public recipient. Must not be the pool (`InvalidRecipient`).
`coinId`	Token withdrawn (`0` = ETH)
`fee`, `feeTokenAddress`	Relayer gas reimbursement

The other fields are as in Private Transfer.

Execution

_checkSpend: relayer allowlist, tx nullifier, root
Verify 38 public inputs
Spend nullifiers
Insert change and fee-change commitments in one batch
Pay fee to msg.sender
Accrue floor(value × withdrawalFeeBps / 10,000) to the treasury, and pay the rest to the recipient
Emit ProtocolFeeCharged(WITHDRAWAL, txNullifier, coin, fee) and ShieldedWithdrawal

There is no round or timestamp check. Round-mode timing is applied off-chain by the scheduler.

Event

event ShieldedWithdrawal(
    bytes32 indexed txNullifier,
    bytes32 nullifiersHash,
    bytes32 noteChangeCommitment,
    bytes32 noteFeeChangeCommitment,
    address recipientAddress,
    uint256 amount,          // full value that left the notes
    address tokenAddress,
    uint256 fee,
    address feeTokenAddress
);