Modifications

However, for the ZEOS Orchard Shielded Protocol, the Zcash Orchard action circuit needs to be slightly adapted. Firstly, because there are no transparent transactions and therefore no transparent value pool in ZEOS. Furthermore, there is not only one, but countless different value pools in ZEOS because of the token diversity in EOSIO/Antelope ecosystems. Finally, there are numerous different fungible tokens as well as NFTs, which have no value pool at all because of their uniqueness.

Therefore the following approach is chosen:

1. $\mathsf{not}{\mathsf{e}}_{\mathsf{old}}$ is renamed to $\mathsf{not}{\mathsf{e}}_{\mathsf{a}}$
2. $\mathsf{not}{\mathsf{e}}_{\mathsf{new}}$ is renamed to $\mathsf{not}{\mathsf{e}}_{\mathsf{b}}$
3. the difference value ${\mathsf{v}}_{\mathsf{net}}$ is converted into a third UTXO $\mathsf{not}{\mathsf{e}}_{\mathsf{c}}$
4. the $\mathsf{ValueCommit}$ of ${\mathsf{v}}_{\mathsf{net}}$ then becomes a $\mathsf{NoteCommit}$ of $\mathsf{not}{\mathsf{e}}_{\mathsf{c}}$

The previous equation of the Zcash Orchard action circuit thus becomes:

$$\mathsf{not}{\mathsf{e}}_{\mathsf{a}}.d1=\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.d1+\mathsf{not}{\mathsf{e}}_{\mathsf{c}}.d1$$

where $.d1$ refers to the value (FT) or ID (NFT) of a UTXO as defined in UTXO Tuple.

Interestingly, the above equation works for both fungible and non-fungible tokens: In case of fungible token transfers, $\mathsf{not}{\mathsf{e}}_{\mathsf{c}}.d1$ represents the change that (normally) goes back into the sender's wallet. In case of NFT transfers, however, $\mathsf{not}{\mathsf{e}}_{\mathsf{c}}.d1$ is necessarily zero, since an NFT cannot be split. But if $\mathsf{not}{\mathsf{e}}_{\mathsf{c}}.d1$ equals zero, it follows from the above equation that $\mathsf{not}{\mathsf{e}}_{\mathsf{a}}.d1=\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.d1$ which corresponds exactly to the desired NFT transfer from $\mathsf{not}{\mathsf{e}}_{\mathsf{a}}$ to $\mathsf{not}{\mathsf{e}}_{\mathsf{b}}$.

In addition to above equations, the following conditions must hold:

$$\mathsf{not}{\mathsf{e}}_{\mathsf{a}}.d2=\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.d2=\mathsf{not}{\mathsf{e}}_{\mathsf{c}}.d2$$ $$\mathsf{not}{\mathsf{e}}_{\mathsf{a}}.sc=\mathsf{not}{\mathsf{e}}_{\mathsf{b}}.sc=\mathsf{not}{\mathsf{e}}_{\mathsf{c}}.sc$$

The equality of all $.d2$ values enforces that either all UTXOs in the circuit must have the same token symbol (FT) or that the upper 64 bits of an ID must match (in case of NFT, but then $\mathsf{not}{\mathsf{e}}_{\mathsf{c}}.d2$ must equal zero). The equality of all $.sc$ values enforces that all UTXOs in the circuit represent tokens issued by the same smart contract.

However, introducing $\mathsf{not}{\mathsf{e}}_{\mathsf{c}}$ and replacing the $\mathsf{ValueCommit}$ with a $\mathsf{NoteCommit}$ comes with the trade-off that value surpluses of multiple actions of the same transaction can no longer be balanced with each other, since a $\mathsf{NoteCommit}$ is no Pedersen commitment and therefore does not have homomorphic properties. This means that in the ZEOS Orchard Shielded Protocol every single action must be balanced out to zero surplus using $\mathsf{not}{\mathsf{e}}_{\mathsf{c}}$, i.e. the inputs of an action ($\mathsf{not}{\mathsf{e}}_{\mathsf{a}}$) must equal the outputs of the same action ($\mathsf{not}{\mathsf{e}}_{\mathsf{b}}+\mathsf{not}{\mathsf{e}}_{\mathsf{c}}$).