Internal Transfers

An internal transfer debits one commitment and credits another inside the program's ledger. No SPL token moves; only internal accounting changes. Authorization comes from the source identity's proof.

REPLAY PROTECTION

Each identity would carry a strictly increasing nonce included in every signed action. Domain separation by program ID and action type prevents cross-context reuse.

VISIBILITY

Standard Solana balances and transfers are publicly observable. Internal transfers would still be visible as program instructions and state changes.