Built an MPC-based wallet prototype on top of @Zcash via @LitProtocol. This is how it works: Orchard key hierarchy is threshold-encrypted and shared across the Lit Protocol nodes. Users can access their keys inside a trusted execution environment via Lit Actions. This is a JavaScript runtime. The main challenge was constructing a Halo2 proof inside a JS-based runtime. First, I aimed to prove and sign within a single Lit Action call. Compiled Rust Orchard prover into WASM. On my machine, the shielded transfer WASM proof took roughly 20s. The Lit Action version consumed over 30 seconds, the Lit runtime's execution limit. So, I offloaded the actual proving to a helper Rust server. Now the flow is: 1. Lit Action decrypts the seed, derives keys, and builds the Orchard circuit witness inside the TEE. 2. Lit Action calls the proving server to generate the Halo2 proof. 3. Proof returns to the same Lit Action, which signs and serializes the full transaction. Spending keys never leave the TEE. The serialized circuit witness is exposed to the helper server, which reveals transaction details like amounts/recipients. To mitigate, run the proving server in a TEE as well. In the screenshot, you can see the Halo2 Shielded Transfer benchmark when running on the: - Local M3 Pro with 11 cores: 1s - Railway (auto-scaling x86): 2.1s - Phala TEE, 4 vCPU Granite Rapids @ 2.4 GHz, TDX: 17.2s The TEE is 8.2x slower while 8x more expensive than a standard CPU instance. The cost of privacy is real, but it's worth it.