Four moving parts, and none of them requires trusting the person who runs it.
The design is old, public and boring on purpose. Anything novel in this position would be a reason to walk away, not a feature.
Your browser draws two random field elements, a nullifier and a secret, and hashes them: commitment = Poseidon(nullifier, secret). Poseidon is used rather than SHA-256 because it is cheap to prove inside a circuit. The program is handed a fixed amount of SOL and that single hash. It learns nothing else.
Commitments are appended to a Merkle tree twenty levels deep — room for just over a million deposits. The program does not keep the leaves; it keeps the root and one node per level, which is all that appending requires. An indexer replays the deposit events to rebuild the full tree so your browser can build a path through it, and your browser checks whatever it is given against the on-chain root before trusting it.
Withdrawing means producing a Groth16 proof of a single statement: I know the nullifier and secret behind some leaf of this tree. Everything identifying stays private — the secrets, the leaf index, the path. Three values go public: the root you proved against, a nullifier hash, and a hash binding the withdrawal's external data. The word carrying the weight is some. The proof never names your leaf, so there is no line back to it.
Verification happens on chain: a pairing check of roughly 110,000 compute units through Solana's BN254 syscall. If it passes, the program creates an account keyed by the nullifier hash. A second withdrawal with the same note finds that account already exists and fails. The hash comes from the nullifier alone and never touches the commitment, so it records that a note was spent without revealing which.
Every deposit changes the root, so a proof built a minute ago would already be stale. The program keeps its last hundred roots and accepts any of them. That is a deliberate window: wide enough that ordinary use works, narrow enough that ancient roots do not linger as an attack surface.
Not from any of the above. The maths guarantees the crowd is real; the crowd is what hides you. In a pool of two you are obvious no matter how good the proof is. The two anonymity-set figures on the pool picker are the honest measure, and the smaller one is the one that counts.