#dusk $DUSK Converted some testnet DUSK from Phoenix into Moonlight last night through the wallet, curious what actually happens at that moment. Assumed it'd just be a balance move — private notes in, public balance out, nothing to think about beyond the click.
Watching it happen changed that. Phoenix funds sit as shielded notes — nobody sees amount, sender, or receiver unless they hold the viewing key. Moonlight is the opposite by design, a public account model where every address and balance sits in the open. The convert function atomically swaps between the two, proving ownership either way. But the second those notes become a Moonlight balance, the amount invisible a block earlier is now sitting open for anyone to read. Privacy doesn't fade gradually here. It ends at one exact block.
That's not how I'd been thinking about it. I'd assumed privacy was a property of the funds themselves — that shielded DUSK stayed shielded until you chose to spend it publicly. It's actually a property of which model your balance sits in, and switching models erases whatever privacy existed, with no partial reveal.
Like sealing cash in an envelope versus handing someone a receipt with your name on it. The envelope protects the amount right up until it's opened in front of someone. After that, there's no half-open version.
Makes sense why it's built this way instead of blending the two. Institutions need the option to go fully public with an exchange or auditor, and fully shielded between counterparties — a model with residual privacy through conversion would be neither clean compliance nor real privacy, just a confused middle state.
Worth being clear this was a testnet conversion I ran myself — I didn't check whether every wallet interface surfaces this moment clearly to a less technical user before hitting convert.
Still turning it over — does anyone lose money or position info by converting at the wrong moment without realizing the reveal is instant, or is that risk mostly theoretical once people treat conversion as a one-way privacy door?@Dusk_Foundation
Watching it happen changed that. Phoenix funds sit as shielded notes — nobody sees amount, sender, or receiver unless they hold the viewing key. Moonlight is the opposite by design, a public account model where every address and balance sits in the open. The convert function atomically swaps between the two, proving ownership either way. But the second those notes become a Moonlight balance, the amount invisible a block earlier is now sitting open for anyone to read. Privacy doesn't fade gradually here. It ends at one exact block.
That's not how I'd been thinking about it. I'd assumed privacy was a property of the funds themselves — that shielded DUSK stayed shielded until you chose to spend it publicly. It's actually a property of which model your balance sits in, and switching models erases whatever privacy existed, with no partial reveal.
Like sealing cash in an envelope versus handing someone a receipt with your name on it. The envelope protects the amount right up until it's opened in front of someone. After that, there's no half-open version.
Makes sense why it's built this way instead of blending the two. Institutions need the option to go fully public with an exchange or auditor, and fully shielded between counterparties — a model with residual privacy through conversion would be neither clean compliance nor real privacy, just a confused middle state.
Worth being clear this was a testnet conversion I ran myself — I didn't check whether every wallet interface surfaces this moment clearly to a less technical user before hitting convert.
Still turning it over — does anyone lose money or position info by converting at the wrong moment without realizing the reveal is instant, or is that risk mostly theoretical once people treat conversion as a one-way privacy door?@Dusk_Foundation