Jat
CONCEPTS

The fee relayer

A fresh stealth address starts with a zero balance, so it cannot pay its own transaction fee. The relayer pays the fee on its behalf, which lets a brand-new address receive and withdraw without ever holding SOL first.

The chicken-and-egg fee problem

On Solana, the fee payer of a transaction must sign and must hold lamports. A one-time stealth account that just received a payment has funds, but spending them to a clean destination still needs a fee paid by some account. Making the stealth account pay its own fee would force it to touch SOL on its own, which is exactly the kind of self-link Jat is trying to avoid.

What the relayer does

The relayer is a service that sets itself as the fee payer of your transaction and submits it. You still sign for the movement of your funds; the relayer only covers gas. This is how a sweep from a stealth address, or a pool withdrawal to a fresh address, can happen with no SOL of your own.

feePayer  = relayer        // relayer pays the network fee
signer    = you            // you authorize the actual transfer
recipient = bound in-tx    // relayer cannot change where funds go
Note
The relayer is for fees and unlinkability, not custody. It never holds your funds and cannot move them anywhere you did not sign for. A pool withdrawal binds the recipient inside the proof, so even a malicious relayer cannot redirect it.

It is built to be untrusted

The relayer refuses transactions that would let it be drained or abused. It rejects any transaction where it is referenced inside a System program instruction, which blocks an attacker from making the relayer fund or create accounts for them. It simulates each transaction and rejects ones whose cost to the relayer exceeds a cap, caps transaction size and instruction count, keeps a minimum balance floor, and rate limits per client. A request that tries to make the relayer spend its own lamports simply fails, costing the attacker nothing but a rejected call.

Running your own

The relayer is a small HTTP service, and the hosted site runs one for you so the flows work out of the box. You can also run your own and point a client at it. See keys and the scan model for what the relayer does and does not see, and run the services for deployment.