A withdrawal with no response isn't a failed withdrawal

A shielded withdrawal can reach the chain even if the browser or the relay doesn't return the response. So "I don't know" isn't "it failed".

UTXO: Solana's or Cloak's?

Solana's base layer organizes its state into accounts; it isn't a UTXO blockchain.[1] Cloak, which we use in the private operation, organizes its pool into UTXO notes.[3] Our flow uses that pool on top of Solana. So here, "UTXO" refers to Cloak's pool note — not native SOL, nor the network's base model.

A spent note can't be spent a second time: the protocol uses a nullifier to prevent double-spending.[4] Therefore, "spending the same UTXO twice" describes an attempt that the protection should block, not two valid withdrawals. The real risk of a lost response is different: treating a note that may already have been spent as available.

What the network's response says

finalized with no error confirms the transaction; a recorded error indicates failure. null, though, doesn't on its own prove that it never reached the chain: Solana's default query looks at the recent cache, and historical lookup has to be enabled.[2] Our flow queries the history, but if the RPC doesn't respond the state remains unknown — it's neither confirmation nor failure.

If there's doubt, check the same signature in the network's history before releasing or trying to use the note again. Don't turn a timeout into authorization to repeat the withdrawal.

The guard's limit

This protection doesn't make the relay trustworthy, nor eliminate risks from the RPC, the network, or a lost backup. It prevents a missing response from being treated as certainty. It isn't financial advice: the vault operates with real assets and requires care.

Sources

[1] https://solana.com/docs/core/accounts [2] https://solana.com/docs/rpc/http/getsignaturestatuses [3] https://docs.cloak.ag/learn/zero-knowledge-without-the-math [4] https://docs.cloak.ag/guide/security