Shroud documentation

Set up a wallet.

1. Open the app and create a private wallet. Your browser generates a 24-word phrase; it never leaves your device.
2. Write the words down offline. They are the only way to recover your notes. Nobody can reset them.
3. Set a password. It encrypts the wallet in this browser so you don’t retype the words.
4. Shield ETH, USDG or a listed stock from any wallet on Robinhood Chain.
5. Get paid privately with a Shroud Pay link from the Receive tab. Your zk1 address is about 2,000 characters long because it carries a quantum-safe key, so share the link or its QR code.

Example: pay a friend privately

1. Shield 0.1 ETH from your normal wallet.
2. Paste your friend’s zk1 address (or open their Shroud Pay link) in Send, and enter 0.05 ETH.
3. Leave “Gasless” on: a relayer submits it, so no wallet of yours appears. The chain sees a proof, not who paid whom.

What Shroud is.

Shroud is a shielded pool for ETH, USDG and tokenized stocks on Robinhood Chain. You deposit into one shared contract and receive encrypted notes. You spend those notes with zero-knowledge proofs: the contract checks that the rules were followed without learning who, what or how much.

Four actions

Shield from any wallet into the pool. Send privately to a zk1 address. Swap through Uniswap without leaving the pool. Withdraw to any address.

Chain

Shroud launches on Robinhood Chain, where the pool is planned to hold ETH, USDG and tokenized stocks such as TSLA and NVDA. It is not live yet. The same contract also runs on Ethereum, with its own tree; that pool can follow later.

How notes and keys work.

A note is a commitment Poseidon(npk, token, amount) stored as a leaf in the pool’s Merkle tree. Only the owner can open it; the encrypted copy lets your wallet find it again from chain data.

Your keys

• Spend secret authorizes spending. Never share it.
• Nullifier secret marks a note spent without revealing which leaf it was.
• zk1 address lets others send to you. Public.
• zkview key shows your history read-only. Share with care.

Storage

The wallet is encrypted in your browser with PBKDF2 (600,000 iterations) and AES-256-GCM. That protects it at rest, not from a compromised device or a malicious extension.

What a proof checks.

One Groth16 circuit over BN254, Transaction(23, 4, 2): a tree of depth 23, up to four input notes and two outputs. It proves that:

• every input note is a leaf under a recent root;
• you hold the secrets that own each input;
• each nullifier is derived correctly, so a note can’t be spent twice;
• inputs equal outputs plus the public amount, all within range;
• the recipient, fee and swap terms are bound to this exact proof.

Proofs are generated in a Web Worker in your browser in a few seconds.

Trading from inside the pool.

A swap spends your notes and trades on Uniswap v4 directly: the pool unlocks the PoolManager itself and swaps along one to three listed pools, between any two listed tokens (on Robinhood Chain, ETH to a stock goes ETH → USDG → stock). No calldata comes from the caller, and the output always lands back in the pool. Your minimum output is part of the proof, so the trade reverts instead of filling at a worse price.

The output arrives as a new note. Everyone can see the pool traded; nobody can see whose notes paid.

Fee

0.5%: taken in ETH when you receive ETH, otherwise from what you sell. Plus the relayer fee. Price impact and slippage still apply.

Relayers pay the gas.

A relayer submits your proof and pays the gas, so your public wallet never appears in a send, swap or withdrawal. Its fee is part of the proof; changing the fee or the recipient makes the proof invalid.

Relayer fees can be paid in ETH, USDG or a listed stock (on Ethereum: ETH, USDC, USDT, DAI or WBTC). The contract accepts proofs from any sender, so you can also submit one yourself, at the cost of linking that wallet.

Endpoints

GET  /info          fees and supported tokens
GET  /events?from=N  pool events for scanning
GET  /nullifiers     spent nullifiers
POST /relay          submit a proof

What each action costs.

Protocol fees accrue in the contract per token. Anyone can call collect(token) to send them to the treasury.

What can still link you.

Deposits and withdrawals are public events. Matching amounts, close timing, an unusual token or a quiet pool can link them. Private sends hide sender, recipient and amount; swaps by the pool are public.

Your RPC provider, the relayer and your browser can see things the proof never reveals, such as your IP address. Use the relayer, wait between moves, and avoid exact amounts.

Addresses and admin powers.

The pool is a single immutable contract with a generated Groth16 verifier. Addresses for each chain, verified source and the ceremony transcript will be published here at launch. Until then there is no official deployment on any chain; any address claiming to be Shroud is not.

Admin powers

• Raise a token’s deposit cap. Caps can never go down.
• Pause new deposits. Sends, swaps and withdrawals can never be paused; only the quantum switch stops them.
• Flip the one-way quantum switch. Anyone who solves the public canary point can flip it too. After that every note leaves through the hash-only exit.
• List Uniswap v4 pools (and their hooks) for private swaps. Listings are permanent; nothing can be unlisted or redirected.

The fee recipient can hand its role to a new address; nobody else can change it. Robinhood Chain has no sanctions oracle; whether its pool screens anyone is still to be decided. On Ethereum, depositors, withdrawal recipients and relayers on the Chainalysis sanctions oracle are refused. Nothing else is screened.