Shield
The pool holds the assets; encrypted notes record who owns what. A note is a Poseidon commitment to an owner key, a token and an amount, appended to a single Merkle tree. Privacy grows with everyone else’s deposits.
Protocol
How Shroud works.
One shared pool on Robinhood Chain. You hold notes instead of a balance, and spend them with proofs instead of signatures.
Step by step
Deposit into the pool.
Deposit ETH or USDC from any wallet. The pool records it as a note that only your keys can open.
- Chain sees
- 0x8ad2…9b3e put in 1.00 ETH
- Stays private
- Who owns the note
Your note joins the tree.
Every note becomes a leaf in one Merkle tree with room for 8,388,608 notes, and all leaves look the same.
- Chain sees
- A new leaf and a new root
- Stays private
- Which leaf is yours
Send to a private address.
Your browser proves the amounts add up, and nullifiers mark your notes spent without saying which.
- Chain sees
- A proof, 4 nullifiers, 2 new leaves
- Stays private
- Sender, recipient and amount
Swap inside the pool.
The pool trades on Uniswap and gives you a note in the new token. Nobody can see whose notes paid.
- Chain sees
- The pool swapped 0.5 ETH for USDC
- Stays private
- Whose notes paid
On Robinhood Chain: USDG and tokenized stocks such as TSLA and NVDA, held and swapped the same way.
Withdraw to any address.
A relayer pays the gas, so even a new address with no ETH can receive. Nothing on-chain points back to your deposit.
- Chain sees
- 0x51f0…c2d4 received 0.5 ETH
- Stays private
- Which deposit paid for it
Timing and exact amounts can still link the two. Wait, and avoid round numbers.
01ShieldExample
The four actions
Send
A private send spends up to four of your notes and creates two new ones: one for the recipient’s zk1 address, one for your change. A relayer submits the proof, so no public wallet of yours appears in the transaction.
Swap
The pool trades on Uniswap v4 itself, along one to three pools the protocol has listed, between any two listed tokens. Your minimum output is bound into the proof. The trade is public; which notes paid for it is not. The output lands as a new note.
Withdraw
Withdraw to any address, including a new one: the relayer pays the gas. The address, token and amount are public. Waiting, and avoiding round or matching amounts, keeps the link to your deposit weak.
Spec sheetQuantum details
What a note is made of.
The circuit, the note format and the encryption, and which parts hold up against a quantum computer.
Notes and proofs
- Circuit
- Transaction(23, 4, 2)
- Note commitment
- Poseidon(npk, token, amount)
- Tree
- Depth 23 · 8,388,608 notes
- Key generation
- In your browser
Quantum
- Note encryption
- X25519 + ML-KEM-768 hybrid
- Note ownership
- Poseidon hashes, no curve key
- Proofs
- Groth16 · BN254, quantum exit as fallback
- Quantum exit
- Commit, wait ~1 hour, reveal
Fees
What each action costs.
Protocol fees go to the treasury, on-chain, in the asset you move. Gas and relayer fees are separate.
| Action | Protocol fee |
|---|---|
| Shield | 0.5% |
| Private send | 0% of the amount; the relayer fee is charged 0.5% |
| Swap | 0.5% in ETH when you receive ETH, else from what you sell |
| Withdraw | 0.5% |
Fee calculator
Protocol fee
0.5% of the amount shielded. Gas is separate.
Make a private wallet.
The app makes your 24 words in this browser and keeps them there. It takes about two minutes.
Pre-launch · unaudited · no pool live yet