Private payments
on Robinhood Chain.
Shield ETH, USDG or tokenized stocks into one shared pool on Robinhood Chain, then send and swap inside it. The chain records a proof, not who paid whom or how much.
Pre-launch: no pool is live yet and nothing is audited.Status
Drag to hide more or less of the sample ledger. An illustration, not a setting.
A public transfer next to a private send.
A normal Robinhood Chain transfer records who paid whom and how much, permanently. A Shroud private send records a proof that the transfer is valid, without the sender, recipient or amount.
| Field | Public transferRobinhood Chain | Private sendShroud |
|---|---|---|
| Amount | 2.5000 ETH | Hidden |
| From | 0x8ad2…9b3e | Hidden |
| To | 0x51f0…c2d4 | Hidden |
| Sender balance | 18.4021 ETH | Hidden |
| Sender’s history | Every past move | Not linkable |
| On the chain | This transfer, forever | A proof ✓, 2 notes, 4 nullifiers |
Four actions, step by step.
Pick a step to see what the chain can see. Your browser builds each proof in a few seconds, and your keys never leave it.
Deposit into the pool.
Deposit from any wallet. The pool records it as a note that only your keys can open, in one shared tree of 8,388,608 slots where all notes look the same.
- Chain sees
- 0x8ad2…9b3e put in 1.00 ETH
- Stays private
- Who owns the note, and which leaf it is
Send to a private address.
Your browser proves the amounts add up, and nullifiers mark your notes spent without saying which.
- Chain sees
- A proof, 4 nullifiers, 2 new leaves
- Stays private
- Sender, recipient and amount
Swap inside the pool.
The pool trades on Uniswap and gives you a note in the new token. Nobody can see whose notes paid.
- Chain sees
- The pool swapped 0.5 ETH for USDC
- Stays private
- Whose notes paid
On Robinhood Chain: USDG and tokenized stocks such as TSLA and NVDA, held and swapped the same way.
Withdraw to any address.
A relayer pays the gas, so even a new address with no ETH can receive. Nothing on-chain points back to your deposit.
- Chain sees
- 0x51f0…c2d4 received 0.5 ETH
- Stays private
- Which deposit paid for it
Timing and exact amounts can still link the two. Wait, and avoid round numbers.
What a quantum computer could break.
Q-day is when a quantum computer can break the elliptic-curve keys most of crypto runs on. Nobody knows when that will be, and the chain keeps everything, so data posted today could be read then. Here is what holds and what doesn’t.
Notes are encrypted twice.
The chain keeps every encrypted note forever, so someone could copy them today and try to decrypt them once a quantum computer exists. Shroud encrypts each note with two schemes at once: X25519, and ML-KEM-768, the NIST post-quantum standard. Breaking one of them is not enough to read the note.
- Chain sees
- Encrypted notes, kept forever
- Stays private
- Amounts and who paid whom
Ownership is proven with hashes.
Note ownership is proven with Poseidon hashes only, so the pool holds no elliptic-curve key for a quantum computer to break. The zero-knowledge proofs reveal nothing, now or later.
- Chain sees
- Hashes and proofs
- Stays private
- The secrets behind them
Your regular wallet still runs on an elliptic-curve key. That part is outside Shroud.
An emergency exit.
The proofs themselves (Groth16 on BN254) are not post-quantum: a large quantum computer could fake them. So a one-way switch, flipped by the admin or by anyone who solves a public canary, freezes private transfers and lets every note leave with hashes alone.
- Chain sees
- Every exit, in public
- Stays safe
- The money in every note
The switch has to flip before anyone can forge a proof, and an exit makes that wallet’s history public.
X25519 + ML-KEM-768 together. Safe if either holds.
HoldsPoseidon hashes, no curve key to crack.
HoldsNothing, even to unlimited computing power.
HoldsGroth16 on BN254 can be forged on Q-day. The one-way switch freezes private transfers.
Covered by the switchEvery note exits with hashes only: commit, wait about an hour, reveal. Public, no privacy.
Covered by the switchAny address that has sent a transaction exposes its key. Withdraw to fresh addresses.
Outside ShroudPre-launch and unaudited. The quantum design in full
Technical details.
BN254 curve. The pool contract verifies every proof on-chain.
Spend up to four notes, create two. Amounts never appear.
8,388,608 notes in one tree, shared by every token.
A relayer submits sends, swaps and withdrawals, so your wallet never signs them.
On shield, swap and withdraw. Private sends: 0% of the amount.
No proxy. The admin can’t move notes: it can raise deposit caps, pause new deposits, list Uniswap pools and flip the quantum switch.
ETHEther
USDGGlobal Dollar
TSLATesla
NVDANVIDIA
AAPLApple
On Robinhood Chain: ETH, USDG and 15 tokenized stocks, including TSLA, NVDA and AAPL.
$SHROUD on Robinhood Chain.
One billion coins, all of it in a Uniswap v4 pool at launch, with the liquidity held by the coin contract so nobody can pull it.
- Supply
- 1,000,000,000
- Allocation
- 100% to the pool at launch
- Liquidity
- Held by the coin contract, permanently
- Trading fee
- 2% per trade: 1% pool + 1% on the ETH side
- Transfer tax
- None
- Max wallet
- 2% for the first 3 minutes, then removed
- Owner
- None: ownership renounced
No transfer tax. Sending $SHROUD from one wallet to another costs only gas. The 2% applies to buys and sells through the pool. The coin contract has no mint and no blacklist, and the protocol does not depend on it.
Make a private wallet.
The app makes your 24 words in this browser and keeps them there. It takes about two minutes.
Pre-launch · unaudited · no pool live yet