What’s private, and what isn’t.
What Shroud hides, what it can’t hide, and what has not been audited yet.
- Deployed
- Not on any chain yet
- Independent audit
- Not yet
- Trusted-setup ceremony
- Not yet, required before mainnet
- Pool contract
- Published at launch
- Robinhood Chain screening
- To be decided
Contracts and circuit pass end-to-end tests on forks of both chains. Until the ceremony and an audit are published, treat Shroud as experimental.
- Chain
- Robinhood Chain
- Proof system
- Groth16 · BN254
- Note encryption
- X25519 + ML-KEM-768
- Key generation
- In your browser
- Admin powers
- Raise caps · pause deposits · list pools · quantum switch
- Upgradeable
- No
What the chain sees, and what it doesn’t.
- DepositsThe depositing wallet, token and amount.
- WithdrawalsThe receiving address, token and amount.
- SwapsThe pool’s trade on Uniswap.
- Every actionA proof, new note commitments and spent nullifiers.
- Private sendsSender, recipient and amount.
- BalancesWhat your notes add up to.
- OwnershipWhich notes are yours.
- The spend linkWhich notes paid for a withdrawal or swap.
Timing, distinctive amounts, your RPC provider and a small pool can all leak more than the proof does. Wait between deposit and withdrawal, avoid exact amounts, and use the relayer.
Quantum computers: what holds and what doesn’t.
- Note encryptionX25519 + ML-KEM-768 hybrid (NIST FIPS 203). Safe if either holds, so notes stored on-chain today can’t be opened later.
- Note ownershipPoseidon hashes only. No elliptic-curve key holds money in the pool.
- What proofs revealNothing, now or later, even to a quantum computer.
- Your moneyOnce the quantum switch is on, every note can leave with hashes only: commit, wait about an hour, reveal.
- Proof systemGroth16 on BN254 is not post-quantum: a large quantum computer could fake proofs. The quantum switch covers this, but only if it is flipped before anyone can forge a proof: the admin is meant to flip it as soon as such a computer looks close.
- ExitsPublic, with no privacy: an exit reveals the wallet’s secrets, so its past moves can be linked. The money is safe, but that history becomes public.
- Your regular walletECDSA, outside Shroud, and not quantum-safe. Withdraw to fresh addresses.
The quantum switch flips one way only: by the admin, or by anyone who solves the canary, a public point on the curve whose key nobody knows. After that, private transfers stay frozen permanently and every note leaves through the hash-only exit. Pre-launch: none of this is deployed or audited yet.
Common questions.
Read these before you put money into any privacy protocol, including this one.
Who controls my funds?
Your spend key. Notes can only be spent with your secrets, through a proof or, once the quantum switch is on, the hash-only exit, and no admin function can move them. That is the design; it has not been audited yet.
What if I lose my 24 words?
Then the notes are gone. Nobody, including us, can recover them. Write the words down offline before you shield anything.
Can a relayer steal or change my payment?
No. The recipient, amount and relayer fee are bound into the proof, so any change makes it invalid. A relayer can refuse or delay; you can then use another one or submit it yourself.
What about the trusted setup?
Groth16 needs one. Phase 1 is the public Perpetual Powers of Tau. Before mainnet we run an open phase-2 ceremony for the Shroud circuit and publish the transcript so anyone can verify it.
Which chain?
Robinhood Chain. The pool is planned to hold ETH, USDG and tokenized stocks such as TSLA and NVDA. It is not deployed yet: the launch waits for the public trusted-setup ceremony and an independent review. The same contract also runs on Ethereum, which can follow later.
Which tokens are safe to shield?
ETH, plus tokens with an open deposit cap. Stablecoins like USDC and USDT, and tokenized stocks on Robinhood Chain, can be frozen by their issuer, including inside the pool. Rebasing and fee-on-transfer tokens are not supported.
Is it quantum-resistant?
Partly. Notes are encrypted with X25519 + ML-KEM-768, so stored notes can’t be opened later, and ownership is proven with hashes, not an elliptic-curve key. The Groth16 proofs on BN254 are not post-quantum, so the pool has a one-way quantum switch: private transfers freeze and every note can leave through a public, hash-only exit. Your regular wallet is outside Shroud and not quantum-safe. All of it is pre-launch and unaudited.
Can I prove my history to someone?
Yes. A zkview viewing key shows your notes and spends to whoever holds it, without letting them spend. Share it only with people you trust with that history.
Are sanctioned addresses blocked?
Robinhood Chain has no on-chain sanctions oracle, so whether the Robinhood Chain pool screens anyone is still to be decided. On Ethereum, the contract refuses deposits from addresses on the Chainalysis sanctions oracle, and withdrawals or relayer fees to them. Notes are never frozen: their owner can always send or withdraw to another address.
Make a private wallet.
The app makes your 24 words in this browser and keeps them there. It takes about two minutes.
Pre-launch · unaudited · no pool live yet