unit PT-8086 · shielded transfer machine
Send without a trace
Put money into the pool once, then pay people at their pool address. That payment moves no token on chain and names nobody: the proof is generated inside your browser and a relayer signs the transaction, so neither wallet is on it.
Live on Robinhood Chain with USDG in our own pool, and on Sepolia with free test money. The pool is young — the figures below are the whole of it, not a sample.
00 — the case
Earning well should not mean being read
A trader who is good at this makes a great deal of money — and every time it moves between wallets, anybody can follow it. Size, timing, who was paid, what is held next. That is the case this was built for, and a great many others are the same case in different clothes.
Salaries, contractors, a share of a desk's profit. Paid from a wallet, each payment publishes what that person is worth to you, and their wallet becomes a permanent branch of yours.
A wallet that has done well is a wallet worth watching. Moving the balance somewhere quieter, in public, only tells the watcher where to look next.
Funding a wallet before it does anything is a signal in itself. On a public ledger the funding transaction dates the intent.
Give out a pt1… address instead of a wallet, and the people paying you cannot see each other, cannot see what you hold, and cannot read what anyone else paid.
what it does not do
It does not hide that you used a pool, and it does not hide the wallet that put money in or the wallet that finally takes it out. It removes the line between them — and pays inside the pool with no transfer at all, so most of the movement never reaches the ledger in the first place.
01 — mechanism
Money does not travel in a straight line
Tokens sit together in one pool. Ownership is recorded as cryptographic commitments in a Merkle tree. Moving value inside the pool emits no transfer at all — so there is nothing to follow.
Your wallet sends USDG into the pool. This step is public and cannot be hidden — your own wallet signs it — but only fixed denominations are accepted, so every deposit looks identical to every other.
The person you are paying gives you their pt1… address. The pool moves the money from your notes to theirs and nothing else happens: publicAmount is zero, no ERC-20 transfer is emitted, and the transaction carries two nullifiers and two commitments that look like everybody else's. There is no payment line for anyone to lay against your deposit. The relayer signs it, so your wallet is not on the transaction either. The contract refuses to charge a fee here, because collecting one would mean moving tokens in public.
The recipient withdraws to an ordinary wallet whenever they need the money — an hour later or never. That step is public and costs 3%, and the relayer signs it too, so their wallet does not appear as the sender. The timing is theirs, not yours, which is the part correlation attacks rely on.
a wallet address is refused here
Money has to leave the pool to reach a 0x… wallet, and that payment is public: the amount, the moment, and the person receiving it. A screen headed send privately should not quietly do that, so it no longer accepts one — ask the person you are paying for their pt1… address. Taking your own money out is a separate control beside the balance, which says plainly that it is public — and lets you take part of it, to whichever wallet you choose.
02 — pool addresses
The address that is not an address
Every wallet that opens this app has one, printed on the send page as pt1…. It is the only thing a recipient has to hand over, and handing it over costs them nothing.
- Derived from one signature by your wallet, hashed into the pool's field. The same wallet always produces the same address, so there is nothing to store and nothing to lose.
- Not an Ethereum address. It holds no ETH, it has no explorer page, and sending it a normal transfer is not possible.
- Publishing it reveals nothing — the pool has no balanceOf, so there is no figure to read off it.
- It is the whole cost of the private route: without one, paying somebody has to end in the pool paying a wallet in public.
One transaction on chain 4663 settling four pool payments at once: eight nullifiers, eight commitments, four roots, and zero ERC-20 transfers. The token contract was never touched, so there is no movement of USDG anywhere to correlate. It was signed by the relayer, not by anyone paying.
Look at it on the explorer: the transfers tab is empty. That is the whole claim, and it is the only one that cannot be argued with.
03 — where it runs
Where it runs
A shielded pool hides you among the people using it, and that crowd is the one ingredient cryptography cannot supply. Ours is being built one deposit at a time, in public, and the numbers above are the honest size of it today.
Robinhood Chain · chain 4663
USDG, six decimals, our contract and our relayer. The fee is 3% and it is charged on the way out, not on the way in and not on a payment inside the pool. There is no burial wait here — the pool is deployed with BURY_UNDER at zero, so a note is spendable as soon as it lands. Young: the crowd is being built one deposit at a time and the figures above are the whole of it, not a sample.
Sepolia · chain 11155111
Identical contract, identical rules, a faucet instead of a bank. This is where to find out what a transfer feels like — what the screen says while it works, how a pool address behaves — before any of it costs anything.
- pool · Robinhood Chain
- 0x60552713…161cE5 ↗
- USDG · 6 decimals
- 0x5fc5360D…F1d168 ↗
- relayer
- 0x7a36EcBf…cCc7Ce ↗
- pool · Sepolia
- 0xfF92eed2…33Bc57 ↗
- mUSDC · test money
- 0xA35093b5…49CA3c ↗
Unaudited, and the trusted setup still has one contributor. USDG is an upgradeable proxy whose issuer can freeze an address — the pool is an address, and freezing it would hold everybody’s balance at once. No version of this contract can prevent that. Send what you can afford to lose.
04 — plainly
What is hidden, what is not
No privacy tool hides everything. This is the real boundary.
- What a pool payment contains — no addresses, no amounts
- Ownership of every note
- Balances — there is no balanceOf
- The link between two notes sent to the same person
- Your wallet does not sign the payment, and does not sign the withdrawal
- That you used this pool at all
- The wallet that put money in, and the wallet that finally takes it out
- Amounts in and out — the ladder makes them identical, not invisible
- A thin pool is defeated by statistics, not by breaking the math
necessary vs sufficient
Cryptography is necessary. Real anonymity also needs a crowd and delay — neither of which can be written in code. A pool payment removes the timing link between the two ends; it does not conscript strangers into the pool.
05 — measured
No estimated figures
Everything below was measured on real hardware and read back from chain — the last figure is a transaction that actually settled, counted on the explorer, not a simulation. Anything unmeasured is labelled as such.
Verifying the proof costs only 235k. Most of the gas is on-chain Poseidon hashing to insert into the tree — the four payments in 0x939c5a7f… ↗ cost 4,813,503 gas between them — which is why a cheap chain matters more than a smaller circuit.
06 — what happens next
Product now, token after
The pool works today with none of what follows. The token gates access and pays the people supplying cover; it is not what makes the machine run.
The pool, running
- Live on Robinhood Chain with USDG, and on Sepolia with free money
- Paying a pool address costs nothing; the 3% falls on the way out
- No token, no holding, no allowlist
Launch, open to all
- Token issued
- Service stays open, no holding required
- Fee share keeps paying the people providing cover
Holders only
- Private transfers become a holder service
- Supplying depth becomes a holder position
- The crowd and the holders become the same people
Supply only falls
- 0.5% of platform fees converted to the token and burned
- Not a buyback that can be paused, a burn
- Every transfer settled removes supply for good
Dates are intent, not a contract. The only column above that is already true is the first one, and it is marked as such.
Send something
Robinhood Chain moves real USDG through our own pool. Sepolia does the same thing with free money and nothing to install but a wallet — the same contract, the same steps, so nothing about it is a surprise later.