Privacy
Feature by feature, with the limit beside each one.
8 live, 4 planned, and 2 that are access mechanisms, listed as such. Each says what it holds against, what stays public, and how it is verified. SPEC 01 on the front page is the short form.
Live 8
Verified on mainnet. Each check runs against the chain and the repository.
One meta-address, published once. Every payment to it lands at a fresh address with nothing on chain tying one to the next, on rails already deployed that nobody can take away.
Holds againstOther users, your counterparty, and passive chain analysis. Not the sequencer operator, and not the sender.
Does not hideAmounts, timing, and the sender. The caller on the announcement is whoever paid the gas. Fund a stealth address from your own wallet and you have re-linked it.
Verified byIt is. One eth_getCode at the canonical announcer and registry, reproducible in a single curl.
Be paid without handing over anything that outlives the payment. Your wallet derives the address, so the payer gets one address and nothing else: no identifier to compare with another payer, nothing to recognise again, nothing to show anyone. And because you chose the key, no announcement is needed, so what lands on chain is one transfer to one ordinary-looking address with no marker that a privacy tool was involved.
Holds againstThe payer, which is the party every other stealth scheme leaves out. Payments to a meta-address are joined by nothing on chain, and the meta-address itself is a persistent identifier off it: ten payers holding yours can compare notes and know they are paying one person. This gives them nothing to compare.
Does not hideThe transfer, its amount and its timestamp, forever, like any transfer. And the one address itself, which the payer can watch for as long as they like. It is interactive too: one request per payer, handed over, which is why the published meta-address stays for the cases where that is impossible.
Verified byIt is, both halves. packages/stealth/src/request.ts derives the addresses, with nine tests including that a wallet rebuilt from its keys alone produces the same ones and that the key beside each address actually controls it. The wallet then checks them one balance query at a time, never one query naming them together, because the cheap query would tell the endpoint they belong to one person.
A threat model in the product rather than behind a footer link: what each part hides, what it does not, and exactly what our own servers receive.
Holds againstUs. A disclosure that only covers other people is marketing wearing a disclosure as a costume.
Does not hideNothing. It is the thing that says what is hidden, and it gives the limit the wider column.
Verified byIt is. The threat model page reads the same rows the front page does, so the short version cannot soften.
An address holding an asset and no gas is stuck. Sign one permit and it moves, without that address ever sending anything. The wallet builds and signs both calls; you send them from any funded address, which needs no relay and nothing of ours in the path. A relay sending them for you is the same two calls and is not built.
Holds againstPassive chain analysis, which never sees a funding transfer joining your wallet to the stealth address, because no such transfer happens: the address signs and never sends.
Does not hideThe move itself, which is an ordinary public transfer with a public amount and timestamp, forever. And the destination: wherever you send it is now joined to the stealth address on chain, so consolidating several payments into one wallet re-links them yourself. Nothing prevents that but the destination you choose.
Verified byThe signature is checked by recovering the signer from it, which is exactly what the token does, and both selectors are asserted against their published values. What has not happened is one of these executed on chain: that is T09, and no gas figure goes on the site before it.
What is holding itNothing, for the self-service path: it is built. One permit executed end to end on chain (T09) is what turns the gas figures in the specification from estimates into measurements, and a relay that sends the two calls for you is a separate thing that is not built.
Put in any address on this chain and see what a passive observer already derives from it: the balance, the counterparties, the assets, the timing. Every line is one ordinary call any explorer makes.
Holds againstNobody. It hides nothing. It demonstrates the threat instead of inventing a statistic about it.
Does not hideAnything. It is the thing that shows what is not hidden.
Verified byIt runs against any address, and every call it makes is one you can make yourself against any public endpoint.
The sender takes the recipient’s meta-address, from a QR or pasted, derives a fresh stealth address from it on their own side, pays it, and announces it. The QR is the device-to-device half and it is in the wallet now: nobody types 141 characters.
Holds againstEveryone but the sender. The recipient’s published address and the address that receives are joined by nothing on chain.
Does not hideThe recipient from the sender, who knows whom they paid. Amounts and timing stay public.
Verified byThe payer page derives the address and produces the announce calldata; the announcer records the call. The QR encoder is ours, in packages/shared/src/qr.ts, checked by reading the matrix back with an independent reader. The first payment made this way will be posted with its hash.
Your wallet wrapped by a passphrase-derived key and kept in this browser, so closing the tab no longer loses it. PBKDF2 at 600,000 iterations into AES-256-GCM, both from the platform, no dependency added to the one path that touches a private key.
Holds againstAnyone who reaches the stored copy later: a shared machine, a synced profile, a backup. Without the passphrase it is ciphertext, and a tampered blob fails the tag check rather than decrypting to garbage.
Does not hideAnything from a script running on the page, which can read the stored blob and the passphrase as it is typed. That needs a separate process, which is what the extension is for and why it is still on this list. Nor anything from someone who has your passphrase.
Verified byIt is. packages/stealth/src/vault.ts, with eight tests covering the wrong passphrase, a tampered ciphertext, salt and IV freshness, and that no private key appears in the stored blob.
Derive an address for a swap to pay out to, so the output does not accumulate at the address that swapped, and announce it so your own scanner finds it later. Set it as the recipient wherever you swap.
Holds againstAnyone reading the address you swapped from. The output is not there, so a position built over several swaps does not aggregate into one readable total.
Does not hideThe swap. A pool interaction, its amount and its timestamp are public forever, and so is the address that sent it, which is an address you already funded. This separates the output from it, not the input.
Verified byIt is. The derivation is the same one the payer station runs and the same one the test suite checks, and the announcement is the canonical announcer call.
What is holding itA built-in swap transaction. The deployed UniversalRouter implements v2, v3 and v4 swaps, established on chain by a controlled comparison, but a router encoding cannot be verified from here and a wrong one in a panel that moves money is not worth shipping on confidence.
Planned 4
Each with the milestone it ships in and the check that marks it live. Nothing here is a date.
The lookups the app makes are encrypted and authenticated, so a provider that hijacks the chain domain today cannot read them or answer in its place.
Holds againstYour network provider, and the default endpoint operator, who never sees your address paired with your network address.
Does not hideThe destination. It is not a tunnel for your machine. It also makes us the party able to see that pairing, limited only by architecture that never records it, and by this page saying so.
Live whenBefore and after, captured on a provider that hijacks the chain domain, reproduced on two other networks and published.
Hand the viewing key to the party entitled to it, scoped to a period or a mandate. The holder sees every address in scope and can move nothing.
Holds againstThe market. Prove the position to your auditor, your investors or your regulator on demand, and stop proving it to everyone else.
Does not hideAnything from the holder of the key, within its scope, for as long as that scope lasts. That is the point of it.
Live whenThe scope is carried in the key material itself and the format is published, so a holder can check what a key covers before accepting it.
What is holding itThe scope format, which has to be carried in the key material itself so a holder can check what a key covers before accepting it. Nothing about it is written yet.
A large fill lands as tranches at fresh addresses, so the position never aggregates into one readable total.
Holds againstThe counterparty who would quote worse next time, the competing buyer, and the bot, all of whom price the next tranche against the running total.
Does not hideEach fill, its amount and its timing. The desk that fills the order knows exactly who it filled and how much. Consolidating tranches later re-links all of them at once.
Live whenThe book, the tranche splitter, and the first large fill landing as separate tranches with every hash published.
What is holding itThe book, which is not built. The tranche logic depends on it, so this follows rather than leads.
Signed quotes settle atomically in one two-leg transaction that never warehouses a stock token.
Holds againstOther participants. Each counterparty is sealed from the other until a fill, and sizes and prices stay invisible to the book.
Does not hideOur server, which sees every quote and both sides. That is where the sealing lives, and it is a trust assumption rather than a cryptographic one. A chain analyst still sees two addresses trade.
Live whenThe settlement contract verified on the explorer, and the first sealed fill with its hash.
What is holding itThe settlement contract, written and verified on the explorer, plus the first sealed fill with its hash. No contract exists yet.
Not privacy 2
Access mechanisms, listed beside the privacy features so the distinction is never blurred.
A fee taken on a routed swap.
Holds againstNothing on its own. Its privacy comes only from being composed with a stealth address.
Does not hideThe trade. A pool’s reserve change is visible forever and the amount is derivable from it. There is no public pending pool on this chain, so protection from front-running is not something we can honestly claim in either direction.
Live whenListed here so it is never mistaken for a privacy feature.
An access mechanism. Tier follows balance and continuous days, and meters the sponsored sweep allowance.
Holds againstNothing. It is not a privacy mechanism.
Does not hideStaking is a public act tied to an address. Stake from the wallet you receive stealth payments into and you have linked the two yourself. The interface will say so at the moment of staking, not afterwards.
Live whenListed here so it is never mistaken for a privacy feature.
What is holding itThe token, which does not exist yet. Tier follows balance and continuous days, and there is no balance to follow.
14 entries, drawn from the threat model, the roadmap and the narrative.