Pre-launchOpen app

Shroud documentation

Overview

Private money, explained.

Shroud is a shielded pool for ETH and ERC-20 tokens on Ethereum. You deposit into one shared contract and receive encrypted notes. You spend those notes with zero-knowledge proofs: the contract checks that the rules were followed without learning who, what or how much.

Pre-launch

The contracts and circuit are unaudited and not deployed. Don’t shield money you can’t afford to lose.

Security status

Four actions

Shield from any wallet into the pool. Send privately to a zk1 address. Swap through Uniswap without leaving the pool. Withdraw to any Ethereum address.

Getting started

Start with 24 words.

  1. Open the app and create a private wallet. Your browser generates a 24-word phrase; it never leaves your device.
  2. Write the words down offline. They are the only way to recover your notes. Nobody can reset them.
  3. Set a password. It encrypts the wallet in this browser so you don’t retype the words.
  4. Shield ETH or a supported token from any Ethereum wallet.
  5. Share your zk1 address to get paid privately. It is safe to post publicly.
Open app
Notes & keys

Ownership without a public balance.

A note is a commitment Poseidon(npk, token, amount) stored as a leaf in the pool’s Merkle tree. Only the owner can open it; the encrypted copy lets your wallet find it again from chain data.

Your keys

  • Spend secret authorizes spending. Never share it.
  • Nullifier secret marks a note spent without revealing which leaf it was.
  • zk1 address lets others send to you. Public.
  • zkview key shows your history read-only. Share with care.

Storage

The wallet is encrypted in your browser with PBKDF2 (600,000 iterations) and AES-256-GCM. That protects it at rest, not from a compromised device or a malicious extension.

Proofs

Prove the rules. Keep the details.

One Groth16 circuit over BN254, Transaction(23, 4, 2): a tree of depth 23, up to four input notes and two outputs. It proves that:

  • every input note is a leaf under a recent root;
  • you hold the secrets that own each input;
  • each nullifier is derived correctly, so a note can’t be spent twice;
  • inputs equal outputs plus the public amount, all within range;
  • the recipient, fee and swap terms are bound to this exact proof.

Proofs are generated in a Web Worker in your browser in a few seconds.

Trusted setup

Phase 1 is the public Perpetual Powers of Tau. A public phase-2 ceremony for this circuit runs before mainnet; the transcript will be published for anyone to verify.

Swaps

Public liquidity from inside the pool.

A swap spends your notes and routes the trade through Uniswap’s Universal Router (v2, v3 and v4 pools). One side must be ETH. Your minimum output is part of the proof, so the trade reverts instead of filling at a worse price.

The output arrives as a new note. Everyone can see the pool traded; nobody can see whose notes paid.

Fee

0.5% of the ETH side, plus gas and the relayer fee. Price impact and slippage still apply.

Relayers

Someone else pays the gas.

A relayer submits your proof and pays the gas, so your public wallet never appears in a send, swap or withdrawal. Its fee is part of the proof; changing the fee or the recipient makes the proof invalid.

Relayer fees can be paid in ETH, USDC, USDT, DAI or WBTC. The contract accepts proofs from any sender, so you can also submit one yourself, at the cost of linking that wallet.

Endpoints

GET  /info          fees and supported tokens
GET  /events?from=N  pool events for scanning
GET  /nullifiers     spent nullifiers
POST /relay          submit a proof
Fees

Know what you pay.

ActionProtocol feePlus
Shield0.5%Gas from your wallet
Send0%Relayer fee
Swap0.5% of ETH sideRelayer fee, pool fees
Withdraw0.5%Relayer fee

Protocol fees accrue in the contract per token. Anyone can call collect(token) to send them to the treasury.

Fee calculator
Privacy limits

The trail is bigger than the proof.

Deposits and withdrawals are public events. Matching amounts, close timing, an unusual token or a quiet pool can link them. Private sends hide sender, recipient and amount; swaps by the pool are public.

Your RPC provider, the relayer and your browser can see things the proof never reveals, such as your IP address. Use the relayer, wait between moves, and avoid exact amounts.

The full boundary
Contracts

Verify before you interact.

The pool is a single immutable contract with a generated Groth16 verifier. Addresses, verified source and the ceremony transcript will be published here at launch. Until then there is no official deployment; any address claiming to be Shroud is not.

Admin powers

  • Raise a token’s deposit cap. Caps can never go down.
  • Pause new deposits. Sends, swaps and withdrawals can never be paused.
  • Change the fee recipient.

Deposits from addresses on the Chainalysis sanctions oracle are refused. Nothing else is screened.