What’s private.
What isn’t.
Privacy tools fail quietly. Here is exactly what Shroud hides, what it can’t, and what is still unverified.
- Independent audit
- Not yet
- Trusted setup ceremony
- Before mainnet
- Pool contract
- Published at launch
- Proof system
- Groth16 · BN254
- Key generation
- In your browser
- Admin powers
- Raise caps · pause new deposits
- Upgradeable
- No
Contracts and circuit pass end-to-end tests on a mainnet fork. No audit and no ceremony yet, so treat Shroud as experimental until both are published.
Private doesn’t mean
invisible.
- DepositsThe depositing wallet, token and amount.
- WithdrawalsThe receiving address, token and amount.
- SwapsThe pool’s trade on Uniswap.
- Every actionA proof, new note commitments and spent nullifiers.
- Private sendsSender, recipient and amount.
- BalancesWhat your notes add up to.
- OwnershipWhich notes are yours.
- The spend linkWhich notes paid for a withdrawal or swap.
Timing, distinctive amounts, your RPC provider and a small pool can all leak more than the proof does. Wait between deposit and withdrawal, avoid exact amounts, and use the relayer.
Questions.
Straight answers.
Read these before you put money into any privacy protocol, including this one.
Who controls my funds?
Your spend key. Notes can only be spent with a proof built from your secrets, and no admin function can move them. That is the design; it has not been audited yet.
What if I lose my 24 words?
Then the notes are gone. Nobody, including us, can recover them. Write the words down offline before you shield anything.
Can a relayer steal or change my payment?
No. The recipient, amount and relayer fee are bound into the proof, so any change makes it invalid. A relayer can refuse or delay; you can then use another one or submit it yourself.
What about the trusted setup?
Groth16 needs one. Phase 1 is the public Perpetual Powers of Tau. Before mainnet we run an open phase-2 ceremony for the Shroud circuit and publish the transcript so anyone can verify it.
Which tokens are safe to shield?
ETH, plus tokens with an open deposit cap. Stablecoins like USDC and USDT can be frozen by their issuer, including inside the pool. Rebasing and fee-on-transfer tokens are not supported.
Is it quantum-resistant?
No. Groth16 on BN254 and X25519 note encryption are not post-quantum. We will not claim otherwise.
Can I prove my history to someone?
Yes. A zkview viewing key shows your notes and spends to whoever holds it, without letting them spend. Share it only with people you trust with that history.
Are sanctioned addresses blocked?
Deposits from addresses on the Chainalysis sanctions oracle are refused. Sends, swaps and withdrawals of existing notes are never blocked.
A little less
public.
Shield, send, swap. Keep the receipts to yourself.