One note, six hops, zero leaks.
A shielded note travels through six stages — each one cryptographically enforced, none of them readable.
The pipeline, stage by stage.
From public tokens to an untraceable exit — six stages, each with a real protocol component behind it.
Deposit
You send tokens to DepositManager. A note is minted: token, amount, nullifier key, commitment.
Prove
Your browser proves ownership locally — Plonky3 STARKs in WASM, zero network exposure.
Broadcast
The ciphertext intent is broadcast to canisters. To the chain it is noise.
Batch
The TEE accumulates amounts homomorphically with tfhe-rs. No one decrypts.
Settle
L1 contracts verify the epoch proof and move only commitments and roots.
Withdraw
A fresh stealth address receives the funds — the link is mathematically severed.
What the chain sees, what it never sees.
Two columns, one hard boundary. Everything on the left is public by design — everything on the right does not exist outside your device.
Public on-chain
The ledger's price of admission
- Opaque commitments (Poseidon hashes)
- Nullifiers of spent notes
- Merkle tree roots per epoch
- Compliance registry status
- Batch proof verification events
Never revealed
Mathematically impossible to leak
- Your note secrets and private keys
- Plaintext amounts (outside the TEE)
- Link between depositor and note
- Link between note and recipient
- Your real addresses and balances
Four layers, one promise.
Every layer is built so that no single component can violate your privacy — and every transition is cryptographically enforced.
Client — Your Device
The wallet derives note secrets locally and generates Plonky3 ZK proofs in WASM. No server ever touches your keys, secrets, or amounts.
Coordination — ICP Canisters
Relayer, verifier, and indexer canisters verify proofs, lock nullifiers, schedule batches, and move only commitments and ciphertexts.
Privacy Core — TEE Coprocessor
tfhe-rs inside the trusted execution environment accumulates amounts homomorphically. Plaintext exists only transiently inside the enclave.
Settlement — L1 Contracts
NoxVault, DepositManager, and ComplianceRegistry enforce state transitions with only commitments, nullifiers, and roots — never amounts.
Built on verifiable primitives.
No marketing magic — each mechanism maps to a real component in the protocol, documented from code.
Plonky3 STARKs
Client-side proving with BabyBear/Poseidon2. Note, spend, mix-spend, split, and epoch AIRs verify conservation without revealing inputs.
Fully Homomorphic Encryption
tfhe-rs in the TEE adds encrypted amounts directly (fhe_add). Buckets accumulate as ciphertext — no one decrypts individual values.
Stealth Notes
Every output is a fresh commitment H(secret, H(asset, CommitAmount(amount))). The on-chain tree sees only opaque hashes.
Compliance Gate
Deposits are blocked until the wallet is registered and matured. Holding periods are enforced by contracts, not promises.
Zero-MEV Execution
Intents stay encrypted until settlement. CoW batch auctions execute trades through solver competition — no mempool exposure.
ZK Proving, Locally
Proofs are generated in your browser via WASM. The relayer only forwards opaque payloads; verification happens on-chain in canisters.
Ready to stay private?
Start with Nox and take control of your financial privacy.