Private money on Solana.
Private launches, too.
A Zcash-Sapling shielded pool on Solana mainnet: balances live in encrypted notes, the chain only sees proofs, and a launchpad runs entirely inside the pool. Shield once; send, trade and launch with no trace back to your wallet.
- live on mainnet
- no admin key
- open source
- zcash sapling design
One of the commitments on-chain is this payment. The chain cannot tell which; your anonymity set is the other notes of the same asset.
- —
- SOL deposits
- —
- Notes on-chain
- —
- Relayer delay
- ~3 s
- Proof time
Three moves. That's the whole product.
Shield
Move SOL or any token from your wallet into the pool. One signature. This is the only public step you ever take.
Send, trade, hold
Pay any scash address, buy a launch, or just sit. Amount, sender and recipient are encrypted; a relayer pays gas, so the receiving side never needs SOL.
Withdraw
Exit to a fresh wallet whenever you like. Nothing on-chain links it to the deposit; round amounts and patience keep timing from doing so.
Built like a protocol, not a product.
Everything below is enforced by the programs, mirrored in the SDK and checked in CI. None of it depends on trusting us.
No pause switch. No admin. No multisig.
01There is no key that can freeze, pause or move a note, and no committee that could be pressured into it. The only privileged action in the whole protocol is lowering the cap on new deposits. Once the public ceremony's keys are burned in, the upgrade authority is revoked and the vault is immutable.
A launchpad that lives inside the pool.
02The first launchpad whose primary market exists only behind the privacy wall. You buy and sell new tokens from your shielded balance; your wallet never appears in a single launchpad transaction. At 20 SOL the curve becomes a Raydium pool with every LP token burned.
Yield without a transaction.
03Notes hold shares, not fixed amounts. When fees are donated into a pool, every private balance in it grows at once: no claim, no transaction, no link to you. The share rate has no instruction that lowers it.
Fees set by four AI agents, not a team.
04Each launched token's trading tax (0–5 %) is voted on every minute by four independent model-driven agents holding four keys. No proposer, no guardian, no veto. Every vote is on-chain with its reason, and the tax funds buybacks of the scash token.
Nothing to enter, move or exit.
05The protocol charges no fee to shield, send or withdraw. You pay the relayer's network fee (0.05 % with a small floor), deducted inside the proof, and nothing else.
2⁸⁸ addresses from one key.
06Zcash Sapling design: one viewing key yields an endless supply of unlinkable receiving addresses, and nothing has to be registered on-chain to receive. Share a fresh one with every counterparty.
Built on Solana's 4 KB transactions.
07A full shielded transfer, proof and all, fits in one transaction on the new v1 format. No lookup-table gymnastics, no multi-step settlement, no partial state to clean up.
Every byte is checkable.
08CI verifies the on-chain bytecode against the build, the proving keys against the circuits, and the ceremony transcript against the chain on every run. The spec, the security policy and the audit package are public, and every ciphertext is on-chain, so any copy of the open-source app recovers your notes.
Launch, buy, sell. Nobody sees who.
Anyone can launch a token in two transactions. The creator gets no allocation, no authority and no fee switch; the mint has no mint or freeze authority from its first block. Every buy and sell is a shielded transfer that exits onto the curve and comes straight back into the token's own pool.
- 01Curve793.1 M of 1 B tokens on a constant-product curve. Buys and sells arrive from the pool through one-use keys; your wallet is in none of them.
- 02Tax0–5 %, voted every minute by four AI agents. Wash trading and bots get taxed up; calm markets get taxed down. All of it goes to the agents' treasury.
- 03GraduationAt 20 SOL raised the curve sells its last token. The SOL and the reserved 20.7 % of supply become a Raydium pool; every LP token is burned, so the liquidity is permanent.
- 04AfterThe agents stop setting that token's tax. The treasury buys back the scash token at random moments and burns it or airdrops it to holders.
Same chain. Nothing to read.
A normal transfer publishes who paid whom and how much, forever. A scash transfer publishes a nullifier, a commitment and ciphertext. Flip the switch.
Who learns what.
Send 0.4 SOL to a friend and watch what each party on the way can see.
Prove it locally
A Groth16 proof is written on your device: you own notes worth at least 0.4 SOL, the new notes add up, and nothing was spent twice. About three seconds.
- Sender
- committed
- Recipient
- committed
- Amount
- committed
- Memo
- committed
The proof commits to the facts without containing them.
Shares, not tokens.
A SCASH note holds a share of the SCASH pool. Creator fees from every trade are donated into the pool, so every private SCASH balance grows without a transaction, a claim, or a link to you. SOL and other pools keep a fixed rate of 1.
- 01Tradeevery SCASH trade pays a creator fee
- 02Harvestanyone calls the harvester; it swaps the fee to SCASH and donates it
- 03Growthe pool grows, every share is backed by more SCASH
No keys but yours.
Nobody can freeze a note
No admin path to a note. The one privileged key can only pause new deposits or lower the cap. The upgrade authority is kept only until the ceremony keys are burned in, then revoked; until then it is the one thing to trust.
The pool cannot overpay
A per-asset turnstile enforces total out ≤ total in outside the circuit. A broken proof could never drain more than was deposited.
Proofs never leave your device
Keys, notes and proofs live in the page. The indexer serves ciphertext, the relayer forwards bytes. Neither can read a thing.
Private, still provable
Show one payment to one party with a receipt, and nothing else, when you must.
Questions.
Everything else is in the spec.
Is the deposit private?
No. Shielding is public: an address put X SOL into the pool. Everything after it is private. You hide among the other notes of the same asset, so use round amounts and wait before withdrawing.
Who pays the network fee?
A relayer. Its fee is deducted inside the proof from your notes, so the address that receives funds never needs SOL for gas.
How does the launchpad stay private?
A buy is an unshield whose exit target is the token's curve; the tokens land at a one-use key derived from your seed and are shielded straight back into that token's own pool. A sell is the same in reverse. The curve, the relayer and the chain see throwaway keys, never your wallet.
Where does the yield come from?
Creator fees from SCASH trading are harvested and donated into the SCASH pool. Balances there are shares, so every SCASH note grows at once. It only applies to the SCASH pool and depends on trading volume.
What if this site disappears?
Your keys come from your wallet signature (plus passphrase), and every ciphertext is on-chain. Any copy of the open-source app recovers the same notes.
Is it audited?
An independent audit is not published yet. The code, the ceremony transcript and the audit package are public, and the proving keys switch to the public ceremony's keys when it completes.
Can a phishing site steal my keys?
Any site can ask your wallet to sign the fixed message, which is why the app asks for a passphrase mixed into the key. With a passphrase set, a stolen signature alone is useless; if you turned the passphrase off, it is the whole key. If another site asks you to sign it, refuse.
What can the relayer and indexer see?
Not your notes or keys. They do see your IP address, when you ask and what you ask for: the indexer sees which pages of ciphertext you fetch, the relayer sees when a proof arrives. The relayer's random delay weakens timing correlation; it does not remove it. Use a VPN or Tor and avoid withdrawing right after depositing if that matters to you.