🫥
Amounts hidden
Balances are Pedersen commitments. A transfer carries only a commitment — the amount never appears in calldata.
Provably sound
A zero-knowledge range proof (bit-decomposition) shows the hidden amount is non-negative and bounded — verified on-chain via the bn254 precompiles.
🔭
Auditable
A viewing key lets a designated auditor recover amounts for compliance, while they stay hidden from the public.
How it works. Deposit converts public tokens into a hidden commitment C = v·G + r·H. A confidential transfer subtracts a commitment from the sender and adds it to the recipient (homomorphic), authorised by a Schnorr opening proof and a range proof — all built in your browser (the amount and blinding never leave the client). Withdraw reveals a balance to exit.