VEIL is a private balance for Robinhood Chain. Value you put in is held as encrypted notes that only your keys can read, and you can send it, trade it and withdraw it without your public wallet ever appearing as the holder or the counterparty.
The thing VEIL hides is who owns what. A transfer between two veiled balances has no sender field and no recipient field on chain — the contract sees a proof, a nullifier that retires the old note and a commitment that creates the new one. It cannot tell whose they are, and neither can anyone watching.
Value entering and leaving has to touch an ordinary address, so those two moments are the ones that need care. Most of this page is about them.
This is privacy, not anonymity. An observer can see that a transaction happened, for which asset, and what it paid in gas. What they cannot see is which note moved, what it was worth, or who owns it.
Four steps. The first three take about a minute.
Connect the wallet you already use, then generate your VEIL wallet behind it. A VEIL wallet is an ordinary EVM wallet with a private balance behind it. The 24-word phrase you are shown once derives both: the 0x address any wallet would show for those words, and the keys to your veiled notes. Write it down; it cannot be reissued.
Send ETH or tokens to your wallet address from any wallet or exchange, then move them into the veiled balance from Portfolio. Or use Add funds to pay from another chain and have a Relay solver make the deposit. See Adding funds.
Your wallet finds its notes by trial-decrypting the pool’s ciphertexts. The first scan reads the chain from the pool’s first block; after that it only reads new ones. Nothing is uploaded and no server is told what you own.
Send to any VEIL address, buy any token the pool can custody, or withdraw to an ordinary wallet. Every action states what it exposes before you sign it.
Three marks carry the whole exposure model.
VEIL would rather stop than show you a number it cannot stand behind. If a quote has gone stale, if a token charges a fee the contract will not report at this block, or if the app cannot verify a market, the button is disabled and the reason is on screen. None of these are errors in your wallet — they are the app declining to sign something it cannot bound.
Two ways in, and they are not equivalent.
You pay on another chain. Relay’s solver makes the deposit into VeilPool, so the depositor of record is the solver. No transaction on Robinhood Chain links your address to VEIL — which removes the single largest practical deanonymisation risk in the product.
You sign the deposit yourself on Robinhood Chain. It is one step and it is cheaper. The address you deposit from, the amount and the timestamp are on chain forever, and they stay linked to VEIL.
Whichever route you use, the note lands on a fresh diversified address, so the deposit is not tied to any address you have handed out.
A deposit is the moment value enters the anonymity set, not a use of it. How much privacy it buys depends on how many other people are in the pool at the same time.
Every address this wallet issues belongs to the same account, and nobody without your viewing key can tell that two of them do. Give each sender their own and they cannot compare notes to reconstruct your activity.
What a fresh address does not fix: if someone pays you from an address publicly tied to your name, that payment was already public before it reached VEIL. A fresh address protects you from senders comparing notes with each other. It cannot un-publish a public transfer.
A send to another VEIL address is the one operation that is private end to end. There is no sender field, no recipient field and no amount on chain — only a proof, the nullifiers of the notes you spent and the commitments of the notes you created.
Notes are spent whole. Paying 0.4 from a note worth 1 creates a 0.4 note for the recipient and a 0.6 note back to you, exactly like cash. The proof enforces that inputs and outputs balance, so no send can create value even if every other part of the app is compromised.
A pons token can charge a creator tax and a snipe tax that VEIL cannot read at the current block. An unread fee is not a zero fee: signing would authorise a withdrawal of an amount nobody can bound, and the minimum-received figure would not hold. VEIL shows those components as Unknown and refuses the trade rather than quoting a number it cannot stand behind.
How VEIL reaches tokens that do not live on a pons curve.
A launch still on its bonding curve is priced and traded on that curve directly. Everything else — a graduated launch, or any other EVM token — is routed through Relay, which finds a path and executes it. The token settles back into the pool as a veiled note either way, so the privacy outcome is the same; the cost is not, because a routed swap pays a solver.
Bridging moves value between Robinhood Chain and another chain. Arriving is the private route described under Adding funds. Leaving is public at the destination: the address that receives is an ordinary address on an ordinary chain, and it is visible there.
Your token, on the pons curve.
A launch is the pons factory’s own call — the same one its site makes — signed by your wallet. Supply is 1B, the curve charges a 1% fee, and the token graduates to a pool at 4.2 ETH.
The creator address, the name, the image and the socials are on chain, as they are for every pons launch. Proceeds from your tax arrive at the splitter and are yours to move — into a veiled balance, if you choose.
A withdrawal moves value out of the pool to an address you name, and that address, the asset and the amount are public from the moment it lands. This is unavoidable — the value has to become an ordinary balance to be an ordinary balance.
Your master secret is generated in this browser, encrypted with your device password, and never uploaded. There is no recovery key, no password reset and no support channel that can restore a wallet. The 24-word phrase and this device are the only two ways in.
Everything. Notes are found by scanning the chain and decrypting with keys derived from the master secret, so a fresh device with the phrase rebuilds the whole account from public data. Nothing needs to have been backed up beyond the phrase itself.
A Full Viewing Key reconstructs every note, spend and balance of an account, and can produce no proof, so it cannot move anything. The circuit takes the spending key as a witness and derives the viewing keys inside itself, which is why a viewing key holder is structurally unable to spend rather than merely discouraged from it.
Decryption happens on the holder’s device from public chain data, so there is no expiry and no revocation. To end an auditor’s visibility you move to a new account epoch. There is no such thing as a date-limited viewing key, so VEIL offers no date filter — it would be cosmetic, not cryptographic. To disclose one payment rather than an account, use a proof of payment instead.
A relayer submits your proof so your own EVM address never appears as the sender and never pays the gas. Without one, you submit the transaction yourself and that address is on chain as the submitter — the contents stay veiled, the fact that you submitted does not.
No relayer is enabled by default. Which one you trust with your IP address is not a decision this app makes for you.
Read from the manifest this app is configured with.
No deployment manifest
VeilPool has no owner, no admin, no upgrade path, no sweep and no way to change its verifier. No code path moves an asset except by consuming a note with a valid proof, so a compromised frontend or relayer cannot cause a loss of custody.
The honest list, in one place, so none of it has to be discovered later.
The normative specification lives in the repository under docs/ — protocol.md, cryptography.md, privacy-model.md and threat-model.md. Never describe VEIL as untraceable, fully anonymous or invisible; those are false, and this page says why.