What VEIL is

VEIL is a private balance for Robinhood Chain. Value you put in is held as encrypted notes that only your keys can read, and you can send it, trade it and withdraw it without your public wallet ever appearing as the holder or the counterparty.

The thing VEIL hides is who owns what. A transfer between two veiled balances has no sender field and no recipient field on chain — the contract sees a proof, a nullifier that retires the old note and a commitment that creates the new one. It cannot tell whose they are, and neither can anyone watching.

Value entering and leaving has to touch an ordinary address, so those two moments are the ones that need care. Most of this page is about them.

This is privacy, not anonymity. An observer can see that a transaction happened, for which asset, and what it paid in gas. What they cannot see is which note moved, what it was worth, or who owns it.

Getting started

Four steps. The first three take about a minute.

1
Connect, then generate

Connect the wallet you already use, then generate your VEIL wallet behind it. A VEIL wallet is an ordinary EVM wallet with a private balance behind it. The 24-word phrase you are shown once derives both: the 0x address any wallet would show for those words, and the keys to your veiled notes. Write it down; it cannot be reissued.

2
Add funds

Send ETH or tokens to your wallet address from any wallet or exchange, then move them into the veiled balance from Portfolio. Or use Add funds to pay from another chain and have a Relay solver make the deposit. See Adding funds.

3
Wait for the scan

Your wallet finds its notes by trial-decrypting the pool’s ciphertexts. The first scan reads the chain from the pool’s first block; after that it only reads new ones. Nothing is uploaded and no server is told what you own.

4
Use it

Send to any VEIL address, buy any token the pool can custody, or withdraw to an ordinary wallet. Every action states what it exposes before you sign it.

Reading the interface

Three marks carry the whole exposure model.

Status marks
PrivateNothing on chain names you. This covers your balance, your notes, transfers between veiled balances, and who holds a token the pool bought for you.shielded
PublicAn address is involved and the fact is permanent. Direct deposits, withdrawals to an ordinary wallet, and the market impact of a trade are all public.onchain
UnknownVEIL could not read something it needs — a token fee, a fresh price. It blocks the action rather than guessing. An unread fee is not a zero fee.Refused
Why actions get refused

VEIL would rather stop than show you a number it cannot stand behind. If a quote has gone stale, if a token charges a fee the contract will not report at this block, or if the app cannot verify a market, the button is disabled and the reason is on screen. None of these are errors in your wallet — they are the app declining to sign something it cannot bound.

Adding funds

Two ways in, and they are not equivalent.

The private routeshielded

You pay on another chain. Relay’s solver makes the deposit into VeilPool, so the depositor of record is the solver. No transaction on Robinhood Chain links your address to VEIL — which removes the single largest practical deanonymisation risk in the product.

Relay sees the hopRelay executes the deposit, so it can link the address you paid from to the specific note this creates — the same fact a direct deposit publishes to everyone, except only Relay holds it. It cannot read the note, follow it once it is spent, see any balance, or move anything.Trusted for this
The origin payment is publicAn ordinary transaction from your own wallet on whichever chain you pay from.onchain
Exact deliveryA note commits to its value, so the delivered amount has to match to the base unit. VEIL quotes the route as an exact-output swap for that reason.EXACT_OUTPUT
The direct routeonchain

You sign the deposit yourself on Robinhood Chain. It is one step and it is cheaper. The address you deposit from, the amount and the timestamp are on chain forever, and they stay linked to VEIL.

Amount and timing link the two endsDeposit 3.7194 ETH and trade 3.7194 ETH four minutes later, and anyone can line the two up without breaking a proof. Round amounts and a delay both help; the private route removes the link entirely.onchain

Whichever route you use, the note lands on a fresh diversified address, so the deposit is not tied to any address you have handed out.

onchain

A deposit is the moment value enters the anonymity set, not a use of it. How much privacy it buys depends on how many other people are in the pool at the same time.

Addresses

Every address this wallet issues belongs to the same account, and nobody without your viewing key can tell that two of them do. Give each sender their own and they cannot compare notes to reconstruct your activity.

A fresh address costs nothingNothing about it is published until it is used, and scanning is O(1) in the number of addresses — the performance property and the privacy property are the same property.shielded

What a fresh address does not fix: if someone pays you from an address publicly tied to your name, that payment was already public before it reached VEIL. A fresh address protects you from senders comparing notes with each other. It cannot un-publish a public transfer.

Sending

A send to another VEIL address is the one operation that is private end to end. There is no sender field, no recipient field and no amount on chain — only a proof, the nullifiers of the notes you spent and the commitments of the notes you created.

What the chain recordsThat some note was spent and some note was created, at a time, paying gas. Not which, not whose, not how much.shielded
Who submitted itWhoever paid the gas is on chain as the sender of the transaction. Use a relayer if that address should not be yours.onchain
Change, and why a send can need two notes

Notes are spent whole. Paying 0.4 from a note worth 1 creates a 0.4 note for the recipient and a 0.6 note back to you, exactly like cash. The proof enforces that inputs and outputs balance, so no send can create value even if every other part of the app is compromised.

Trading

What a trade reveals
Source ownershipWhich veiled note funded the buy. The chain sees a nullifier, not a note.shielded
Destination ownershipWho holds the tokens afterwards. They are held by the pool against a veiled note, and your own wallet's balance of that token never changes.shielded
Market impactThe curve moves, reserves change and a trade event fires. Size, direction, timing and price impact are all visible, and an observer who already knows your deposit can try to line the two up.onchain
Why a trade gets blocked

A pons token can charge a creator tax and a snipe tax that VEIL cannot read at the current block. An unread fee is not a zero fee: signing would authorise a withdrawal of an amount nobody can bound, and the minimum-received figure would not hold. VEIL shows those components as Unknown and refuses the trade rather than quoting a number it cannot stand behind.

A stale quotePast the freshness window a quote is not an executable price.Refused

Swap and bridge

How VEIL reaches tokens that do not live on a pons curve.

A launch still on its bonding curve is priced and traded on that curve directly. Everything else — a graduated launch, or any other EVM token — is routed through Relay, which finds a path and executes it. The token settles back into the pool as a veiled note either way, so the privacy outcome is the same; the cost is not, because a routed swap pays a solver.

Bridging

Bridging moves value between Robinhood Chain and another chain. Arriving is the private route described under Adding funds. Leaving is public at the destination: the address that receives is an ordinary address on an ordinary chain, and it is visible there.

Launching

Your token, on the pons curve.

A launch is the pons factory’s own call — the same one its site makes — signed by your wallet. Supply is 1B, the curve charges a 1% fee, and the token graduates to a pool at 4.2 ETH.

Launch fee0.0005 ETH
Creator tax2% on every trade
Your sharePaid to a splitter that only you and VEIL are written into. Your half cannot be changed by anyone, VEIL included.1%
What is public

The creator address, the name, the image and the socials are on chain, as they are for every pons launch. Proceeds from your tax arrive at the splitter and are yours to move — into a veiled balance, if you choose.

Withdrawing

A withdrawal moves value out of the pool to an address you name, and that address, the asset and the amount are public from the moment it lands. This is unavoidable — the value has to become an ordinary balance to be an ordinary balance.

Withdraw to a fresh addressAn address with no history is worth far more here than a clean transaction. Withdrawing to the address you deposited from links both ends and undoes most of what the pool bought you.Recommended
Amount is a fingerprintWithdrawing exactly what you deposited, or withdrawing everything at once, narrows the set of people it could have been. Round numbers and partial withdrawals both help.onchain

Keys and recovery

Your master secret is generated in this browser, encrypted with your device password, and never uploaded. There is no recovery key, no password reset and no support channel that can restore a wallet. The 24-word phrase and this device are the only two ways in.

What the phrase restores

Everything. Notes are found by scanning the chain and decrypting with keys derived from the master secret, so a fresh device with the phrase rebuilds the whole account from public data. Nothing needs to have been backed up beyond the phrase itself.

Viewing keys and audit

A Full Viewing Key reconstructs every note, spend and balance of an account, and can produce no proof, so it cannot move anything. The circuit takes the spending key as a witness and derives the viewing keys inside itself, which is why a viewing key holder is structurally unable to spend rather than merely discouraged from it.

Sharing one cannot be undone

Decryption happens on the holder’s device from public chain data, so there is no expiry and no revocation. To end an auditor’s visibility you move to a new account epoch. There is no such thing as a date-limited viewing key, so VEIL offers no date filter — it would be cosmetic, not cryptographic. To disclose one payment rather than an account, use a proof of payment instead.

Relayers

A relayer submits your proof so your own EVM address never appears as the sender and never pays the gas. Without one, you submit the transaction yourself and that address is on chain as the submitter — the contents stay veiled, the fact that you submitted does not.

No relayer is enabled by default. Which one you trust with your IP address is not a decision this app makes for you.

What a relayer learns, and what it cannot do
SeesYour IP address, your timing, and the public half of the transaction: the proof, the public inputs and the encrypted note blobs.onchain
Cannot seeYour spending key, which notes you spent, your balances, or the contents of any note.shielded
Cannot changeThe recipient, the amounts and the fee. It can refuse to submit, delay, or reorder — so use more than one.Bound in the proof

Deployed contracts

Read from the manifest this app is configured with.

No deployment manifest

Reading the deployment manifest…

VeilPool has no owner, no admin, no upgrade path, no sweep and no way to change its verifier. No code path moves an asset except by consuming a note with a valid proof, so a compromised frontend or relayer cannot cause a loss of custody.

Limits

The honest list, in one place, so none of it has to be discovered later.

Deposits and withdrawals are public eventsThe private funding route moves the public half onto another chain and hands the link to Relay alone. It does not delete it.onchain
Trades move a public marketSize, direction and timing are visible on the curve even though the owner is not.onchain
Your anonymity set is other usersPrivacy here is a crowd property. A pool with few notes in it protects everyone in it less, and no cryptography changes that.Grows with use
Timing and amount correlationDistinctive amounts and tight timing link the public ends of a private middle. Delay and round numbers both help.onchain
Trades cannot be relayed yetA trade is submitted by your own address today. Sends and withdrawals can be relayed.Not implemented

The normative specification lives in the repository under docs/protocol.md, cryptography.md, privacy-model.md and threat-model.md. Never describe VEIL as untraceable, fully anonymous or invisible; those are false, and this page says why.