How SHROUD works.

Overview

SHROUD is a privacy token on Solana. You can hold $SHROUD in your wallet like any token, or shield it into private notes that only your keys can read. Private notes earn: 30% of the pump.fun creator fee on every $SHROUD trade buys $SHROUD for the vault that backs every private note.

Three things you can do: shield (wallet → notes), send (notes → someone else's notes) and unshield (notes → any wallet).

Getting started

1. Open the app and connect Phantom or Backpack.
2. Unlock: your wallet signs one message. It's free and sends nothing. That signature creates your private keys, so the same wallet always opens the same notes. The first time, you sign twice: the app checks your wallet signs the same way every time.
3. Write down your 24-word backup (Backup & keys → 24-word backup). It restores everything, even without your wallet.
4. Shield some $SHROUD. From then on, your balance is a set of private notes.
5. Share your private address (it starts with shroud1) to get paid privately.

How it works

The vault is a program on Solana. It holds all shielded $SHROUD and a Merkle tree of note commitments: one-way fingerprints of each note's amount and owner. The tree never shows who owns what.

To spend notes, your browser builds a zero-knowledge proof: "I own notes in this tree, nobody spent them before, and the amounts add up." The proof doesn't say which notes are yours. The vault checks it, records one-way nullifiers so the same notes can never be spent twice, and adds the new notes.

New notes are published encrypted to the recipient's viewing key. Your app scans the vault's history, opens the notes that are yours, and checks the result against the tree the program holds on-chain.

Shield, send, unshield

Shield

Moves $SHROUD from your wallet into a private note. The deposit is public: the amount and your wallet are visible. Everything after it isn't.

Send

Moves value from your notes to anyone's shroud1… address. Neither the amount nor who sent to whom is published. A relayer submits it, so your wallet doesn't appear.

Unshield

Moves value from your notes to any Solana wallet. The amount and the destination are visible; which notes it came from isn't. Unshield to a different wallet than the one you shielded from: the app warns you if you don't.

Send a link

Puts value in a link you can send in any chat. Whoever opens it first claims it into their own private notes: they don't need an address or a wallet with funds. You pay two relayer fees, so they receive the full amount. Until someone claims it, you can take it back. A link is a secret: anyone who sees it can claim it, and it stays in the browser history of whoever opens it.

Yield

$SHROUD launches on pump.fun, which pays the coin's creator a fee on every trade: on the bonding curve, and on the pump.fun AMM after the coin graduates. pump.fun sets the rate.

• The buyback bot claims those creator fees, in SOL.
• 30% buys $SHROUD and donates it into the vault for private holders; 70% goes to the team. Part of the holders' share first keeps the relayers topped up with SOL, so private sends stay cheap.
• Donations are released over 24 hours, so nobody can deposit just before a buyback and take it.

Your private notes hold vault shares. As buybacks arrive, each share is worth more $SHROUD: nothing to claim. $SHROUD held in a wallet doesn't earn; only private notes do. There is no transfer tax: shielding and unshielding move exactly the amount you choose.

The split happens in our bot, not in the token. Every buyback and donation is a public transaction into the vault, shown on the Stats page.

What stays public

SHROUD hides who did what, not that something happened. Timing and unusual amounts can still link actions, and the fewer people use the pool, the easier that is. Good habits: shield ahead of time, use round amounts, and unshield to a fresh wallet.

Your keys

Your wallet signs a fixed message once. Your browser turns that signature into one 32-byte root, and every key comes from the root: a spending key (to spend notes), a nullifier key (to see which notes are spent) and a viewing key (to find and read notes). Nothing is sent anywhere.

Never sign the SHROUD message on any other site. Anyone with that signature can see and spend your private funds. The message itself says so.

24-word backup

Your root, written as 24 words. They restore your notes and every link you made, with no wallet: open the app, choose Restore from 24 words. Write them on paper. Anyone who sees them can spend your private funds, and SHROUD never asks for them.

Full viewing key

A shroudview1… key shows your whole history: every note, its amount and whether it's spent. It can't spend: spending needs the spending key, which the viewing key doesn't hold. Give it to an accountant or an auditor, or open it yourself in the app (Open a viewing key). You can also download a statement (CSV). It does not show claim links you made that nobody has claimed yet: those belong to your 24 words.

Recovery file

One HTML file (about 30 MB) with everything inside: the app's code, the proving circuit and the pool's public settings. Open it from your disk, type your 24 words, and it withdraws every note to the wallet you choose, including links nobody claimed. It needs no SHROUD website, server or relayer: only a Solana RPC that keeps the full history and accepts pages opened from disk (most paid RPCs do). It pays the network fee from a one-time wallet it makes, which you fund with about 0.01 SOL.

Relayers & fees

A relayer submits your private sends and unshields and pays the Solana fee, so your wallet never signs them. It's paid a small fee in vault shares, fixed inside your proof: it can't take more, change the recipient or the amount, or replay your action. It can refuse or delay, and it sees the IP address a request comes from.

Anyone can run a relayer. The app asks every relayer it knows for its fee and uses the cheapest one that answers. If that relayer stops answering, the app builds a new proof for the next one. It caps what it will pay and refuses a relayer that asks for more.

The $SHROUD token

• Launched on pump.fun: fixed supply (no mint authority) and no freeze authority. The vault refuses any coin that could be frozen or minted.
• No transfer tax. Trades pay pump.fun's creator fee, and 30% of it buys $SHROUD for private holders.
• Only the admin key built into the vault program can create the $SHROUD pool, so nobody can create it first with other settings.
• A guardian can pause or cap new deposits, for example until the audit. It can never touch a note: private sends and withdrawals always go through.
• Live checks of all of this: Stats.

Security & risks

• Not audited yet. Three internal adversarial reviews; every finding was fixed, with regression tests. An independent audit comes before any real funds.
• Trusted setup. Today's proving keys are development keys. Mainnet keys will come from a multi-party ceremony with a published transcript.
• Upgrades. The vault will be made immutable after the audit: no upgrade. The guardian can only pause or cap new deposits.
• The buyback is ours to run. The 30/70 split and the buybacks happen in our bot, which holds the creator wallet. Every buyback is public, so you can check it.
• No anonymity guarantee. See What stays public.
• Value. $SHROUD's price can fall, and yield depends on real trading. Nothing here promises a return.

Addresses

FAQ