Move money
in a crowd.
A public chain publishes the amount, the counterparty and the receiving wallet. Shoal publishes a proof instead — and nothing else. Your transfer settles inside a shoal of thousands of identical ones.
Two machines meet.
Neither learns a name.
Every shielded transfer ends as a handoff between machines — the prover running in your browser, and a bonded relayer that broadcasts the result. The relayer pays the gas and never learns who you are. You never learn who it is. The only thing that crosses the gap is a proof.
A transfer tells on you three separate times.
Hiding one of these does nothing for the other two. That’s why Shoal is three mechanisms and not one — each closes a different channel.
The amount
Every value is denominated in public. Salary, position size, treasury balance — readable by anyone with a block explorer, forever.
The counterparty
An edge between two addresses is permanent. One doxxed wallet in your history deanonymizes everyone you have ever paid.
The trail around it
The subtle one. A fresh wallet has no gas, so you fund it — and that funding transaction re-links everything you just spent effort unlinking.
Four moves, and the trail is gone.
A genuine sequence — each step depends on the one before it. The first two are the same transaction from the chain’s point of view.
Deposit
Funds enter the pool as a Pedersen commitment — a sealed envelope binding you to an amount nobody can read. It becomes a leaf in the note tree.
Prove
To spend, you prove in zero knowledge that you own some unspent leaf and that inputs net to outputs. You never point at your own.
Nullify
The spend publishes one nullifier derived from the note’s secret. It kills that note permanently without revealing which note died.
Claim
Funds land at a one-time stealth address only the recipient can unlock, submitted by a bonded relayer so no wallet of yours pays the gas.
A proof that a leaf exists — not which leaf.
Every shielded note is a leaf hashed upward into one root. To spend, you prove you know the path from some leaf to that root. Watch it climb, then watch the evidence disappear. Hover any leaf to trace it yourself.
Note tree · depth 4 · 16 leaves shown
Inserting noteA leaf consistent with this root exists, and its nullifier has never been seen before.
Which of the 16 leaves it was, what value it holds, or who put it there.
Three layers, one per leak.
They compose, but they don’t depend on each other — you can use the pool without stealth addresses, or stealth addresses without a relayer. Each removes exactly one signal.
Shielded pool
Pedersen commitments hide values; a Merkle tree of notes hides which coin is yours; SNARK proofs enforce that balances net to zero without opening a single envelope.
Stealth addresses
Publish one meta-address, receive at infinitely many. Each sender derives a fresh one-time address by Diffie–Hellman; only you can compute its private key. No two payments to you are linkable.
Bonded relayers
Relayers stake collateral and submit your claim as a meta-transaction, taking their fee from the shielded amount. Your funded wallets never touch your stealth addresses.
Your balance, minus the audience.
Notes on the left, anonymity on the right. The app refuses to build a note into a thin denomination, and tells you what your wait time actually buys.
Your anonymity set
Peers holding a note of the same denomination as yours right now.
Time in pool
Withdraw now and timing analysis links you. Wait, and the crowd grows around you.
Relayer quote
Bonded relayer submits your claim. Fee is taken from the shielded amount.
Twelve machines keeping the pool busy.
A pool holding a handful of notes hides nobody, so twelve autonomous agents deposit and claim around the clock on randomised timing and amounts. They are not props: each one holds a real keypair and publishes through the same endpoint your browser uses, so on the public feed their notes and yours are the same object.
Disclosure · the operator of this deployment holds the agent keys and can tell decoys apart. Cover traffic raises the cost for an outside observer. It is never counted as adoption.
Build a note. Watch the ledger learn nothing.
Real SHA-256, computed in your browser. Nothing is broadcast, no wallet is touched — this is the note construction, side by side with everything an observer would see.
Construct a shielded note
Local onlyThe blinding factor and note secret come from your browser’s CSPRNG. Lose them and the note is unspendable — no one can recover it for you.
What the public ledger records
Awaiting noteThe only number that decides whether you’re hidden.
A perfect proof in an empty pool hides nothing — with eight depositors, timing and amounts give you up immediately. Shoal uses fixed denominations and shows you the size of your crowd before you deposit, not after.
Bar widths illustrative · live counts read from the note tree at deploy
Why fixed denominations
If you deposit 4,137 and 4,137 later exits, no proof system on earth saves you. Arbitrary amounts are self-identifying. Shoal splits every transfer into standard notes so your withdrawal is shaped exactly like everyone else’s.
Thin set warning. The app refuses to build a note in a denomination with fewer than 50 peers, and tells you which one to use instead.
Some of this crowd is decoys. Autonomous agents deposit and claim alongside real users, on randomised timing and denominations. Standard mixnet practice, and disclosed rather than counted as adoption.
What each approach actually closes.
A mixer alone leaves two of the three channels wide open. This is the honest version of the comparison table, including the row where nobody wins.
| Signal | Plain transfer | Mixer only | Shoal |
|---|---|---|---|
| Amount visible | Public | Hidden | Hidden |
| Sender ↔ recipient edge | Permanent | Broken | Broken |
| Receiving wallet reused | Always | Usually | Never — one-time address |
| Gas funding re-links you | Yes | Yes | No — relayer pays |
| Warns on a thin crowd | n/a | No | Yes, before deposit |
| That you used a privacy tool | Nothing to see | Visible | Visible |
Last row is the one every competitor omits — participation is public in all pooled designs, including this one
What Shoal does not hide.
Any privacy tool that won’t print this section is selling you something. These are real, not fixable by better cryptography, and you should plan around them.
That you used Shoal at all
Your deposit is a public transaction to a public contract. Participation is visible; only its contents are not. Some counterparties and venues treat that as a signal on its own.
Timing correlation
Deposit and withdraw within minutes in a quiet pool and the link is trivially reconstructed. Time in the pool is the price of the privacy — the app tells you what the current wait buys.
The trusted setup
Groth16 requires a per-circuit ceremony. If any participant keeps their leftover randomness, they can forge proofs and drain the pool with no on-chain trace. Verify the transcript before you deposit.
Part of the crowd is synthetic
The pool runs decoy agents that deposit and claim on randomised timing, because a pool with a handful of notes hides nobody. Their traffic is indistinguishable from yours on the public feed — but whoever operates this deployment holds the decoy keys, so cover traffic raises the cost for an outside observer, not for us. It is not a substitute for real users.
Your own operational security
Reusing an IP across deposit and claim, or pasting a stealth address into a service that knows your name, undoes all three layers. The chain is not the only place you leak.
The questions worth asking first.
Can Shoal see my balance or recover my notes?
No, and that cuts both ways. Note secrets are generated in your browser and never leave it. There is no account, no recovery flow and no support path that can restore a lost note — the same property that keeps us from reading your balance keeps us from rebuilding it.
What happens if a relayer refuses to submit my claim?
Any relayer can serve you, and you can always submit the claim yourself from a funded wallet — you simply lose the third layer of privacy by doing so. Relayers stake collateral that is slashable for censorship or transaction reordering, so refusing costs them more than the fee they would have earned.
Is a shielded pool legal to use?
Financial privacy is lawful in most jurisdictions and pooled privacy tools have been sanctioned in some. That is a real question with a real answer where you live, and neither this page nor a protocol can answer it for you. Get advice that accounts for your jurisdiction before moving significant value.
Why fixed denominations instead of arbitrary amounts?
Because an arbitrary amount is a fingerprint. If 4,137.00 goes in and 4,137.00 comes out, the strongest proof system in the world has not hidden you. Standard notes make every withdrawal the same shape as every other, which is what makes the crowd a crowd.
Has this been audited?
Not yet — see the spec table below, where that row stays marked until an audit exists and is linked. Treat any unaudited pool as capable of losing everything in it, and size your deposit accordingly.
Specification
Fill the marked rows before launch. Every one is a claim a reader is entitled to verify — leaving one blank is better than guessing.
- Proof system
- Groth16 zk-SNARK · BN254 · ~192-byte proofs, constant-time verification
- Commitment scheme
- keccak256 commitments over an incremental Merkle tree, depth 20 — implemented and tested
- Stealth addresses
- ERC-5564 announcer + ERC-6538 meta-address registry, secp256k1 ECDH
- Relayer model
- Permissionless, stake-bonded, slashable for censorship or reordering
- Denominations
- 100 / 1,000 / 10,000 / 100,000 per supported asset
- Trusted setup
- Ceremony transcript — publish the URL and participant list here
- Audit
- Unaudited until an audit exists. Name the firm and link the report, or say so plainly
- Contract address
- 0x———— add after deployment and verification
- Source
- Client core, pool contract and withdrawal circuit in /protocol — 27 unit tests, 12 in-browser integration checks
Join the shoal.
Shield your first transfer, or read the circuits before you trust a line of this. Both are the right instinct.