ZKBLANK, end to end.

ZKBLANK is a privacy rail for trading on Robinhood Chain. Money from any chain lands as a private balance (a note) in a zero-knowledge vault. Every buy goes out from a blank: a one-life wallet that is paid inside a proof, holds one position and retires after the sell. Sells come back into the vault as fresh notes.

• Dark Drop: a one-time address that turns a payment from any wallet, bridge or exchange into a private note
• Burner Mode: every buy signed by a fresh blank, never funded by a transaction anyone can follow
• Privacy Report Card: a grade for every trade before you sign, computed in your browser
• Crowd Fees: notes that rest share a pot of $ZKBLANK bought with protocol fees
• The 1,000-Hand Ceremony: a public trusted setup where one honest contributor is enough

NoteZero-knowledge proofs hide the link between a deposit and a trade. They do not hide behaviour: amounts, timing, IP addresses and token choice can still give a user away. The Report Card exists to say so before you sign.

Dark Drop is how money enters the vault. You never need to connect a wallet to the vault contract.

1. 1Your browser makes a drop key (it never leaves the device) and predicts a one-time drop address from it with CREATE2. Nothing is deployed yet.
2. 2Pay the drop address from anywhere: any Robinhood Chain wallet, any bridge or intent rail from Solana, Base, Ethereum or Bitcoin, or an exchange withdrawal. ETH, WETH and USDG are accepted at launch.
3. 3Any keeper calls sweep(dropKey). The drop box deploys at the predicted address, reads what arrived, computes the note commitment on-chain from the amount and your sealed key, and inserts it into the vault's Merkle tree.
4. 4The association-set provider checks the deposit's source. Clean deposits join the approved set, usually within the hour.
5. 5The note is spendable. The chain knows a deposit happened; it never learns which later trade it pays for.

NotePaying from your main wallet links that wallet to this deposit, never to your trades. A bridge or rail sees your source wallet and the drop address: that is the near side only.

One buy

1. 1Pick a token and a size. The quote is computed in the browser from pool state, so no quote API sees the trade before it lands.
2. 2The browser derives blank #n from your keys: a counterfactual smart account with no code, no balance and no history. A restore finds every blank again.
3. 3The Privacy Report Card grades the trade A to F and offers one fix per weak factor.
4. 4The browser proves, in zero knowledge, that you own unspent notes worth at least the size, that their deposits sit in the approved set, and exactly which swap to pay.
5. 5A relayer submits the proof. The vault spends the notes, routes the amount through the swap (a launchpad curve or a Uniswap pool), the tokens land in the blank, and change returns as a new private note.
6. 6The blank holds the position. It was never sent gas and never touched your other wallets.

What the proof binds

pay

the amount, from the vault

swap

the asset in and the token out

minimum out

the slippage floor

recipient

the blank's address

deadline

a short expiry

relayer fee

what the relayer may take

Change any field and the proof fails. A relayer can carry a trade; it cannot edit it.

Sell, back into the dark

1. 1The blank signs a sell intent off-chain (EIP-712): token, amount, minimum out, deadline and a sealed key for the note the proceeds will become.
2. 2A relayer deploys the blank's account and sells in the same transaction. The blank still never holds gas: the relayer is paid from the proceeds.
3. 3Proceeds go straight into the vault; the note commitment is computed on-chain from the amount and the sealed key, exactly like a Dark Drop.
4. 4The blank retires. One position, one life; the app refuses to reuse it.

Exit

Any Robinhood Chain address

One proof, one relayed transaction

Another chain

The relayer hands the withdrawal to a bridge rail; every refund address is a fresh one

Split exit

One note leaves as uneven amounts over hours (tier feature)

Ragequit

Flagged deposits only: back to the funding address, in public

Computed in your browser from public data and never sent anywhere. Six factors, each good (2), fair (1) or weak (0).

Cover

Good: 1,000+ notes newer than yours. Weak: under 100.

Rest

Good: 6 hours or more since the deposit. Weak: under 30 minutes.

Amount

Good: a common round size. Weak: the same size as a recent deposit.

Token crowd

Good: many buyers of the token today. Weak: you are the only one.

Rail timing

Good: the funding drop is older than 2 hours. Weak: under 10 minutes.

Holder band

Good: off (the whole crowd). Fair: on (half the crowd).

Grade: 11–12 is A, 9–10 B, 7–8 C, 5–6 D, 4 or less F. Every weak or fair factor comes with one concrete fix: wait, round the size, split across two blanks, or skip the discount.

A blank is only as private as the crowd it hides in. Every note resting in the vault is cover for every other note, so the protocol rewards resting.

1. 1An epoch is 24 hours. The vault records how many leaves the tree held when each epoch began.
2. 2When you spend a note (a buy, an exit or a re-shield), the proof may show how many full epochs its oldest input rested: 0 to 7, capped. Nothing else is revealed.
3. 3Rested at least one epoch and worth at least 0.02 ETH or 50 USDG? The spend creates a private Crowd ticket with weight = epochs rested.
4. 4Each epoch's pot is $ZKBLANK bought on the market with 30% of that epoch's fees. The total weight is public.
5. 5After the epoch closes, a ticket claims pot × its weight ÷ total weight into a private $ZKBLANK note. Tickets left unclaimed for 30 epochs roll into the next pot.

What the Crowd meter counts

• Counts: every note ever created (leaves in the tree), every spend (nullifiers), and rest times read from the epoch markers
• Cannot count: which notes are still unspent, or how many people own them. One person with ten notes is ten notes.

Groth16 proofs need a one-time setup. Whoever keeps that setup's secret could forge any proof. ZKBLANK's phase 2 is built by up to 1,000 public contributors on top of the public perpetual powers of tau; if even one of them destroys their secret, nobody can forge a proof, the team included.

1. 1Sign in with GitHub or X on an account at least 90 days old, and bind a Robinhood Chain address for the Hand share.
2. 2Your browser downloads the latest key, adds fresh randomness, uploads the result and destroys its secret. About one to two minutes.
3. 3Your contribution hash and position (#1 to #1,000) go into the public transcript.
4. 4When the ceremony closes, a public random beacon finalises each circuit's key; the verifier contracts are generated from those keys and anyone can reproduce them.

Hand share

3% of supply, bought in the launch transaction at the opening price

Per Hand

30,000,000 $ZKBLANK ÷ verified Hands (1,000 Hands → 30,000 each)

Claim

Straight into a private note; window of 60 days, then unclaimed shares are burned

Perk

SHEET tier free for 90 days, no lock needed

Anti-Sybil

One Hand per GitHub or X account aged 90+ days; failed contributions struck in public

Every spend proves two things: the note is in the vault, and the deposit that funded it is in the approved set.

• The association-set provider (ASP) screens each new deposit against public sanctions lists and known exploit addresses, then posts the approved root.
• Approved deposits are spent privately as normal. Flagged deposits can only ragequit: back to the funding address, in public. They never join the crowd.
• Anyone can read and diff the approved set. Adding a provider waits 7 days. Later, users choose between several providers.
• Design after Buterin, Illum, Nadler, Schär and Soleimani, “Blockchain Privacy and Regulatory Compliance: Towards a Practical Equilibrium” (2023).

Dark Drop (money in)

0.10%, covers the sweep

Burner buy

0.25% (0.15% in the holder band)

Sell back into the dark

0.25% (0.15% in the holder band)

Re-shield (note to note)

0.10%

Exit to an address or chain

0.25%

Ragequit (flagged)

0%

Relayer gas

At cost + up to 10%, paid to the relayer

NoteHard cap in the contract: no fee can ever exceed 0.50%. Changes inside the cap wait 7 days in a timelock.

The split, for every fee from every source

Token-side revenue

• $ZKBLANK launches on the Robinhood Chain launchpad: a 1% base trading fee, 70% of it to the creator fee recipient
• Creator tax: 1% on $ZKBLANK trades, all of it to the recipient
• Recipient = FeeRouter, a contract, swept daily; about 1.7% of $ZKBLANK volume feeds the same split
• Values are re-read from the launchpad's verified contracts on launch day

Burner API and SDK

Bots and agents

Same protocol fee per trade; 20% off above $1M a month

Wallet integrators

Up to 20% of the protocol fee to the wallet, set on-chain

Report Card API

1,000 calls a day free; more with a tier lock

White-label vaults

Never: one crowd is the product

Total supply

1,000,000,000

Team allocation

0

Launch curve

100% of supply

Hand share

3%, bought in the launch transaction at the opening price

Creator tax

1% to the FeeRouter

Graduation

A Uniswap pool at the launchpad's ETH threshold, LP locked

Contract

The launchpad's standard ERC-20, burnable

Chain

Robinhood Chain (EVM 4663)

Tiers, locked privately inside the vault (30-day minimum)

BLANK (0)

Full privacy; burner fee 0.25%; Report Card; Crowd tickets

SHEET (1M · 0.1%)

Burner fee 0.15%; split exits up to 4 parts; API 10,000 calls a day

STACK (5M · 0.5%)

Report Card Pro; scheduled sells; priority relaying; API 50,000 a day

REAM (10M · 1%)

Split exits up to 12 parts; API 250,000 a day; a ceremony-2 seat

A tier is proven, never shown: a burner proof may carry one public bit (standard or holder band) backed by a locked $ZKBLANK note that cannot be spent until its lock ends. The holder band splits the crowd in two; the Report Card shows when the discount costs more cover than it saves.

What the token may never do

• Buy cover: a tier-0 note is exactly as private as anyone's
• Boost Crowd tickets: weight follows rest, not holdings
• Pause a spend or touch a withdrawal

Contracts (Solidity, Robinhood Chain)

BlankVault

Shielded pool: Merkle tree (depth 32), root history, nullifier set; ETH, WETH, USDG, $ZKBLANK. Immutable: no owner, no proxy.

DropFactory

Predicts drop addresses (CREATE2); sweep() deploys a DropBox and builds the commitment

BurnerRouter

Runs the bound swap with the blank as recipient; deposits sell proceeds as a new note

BlankFactory

Counterfactual blank accounts; deploy and signed sell in one call

AssociationRegistry

Approved roots per provider; adding a provider waits 7 days

Verifiers

Groth16 verifiers built from the ceremony's final keys

FeeRouter

Receives every fee; splits 35/30/20/10/5

CrowdPot

Epoch pots, ticket weights, claims

HandsDistributor

Holds the Hand share; private claims

Circuits (Circom 2 · Groth16 · bn254)

• spend.circom: 2-in / 2-out join-split; proves membership in a recent root, deposit labels in the approved root, value conservation and the action hash; optional tier bit and rest epochs
• ticket.circom: claims a Crowd ticket after its epoch
• hand.circom: claims a Hand share into a private note
• Poseidon2 hashing, incremental tree of depth 32, about 2–4 s to prove in a desktop browser (Web Worker)
• A fork of an audited, open-source privacy-pool codebase (association-set design); its license is checked before the fork

Notes and keys

note

Poseidon2(asset, value, ownerKey, blinding, lockUntil, label)

nullifier

Poseidon2(nullifierKey, leafIndex)

label

The deposit's id, carried by every note it funds; association sets check it

keys

Spend, viewing, blank and drop keys, all derived in the browser

note data

Encrypted to the viewing key and emitted with each commitment, so a restore finds everything

backup

Encrypted export: PBKDF2-SHA256 (600k rounds) to AES-GCM-256

Public API (no endpoint takes an address, an amount or a plan)

GET /v1/tree/chunk/:n

4,096 leaves per chunk, fixed

GET /v1/roots

Latest roots and approved roots

GET /v1/crowd

Crowd meter, no parameters

GET /v1/epochs

Pots, weights, claim windows

GET /v1/pools/snapshot

Pool states for quotes computed in the browser

GET /v1/relayers

Relayer list and fee schedules

POST /v1/relay

{ proof, publicInputs } only

GET /v1/ceremony

Progress and transcript hashes

GET /v1/status

Contracts, ASP, relayers

The server keeps public data only: leaves, roots, approved roots, nullifiers, epochs, tickets, relayers, ceremony receipts and incidents. There is no table of users, sessions, IP addresses or owners of notes, blanks or drops.

Bridge or rail

Money in: source wallet, drop address, IP. The trade: never a blank.

Indexer

Fixed public data only, on both sides

ASP

Money in: the deposit and its source. The trade: never a spend.

Relayer

Money in: never the deposit. The trade: the proof, the blank, an IP.

DEX pool

The blank's swap only

Browser RPC

Chunked reads; trades go through a relayer, not the RPC

Website

A page load and an IP, on both sides, and nothing else

The rule is that no party sees both sides. Every release runs a browser test that records each outbound request per phase and fails on a new host. An IP address cannot be hidden by the product; Tor or a VPN can.

What still leaks

• Amount: a buy the same size as a recent deposit
• Timing: a buy right after a drop lands
• Rare tokens: being the only buyer of a coin
• IP address: the relayer sees the IP that submits
• Rails: a bridge sees the source wallet and the drop address

• Delta audit of the forked circuits and contracts before mainnet; a second, independent audit before caps rise
• Bug bounty from the first testnet day, paid from the security fund (10% of all fees)
• Guarded launch: at most 5 ETH per note and a 500 ETH vault cap for the first 30 days
• Immutable core; fees (inside the hard cap) and the ASP list behind a 7-day timelock
• Spends can never be paused; deposits can be paused during an incident
• Every contract verified, its source public, on the day it deploys
• Relayer requests carry no cookie, no credential and no account
• The status page tells the truth: if the indexer lags, it says so, with the block it is on

Phase 1 · MVP (weeks 1–6) · now

• Fork and adapt the audited circuits; vault, drops and router on testnet
• Burner Mode end to end on testnet
• Delta audit and bug bounty
• The 1,000-Hand Ceremony
• Mainnet with guarded caps, then $ZKBLANK

Phase 2 · Growth (months 2–3)

• Crowd Fees: epochs, tickets, claims
• Tier locks and the holder band
• Split exits and scheduled sells
• Burner API and TypeScript SDK
• One-click rails inside Dark Drop
• Mobile app with on-device proving
• Second audit, caps raised

Phase 3 · Upgrade (months 4–6)

• Dark Stocks: private balances of official stock tokens, inside each issuer's transfer rules
• Dark OTC: two notes swap atomically at a fixed price
• Several association-set providers
• Ceremony 2 for the V2 circuits
• Report Card Pro

Phase 4 · Ecosystem (months 6–12)

• Wallet Burner buttons
• Agent SDK and Proof-of-PnL
• Browser extension
• Cross-chain exits
• Fee votes inside the hard cap, cast with locked-note proofs

How is a blank different from a fresh wallet?

A fresh wallet has to be funded, and the funding transaction points back to whoever sent it. A blank is paid inside a zero-knowledge proof straight from the vault, so there is no funding transaction to follow.

Can ZKBLANK see my balance or my blanks?

No. Keys, notes and blanks live in your browser. The server stores public chain data only, and relayers receive finished proofs.

What happens to flagged money?

A deposit the association-set provider flags cannot be spent privately. It can only ragequit: back to the address that funded it, in public.

Does holding $ZKBLANK make my trades more private?

No. Every note gets the same proofs. A tier lowers the fee and unlocks app features; it never buys cover.

What can still give me away?

Behaviour: amounts, timing, IP address and token choice. The Report Card grades those before you sign, and suggests a fix for each weak factor.

When does $ZKBLANK launch?

After the 1,000-Hand Ceremony closes and the vault is live on mainnet. The address will be posted on the landing page and on X at the same moment.