What it does
Anonhood is a vault on Robinhood Chain. You hold Stock Tokens and USDG in it without the chain saying what you hold, how much or since when. You prove facts about a position without revealing the position. You trade one note for another without exposing the strategy.
- Shield. Deposit into the vault. The chain records a commitment: a hash of two secrets, the amount, the asset and the entry time. The secrets stay in your browser.
- Prove. Pick a fact, such as “I hold at least 100 NVDA”. A zero-knowledge proof is generated locally and verified by the vault contract.
- Trade. Place a sealed order. When the market crosses your limit, your browser proves a swap and the vault spends one note and creates a note of the other asset, in one transaction.
- Withdraw. A proof authorizes the exact amount to any address. Nothing on-chain links it to the deposit.
Private by default. Provable when you choose.
Go private
Choose an asset from the allowlist (twelve Stock Tokens and USDG), enter an amount, press Go private. Your wallet signs an approval and a deposit.
What happens under the button:
- Two random field elements are generated: a secret and a nullifier seed.
- They are hashed with the amount, the asset and the entry timestamp into a Poseidon commitment.
- Only the commitment enters the vault's Merkle tree (depth 20, about a million leaves). The note, with the secrets, is stored in this browser.
The deposit itself is public. The chain sees which address deposited which asset and how much. What stays private is the link between that deposit and anything that happens after it. Lose the note and nothing can be proven or withdrawn: there is no recovery, because there is no account.
Prove
Five statements. The first runs a real circuit and a real verifier today; the others share the same receipt and will gain circuits one by one.
| Statement | What goes public | Status |
|---|---|---|
| Hold at least N | tree root, asset, threshold, a tag derived from the note | Circuit and on-chain verifier |
| Made the trade | root, nullifier, asset in, amount in, asset out, half of the new note | The swap runs; the shareable proof is next |
| Portfolio return | root, return in basis points, period | Receipt only |
| Eligibility | root, policy id | Receipt only; association proofs on the roadmap |
| Entered before day D | root, asset, deadline | Receipt only; the book already keeps the timestamp |
A proof is 8,384 bytes, UltraHonk, about 24,000 to 26,000 gates, generated in the browser in one to three seconds. The receipt shows every phase with its real duration. The exact amount, the entry date and the position in the tree never leave your device. Two proofs from the same note are linkable to each other by design.
Thresholds are entered in shares and converted to raw units with the asset's ERC-8056 multiplier, read at proof time. A threshold above the note is rejected by the circuit, not by the interface.
Withdraw
Pick a note and a recipient. The proof authorizes the exact amount and publishes a nullifier, a second hash derived from the same seed, which the vault marks as spent. The vault pays the recipient the amount minus a 0.10% fee and sends the fee to the burner.
Notes are spent whole today. Change notes and partial fills are the next contract change.
The desk
Every order has a Stock Token leg and a USDG leg. A sell spends a Stock Token note into USDG and fills when the bid reaches your limit. A buy spends a USDG note into a Stock Token and fills when the ask reaches it. Limits are USD per share.
The tape shows bid and ask next to the Chainlink print and its age. Feeds print 24/5: on a weekend or holiday the tape freezes on the last print and no order fills. A feed older than its heartbeat on a trading day is stale, and no order fills on it either.
A market swap quotes against the measured pool table and executes at once with a floor 0.5% below the quote.
Sealed orders
Placing an order publishes keccak256(tokenIn, amountIn, tokenOut, limitOutNet, salt) to the order book. The book records that hash and the block time. No owner, no side, no price, no size.
Your browser watches the market. When a fresh print crosses the limit, it generates the swap proof and sends one transaction: the vault verifies the proof, swaps against the Uniswap v4 pool through the adapter, checks the output clears both your floor and your sealed limit, finishes the new note's commitment on-chain and inserts it.
There is no cancel on-chain because there is nothing to cancel: an order that never fills is never revealed, and its hash says nothing. Withdrawing an order happens on your device and stops the watcher.
If the pool cannot reach the limit, the transaction reverts before the note is spent and the order stays open.
What a fill reveals
The OrderFilled log carries the asset sold, the amount, the asset bought, the net output and the second. It carries no address. The spent note cannot be tied to the deposit that created it. It is tied to the new note created in the same transaction, which is why the new note behaves like any other note from then on.
One thing is visible today: the wallet that pays the gas for the fill transaction, which is the wallet that placed the order. The relayer and paymaster on the roadmap remove it.
The swap is public. The trader is not.
What is private, what is not
Guaranteed
Between a deposit from address A and a withdrawal or a fill to address B there is no on-chain data linking them. Proofs reveal only their public inputs: never the amount, the date or the leaf.
Limits, said out loud
- The anonymity set starts at zero. Privacy is as large as the number of unspent notes in the tree. That number is on screen, read from the contract. An anonymity set is a count, not a claim.
- The deposit leaves your address and pays gas. If that address is tied to you, the deposit is.
- Amounts can identify. A single note of 100 NVDA is recognizable by its size. Change notes, partial fills and denominations are on the roadmap.
- The swap is public. The vault visibly trades X for Y. Who is behind it is not visible, but the gas payer of the fill is, until the relayer lands.
- The issuer can pause or burn a Stock Token. That is a property of the asset, not of the protocol. The vault cannot react to it, and the backing line shows it the same second.
Contracts
| Contract | Role | Properties |
|---|---|---|
| AnonhoodVault | custody, Merkle tree, deposit, withdraw, swap, verifyHolding, counters | immutable, no owner, no pause, no upgrade, fixed allowlist, fee 10 bps |
| SwapAdapter | swaps on Uniswap v4 directly against the PoolManager, one or two hops through USDG | stateless, 13 measured routes, vault only |
| OrderBook | sealed book: place, fill (vault only), placedAt, isFilled | anonymous, no cancel, no owner |
| AnonhoodToken | $AHOOD, ERC-20, fixed supply of 1,000,000,000 | no mint, no admin, no blacklist |
| FeeBurner | receives fees, permissionless buyback and burn | no owner, no withdraw, no rescue |
| Verifiers | HoldAtLeast, Withdraw, Swap | UltraHonk, generated by bb 5.2.0, deployed unmodified |
Poseidon with circomlib parameters, identical in Noir, Solidity and TypeScript. Verifying a proof costs about 2.2M gas, a fraction of a cent on this chain. 178 Foundry tests, including a mainnet fork where 3 NVDA sold at 99.67% of the Chainlink print.
$AHOOD
Fixed supply, no admin. Every fee the protocol collects, 10 bps on each withdrawal and each fill, flows to the burner, which swaps it for $AHOOD on Uniswap v4 and burns all of it. Anyone can trigger the buyback; a per-call cap keeps thin pools intact.
Honest condition: the buyback needs an AHOOD/USDG pool with real liquidity. Until then the burner accumulates and the public function has not been fired.
Chain facts
- Robinhood Chain is an Arbitrum Nitro L2. Blocks every ~100 ms, Cancun active, contracts up to 96 KB. Chain id 4663, testnet 46630.
- Gas is 0.1 to 0.5 gwei with no L1 data fee. Writing on-chain costs cents, which is why the vault finishes notes on-chain instead of pretending.
- Stock Tokens are ERC-20 with 18 decimals and an ERC-8056 multiplier that absorbs splits. USDG has 6 decimals.
- Chainlink equity feeds print 24/5 from Monday 00:00 UTC, with a 24 h heartbeat and a 0.5% deviation threshold. No prints on weekends.
- The canonical Uniswap addresses from Ethereum host impostors here. Everything is verified by behavior; the route table is measured from the chain, never copied from a document.
- Stock Tokens are not available to persons in the US, UK, Canada or Switzerland.
FAQ
Is the swap private?
No, and the product never says it is. The swap is public: asset, amount, price, second. What is not there is who. The gas payer of the fill is still visible today; the relayer removes it.
Who fills my order?
Your own browser. There is no matcher and no counterparty waiting. The Uniswap v4 pool is the counterparty.
Can I cancel?
On your device, yes: the watcher stops. On-chain there is nothing to cancel, because an unfilled order is never revealed.
What if the pool is thin?
The transaction reverts before your note is spent. The vault enforces the floor you set and the book enforces your sealed limit; neither reads a price feed, both read the pool's actual output.
What if I lose the note?
The position cannot be proven or withdrawn. The contract holds a commitment it cannot open. Back up your browser storage, or export the note when that lands.
Why does a proof take a few seconds?
Because it is a real proof: tens of thousands of gates solved in the browser. A receipt that takes zero seconds is the one to distrust.
How do I reset the environment?
Shift + Alt + R clears local notes, receipts, orders, proofs and tour progress on this device. The chain is never touched.