Pay on Stellar with the
amount and the link
invisible.
zStellar shields a public asset into a pool, moves value privately between users, and withdraws back to any address — without revealing amounts or the sender → receiver link on-chain. Proofs are generated in your browser; a relayer submits, so your address never appears.
Proven withGroth16BN254Poseidon2SorobanFeatures
Privacy that proves itself,
not just hides.
Six primitives on the Soroban stack turn a transparent ledger into a private one — without ever taking custody of your funds.
Client-side Groth16 proving
Every proof is built in your browser by a Rust→WASM prover (arkworks ark-groth16 / ark-circom). Secret note keys, amounts, and blindings never leave the device.
Shielded note pool
Deposits create note commitments in an on-chain Merkle tree. Spending a note reveals only a nullifier — never the amount or the owner. Your balance is the sum of your unspent notes.
Three flows, one entrypoint
Shield, Private Transfer, and Private Withdraw all route through one transact(proof, ext_data, sender) call. Only the signed ext_amount and who submits differ.
On-chain verification
A dedicated Groth16 verifier contract checks the proof over BN254 on Stellar. ext_data is bound to the proof, so amounts and recipients can't be tampered with after proving.
ASP membership
An Association Set Provider keeps a Merkle tree of approved deposits. Honest users prove membership without revealing which leaf is theirs — a compliance-friendly anonymity set.
Always-on private relay
Private transfers and withdrawals are submitted by a server-side relayer keypair. You sign nothing for submission, pay no fee, and never appear as the on-chain source.
How it works
One pool. Three flows.
Custody never leaves you.
Every action is a zero-knowledge proof built in your browser and verified on-chain through a single transact entrypoint.
Connect & derive keys
Connect Freighter and sign once. Your note and encryption keys are derived from that single signature and cached locally in OPFS.
Shield
Deposit a public asset into the pool. You sign the token pull and a note commitment is added. First deposit auto-registers you in the ASP set.
Pay or receive privately
Send to a recipient's shielded address, or share yours to get paid. The amount and the sender → receiver link stay hidden on-chain.
Withdraw
Cash out to any public G-address at any time. The relayer submits the proven transaction, so your address never appears on the ledger.
| Flow | Shield | Private Transfer | Private Withdraw |
|---|---|---|---|
| Direction | public → shielded | shielded → shielded | shielded → public |
| Signed value | ext_amount > 0 | ext_amount == 0 | ext_amount < 0 |
| Submitter | Your wallet | Relayer | Relayer |
| What stays hidden | Your in-pool balance | Amount + sender→receiver link | Amount + your submitter address |
Tech & architecture
Built on Soroban,
proven in the browser.
Secrets never leave the device. The proof and the value bound to it are verified by a Stellar contract before anything settles.
Tech stack
Frontend
Zero-knowledge
Prover runtime
Stellar
Relay
Motion
Deployed on Testnet
Soroban contracts the app talks to.
- PoolCCQVW6…Y3CY2N
- Groth16 VerifierCDMMDE…662S53
- ASP MembershipCBEVWM…AK2365
- ASP Non-MembershipCACMAM…K3G3TC
- Token (XLM SAC)CDLZFC…HGCYSC
Your balance and your counterparties stay private.
Shield, pay, and cash out on Stellar — without revealing amounts or the link between you and your payees.