How it works

Threat model

Who we defend against, what each of them can and cannot do, what we assume, and the gaps we know about. Written for security researchers. If you just want to know what an explorer shows, start with What stays private.

Network: Mainnet, in beta
Bounty: None yet, credit by name
Report to: hello@gloam.trade
Fork tests: Welcome

What we protect

The link between a deposit and any later spend or cash out.
Who paid whom, and how much, for a private send inside the vault.
Who made a private swap, and which balance it came from.
What anyone holds while their money is in the vault.
Payment notes and receive keys on the user's own device.
The vault itself: nobody takes out more than was put in.

Some things are public by design and we do not try to hide them: deposits and cash outs, the tokens and amounts of a private swap, the wallet that sent each transaction, timing, and the opaque hashes every payment adds to the vault. What stays private walks through exactly what an explorer shows.

Who can do what

Who	Can	Cannot
Anyone watching the chain	See every deposit and cash out (wallet, asset, amount), who sent each transaction and when, and try to match deposits to exits by amount and timing.	Tell which note a spend used, see the amount or parties of a private send, or see what anyone holds in the vault.
The Gloam relay	See your IP address and the timing of the transactions it sends for you, swaps included, and refuse to send one. The Gloam team runs it at launch.	Change a cash out's recipient or amount, which the proof binds, change what a swap delivers or where, learn a note secret, or move money.
The swap routers	Take one note out of the vault for a swap, trade it on their fixed venues, and send what the trade did not use to the treasury. They have no owner, no admin and no upgrade.	Change a swap's new note, its refund note or its route, which the escrow address binds, or touch any other note in the vault.
Anyone who sees a swap go out	Send its first step alone, so the swap fails and refunds 99% of the note. Send a swap that reverted again later, which lands exactly as it was made if the price allows.	Redirect the money, change the new note or the refund note, or keep any of it.
The DEX pools and Tempo's exchange	Set the price a swap pays, and make it fail. A price move before the swap lands can take up to the buffer, which would otherwise go to the treasury.	Deliver less than the swap asks for. The router checks the output and what it paid, or the whole swap reverts.
RPC providers	See the reads the app makes through them, including a check on whether one specific payment has been spent.	See note secrets, or anything the chain does not already show.
The Gloam team and contract owner	Change proof, price or rate rules, raise deposit limits or add assets after a 3-day public timelock, lower deposit limits or close deposits at once on the mainnet vault, and change the web app you load.	Move pooled funds. There is no admin withdraw, and no rule change takes effect without 3 days of public notice.
Someone who pays you	Spend the payment back before you claim it, since they made its secret.	Take it back once you have claimed it. Claiming moves it into a new note only you know.
Anyone holding a claim link	Claim it. A plain link is like cash. A locked link also needs its phrase, which a weak phrase does not protect for long.	Claim a payment sealed to a Gloam address. Only that address's owner can open it.
Someone with your device or browser	Use an unlocked session, or read your notes if they control the browser while it is open.	Read your notes from storage alone. They are encrypted under a key the browser will not export, or under your passkey.
Gloam's recovery store	See a backup's id, a hash of its write token, its size and when it changes.	Open it. The key comes from your wallet signature or passkey and never reaches the server.
A stablecoin issuer	Pause its coin or block the vault, so no balance in that coin can be cashed out until it lifts the block. Some token standards also let an issuer burn a blocked holder's balance.	See inside the vault, or tell whose money is in it.
Whoever ran the trusted setup	On testnet, where the dev keys had one contributor, forge proofs if they kept its secret, and so drain the test pool.	Do the same on mainnet, provided one of the 13 contributors to the mainnet ceremony destroyed their secret.

The details that matter

Amount and timing

A shielded pool hides you in a crowd. If you deposit 137 and someone cashes out 137 an hour later, an observer will guess it was you, and the proof cannot stop that. The mainnet vaults are brand new, so the crowd is thin at first: treat unlinkability as weak until more people use them. The testnet crowd is small too. Splitting amounts and waiting before you cash out help. A cash out sent later still carries a proof that shows roughly when it was made; the app swaps in a fresh one while it is open, and one that goes out while it is closed keeps its last. More in the privacy model.

The relay

The relay pays gas so your wallet does not appear as the sender of a private send or cash out. It checks every payment before sending it, keeps per-device and per-network rate limits keyed by IP address, and cannot alter what the proof binds. If it refuses or goes down, you can turn it off and send from your own wallet, at the cost of your wallet showing as the sender. Swaps are the exception: they only go through the relay, so while it is down, swaps wait. On Robinhood Chain, a payment message you post yourself shows your wallet as the poster. Through the relay it does not.

Private swaps

A swap runs in one transaction through a router: the vault releases one note to a one-time escrow, the router trades it on a public DEX for an exact amount, and the output goes back into the vault as a new note. The relay sends it, so no wallet shows. The tokens, the amounts and the timing are public.

What a router trusts. Each router is fixed at deploy, with no owner, admin or upgrade. On Robinhood Chain it trades only on three Uniswap v4 pools set at deploy: ETH and USDG, ETH and $GLOAM (the launch pool, whose hook takes the creator fee), and USDG and $GLOAM. On Tempo it trades only on Tempo's stablecoin exchange. These venues are outside code. The router checks that it received the full output and paid no more than arrived from the vault, so the worst a venue can do is make a swap fail.

Price moves. The swap asks a little below the quote (0.5% on Robinhood Chain, 0.1% on Tempo). The app prices the swap again just before it goes and binds the new note to an exact amount: the better of that price and the quote the person saw. The router delivers exactly that amount or nothing. A trader who moves the price before the swap lands can take up to the buffer, which would otherwise go to the treasury. Past the buffer, the swap reverts and nothing moves.

A swap made to fail. Once a swap is broadcast, its unshield proof is public. Anyone can send that step alone. The money then waits at the swap's escrow, which only the router can open, and only into the refund note the owner made with the swap. That refund holds 99% of the note: the vault keeps its 0.25% cash-out fee and the rest of the 1% goes to the treasury. The owner's app finishes the refund through the relay on its next sync. The attacker pays gas and gains nothing.

A swap that reverted can still land. Its proofs stay valid, so anyone can send the same call again, and it lands if the price comes back within the buffer. It lands exactly as the owner made it: the same output, into the owner's new note. The app keeps both new notes until the chain shows which one landed.

Limits and blocks. The new note and the refund note are deposits, so the beta deposit limits apply. If the vault is full for that token, a refund waits at the escrow until there is room. If a token issuer blocks the treasury, what it cannot take stays in the router; it never stops a swap or a refund.

Owner powers

After setup, the owner can change how proofs, prices or rates are checked only by queueing the change on-chain, where anyone can see it, and running it three days later. On mainnet the same delay applies to raising deposit limits or adding an asset. A harmful change, such as a bad verifier, gives everyone three days to cash out first. On the mainnet vault the owner can also lower deposit limits at once, down to zero. That can stop new deposits during an incident, never withdrawals or private sends. At launch the owner, which is also the treasury, is a single wallet (0x76b7E410a227c888aBD2Bdc24Ee32E094B0FD4D8). A multisig is planned.

The web app

Your notes are made and stored by the code you load from gloam.trade, so a malicious or compromised build could read them. That is a trust assumption, not something the cryptography removes. The code is open source, the app checks the circuit files it downloads against fixed fingerprints, and you can run the SDK yourself instead of the hosted app.

Claim links and phrases

A claim link carries the payment's secret in the part after #, which browsers do not send to servers, and our analytics drop everything after ? and #. A locked link is encrypted with a key stretched from its phrase (PBKDF2, 120,000 rounds), but anyone holding the link can keep guessing offline, so the phrase is only as strong as its words.

Proofs you share

A proof of funds, payment or payroll total shows exactly what it states and names who it is for, until it expires. It reveals nothing about other notes. Whoever receives it can forward it, and the name inside shows who it was made for.

Agents

The MCP server an agent owner runs keeps the agent's note secrets in an encrypted store on that machine, and the agent only ever handles references to them. Spending limits are enforced by that server, so a compromised host can ignore them. The hosted Gloam tools hold no secrets: they verify proofs, build payment requests and read vault stats.

What we assume

Groth16 and the Poseidon hash are sound, and our circuits enforce what we say they do.
At least one contributor to the mainnet trusted setup destroys their secret.
Tempo, Robinhood Chain and the stablecoin contracts behave as documented.
The browser's built-in cryptography is correct, and the device is not compromised.

Known gaps

Beta software. Mainnet is new. Beta deposit limits cap what each pool can take while it is young.
Internal review only. Several internal rounds, with fixes deployed. The pre-mainnet review finished on 20 October 2026 with no Critical or High findings open. An external audit is planned, not done.
Thin anonymity set. The mainnet pools are new, so there are few notes to hide among at first. Few people use the testnet vaults either.
Dev-ceremony keys on testnet. Testnet proving keys had one contributor, so testnet is for practice only. Mainnet uses the final keys from the 13-contributor ceremony.
Read metadata. Checking whether a specific payment was spent goes through a public RPC, which can tie your IP address to that payment.
Single-wallet owner. One wallet is owner and treasury at launch. A multisig is planned.
Team-run relayer. The Gloam team runs the relayer at launch. It only submits already-proven transactions and pays gas, so it cannot move or redirect money, but it can refuse or go down. You can then send from your own wallet.
Swap amounts are public. A private swap hides who swapped, not the tokens or the amounts. Its routers were reviewed internally, not externally audited.
The sealed trade is retired. The mainnet pools have no sealed swap, and on testnet it stays switched off. Private swaps replaced it.

Out of scope

Linking you through information you share yourself, or cashing out to an address tied to your name.
Social engineering, phishing for your recovery signature, or a compromised device.
Attacks that only slow down public RPCs or the chain itself.

How to report

Email hello@gloam.tradewith "Security" in the subject, or DM @gloamtrade. Include the contract, route or page, exact steps or a proof of concept, and the impact. Tests on a fork or a local chain are ideal. Please do not attack the live service or touch other people's notes.

Gloam has no paid bug bounty yet. We reply within three days, credit you by name once a fix ships, and you are free to publish what you found after that. The full policy is in the repository's SECURITY.md.