Private payments that leave no trail

Overview

Each supported chain runs one pool per asset (native coin plus a stablecoin). Deposits add an encrypted note to a Merkle tree; spending a note means proving, in zero knowledge, that you own a leaf of that tree without revealing which one. Blackpool uses Groth16 proofs generated in your browser or by the CLI, and a relayer that submits transactions so your wallet never has to appear on-chain again after the deposit.

Core concepts

Private account

When you connect a wallet, you sign a fixed message once. The signature is hashed into your spending key and viewing key. Keys never leave the device; the API only ever sees the signature-derived public identifier it needs to look up your encrypted notes.

Notes, commitments and nullifiers

A note is (amount, owner, blinding). Its commitment is inserted in the pool's Merkle tree. To spend, you publish a nullifier (a hash that commits to the note without revealing it) and a proof that the note exists in the tree and that inputs equal outputs plus fees. The contract rejects a nullifier it has seen before, which is what prevents double spends.

Relayer

Every private operation is a transact call on the pool. The relayer pays gas and broadcasts it; the fee is taken inside the proof from the amount you are moving, so you never need gas in a fresh address. The relayer learns the public destination of a withdrawal but not who funded it.

Shield (deposit)

Shielding moves public funds into the pool. The app prepares a proof for a new note worth the deposit, your wallet sends the token (or native coin) to the pool contract together with that proof, and the commitment is appended to the tree. Shielding is the only step your wallet signs on-chain.

1. Prepare — the client builds an output note for you and a Groth16 proof.
2. Broadcast — your wallet calls transact with the deposit amount (ERC-20s need a one-time approval).
3. Confirm — the pool emits the new commitment and an encrypted copy of the note that only your viewing key can read.

Your private balance is the sum of your unspent notes. The app keeps an encrypted index per account; nothing about balances is stored in plaintext anywhere.

Private send

A private send spends one or more notes and pays an external address. The relayer submits it, so the recipient sees a plain transfer from the pool contract with no connection to your wallet. Up to two recipients can be paid in one proof; any remainder returns to you as change.

Recipient   0x9f3c…41e7
Amount      0.25 ETH
Fee         0.00015 ETH + 0.35%   (paid from the pool, no gas needed)
Result      pool → recipient. Nothing on-chain links the two.

Swap

Swaps happen inside the pool's privacy set. The app derives a one-time burner wallet from your account, withdraws to it privately, swaps on Uniswap V3 (Base and Arbitrum) and re-shields the output into the destination pool. The burner is used exactly once and is deterministic, so it can always be recovered from your signature.

Gas for the burner is capped per chain to realistic values; the app refuses to start a swap whose output would fall under the destination pool's minimum after slippage.

Bridge

Cross-chain moves use NEAR Intents (1Click). Blackpool asks for a quote, receives a one-off deposit address controlled by the solver network, and pays it from the pool through a burner. Solvers deliver the destination asset to your recipient. The origin chain never sees the recipient, and the destination chain never sees the origin.

• Destinations include EVM chains (Base, Ethereum, Arbitrum, BNB Chain, Robinhood Chain) and Solana (SOL, USDC, USDT).
• Every bridge is recorded server-side in an intent registry keyed to your account, with a refund address on the origin chain in case a quote expires.
• Status is tracked until SUCCESS or REFUNDED; you can follow any intent on the public NEAR Intents explorer.

Recovery

Anything that can get stuck is recoverable from your signature alone. The Recover page lists every burner wallet your account has ever derived (with live balances) and every bridge intent, and lets you sweep or re-shield funds from any device. No seed phrases, no exports: the same wallet signature regenerates everything.

Chains & assets

Pool addresses are published here when each chain goes live. Blackpool uses public RPC endpoints only.

Fees & limits

Fees are deducted inside the proof from the amount you move and cover relayer gas. Bridges pay the pool fee plus the solver's quoted rate; there is no additional Blackpool fee on bridges.

CLI

The CLI wraps the same API as the app, so agents and scripts get private payments without a ZK client of their own. Keys are read from BLACKPOOL_KEY or stored locally with chmod 600; only derived signatures are ever sent.

npm i -g @blackpool/cli
blackpool login                         # hidden prompt, or set BLACKPOOL_KEY
blackpool balance --chain base
blackpool deposit 25 --pool usdc        # shield
blackpool send 0xRECIPIENT 2.5          # private send, relayer pays gas
blackpool swap 0.001 --from eth         # private ETH → USDC via Uniswap V3
blackpool bridge 0.05 --to sol_usdc --recipient <solana address>
blackpool bridges                       # list your intents and their status
blackpool recover                       # sweep stranded burners

Every command accepts --chain base|robinhood|arbitrum|bsc (default base).

API

The relayer API is stateless with respect to your keys: requests carry a signature-derived account identifier and the proof inputs, never a private key. Base URL will be published with the first deployment.

Security model

What is hidden

The link between a deposit and any later spend; your balance; which note a spend consumes; the origin of a bridged payment on its destination chain.

What is public

That a deposit of a given amount entered a pool; that a withdrawal of a given amount left it to a given address; the fee paid. Anonymity grows with the number and variety of notes in a pool — a very unusual amount is easier to correlate.

Trust assumptions

Proofs are verified on-chain, so the relayer cannot steal or forge spends; it can only refuse to relay. Bridges rely on NEAR Intents solvers for delivery, with on-chain refunds on failure. Contracts are upgradeable behind a multisig during the launch period; the upgrade path and audit status will be documented here before mainnet pools accept deposits.

FAQ