Meet $GLOAM, the Gloam token.

See more
GloamDocs

Deeper

Production gate

Testnet is live. Mainnet and real money wait on this checklist, we will not skip it.

Today
Testnet + dev keys
Keys
Dev ceremony
Audit
Required
Mainnet
Blocked

Why this page exists

The app proves shield, unshield, and private send in the browser. That is real cryptography, and still not production-safe while the proving keys come from a development trusted setup.

Gate order
Step 1Production ceremonyMulti-party Powers of Tau + circuit-specific contribution. Publish transcripts. Replace app zkeys and redeploy verifiers.
Step 2Independent reviewContracts + circuits reviewed. Fix blockers. No “audit pending” mainnet.
Step 3Ops + incident planOwner keys, pause/upgrade policy (or immutability choice), monitoring, disclosure channel.
Step 4Mainnet deployNew pool + verifiers on Robinhood mainnet. App points at production artifacts only.

Ceremony checklist (keys)

  • Document phase-1 ptau source (or re-run public Powers of Tau)
  • Phase-2 contributions for unshield + transfer + sealed swap circuits with public logs
  • Export new *.zkey + Solidity verifiers; match public inputs layout v2
  • Update SHA-256 fingerprints in circuitArtifacts.ts
  • Flip PROVING_CEREMONY to production only after the above
  • Destroy or never re-use toxic waste from the ceremony

What is already hardened on testnet

  • Real on-chain verifiers (no always-true mock on the funded pool)
  • Browser prove path with artifact hash checks
  • Private send does not keep the payment note on the sender
  • Hardened pool: a bound shield proof and 128-bit amount range checks (audit C1/C2)
  • Two-step ownership and a one-way shield-verifier set (audit M-4)
  • Note secrets and receive keys encrypted at rest (AES-GCM under an IndexedDB device key, or that key wrapped by a passkey, audit M-1)
  • Claimed payments secured on claim: moved into a fresh note only the payee knows, so the payer cannot spend them back

What is still open product-wise

  • Re-enable sealed swaps after the H1 solvency fix (they are disabled on-chain today)
  • Stronger key custody. Notes and receive keys are encrypted at rest, but the key is device-bound; a wallet-bound or passphrase key is a mainnet consideration
  • Stronger public-input privacy (rates / pair strategies)
  • Anonymity set growth (more users → better privacy)
  • Mainnet only after this gate

Security policy: Disclosures · repo SECURITY.md. Product status: What ships when.