Selective disclosure

Why it matters

A shielded pool that can only hide is a dark pool, and a regulated-chain sponsor cannot build on that. Gloam is private by default and provable on demand: the holder, and only the holder, chooses what to prove and who to send it to. That is the difference between privacy and opacity, and the answer to the dark-pool objection.

What a disclosure proves

A disclosure is a portable token that lets a verifier confirm:

• the discloser knows the secret that binds a commitment to a specific amount and asset, and
• that commitment was added to the pool.

Together: this holder controls, or controlled, this balance in the Gloam vault. It reveals nothing about who they are, does not expose the note secret (so it can never be used to spend), and says nothing about any of their other notes. It does not show the note is still unspent.

How it works

It reuses the shield circuit, so there is no new trusted setup. The shield proof already proves commitment == Poseidon(secret, amount, asset) with the secret private. A disclosure is that proof plus the public commitment. The verifier checks the proof, then confirms membership on-chain with pool.commitmentSeen(commitment). Because the commitment is already a public tree leaf, a disclosure leaks nothing new beyond the amount and asset the holder chose to reveal.

Create a disclosure

In the app, open /app/disclose, pick a note, and copy the token. Programmatically, generate the shield proof for the note you want to reveal and package it:

import { artifactProver } from "@gloamtrade/sdk";

// prove the note you choose to reveal (same input as a shield)
const prover = artifactProver({ wasm: "shield.wasm", zkey: "shield_final.zkey" });
const { proof, publicSignals } = await prover({
  commitment: note.commitmentField.toString(),
  amount:     note.amountWei.toString(),
  asset:      assetField.toString(),
  secret:     note.secretField.toString(),
});

// publicSignals === [commitment, amount, asset]
const disclosure = { v: 1, chainId, pool, commitment: publicSignals[0],
  amount: publicSignals[1], asset: publicSignals[2], proof };

Verify a disclosure

Anyone can verify at /verify, with no wallet and no account. The proof is checked locally with snarkjs and the note is looked up directly on Robinhood Chain. Verification is two independent checks:

import { groth16 } from "snarkjs";

// 1) the proof (ownership + amount/asset binding)
const vkey = await (await fetch("/circuits/shield_vkey.json")).json();
const proofOk = await groth16.verify(vkey, [d.commitment, d.amount, d.asset], d.proof);

// 2) membership: the commitment was added to the pool
const live = await pool.read.commitmentSeen([toBytes32(d.commitment)]);

const verified = proofOk && live;

Guarantees

• Unspendable. The disclosure carries a proof, not the secret, so it can never move the funds.
• Scoped. It reveals exactly one note. Other holdings, the wallet, and the history stay private.
• Not bound to a reader or a time. This original format has no recipient label and no expiry, and stays valid after the note is spent. Anyone holding it can check it, so send it only to the party you mean to.
• Trustless to verify. The recipient checks the math and the chain themselves; they do not trust the holder or Gloam.

Newer proofs cover what this format cannot. A proof of funds shows you hold at least X across up to four unspent notes, a proof of payment shows a private payment was made, and a payroll total shows a run added up. Each carries a label naming who it is for and an expiry, and is checked at /verify. See proofs.

Roadmap: viewing keys for continuous read access to a designated auditor.