How it works
Threat model
Who we defend against, what each of them can and cannot do, what we assume, and the gaps we know about. Written for security researchers. If you just want to know what an explorer shows, start with What stays private.
- Network
- Testnet today
- Bounty
- None yet, credit by name
- Report to
- hello@gloam.trade
- Fork tests
- Welcome
What we protect
- The link between a deposit and any later spend or cash out.
- Who paid whom, and how much, for a private send inside the vault.
- What anyone holds while their money is in the vault.
- Payment notes and receive keys on the user's own device.
- The vault itself: nobody takes out more than was put in.
Some things are public by design and we do not try to hide them: deposits and cash outs, the wallet that sent each transaction, timing, and the opaque hashes every payment adds to the vault. What stays private walks through exactly what an explorer shows.
Who can do what
| Who | Can | Cannot |
|---|---|---|
| Anyone watching the chain | See every deposit and cash out (wallet, asset, amount), who sent each transaction and when, and try to match deposits to exits by amount and timing. | Tell which note a spend used, see the amount or parties of a private send, or see what anyone holds in the vault. |
| The Gloam relay | See your IP address and the timing of the transactions it sends for you, and refuse to send one. | Change a cash out's recipient or amount, which the proof binds, learn a note secret, or move money. |
| RPC providers | See the reads the app makes through them, including a check on whether one specific payment has been spent. | See note secrets, or anything the chain does not already show. |
| The Gloam team and contract owner | Change proof, price or rate rules after a 3-day public timelock, lower deposit limits at once on the mainnet vault, and change the web app you load. | Move pooled funds. There is no admin withdraw, and no rule change takes effect without 3 days of public notice. |
| Someone who pays you | Spend the payment back before you claim it, since they made its secret. | Take it back once you have claimed it. Claiming moves it into a new note only you know. |
| Anyone holding a claim link | Claim it. A plain link is like cash. A locked link also needs its phrase, which a weak phrase does not protect for long. | Claim a payment sealed to a Gloam address. Only that address's owner can open it. |
| Someone with your device or browser | Use an unlocked session, or read your notes if they control the browser while it is open. | Read your notes from storage alone. They are encrypted under a key the browser will not export, or under your passkey. |
| Gloam's recovery store | See a backup's id, a hash of its write token, its size and when it changes. | Open it. The key comes from your wallet signature or passkey and never reaches the server. |
| A stablecoin issuer | Pause its coin or block the vault, so no balance in that coin can be cashed out until it lifts the block. Some token standards also let an issuer burn a blocked holder's balance. | See inside the vault, or tell whose money is in it. |
| Whoever ran the trusted setup | On testnet, forge proofs if they kept the setup's secret, and so drain the pool. | Do the same at mainnet, provided one contributor to the multi-party ceremony is honest. |
The details that matter
Amount and timing
A shielded pool hides you in a crowd. If you deposit 137 and someone cashes out 137 an hour later, an observer will guess it was you, and the proof cannot stop that. The crowd is small on testnet, so treat unlinkability as weak until more people use the vault. Splitting amounts and waiting before you cash out help.
The relay
The relay pays gas so your wallet does not appear as the sender of a private send or cash out. It checks every payment before sending it, keeps per-device and per-network rate limits keyed by IP address, and cannot alter what the proof binds. If it refuses or goes down, you can turn it off and send from your own wallet, at the cost of your wallet showing as the sender. On Robinhood Chain, a payment message you post yourself shows your wallet as the poster. Through the relay it does not.
Owner powers
After setup, the owner can change how proofs, prices or rates are checked only by queueing the change on-chain, where anyone can see it, and running it three days later. A harmful change, such as a bad verifier, gives everyone three days to cash out first. On the mainnet vault the owner can also lower deposit limits at once, down to zero. That can stop new deposits during an incident, never withdrawals or private sends. The owner is a single wallet today. Mainnet moves it to a multisig.
The web app
Your notes are made and stored by the code you load from gloam.trade, so a malicious or compromised build could read them. That is a trust assumption, not something the cryptography removes. The code is open source, the app checks the circuit files it downloads against fixed fingerprints, and you can run the SDK yourself instead of the hosted app.
Claim links and phrases
A claim link carries the payment's secret in the part after #, which browsers do not send to servers, and our analytics drop everything after ? and #. A locked link is encrypted with a key stretched from its phrase (PBKDF2, 120,000 rounds), but anyone holding the link can keep guessing offline, so the phrase is only as strong as its words.
Proofs you share
A proof of funds, payment or payroll total shows exactly what it states and names who it is for, until it expires. It reveals nothing about other notes. Whoever receives it can forward it, and the name inside shows who it was made for.
Agents
The MCP server an agent owner runs keeps the agent's note secrets in an encrypted store on that machine, and the agent only ever handles references to them. Spending limits are enforced by that server, so a compromised host can ignore them. The hosted Gloam tools hold no secrets: they verify proofs, build payment requests and read vault stats.
What we assume
- Groth16 and the Poseidon hash are sound, and our circuits enforce what we say they do.
- At least one contributor to the mainnet trusted setup destroys their secret.
- Tempo, Robinhood Chain and the stablecoin contracts behave as documented.
- The browser's built-in cryptography is correct, and the device is not compromised.
Known gaps
- Dev-ceremony keys. Testnet proving keys had one contributor. Mainnet waits on a multi-party ceremony.
- Internal audits only. Several internal rounds, with fixes deployed. No external audit yet.
- Small anonymity set. Few people use the testnet vaults.
- Read metadata. Checking whether a specific payment was spent goes through a public RPC, which can tie your IP address to that payment.
- Single-wallet owner. Moves to a multisig at mainnet.
- Private trade is off. Its accounting needs a redesign before it comes back.
Out of scope
- Linking you through information you share yourself, or cashing out to an address tied to your name.
- Social engineering, phishing for your recovery signature, or a compromised device.
- Attacks that only slow down public RPCs or the chain itself.
How to report
Email hello@gloam.tradewith "Security" in the subject, or DM @gloamtrade. Include the contract, route or page, exact steps or a proof of concept, and the impact. Tests on a fork or a local chain are ideal. Please do not attack the live service or touch other people's notes.
Gloam has no paid bug bounty yet. We reply within three days, credit you by name once a fix ships, and you are free to publish what you found after that. The full policy is in the repository's SECURITY.md.