Private pay designed · not deployed
Agents that pay without a name
An agent that pays for what it uses should not have to reveal whose wallet it is. This is the design for that on Robinhood Chain, in full, so it can be argued with now. None of it is deployed and nothing on this site takes money.
The shape
- Deposit. A wallet sends USDG to the pool contract in a fixed denomination and receives a note: a secret and a nullifier, generated in the browser, whose commitment is inserted into the pool's Merkle tree. The chain records the deposit, not the note.
- Hold. The note lives in the comb's storage on the device, encrypted with a passphrase. It is the thing an agent can spend.
- Pay. To pay a service, the browser builds a zero-knowledge proof that it knows a note in the tree and that the note's nullifier has not been used. The proof names the payee and the amount and nothing about which deposit funded it.
- Verify and settle. The pool contract verifies the Groth16 proof, records the nullifier, and pays the service in the same transaction. One call, no approval step.
- Agents pay alone. A scheduled task carries a spend limit and can settle its own usage from a note, so the owner's wallet never signs the payment.
What the chain sees, and what it does not
| Visible | Hidden |
|---|---|
| That a deposit of a fixed size happened, from which wallet | Which deposit a payment came from |
| That a payment of a fixed size went to a service | Who is paying the service |
| Every nullifier ever spent | The link between a nullifier and a deposit |
The privacy is the size of the pool. With ten deposits, a payment hides among ten; with ten thousand, among ten thousand. Fixed denominations exist so amounts cannot single out a depositor.
Parameters, proposed
| Token | USDG on Robinhood Chain, 6 decimals |
| Denominations | 1, 10, 100 USDG |
| Tree | Poseidon Merkle tree, depth 20 |
| Proof system | Groth16 over BN254, verified on chain; the circuit and trusted setup published before deployment |
| Relayer | Optional, for paying gas without revealing the payer; takes a stated fee, cannot redirect funds |
| Fee | None to the pool. Gas only, or the relayer's stated fee |
What is not built
- The pool contract, the verifier and the circuit. Nothing is deployed on Robinhood Chain for this.
- The note store in the comb. There is no deposit button and no place to paste a note.
- Any service that accepts a shielded payment. The first one will be the comb's own relay, from roadmap phase two.
When any of that changes, this page changes with it, before anything is announced elsewhere.