Styx Protocol · Devnet app · Solana
On a stealth send, the payee is a one-time address, not a wallet.
Nothing here hides you from the start: a stealth send names your wallet as the payer, and a pool withdrawal republishes its deposit's commitment. A deposit is the one leg that detours — you pay this deployment, and it funds the key that touches the pool. Your keys are derived from one wallet signature and live in this tab's worker. They are never uploaded.
Devnet only, read first
Test tokens, not real funds. This software has not been audited, and there is no mainnet deployment. Anything you move here you should be able to afford to lose.
Proof system
Hash-based STARK
Poseidon and Merkle trees only. No elliptic curves anywhere in the proof.
Stealth address
X25519 + ML-KEM-768
Hybrid key encapsulation. The lattice half follows FIPS 203.
Signatures
Ed25519
Solana verifies nothing else, so every transaction you send from here stays classically signed.
Status
Devnet, not audited
Deployed and running on devnet. There is no mainnet deployment.
The app
Shield, withdraw, subscribe.
Connect a wallet, then sign to derive your stealth spending, viewing and ML-KEM keys. Your wallet is asked for two signatures, and the second one is only there to prove it signs deterministically, so your keys can still be re-derived next session. Neither signature leaves this tab and no transaction is sent to derive anything. From there the tabs cover sending to a one-time address, importing a sealed note, moving value in and out of the shielded pool, and opening or reviewing a subscription vault.
The signing prompt is still headed with the old Protocol 01 name. That heading is the seed of every key this app derives for you, so renaming it would orphan the notes and vaults of everyone who already has some. It stays exactly as it is. The name on the prompt is old; the keys it produces are yours.
Solana devnet · your keys stay in this tab
Test tokens only. Depositing costs your wallet one public signature paying this deployment, which then funds the one-time key that touches the pool — so your address is not on the pool transaction itself. Each screen says who paid for that screen.
- 1Connectyour wallet
- 2Derive keys
- 3Send or subscribe
Connect a wallet
Everything here runs on a P01 key: subscriptions belong to it and notes are sealed to it. A deposit costs you one signature — the denomination, a 0.3% protocol fee and a 1% operator fee — while this deployment fronts the refundable proof rent and takes it back afterwards. Recipient addresses are hybrid post-quantum. The signature that pays is Ed25519 and stays Ed25519.
The P01 extension is not installed.
It holds your keys and signs for you, and it is a convenience rather than a requirement. Install it and reload, and its button appears above. No wallet announced itself to this page, so there is nothing to connect yet. Install Phantom or the P01 extension, then reload.
Before you sign
Four things this page will not pretend.
Each of these is checkable on a block explorer or in the source, which is the only reason it is written here. The recipient side is what this app hides. The payer side is not, and neither is the link between a deposit and the withdrawal that spends it.
- 01
Your wallet signs, and it is not always on chain
A deposit costs your wallet one signature: a single, fully visible transaction paying this deployment, plus a 1% operator fee in the same transaction. This deployment then funds the single-use key that touches the pool, from a different address of its own — so the transaction that deposits does not name you. A withdrawal or a subscription asks the deployment to cover the whole job; when it does, your wallet is on no transaction at all, and when it cannot, your wallet pays and the screen tells you which of the two happened. A deposit that cannot be relayed is refused rather than quietly falling back.
you signone transfer, to this deploymentthe pool deposita single-use key we fundedrelayerthis deployment, for the funding leg - 02
A withdrawal can be paired with its deposit
Unshielding republishes the same commitment the deposit published, so the two transactions can be matched today by anyone reading the chain. This is not fixed, no client-side change can hide it, and the pool is small enough that matching is not hard. Read the pair below on devnet before you decide what to move.
clusterdevnetleaf16commitment8901821612542787864appears inboth the deposit and the withdrawal - 03
One public hop, and it points at us, not at the pool
Shielding still begins with one ordinary, fully visible transfer signed by your wallet — but it now pays this deployment rather than the single-use signer, and this deployment funds that signer from a separate address. Two transfers, neither naming both ends. What still ties them is the amount and the minutes between them, and nothing here hides either. A pool withdrawal then pays a payout address derived per note, and refuses to pay the connected wallet at all.
pre-fundpublic transfer, from you to this deploymentsignerone use, funded by this deploymentpayoutderived per note, never your wallet - 04
The amounts are not hidden, and neither is the clock
The pool is denominated, so a shield or a withdrawal reveals which denomination you used, and the timing of every transaction is public because you sent it yourself. What the proof withholds is which note in the tree you spent. That is the whole of the guarantee, and it is worth exactly as much as the number of other notes sitting beside yours.
hiddenwhich note was spentpublicdenomination, timing, your walletverified bya Solana program, not a server
The honest offer
Test it with money you can afford to lose.
That is what a devnet can offer. Shield, pay, withdraw, then read the programs that did it and the transactions they left behind.
Every claim on this page is either visible on devnet or readable in the source. Nothing about users, volume or throughput appears here, because none of it is benchmarked.