PrivacySend

What It Is

Zero-knowledge privacy layer for any Ethereum wallet. Connect MetaMask, Rainbow, or any EIP-1193 wallet and instantly receive a private RAILGUN address. Shield tokens into an encrypted balance, transact invisibly, and unshield to any destination, all from your browser.

Two transaction modes:

• Broadcaster Mode: Unshield transactions submitted through the Waku broadcaster network. Your gas-paying wallet never touches the blockchain. Maximum privacy, small token fee.
• Self-Sign Mode: Submit directly from your connected wallet. You pay gas in ETH. Faster, no broadcaster fee, but links your public wallet to the unshield event.

Every zero-knowledge proof is generated locally in the browser using Groth16 + WASM. Keys never leave the device.

The Problem

Every Ethereum transaction is permanently visible. Your wallet address is your identity, and every token you hold, every contract you touch, every transfer you make is public forever.

• Anyone can trace your holdings, trading patterns, and counterparties
• DeFi and NFT activity exposes net worth and strategy on-chain
• Moving funds to a fresh wallet still requires a traceable public transaction
• Existing privacy tools are custodial, sanctioned, or require trusted operators
• No standard way to give a normal wallet private-balance capability

The Solution

PrivacySend wraps any wallet with RAILGUN's zk infrastructure and gives the user a private-balance ledger that only they control. Shielded tokens move through an encrypted Merkle Tree where amounts, senders, and receivers are cryptographically hidden.

Three steps:

1. Connect: Any EIP-1193 wallet, MetaMask, Rainbow, WalletConnect
2. Shield: Deposit tokens into your private RAILGUN balance with one click
3. Send or Unshield: Transfer privately to any 0zk address, or withdraw to any public wallet

Non-custodial. No KYC. No accounts. No servers hold your keys.

How It Works

Private Address Derivation: Your 0zk address is derived deterministically from a signature of a project-specific message. Sign once with your connected wallet and the same private address is recoverable on any device. Optional random-entropy mode for users who want an independent mnemonic.

Zero-Knowledge Proofs: Every unshield uses a Groth16 zk-SNARK to prove ownership of UTXOs without revealing which ones. Proofs are generated entirely in-browser via snarkjs/WASM, no proving server, no trusted operator.

Encrypted UTXO Ledger: All balances live inside the RAILGUN Relay Adapt contract as an encrypted Merkle Tree. The contract keeps every UTXO individually accounted for while hiding which address owns which commitment.

Broadcaster Network: Unshield transactions can be submitted via the decentralised Waku broadcaster network. Broadcasters relay your signed transaction without learning the sender, recipient, or amount. The broadcaster is paid in the token being unshielded, no ETH required from you.

Proof of Innocence: Before every unshield, the SDK generates POI proofs to demonstrate that your UTXOs are not linked to known illicit sources. This keeps the protocol compliant at the edges while preserving user privacy.

Privacy Primitives

Every PrivacySend wallet ships with three primitives built in. Not plugins, not add-ons.

Auto-Provisioned 0zk Address: Connect a wallet and it instantly receives a unique RAILGUN private address. Mnemonic encrypted at rest in browser IndexedDB, never transmitted, never stored on any server.

Groth16 zk-SNARK Proofs: Every unshield is backed by a local zero-knowledge proof. The prover runs fully in the browser via WASM, no remote proving service, no trust assumptions beyond the RAILGUN contracts themselves.

Waku Broadcaster Relaying: Unshield transactions can be relayed through the Waku peer-to-peer network. The broadcaster submits the tx, pays the gas, and takes a fee in the unshielded token. Your public wallet stays entirely off-chain for the operation.

Built-in Privacy Features

Every PrivacySend session ships with a full privacy toolkit on the UI. The user sees exactly what they can do and what each action reveals on-chain.

UI Tools

Shielded Balance Model

Every user holds a private UTXO set that only they can spend. No observer, including the RAILGUN contracts, can link commitments to identities.

• Shield: Public tokens enter the contract and become encrypted commitments owned by your 0zk address
• Transfer: Commitments are consumed and new ones are created for the recipient, all inside the Merkle Tree
• Unshield: A zk-proof authorises the contract to release public tokens to any recipient you choose

The flywheel: more users means a larger anonymity set, which means stronger privacy for every user.

Features

Supported Networks

Security Model

PrivacySend is a client-side interface to audited RAILGUN contracts. It does not hold user funds, never has custody, and cannot move balances on behalf of users.

What the system does NOT do:

• Does not expose raw private keys. Mnemonic encrypted at rest in browser IndexedDB
• Does not transmit signing material. All signing happens locally in the user's wallet
• Does not store conversation or transaction history on any server
• Does not require KYC, email, or personal information
• Does not control which address receives an unshield. The user signs every action

What happens:

• Private keys exist only in browser memory at runtime
• Every transaction settles on-chain with cryptographic verification
• zk-proofs are verified by the RAILGUN smart contracts, not any off-chain party
• Broadcasters cannot see or modify the contents of the transactions they relay
• The UI is open-source; the underlying protocol is audited

Integration with Portal Ecosystem

Fees

The 0.25% protocol fee is paid to the RAILGUN DAO. Broadcaster fees are set by individual broadcasters on the Waku network and quoted in real time before you submit.

Development Status