System Overview - Veilify

Veilify has three layers. The wallet signs. Veilify Network services prove, schedule and relay. The pool on Robinhood Chain verifies and settles.

On-chain

Contract	Role
Pool proxy	Holds every pooled asset and all state. Custom ERC-1967 proxy, initialized atomically.
Pool implementation	Deposits, private transfer / withdrawal / swap, key registry, whitelist, fees, roles. UUPS-upgradeable through an upgrade controller.
Verifiers	Three UltraHonk verifiers generated from the circuits. Each holds one verification key.
Poseidon2T4Unrolled	Linked library for Poseidon2 hashing of commitments and inbox keys.
VeilifySwap	Linked library that runs the router leg of a private swap by `DELEGATECALL`. Keeps the pool under the EIP-170 size limit.
AdminUpgradeController	Answers `canUpgrade(caller, impl)`. Holds the admin role. Replaceable by a timelock or multisig.

Off-chain

Service	Role
RPC proxy	The Veilify Network endpoint. Intercepts wallet transactions, serves balances, forwards reads to Robinhood Chain, and hosts the `veilify_*` methods.
Prover	Builds witnesses and UltraHonk proofs for transfers, withdrawals and swaps.
Withdrawal scheduler	Holds prepared intents and signed withdrawal jobs. Releases Round withdrawals at their round.
Relayer	Allowlisted on-chain. Submits proofs, pays gas, collects the proven fee.
Gatekeeper	Watches `DepositPending`, screens depositors, calls `approveDeposit` or `rejectDeposit`.

Trust boundaries

The contract and proofs decide whether value can move. No service can spend a note without the owner’s signature.
The proxy sees your viewing key, so it can see your private activity. Run it on-device to remove that trust. See Virtual Network.
The scheduler decides when a round withdrawal leaves. Round timing is not enforced on-chain.
The gatekeeper decides whether a deposit enters. It cannot take pooled funds.