​
Actors

​
On-chain observers

An observer sees deposits (who, what, how much), withdrawals (to whom, what, how much), swaps (pair and amounts), fees and the timing of everything. They do not see who sent a private transfer, who received it, or how much. Correlation attacks use address, amount and time. See Privacy Best Practices.

​
Known trust gaps

Round timing is trusted. The selected round and staggered group are not part of the signed transaction, and the contract does not check them. A dishonest scheduler could send a round withdrawal at a different time.
Hosted proxies see your activity. Your viewing key lets the proxy decrypt every note you own. Run the proxy on-device to remove this trust.
  • Encryption key substitution. A dishonest proxy could try to register an encryption key it controls for you. The contract rejects any key that isn’t on the Grumpkin curve, and the app verifies your registered key against the one derived locally. Registration is final, so verify before you sign.
  • Swap MEV. The proof binds amountOutMin. Keeping the relay transaction out of the public mempool is the main defence against sandwiching.

​
Mitigations built into the contract

  • Every public input is range-checked against the BN254 field.
  • Any historical Merkle root is valid. Double-spends are stopped by nullifiers, not root freshness.
  • ReentrancyGuardTransient on every value-moving entry point.
  • Separate pause flags: the gatekeeper can stop inflows, but only the admin can stop exits.
  • Plain ETH transfers to the pool revert, except from the router during a swap.
  • Withdrawals to the pool’s own address are refused.