Own stocks.
Quietly.
Shielded pools for tokenized stocks on Robinhood Chain. Nobody sees what you hold. Auditors can still prove every exit is clean.
Your share becomes one of 1,284.
Nobody can tell which one is yours.
One leaves for a fresh address.
It drops into the pool beside every other deposit. Same size, same shape.
Three moves.
- 1
Deposit one share.
Approve, deposit. Your browser writes a bearer note and keeps it. The note is the share; nothing about it is sent anywhere.
- 2
Let it settle.
- 3
Withdraw to a fresh address.
AAPL
Apple Inc., one share.
Privacy for the holder. Proof for the auditor.
Every withdrawal proves membership in the global tree and in the association set of clean deposits, bound to the same leaf. Nobody can tell which deposit it was. Everybody can tell it was a clean one.
The public
- Learns about the deposit
- One share entered the pool
- Learns about the withdrawal
- One share left, to a fresh address
- Can link the two
- No
- Knows the exit is clean
- Yes, by proof
Robinhood Chain
- Learns about the deposit
- The same as the public
- Learns about the withdrawal
- The same as the public
- Can link the two
- No
- Knows the exit is clean
- Yes, by proof
The curator
- Learns about the deposit
- Which deposits it admits to the set
- Learns about the withdrawal
- Nothing more than the public
- Can link the two
- No
- Knows the exit is clean
- It defines the set
An auditor
- Learns about the deposit
- Everything the public sees
- Learns about the withdrawal
- Everything the public sees
- Can link the two
- No
- Knows the exit is clean
- Verifies every exit against the association set
The recipient
- Learns about the deposit
- Nothing
- Learns about the withdrawal
- Their own
- Can link the two
- No
- Knows the exit is clean
- Yes, by proof
You
- Learns about the deposit
- Yours
- Learns about the withdrawal
- Yours
- Can link the two
- Only you
- Knows the exit is clean
- Yes
Privacy Pools design by Buterin, Illum, Nadler, Schär and Soleimani; implementation forked from 0xbow. The curator’s policy is public from day one: deposits are admitted by default and filtered only when flagged.