DARK
An ERC-20 with an encrypted ledger

Privacy inside the token.

Balances, sends and sells are encrypted inside the token contract itself. Trade DARK like any ERC-20, then move it into a balance only your key can read.

Open demo wallet How it works
Checking the demo Ethereum fork, test funds only.
Sample transfer Public record
Sender
Encrypted, hidden inside the ring
Recipient
Encrypted, hidden inside the ring
Amount
Encrypted
Ring of 8

    The chain sees eight keys and a proof. Which two moved value, and how much, stays inside the ring.

    Ciphertext

    Press “Sample key” to generate a real ElGamal ciphertext for this transfer in your browser, using the same Baby Jubjub code the wallet uses. Nothing is submitted.

    Visibility

    Both ledgers live in one contract.

    Hide moves whole tokens from the public balance into the encrypted one; exit moves them back. There is no separate pool, no deposit and no admin. Public trading stays on an ordinary Uniswap v2 pair.

    Public balanceReadable by anyone
    Holder
    0x7f31…a204
    Balance
    1,840 DARK
    Stored as
    A number in balanceOf, like every ERC-20.
    Who reads it
    Anyone: explorers, bots, routers, Uniswap v2.
    Private balanceReadable by the holder
    Holder
    dark key 0x9c4e…b17d
    Balance
    Encrypted amountencrypted
    Stored as
    An ElGamal ciphertext (two curve points) under the holder’s dark key.
    Who reads it
    Only the holder. The wallet decrypts it in the browser; the chain only verifies proofs about it.

    Illustrative balances. Your real balance is decrypted in the wallet.

    Actions

    Only the move inside is private.

    Entering and leaving touch the public side, so those amounts are public. Each of the five operations below shows exactly what the chain sees.

    Enter
    Move privately
    Leave
    Public sideETH in your wallet
    crosses in
    Encrypted ledgerYour dark balance
    Public on chain
      Hidden

        Buy straight into the dark side.

        One transaction swaps ETH through Uniswap v2 and credits the result to your encrypted balance. Nothing ever sits in your public balance.

        Spendable from the next 60-second epoch.

        Try it in the wallet
        Protocol

        What the demo does today.

        A known construction, encrypted balances with ring proofs and epochs, placed inside an ordinary token. Nothing below is a claim about mainnet.

        Mechanism

        • BalancesElGamal ciphertexts on the Baby Jubjub curve, stored in the token contract under your dark key.
        • TransfersA ring of 8 keys and one Groth16 proof. The proof shows one ring member paid, one received, and the ciphertexts balance.
        • Epochs60 seconds. Incoming value sits in a pending slot and folds into the balance next epoch, so a proof stays valid for its whole epoch. One private spend per key per epoch.
        • RelayerSubmits the proof so the sending wallet never appears. Its fee in DARK is bound into the proof.
        • AdminNone. No owner, no upgrade path, no pause.

        What stays public

        • EnteringBuy and hide amounts, the paying wallet, and the destination dark key.
        • Every transferThe eight ring keys, the epoch, the nullifier and the relayer fee.
        • LeavingThe exit amount and the payout address. Which ring key paid stays hidden.
        • HiddenIn a private send: who paid, who received, and the amount.
        • LimitsAnonymity is “one of eight” per transfer. Timing and amounts at the edges can still be correlated. This is not a mixer and not a full shielded pool.

        Deployment

        • ChainFork of Ethereum mainnet, chain id 31337, 60-second epochs. State resets when the demo chain restarts.
        • Contractloading from the relayer…
        • Relayer fee…
        • FundsTest ETH from a faucet. Nothing here has value.
        • Before mainnetA public phase-2 ceremony (the current proving key has a single contributor and is forgeable), an independent audit of the circuit and contracts, and a relayer with a funded key on a real domain. None of these exist yet.

        What you can check

        • Live walletOpen the demo and run a buy, a private send and a private sell with test funds.
        • Relayerapi/info (chain, contract, fee, epoch) and api/keys (every dark key seen on chain, the decoy pool).
        • CircuitDarkTransfer(8): 25,148 constraints, 73 public inputs. Proving in the browser takes well under two seconds on a laptop.
        • Gas on the fork
          hide240k
          buy into dark362k
          ring transfer1.0–1.54M
          exit sold for ETH1.74M
        • SourceNot yet published. No audit, no benchmark claims beyond the numbers above.

        Questions.

        What is actually private?

        A private send hides the payer, the recipient and the amount inside a public ring of eight keys. Buying and hiding are public entries, including the amount and the destination dark key. Exits publish the amount and the payout address; which ring key paid stays hidden. Relayer fees are public.

        Is this a mixer or a pool?

        No. The encrypted ledger is part of the ERC-20 contract. You never deposit into a separate contract, and public trading uses an ordinary Uniswap v2 ETH pair, so bots, routers and terminals work unchanged.

        Why wait for the next epoch?

        Incoming value lands in a pending ciphertext and folds into the spendable balance at the next 60-second epoch. That keeps your balance fixed while the proof is generated, so nobody can invalidate your transfer by paying you. One private spend per key per epoch.

        What if I lose my dark key?

        The key is the only thing that decrypts and spends your private balance. The wallet keeps it in this browser’s storage. Back it up: clearing site data or losing the device removes access permanently. There is no recovery and no admin.

        Can I use real funds?

        Not here. The demo runs on a fork of Ethereum with faucet ETH, and balances reset when the chain restarts. Mainnet needs a public proving-key ceremony and an audit first.