Styx Protocol · Devnet app · Solana
On a stealth send, the payee is a one-time address, not a wallet.
Nothing here hides you: your wallet signs and pays for every transaction, and a pool withdrawal republishes its deposit's commitment. Your keys are derived from one wallet signature and live in this tab's worker. They are never uploaded.
Devnet only, read first
Test tokens, not real funds. This software has not been audited, and there is no mainnet deployment. Anything you move here you should be able to afford to lose.
Proof system
Hash-based STARK
Poseidon and Merkle trees only. No elliptic curves anywhere in the proof.
Stealth address
X25519 + ML-KEM-768
Hybrid key encapsulation. The lattice half follows FIPS 203.
Signatures
Ed25519
Solana verifies nothing else, so every transaction you send from here stays classically signed.
Status
Devnet, not audited
Deployed and running on devnet. There is no mainnet deployment.
The app
Shield, withdraw, subscribe.
Connect a wallet, then sign to derive your stealth spending, viewing and ML-KEM keys. Your wallet is asked for two signatures, and the second one is only there to prove it signs deterministically, so your keys can still be re-derived next session. Neither signature leaves this tab and no transaction is sent to derive anything. From there the tabs cover sending to a one-time address, importing a sealed note, moving value in and out of the shielded pool, and opening or reviewing a subscription vault.
The signing prompt is still headed with the old Protocol 01 name. That heading is the seed of every key this app derives for you, so renaming it would orphan the notes and vaults of everyone who already has some. It stays exactly as it is. The name on the prompt is old; the keys it produces are yours.
Solana devnet · your keys stay in this tab
Test tokens only. Your wallet is the fee payer on every transaction this panel sends, and this browser submits them itself.
- 1Connectyour wallet
- 2Derive keys
- 3Send or subscribe
Connect a wallet
Connect Phantom, or pair your Protocol 01 mobile wallet, to send and receive private, post-quantum payments.
Before you sign
Four things this page will not pretend.
Each of these is checkable on a block explorer or in the source, which is the only reason it is written here. The recipient side is what this app hides. The payer side is not, and neither is the link between a deposit and the withdrawal that spends it.
- 01
Your wallet is on every transaction
Every transaction sent from this page names your connected wallet as the fee payer, and this browser submits it directly to the RPC endpoint. There is no relayer on this page and nothing stands between you and the cluster.
fee payeryour connected walletsubmitted bythis browser tabrelayernone on this page - 02
A withdrawal can be paired with its deposit
Unshielding republishes the same commitment the deposit published, so the two transactions can be matched today by anyone reading the chain. This is not fixed, no client-side change can hide it, and the pool is small enough that matching is not hard. Read the pair below on devnet before you decide what to move.
clusterdevnetleaf16commitment8901821612542787864appears inboth the deposit and the withdrawal - 03
One public hop before the private leg
Shielding into the pool and opening a subscription both pre-fund a single-use signer with an ordinary public transfer from your wallet, one hop before the private step. That transfer is as visible as any other. A pool withdrawal then pays a payout address derived per note, and refuses to pay the connected wallet at all.
pre-fundpublic transfer from your walletsignerephemeral, one usepayoutderived per note, never your wallet - 04
The amounts are not hidden, and neither is the clock
The pool is denominated, so a shield or a withdrawal reveals which denomination you used, and the timing of every transaction is public because you sent it yourself. What the proof withholds is which note in the tree you spent. That is the whole of the guarantee, and it is worth exactly as much as the number of other notes sitting beside yours.
hiddenwhich note was spentpublicdenomination, timing, your walletverified bya Solana program, not a server
The honest offer
Test it with money you can afford to lose.
That is what a devnet can offer. Shield, pay, withdraw, then read the programs that did it and the transactions they left behind.
Every claim on this page is either visible on devnet or readable in the source. Nothing about users, volume or throughput appears here, because none of it is benchmarked.