Styx Protocol · Devnet app · Solana
Send, receive, shield, subscribe.
Devnet onlyTest tokens, not real funds. This software has not been audited, and there is no mainnet deployment. Anything you move here you should be able to afford to lose.
The v1 trust pointShield can hand you an older note from this deployment’s stock instead of the note your payment creates. This deployment derived that note, knows which one it handed you, and can spend it until you do.
Solana devnet · your keys stay in this tab
Test tokens only. What a deposit costs, and who signs it.
Test tokens only. Depositing costs your wallet one public signature paying this deployment, which then funds the one-time key that touches the pool — so your address is not on the pool transaction itself. Each screen says who paid for that screen.
- 01Connectyour wallet
- 02Sign
- 03Send or subscribe
Connect a wallet
One signature to start. Nothing is sent, nothing is paid.
What a deposit costs, and what your keys are
Everything here runs on a P01 key: subscriptions belong to it and notes are sealed to it. A deposit costs you one signature — the denomination, a 0.3% protocol fee and a 1% operator fee — while this deployment fronts the refundable proof rent and takes it back afterwards. Recipient addresses are hybrid post-quantum. The signature that pays is Ed25519 and stays Ed25519.
Proof system
Hash-based STARK
Poseidon and Merkle trees only. No elliptic curves anywhere in the proof.
Stealth address
X25519 + ML-KEM-768
Hybrid key encapsulation, with keys derived from your Ed25519 wallet key. The lattice half follows FIPS 203.
Signatures
Ed25519
Solana verifies nothing else, so every transaction you send from here stays classically signed.
Status
Devnet, not audited
Deployed and running on devnet. There is no mainnet deployment.
How it works
One signature, then the tabs.
On a stealth send, the payee is a one-time address, not a wallet. Your keys are derived from one wallet signature and live in this tab’s worker. They are never uploaded.
Connect a wallet, then sign to derive your stealth spending, viewing and ML-KEM keys. Your wallet is asked for two signatures, and the second one is only there to prove it signs deterministically, so your keys can still be re-derived next session. Neither signature leaves this tab and no transaction is sent to derive anything. From there the tabs cover sending to a one-time address, importing a sealed note, moving value in and out of the shielded pool, and opening or reviewing a subscription vault.
The signing prompt is still headed with the old Protocol 01 name. That heading is the seed of every key this app derives for you, so renaming it would orphan the notes and vaults of everyone who already has some. It stays exactly as it is. The name on the prompt is old; the keys it produces are yours.
Before you sign
Five things this page will not pretend.
Each of these is checkable on a block explorer or in the source, which is the only reason it is written here. The recipient side is what this app hides. The payer side is not, and the link between a deposit and the withdrawal that spends it is hidden only in part: limit 2 says where it still holds.
Your wallet signs, and it is not always on chain
A deposit costs your wallet one signature: a single, fully visible transaction paying this deployment, plus a 1% operator fee in the same transaction. This deployment then funds the single-use key that touches the pool, from a different address of its own — so the transaction that deposits does not name you. A withdrawal or a subscription asks the deployment to cover the whole job; when it does, your wallet is on no transaction at all, and when it cannot, the job stops before anything moves and the screen says so — your wallet never pays in its place. A deposit that cannot be relayed is refused rather than quietly falling back.
you signone transfer, to this deploymentthe pool deposita single-use key we fundedrelayerthis deployment, for the funding legSome withdrawals can still be paired with their deposit
From this web app, a recent note is withdrawn on one circuit-7 proof, which publishes the nullifier, a subtree root and a hash of the payout address, and not the commitment the deposit published. The commitment still appears in both transactions when a note is withdrawn from the phone, and anyone reading the chain can match them. A note deposited before we randomised the blinding can only be spent on the older C1 + C3 pair, which republishes it too and binds no payee, so a copy of its public proof could redirect the note: this web app refuses that pair now, and such a note cannot be spent from this web app until v2. Even on circuit 7 the timing is not hidden, and the pool is small enough that the minutes or hours between a deposit and a withdrawal can narrow it down. The pair below is one of those older withdrawals on devnet; read it before you decide what to move.
clusterdevnetleaf16commitment8901821612542787864appears inboth the deposit and the withdrawalOne public hop, and it points at us, not at the pool
Shielding still begins with one ordinary, fully visible transfer signed by your wallet — but it now pays this deployment rather than the single-use signer, and this deployment funds that signer from a separate address. Two transfers, neither naming both ends. What still ties them is the amount and the minutes between them, and nothing here hides either. A pool withdrawal then pays a payout address derived per note, and refuses to pay the connected wallet at all.
pre-fundpublic transfer, from you to this deploymentsignerone use, funded by this deploymentpayoutderived per note, never your walletThe amounts are not hidden, and neither is the clock
The pool is denominated, so a shield or a withdrawal reveals which denomination you used, and the timing of every transaction is public because you sent it yourself. What the proof withholds from a chain reader is which note in the tree you spent. That is the whole of the guarantee. It does not hold against this deployment for a note it handed you (limit 5), and it is worth exactly as much as the number of other unspent notes sitting beside yours.
hiddenwhich note was spentpublicdenomination, timing, your walletverified bya Solana program, not a serverA note this deployment hands you is not yours alone
The older-note exchange keeps your payment from pointing at the note you spend: your deposit funds a note this deployment keeps, and you hold an older one it deposited and derived from its own seed. A chain reader cannot match the two, although on a quiet pool the timing still can. This deployment always can: it knows which note it handed you, and it can spend that note until you do.
you holdan older note from its stockthis deployment knowswhich note it handed youcan spend ityou, and this deployment until you do
The honest offer
Test it with money you can afford to lose.
That is what a devnet can offer. Shield, pay, withdraw, then read the programs that did it and the transactions they left behind.
Every claim on this page is either visible on devnet or readable in the source. Nothing about users, volume or throughput appears here, because none of it is benchmarked.