Trust model

Every privacy system asks you to trust someone with something. This is Opaque's complete list.

Nobody, for these

• Reading your balance or your transfers. They are encrypted to your viewing key and proven, not disclosed. No operator, server or auditor acting alone can read them.
• Spending your notes. Only the spending key derived from your wallet signature can. It never leaves your device.
• Changing a transaction you proved. Every field is bound into the proof. A relayer can only submit it or decline.
• Blocking a withdrawal. There is no pause on exits, and delisting an asset does not stop its withdrawals.

The pool authority (a multisig)

Can list and delist assets for deposit, list markets, and rotate the audit key. Cannot touch funds, change the verifying keys or the tree, or stop withdrawals. The program's upgrade authority is held by the same multisig; an upgrade is announced before it is applied.

The audit key holders

Independent parties, each holding one share. Together, transaction by transaction, they can open the sealed record of any transaction: the asset, amounts, and the owner identities of the notes involved. Alone, nothing. They cannot spend, block or alter anything.

The relayer and servers

Operated by Opaque. They see the public chain and the proofs you send them. They can refuse service; you can then submit the same transaction yourself from any address. They cannot read notes and cannot learn which notes are yours.

The token issuer

xStocks are issued by Backed under Swiss law, and the mints keep the powers that framework requires. The issuer can pause all transfers of a token, freeze any token account, move or burn tokens from any account through a permanent delegate, and install a transfer hook that every transfer must pass. Those powers reach the pool's vault exactly as they reach any wallet: a pause stops deposits and withdrawals until it is lifted, and a delegate transfer out of the vault would take shielded balances with it. Opaque cannot shield a position from its issuer, and does not claim to. USDC carries the same freeze power under its issuer's terms.

The price keeper

Each Cross market names one key that may close its batches, and the price it posts is the batch price. Opaque's keeper holds that key and posts the midpoint of Jupiter's quotes for the pair, both ways, taken at the moment of closing. This is the one place where you trust an operator with a number: a wrong price would cross trades at that price for that batch. Two things bound it. A limit order refuses any price outside its limit, so a market order is the only kind that takes the keeper's price unconditionally; and every batch price is on the chain next to the time it was posted, so a keeper that strayed from the market would be caught by anyone comparing the two. The authority can hand the key to another keeper at any time.

The proving system

Groth16 relies on a trusted setup. Opaque's setup used the public Hermez phase one and a multi-party phase two whose transcripts are published. If every participant in the phase two had colluded, proofs could be forged; one honest participant is enough to prevent it.