The dollar that can be private.
Privé is privacy-stablecoin infrastructure built for Robinhood Chain (chain 4663): PUSD, a dollar designed to be backed 1:1 by USDG — the Global Dollar, issued by Paxos — with an opt-in shielded layer where balances and transfers are proven correct by zero-knowledge proofs instead of being broadcast to everyone. Minting gives you a public ERC-20; privacy begins at the separate shield step. This document describes the system as designed and implemented — its architecture, its privacy design, its compliance posture, and its risks. It is not yet deployed: no Privé contract exists on any network as of this revision.
What this is.
On a public blockchain, every balance and every payment is visible to anyone, forever. That is a strange default for money. Privé keeps the part of a stablecoin that should be public — that it is fully backed and that every transfer is valid — public, and makes the part that should be personal — who holds what and who pays whom — private, at the holder's option. PUSD mints 1:1 against USDG, fee-free, and redeems back 1:1 — redemption has no pause path at all, and the only thing that can stop a redemption is the screening blocklist the ramp consults (§05). What the mint produces is an ordinary public ERC-20; an opt-in shielded pool then turns those dollars into private notes, one deliberate proof-gated step later. Zero-knowledge proofs generated in the user's own browser guarantee that no value is created, destroyed, or double-spent inside the pool. Screening lives at the public on- and off-ramps, and withdrawals prove membership in an association set — privacy designed to complement compliance, not to defeat it.
Financial privacy for normal people.
Your salary, your savings, your rent — none of it should be a public broadcast. Today, a single payment reveals your entire financial history to the counterparty and to anyone watching the chain.
The transparency problem
Pay someone once and they can see your balance, your income, and everyone you've ever transacted with. Businesses leak payroll and supplier relationships. Individuals become targets.
The wrong fixes
Designs that pool everything indiscriminately hide provenance for everyone at once — which is exactly why they attract illicit flows and regulatory action. Opaque custodians ask you to trust them with both your money and your data.
The Privé position
Keep validity and backing publicly provable; make the transaction graph private inside a pool people choose to enter; screen at the legible fiat boundaries. Privacy and accountability, at the same time.
Constraints, not slogans.
These principles decided the architecture — each one closes off a whole class of designs.
Immutability is a feature
The vault, ramps, and shielded pool are non-upgradeable. No proxies, no admin withdrawal path, no admin who can mint unbacked dollars, and no way to pause an exit. The one exception is named plainly in §05: the guardian owns the sanctions blocklist the ramps consult, so a blocklisted address cannot mint or take a redeem payout. What you read is what will run — forever, from the deploy transaction onward.
Privacy for normal users
The design target is everyday financial privacy, not evasion. The system follows the Privacy Pools model: association sets and opt-in transparency instead of pooling everything indiscriminately.
Compliance in the architecture
Screening is enforced by the mint and redeem ramps themselves — the boundary where dollars become legible. It is wired into the immutable contracts, not bolted on beside them.
The freeze is in the threat model
The vault holds USDG, issued by Paxos, which retains the ability to freeze and to wipe balances. Anything holding USDG inherits that, and we treat it as a real risk to design and communicate around — not something to pretend away.
No Ponzi surface
No yield is promised anywhere in the system — not on PUSD, and not on $PRIVE. PUSD pays nothing; it is a backed dollar, not an investment. $PRIVE, the separate ecosystem token of §07, is volatile and unbacked and pays nothing either: no APY, no staking returns, no revenue share, no buybacks, and no claim on fees, treasury or reserves. Numbers that don't exist can't be faked.
Name the trusted parties
The remaining trust is explicit: a guardian — a Safe multisig from genesis — that can pause entries, append association roots, and own the screening blocklist. That is the whole list. It cannot touch funds, mint, upgrade anything, or pause exits.
A deliberately small immutable core.
Every contract is non-upgradeable and will be source-verified on Blockscout at deploy; the only privileged authority anywhere is pause + association-root acceptance + the screening blocklist, held by the guardian.
| Contract | Role | Privileged authority |
|---|---|---|
| USDGVault | Custodies the USDG backing, 1:1 against all outstanding PUSD. | Pause only |
| MintRamp | USDG in → PUSD out. Runs the sanctions-screening hook. No fee. | Pause; and the guardian-owned screening oracle gates the minting address |
| RedeemRamp | PUSD in → USDG out. Same screening at the exit boundary. No fee, and no pause path. | None on the contract; the guardian-owned screening oracle gates the payout address |
| ShieldedPool | The privacy core: a commitment Merkle tree + nullifier set. | Pause entries + accept association roots |
| Verifiers (×3) + adapter | Immutable UltraHonk verification of every shield / transfer / unshield proof. | None |
| PriveDollar | Standard 6-decimal ERC-20 ("Prive Dollar" / PUSD); mint/burn callable only by the ramps. | None |
| NoteMemo | Stateless encrypted payment-notice channel. Holds no funds; decoupled from the pool. | None |
The solvency invariant
USDG in the vault ≥ public PUSD supply + shielded value — always. Both tokens carry 6 decimals, so the comparison is exact and needs no scaling. Minting increases both sides; redeeming decreases both. No path exists that creates PUSD without locking USDG, and none that releases USDG without burning PUSD. Pause halts entries during an incident, and there is no pause path on the exits at all: neither redeem nor unshield can be paused, so a pause on its own can never trap user funds. Two guardian-held conditions do sit on the exit, and they are not the same thing as a pause — a redeem payout address must not be on the screening blocklist, and an unshield reverts unless the guardian has already accepted an association root covering the note. Both are stated in full in §05 and §08.
Notes, commitments, nullifiers.
Entering the pool is a choice, and it costs a proof. Once inside, dollars are notes — UTXOs whose contents only their owner knows. The chain stores commitments; inside the pool, the amount and the sender↔recipient link stay off the public ledger. (A private transfer is still a public transaction: it emits an event and the submitting wallet pays gas in the clear, so that a transfer happened is visible — what it moved, and between whom, is not. Amounts entering and leaving the pool — shields and withdrawals — are public, like any on-chain transaction, as is every PUSD balance that was never shielded at all.)
commitment = H(value, owner_pub, blinding, asset_id) owner_pub = H(owner_priv) nullifier = H(owner_priv, leaf_index)
A note commits to its value, its owner, and a random blinding factor with the Poseidon hash. Commitments are inserted into a depth-32 Merkle tree — the same tree the contracts, the circuits, and the client all compute identically. Spending a note reveals only its nullifier, which marks it spent without disclosing which commitment it was: double-spends are impossible, and on-chain unlinkability is preserved.
Private transfers are JoinSplit: spend two input notes, create two output notes (payment + change), and prove in zero knowledge that Σ inputs = Σ outputs + fee — value is conserved without revealing any amount.
That fee term is real: ShieldedPool.transfer and unshield bind both a fee and a fee recipient into the proof, so that a relayer could one day be paid out of the transaction without ever being trusted with the witness. The shipped client always passes a fee of 0 with the fee recipient set to the sender, and the public mint and redeem ramps carry no fee at all.
Recipient-controlled payments
A Privé address (prive1…) packs an encryption key and a spending key. Output notes are bound to the recipient's spending key — only they can ever spend what they receive, and the sender cannot claw it back. Real payment finality, privately.
Encrypted payment notices
The sender posts the note's secrets — encrypted to the recipient — on the permissionless NoteMemo contract. The recipient's browser scans and trial-decrypts to discover incoming payments. NoteMemo holds no funds and can't affect the pool.
Proofs in your browser
Circuits are written in Noir and proven with UltraHonk over BN254 — entirely client-side, in WASM. Note secrets never leave the device; the chain's immutable verifier contracts check every proof. There is no trusted proving service.
Two keys, two signatures
Identity is derived from two separate wallet signatures, never one. A view signature unlocks reading your shielded balance and nothing more; a distinct spend signature authorizes sending, withdrawing, and registering your receiving address on a new device. Note secrets are encrypted at rest in the browser under the view key. Losing the secrets means losing the notes — users are told to back them up, plainly.
Privacy, not concealment.
The point is not to hide where money came from — it's that your finances shouldn't be a public feed. The design follows the Privacy Pools approach: keep the graph private inside the pool, screen at the boundaries, and let exits prove they belong to an honest set.
Screen where money is legible
Every mint and every redemption passes an on-chain screening check at the ramp — the point where dollars touch the regulated world. Today that check is a guardian-managed blocklist oracle; a dedicated screening provider is the designed direction. The pool itself never needs to see identities.
Association-set exits
Every withdrawal proves membership in an association root the guardian has accepted on-chain — so a withdrawal is only possible if a root covering your note has been published. The designed model derives that set from the full commitment stream minus a published exclusion ledger, so flagged funds can be excluded from exits without exposing anyone else. At launch the guardian simply accepts the pool's current root; the exclusion ledger is the designed direction and is not built yet.
Validity is public
Backing, supply, and every state transition are publicly verifiable at all times. Privacy applies to who and how much — never to whether the system is solvent and correct.
Privacy for normal people — not a tool for evading the law
A dollar's round trip.
Mint
Deposit USDG at the ramp; receive public PUSD 1:1, fee-free. Screening runs here.
Shield
Optional. Prove a note commitment in-browser; PUSD moves into the pool as a private note.
Send
JoinSplit: pay any prive1… address privately. Amounts and recipients stay off the ledger.
Withdraw
Prove ownership + association-set membership; the note returns to public PUSD.
Redeem
Burn PUSD at the ramp; USDG returns to your wallet. Screening runs again.
Two tokens, and a firewall between them.
The protocol has exactly two tokens. $PUSD is the dollar. $PRIVE is a separate ecosystem token that is volatile and unbacked — not a second dollar, and not a stablecoin. Neither is deployed.
$PUSD · the product
The dollar.
On-chain as Prive Dollar / PUSD, six decimals: a public ERC-20 designed to be backed 1:1 by USDG locked in the immutable vault, minted and redeemed 1:1 through the ramps with no fee on either side. Redemption has no pause path — subject only to the screening check the redeem ramp runs on the payout address. Public when minted, private once shielded, at the holder's option. It pays no yield: it is a dollar, not an investment.
$PRIVE · separate · volatile · unbacked
Not a dollar, and not a stablecoin.
$PRIVE is a separate access and utility token for the ecosystem around $PUSD, planned to launch on PONS. No date is set. It is volatile and unbacked: no reserve, no peg, no redemption at $1, and it can go to zero. It pays no yield, no APY and no staking return; there is no revenue share, no value-accrual mechanism and no buyback, and holding it confers no claim on protocol fees, on the treasury, or on the reserves. Every utility described for it is planned, not shipped. It is complementary to $PUSD — never a competitor to it, and never a second dollar.
The firewall
No $PRIVE mechanism may ever make $PUSD's 1:1 USDG backing, or its solvency, depend on $PRIVE. Every $PRIVE mechanism lives outside the immutable core: the vault, the ramps and the shielded pool neither read $PRIVE, hold it, price it, nor accept it as collateral, and no $PRIVE balance, supply or price can enter the solvency invariant of §03. A move in the $PRIVE price, in either direction, can never touch $PUSD's 1:1 redemption. The dollar stands on USDG alone, and nothing else can be attached to its backing.
Stated plainly.
A privacy protocol earns trust by being explicit about what can go wrong — so here it is, without varnish.
Posture
- All contracts are immutable, and will be source-verified on Blockscout at deploy — anyone will be able to review exactly what runs.
- No external audit report exists. Independent security review and a public bug bounty come before the mainnet deploy, and results will be published when they exist. We won't claim an audit we don't have, and this page will say so until we do.
- The guardian is a Safe multisig from the genesis deploy, never a single key.
- The guardian's authority is: pause entries (mint, shield, transfer), append association roots, and own the screening blocklist. It cannot move funds, mint, upgrade anything, or pause exits — redeem and unshield can never be paused. Two exit-side levers do exist, and both come from that list: which association roots are accepted determines which notes can withdraw, and a payout address on the screening blocklist is refused at the redeem ramp. Those are the compliance levers, named plainly.
Known risks
- Pre-deployment: nothing described here is running yet. Until the mainnet deploy, treat every property in this document as a claim about source code, verifiable by reading it, not as an observation about a live system.
- Smart-contract and circuit risk: a flaw in the contracts or the zero-knowledge circuits could put funds at risk. Immutability means bugs cannot be patched in place.
- Issuer risk: the backing is USDG, issued by Paxos, which retains the ability to freeze and to wipe balances. A freeze or a wipe of the vault's USDG would halt redemptions while it lasted, and a wipe would destroy backing outright. Every holder of USDG inherits this, and PUSD inherits it through the vault.
- Exit liveness: the exits have no pause path, but they do carry two conditions. An unshield reverts unless the guardian has already accepted an association root covering your note — under v1 self-association that root is the pool's current commitment root, so every new deposit needs a fresh acceptance before the notes under it can be withdrawn, and if the guardian stops accepting, withdrawals stall until it resumes. And a redeem payout address that the guardian has blocklisted cannot receive a payout. Neither is a pause; both are real, and neither is described away here.
- Privacy limits: privacy strengthens with pool usage, and at launch the set of shielded notes will be tiny. With few participants, matching public shield/withdraw amounts or timing can narrow who paid whom — early users get meaningfully weaker privacy than later ones, and that is arithmetic, not pessimism. Anything you never shield stays fully public. Network-level metadata (IP, RPC provider) is outside the protocol's protection.
- Key loss: shielded note secrets exist only client-side. If a user loses them (and any backup), the notes are unrecoverable by anyone — including us.
- $PRIVE risk: $PRIVE is a separate token, volatile and unbacked. It has no reserve, no peg and no redemption at $1, and it can go to zero. It is not $PUSD and not a stablecoin, holders have no claim on fees, treasury or reserves, and no date is set for its launch. Its price is not a signal about PUSD's solvency, and by construction it cannot become one.
Not deployed yet.
These are the user-facing contracts and what each one does. No addresses exist yet — the deploy has not happened, and this table gains its Address column the day it does. When it arrives, verify by address, not by name or ticker: anything claiming to be Privé before then is not us.
| Contract | Role | Address · Robinhood Chain |
|---|---|---|
| PriveDollar (ERC-20) | The public dollar surface — name "Prive Dollar", symbol PUSD | Published at deploy |
| USDGVault | Custodies the 1:1 USDG backing | Published at deploy |
| MintRamp | USDG in → PUSD out (screening hook) | Published at deploy |
| RedeemRamp | PUSD in → USDG out (screening hook) | Published at deploy |
| ShieldedPool | Commitment tree + nullifier set — the privacy core | Published at deploy |
| NoteMemo | Encrypted payment-notice channel for private sends | Published at deploy |
Hold dollars. Keep them private.
The app is built and the contracts are written. When the deploy lands you will be able to mint a dollar, shield it, send it privately — and verify every claim in this document on-chain. Until then, verify them by reading the source.
This document describes software, not an offer, solicitation, or financial advice. It is a living document and will be revised as the protocol evolves.