tidex6

<p align="center">
  <img alt="tidex6" src="brand/logo/hat-solana.svg" width="220">
</p>

<h1 align="center">tidex6</h1>

<p align="center">
  <strong>I grant access, not permission.</strong><br>
  <em>The Rust-native privacy framework for Solana.</em>
</p>

---

tidex6 is a Rust-native, open-source framework that lets Solana developers add full transaction privacy to their Anchor programs through a small SDK surface. Transactions are private by default — sender, receiver, and amount are hidden. Privacy comes in **two layers**: a Groth16 shielded pool hides the *link* between sender and receiver, and a Token-2022 Confidential Transfers layer (wUSDC / wUSDT hidden-amount pools, live on mainnet and devnet) hides the *amount* itself. Users can optionally share a viewing key with someone they trust (an accountant, an auditor, a family member) to selectively disclose history, on their own terms.

**Status:** full MVP product stack **live on Solana mainnet**. The privacy-core verifier program at [`CSDD31Zmm3pRMHAMB8c3TBqsj9mbmH2rXBzV7jrsJhcd`](https://solscan.io/account/CSDD31Zmm3pRMHAMB8c3TBqsj9mbmH2rXBzV7jrsJhcd) is OtterSec-verified and immutable (upgrade authority renounced). The full feature stack — deposit, ZK withdraw (Groth16 `WithdrawCircuit<20>` verified via `alt_bn128` syscalls), per-nullifier double-spend PDA, recipient-binding front-run protection, **unlinkable withdraw via reference relayer** at [`relayer.tidex6.com`](https://relayer.tidex6.com), opaque hex notes + **post-quantum ML-KEM-768 encrypted memos in a dedicated on-chain account**, **stealth payments** (the recipient is never handed the note — they scan the chain with their own ML-KEM secret) and **per-deposit revoke**, **client-side proof generation in the browser via WebAssembly** (`tidex6-prover-wasm`, ~1.7 s per proof, secret never leaves the user's tab), user-facing `tidex6` CLI, `tidex6-client` SDK, web app at [tidex6.com](https://tidex6.com), the flagship `examples/private-payroll` three-binary demo, and a **third-party CPI integration example** (`tidex6-tip-jar`, ~30 lines of Rust to add privacy to any Anchor program — deployed and OtterSec-verified on mainnet at [`5WohQRRzC31SkFMSWgEqJC9p2KvNhGkQbzUSsNUi9b9x`](https://solscan.io/account/5WohQRRzC31SkFMSWgEqJC9p2KvNhGkQbzUSsNUi9b9x) in April 2026, demo deployment since closed) — all validated end-to-end on mainnet. MVP shipped for the **Colosseum Frontier hackathon (2026-05-11)**; development continues — since then the **hidden-amount pools** (Token-2022 Confidential Transfers, wUSDC [`AYTRKmF8VBdqRWGZr9c6Mx582SRm2tbUEwMesFMhcPcU`](https://solscan.io/account/AYTRKmF8VBdqRWGZr9c6Mx582SRm2tbUEwMesFMhcPcU) and wUSDT [`QGPYpwyMnWhJUPGieXyJU5jhAkKsKuU7iGN53VCWPz2`](https://solscan.io/account/QGPYpwyMnWhJUPGieXyJU5jhAkKsKuU7iGN53VCWPz2)), a configurable **per-operation fee** paid on top by the sender and **collected privately** as a stealth note (ADR-016), and the live **public trusted-setup ceremony** at [ceremony.tidex6.com](https://ceremony.tidex6.com) (ADR-017) have shipped.

> **DEVELOPMENT ONLY.** Pre-audit, single-contributor trusted setup, hackathon-grade trust assumptions. Verifier `upgrade-authority` has been renounced with `solana program set-upgrade-authority --final` — the program is immutable. Do not use to secure real funds. A **public multi-party trusted-setup ceremony is live** at [ceremony.tidex6.com](https://ceremony.tidex6.com) (publicly verifiable transcript, see [CEREMONY.md](docs/release/CEREMONY.md)); the on-chain VK is replaced only when the ceremony finalizes and a fresh immutable verifier ships. See [`docs/release/security.md`](docs/release/security.md).

---

## What builds from a clean clone

Everything in this repository builds with `cargo build --release` after a plain
`git clone`, and the on-chain programs build reproducibly in Docker via
`solana-verify build`. Three crates are deliberately outside the workspace and
build on their own terms:

| crate | how to build it | why it is separate |
|---|---|---|
| `crates/tidex6-prover-wasm` | `wasm-pack build` | targets `wasm32-unknown-unknown` and pulls browser-only crates |
| `crates/tidex6-ct-lab` | `cargo build --manifest-path crates/tidex6-ct-lab/Cargo.toml` | pinned to newer `spl-token-2022` / `solana-*` than the workspace |
| `crates/tidex6-mcp` | `cargo build --manifest-path crates/tidex6-mcp/Cargo.toml` | **needs a checkout of our internal core (`forge`) next to this repo**, so it cannot build for anyone else |

The last one is worth stating plainly rather than leaving to be discovered: the
hosted MCP server depends on a private crate outside this repository. While it
was a workspace member, `cargo build` failed in a clean clone for everybody who
does not have that checkout — which is everybody but us — and for the same reason
a program verifier could not build the repository on its own machine. It is now
its own workspace. Nothing else here depends on it: the payment protocol, the
programs, the SDK, the CLI and the local MCP server (`crates/tidex6-mcp-local`)
are all self-contained.

---

## Quick start — CLI

Three commands, no setup beyond a Solana mainnet wallet at
`~/.config/solana/id.json`:

```bash
# Generate a tidex6 identity (spending + viewing key).
cargo run --release -p tidex6-cli -- keygen

# Make a private 0.5 SOL deposit to the shielded pool.
cargo run --release -p tidex6-cli -- deposit \
    --amount 0.5 --note-out parents.note

# Redeem the note into any recipient wallet. The CLI rebuilds
# the offchain Merkle tree from on-chain history via the
# indexer, generates a Groth16 withdraw proof, and submits it
# to the verifier program.
#
# Default is the direct path — the user signs their own tx.
# For full unlinkability (ADR-011) add `--relayer` to delegate
# the tx to a relayer service that signs and pays on the user's
# behalf:
#   --relayer https://relayer.tidex6.com \
#   --relayer-pubkey <relayer_hot_wallet_pubkey>
cargo run --release -p tidex6-cli -- withdraw \
    --note parents.note --to <recipient_pubkey>
```

## Quick start — SDK

Integrate a shielded pool into your own Rust app in a handful
of lines using the `tidex6-client` builder API:

```rust
use anchor_client::Cluster;
use tidex6_client::PrivatePool;
use tidex6_core::note::Denomination;

# fn demo(
#     payer: &solana_keypair::Keypair,
#     recipient: anchor_client::anchor_lang::prelude::Pubkey,
# ) -> anyhow::Result<()> {
let pool = PrivatePool::connect(Cluster::Mainnet, Denomination::OneSol)?;

// Deposit side: keep the note locally — with stealth payments the recipient
// is never handed the note; they discover the deposit by scanning the chain
// with their own ML-KEM secret.
let (deposit_sig, note, _leaf_index) = pool.deposit(payer).send()?;
std::fs::write("parents.note", note.to_text())?;

// Withdraw side: rebuild the tree, prove, submit.
// Default direct path — user signs the tx themselves.
let withdraw_sig = pool
    .withdraw(payer)
    .note(note)
    .to(recipient)
    .send()?;

// Full unlinkability via the reference relayer (ADR-011): the
// user's keypair never signs the withdraw tx, the relayer pays
// fees and becomes the on-chain payer. Circuit binds the specific
// relayer so a front-runner cannot swap them in mempool.
// let withdraw_sig = pool
//     .withdraw(payer)
//     .note(note)
//     .to(recipient)
//     .via_relayer("https://relayer.tidex6.com", relayer_hot_wallet_pubkey)
//     .send()?;
# drop((deposit_sig, withdraw_sig));
# Ok(())
# }
```

## Try the flagship demo

[`examples/private-payroll`](examples/private-payroll/) is the
full story of Lena sending monthly support to her parents, with
her accountant Kai producing a tax report from a shared scan
file. Three binaries — `sender`, `receiver`, `accountant` —
hit live mainnet.

```bash
cd examples/private-payroll
./scripts/run_demo.sh
```

The script splits one terminal into three tmux panes and runs
the whole flow side by side — deposit → rebuild → prove →
withdraw → report — in under a minute.

---

## Architecture at a glance

- **Groth16** zero-knowledge proofs on the **BN254** curve, verified onchain via native Solana `alt_bn128` syscalls in under 200,000 compute units per proof.
- **Poseidon** hash function, parameter-aligned between offchain (`light-poseidon`) and onchain (`solana-poseidon`) components.
- **Offchain Merkle tree** (depth 20, ~1M capacity) with an onchain root ring buffer.
- **Hidden amounts** — a Token-2022 Confidential Transfers layer (wUSDC / wUSDT wrapped-mint pools, live on mainnet and devnet) hides the transferred amount itself on top of the Groth16 link-privacy pool. Two layers: the pool hides *who↔whom*, confidential transfers hide *how much*.
- **Per-deposit selective disclosure** via post-quantum ML-KEM-768 auditor tags — users choose who sees what, per transaction.
- **Shielded memos** — post-quantum ML-KEM-768 encrypted notes stored in a dedicated on-chain account (separate from the deposit event), readable only by the viewing-key holder. Supports **stealth payments** (the recipient scans the chain with their own ML-KEM secret rather than receiving the note) and **per-deposit revoke**.
- **Non-upgradeable verifier** — the core proof verifier is locked after deployment, so users do not have to trust the deployer forever.
- **Relayer unlinkability** — ADR-011: a reference HTTPS service at `relayer.tidex6.com` signs and submits withdraw transactions so the user's wallet never appears on-chain as the payer. The proof commits to the specific relayer (public input) so front-runners cannot redirect the fee. The in-circuit `relayer_fee` policy for the reference service is zero; anyone may run their own relayer with any fee. Separately, deposits carry a configurable per-operation fee (ADR-016): the sender pays it on top (it may be zero), it is shown before signing, and it is collected privately — as a stealth note to the operator inside the same shielded pool.
- **Client-side proof generation** — `tidex6-prover-wasm