Docs.

Think of it as two layers. Your normal wallet is the street-level account everyone can look at. Your BlindSpot vault is a back room on the same chain: the network can confirm every action in it is valid, but it cannot see who did it, how much moved, or (if you pay fees in private SOL) which token was involved.

Chain

Solana mainnet, first and natively. Other chains are reached through private routes

Shielded pool

Private balances, payments, swaps and exits on Solana

Quantum-safe vault

Holds SOL behind hash-based signatures from your passkey or 24 words

Custody

Non-custodial; secrets are created and kept in your browser

Privacy engine

Zero-knowledge proofs (Groth16) over a shared note pool

Ways out

Fresh one-time Solana address, or any chain via cross-chain routes

1. 01Open a vaultHit Create account and pick Create a BlindSpot vault. Choose a password for this device. You get a recovery key once; store it offline.
2. 02ShieldGo to Shield, pick a token and amount, and approve one signature from your public wallet. Your tokens become sealed notes.
3. 03Use itSend to any blind2… address, trade inside the pool, or exit. No pop-ups: a relayer submits each proof for you.
4. 04LeaveWithdraw to a brand-new address, or use Intent swap to land on another chain.

Intent swap runs on a manual-deposit model. You get a quote, place an order, and then decide whether to fund it by sending SOL or a token from any wallet you like. Placing the order itself moves nothing.

• No sign-up and no wallet connection
• Each order has its own deposit address and deadline
• Live order status right after you place it

A note bundles four things: a token mint, an amount, an owner key and a random blinding value. What lands on-chain is only its fingerprint (a commitment), written as a leaf in a Poseidon Merkle tree that is 26 levels deep, which is room for 67,108,864 notes.

When you spend a note you publish its nullifier, a one-way tag the program stores in a spent list. The same note can never be spent twice, and nobody can trace which commitment a nullifier belongs to.

Incoming payments are found by your browser trial-decrypting each new note ciphertext with your viewing key. The indexer serves everyone the same feed, so it never learns which notes are yours.

Every private action ships with a zero-knowledge proof that says, in effect: I own a note that is really in the pool, I am allowed to spend it, and the totals add up. The verifier checks the maths and learns nothing else.

• Membership: each spent note sits under the current Merkle root
• Authority: the spender holds the matching spending key
• Uniqueness: nullifiers are derived correctly, so no double-spends
• Conservation: inputs + public amount = outputs + fees

proof system   Groth16 on BN254
circuit        Transaction(levels 26, in 4, out 3)
public inputs  13
hashing        Poseidon
on-chain check alt_bn128 syscalls

A relayer takes your finished proof, wraps it in a transaction and pays the network fee, taking a small relayer fee from the note in return. The recipient, amount, fee and any swap terms are bound into the proof hash, so a relayer that tampers with anything just produces a failed transaction.

Private trades run in two moves. swap_prepare locks the input into a dedicated escrow, then swap_execute runs the route. The program confirms the escrow paid exactly the input and the vault got at least your minimum; if not, swap_refund puts everything back.

Your vault starts as 32 random bytes. From that seed the browser derives a spending key, a viewing key and an endless supply of single-use receive addresses. On this device the bundle is locked with your password (PBKDF2 at 600k rounds, then AES-GCM).

The recovery key is shown once and restores the whole vault anywhere. Because it is independent of your public wallet, losing one never exposes the other.

You describe the outcome you want: an exact Solana input, a destination asset and chain, a recipient and a Solana refund address. Market makers bid to deliver it and the best bid becomes your quote. Once you confirm, you get deposit instructions; after your deposit lands the solver pays out on the destination chain and the settlement contract finalises atomically. Failures refund to your Solana address.

Processing happens in a private shard run by permissioned validators, with encryption and restricted visibility. That is confidential execution rather than a zero-knowledge pool, so those validators sit inside the trust boundary.

Destinations

Solana, NEAR, Ethereum, Arbitrum, Base, Optimism, Polygon, BNB Chain, plus native Zcash (receive-only, shielded address)

Partner fee

0.40%, already reflected in the quote

Refunds

Always to the Solana refund address you set

GET  /api/ds/tokens?side=source|destination&term=&chain=
GET  /api/ds/quotes?from=&to=&amount=
POST /api/ds/orders        { from, to, amount, address, ... }
GET  /api/ds/orders/{id}   -> status, deposit, payout

A shielded pool is only as private as its crowd. Low fees and fast finality mean people can shield, pay and exit in normal amounts and at normal times, which keeps the anonymity set large and lively. That is why BlindSpot is built on Solana first and reaches other chains through private routes rather than spreading thin across many pools.

• One deep pool instead of many shallow ones
• Proof verification on-chain, paid in cents
• Cross-chain exits without bridging your identity along

Large quantum computers would threaten the elliptic-curve maths behind most of crypto: ordinary Solana wallet signatures (Ed25519) and pairing-based proof systems. Hash functions are expected to hold up, with larger security margins.

The vault is an on-chain program that pays out only against a hash-based signature. Its keys come from your passkey (Face ID / Touch ID) or a 24-word phrase and never leave your device. Because the security rests on hash functions rather than elliptic curves, it is designed to survive a future quantum computer.

1. 01OpenCreate a vault with your passkey or 24 words.
2. 02FillSend SOL to the vault address from any wallet.
3. 03ReleaseSign a payout with your vault keys; the program checks the hash-based signature on-chain.

• Post-quantum proof systems (hash-based / STARK-style) for the shielded pool
• Post-quantum key exchange (ML-KEM) for note encryption
• Moving vault-held SOL into the pool without an elliptic-curve step
• Bigger, healthier anonymity sets: batching and timing guidance built into the app

• Let funds sit a while between shielding and withdrawing
• Avoid unique amounts; round numbers blend in
• Keep some private SOL so fees do not reveal the token
• Withdraw to a fresh address, never back to the wallet you shielded from
• Store the recovery key offline, away from this device