tidex6 — private payments on Solana

tidex6

I grant access, not permission.

Private stablecoin payments with disclosure by consent — one Rust codebase, live on Solana mainnet, on Arc and on EVM chains.

---

tidex6 is a Rust-native, open-source framework that lets Solana developers add full transaction privacy to their Anchor programs through a small SDK surface. Transactions are private by default — sender, receiver, and amount are hidden. Privacy comes in two layers: a Groth16 shielded pool hides the *link* between sender and receiver, and a Token-2022 Confidential Transfers layer (wUSDC / wUSDT hidden-amount pools, live on mainnet and devnet) hides the *amount* itself. Users can optionally share a viewing key with someone they trust (an accountant, an auditor, a family member) to selectively disclose history, on their own terms.

Status: full MVP product stack live on Solana mainnet. The privacy-core verifier program at CSDD31Zmm3pRMHAMB8c3TBqsj9mbmH2rXBzV7jrsJhcd is OtterSec-verified and immutable (upgrade authority renounced). The full feature stack — deposit, ZK withdraw (Groth16 WithdrawCircuit<20> verified via alt_bn128 syscalls), per-nullifier double-spend PDA, recipient-binding front-run protection, unlinkable withdraw via reference relayer at relayer.tidex6.com, opaque hex notes + post-quantum ML-KEM-768 encrypted memos in a dedicated on-chain account, stealth payments (the recipient is never handed the note — they scan the chain with their own ML-KEM secret) and per-deposit revoke, client-side proof generation in the browser via WebAssembly (tidex6-prover-wasm, ~1.7 s per proof, secret never leaves the user's tab), user-facing tidex6 CLI, tidex6-client SDK, web app at tidex6.com, the flagship examples/private-payroll three-binary demo, and a third-party CPI integration example (tidex6-tip-jar, ~30 lines of Rust to add privacy to any Anchor program — deployed and OtterSec-verified on mainnet at 5WohQRRzC31SkFMSWgEqJC9p2KvNhGkQbzUSsNUi9b9x in April 2026, demo deployment since closed) — all validated end-to-end on mainnet. MVP shipped for the Colosseum Frontier hackathon (2026-05-11); development continues — since then the hidden-amount pools (Token-2022 Confidential Transfers, wUSDC AYTRKmF8VBdqRWGZr9c6Mx582SRm2tbUEwMesFMhcPcU and wUSDT QGPYpwyMnWhJUPGieXyJU5jhAkKsKuU7iGN53VCWPz2), a configurable per-operation fee paid on top by the sender and collected privately as a stealth note (ADR-016), and the live public trusted-setup ceremony at ceremony.tidex6.com (ADR-017) have shipped.

DEVELOPMENT ONLY. Pre-audit, single-contributor trusted setup, hackathon-grade trust assumptions. Verifier upgrade-authority has been renounced with solana program set-upgrade-authority --final — the program is immutable. Do not use to secure real funds. A public multi-party trusted-setup ceremony is live at ceremony.tidex6.com (publicly verifiable transcript, see CEREMONY.md); the on-chain VK is replaced only when the ceremony finalizes and a fresh immutable verifier ships. See docs/release/security.md.

---

The same circuit off Solana — Arc and the EVM chains

Solana is where this started and where the deepest integration lives, but the proof system is not tied to it. The same Groth16 circuit and the same verifying key run unchanged on EVM chains through a Solidity verifier and a Solidity Poseidon (contracts/), against a hidden-amount pool where the value sits inside the commitment rather than next to it. One rail, not one protocol per chain.

Arc — Circle's chain, where the loop closes. The contracts needed no modification: Arc's BN254 precompiles (0x05–0x08) were checked live before deploying. Six contracts on chain 5042, deployed 18 September 2026:

The same addresses exist on Arc Testnet (chain 5042002) — same deployer, same nonces — and testnet is the place to put hands on it: faucet at faucet.circle.com, flow identical to mainnet.

What makes Arc more than another deployment target: gas there is USDC, the same token the pools move and the same token the fee is charged in. Everywhere else, a service paying its own running costs out of its own revenue has to convert one asset into another — on Solana the fee is swapped to SOL through an aggregator when the operator's balance falls under a threshold (crates/tidex6-ct-lab/src/gas.rs). On Arc there is nothing to convert: fee in USDC, gas in USDC, no swap, no price risk, no third party. On the remaining EVM chains that loop is still open — fee in USDC, gas in ETH or HYPE — and closing it is the next piece of work.

How the fee works and what it costs, including the parts that do not work yet, is written out in docs/release/BUSINESS.md.

Arbitrum — where the contracts are Rust rather than Solidity. The same pool is compiled to WASM and runs on Stylus (stylus/), on two chains: Arbitrum Sepolia and Robinhood Chain, an Orbit chain whose token is a tokenized stock. Every contract is a reproducible Docker build and cargo stylus verify passes on both networks, constructor included.

Three tokens move through these pools, and the point is that the pool does not care which: USDC, TSLA — a tokenized stock, so a salary or an invoice can be paid in equity without publishing what anyone is paid — and USDG, Paxos's dollar, added 22 September 2026 on both chains. A second token is a second pool sharing the first one's verifiers: the proof is about the tree and the nullifier and carries no signal about which token is inside.

Poseidon is what makes this worth doing in Rust: a depth-20 tree walk hashes twenty times per deposit, and in Solidity one hash costs around 63 000 gas (measured on our own deployment). On Stylus the constraint moves elsewhere — a contract must fit 24 KB after brotli, and Poseidon's 195 round constants do not compress — which is why the hash is a separate contract the pool calls. stylus/README.md has the sizes, the deployment gas and the reasoning.

The EVM, Arbitrum and Arc deployments carry the same caveat as Solana, and

one more: the verifying key comes from the ceremony still in progress, so

these pools are for review and testing, not for real money.

---

What works, what does not yet, and what we chose not to do

Judges and integrators ask these three questions anyway; the answers are better written down by us than discovered.

Works — and can be run by anyone:

• Private stablecoin payments on Solana mainnet in wUSDC and wUSDT: the Groth16 pool hides who paid whom, Token-2022 Confidential Transfers hide the amount. The verifier is immutable (upgrade authority renounced).
• The hidden-amount pool on Arbitrum Sepolia, Robinhood Chain, Base Sepolia, HyperEVM testnet, Arc testnet and Arc mainnet: send, receive and audit from the browser at tidex6.com; the relayer pays the gas, so the recipient's wallet never appears as the one that asked for the money.
• USDG on Robinhood Chain: a full payment and withdrawal run live on 23 September 2026, fee note included.
• USDG on Solana devnet through our confidential wrapper (wUSDG, pool GwZ55BcsK39KBmT3oh6jcWQpVm7EpC7p8rFNVWFUvN5U): a full send and receive run on 24 September 2026, and its fee note collected by the treasury robot.
• The treasury: every payment's 1% fee is a separate note sealed to the treasury; robots on our server collect those notes on the EVM chains and on Solana, and top up the relayer's gas from the treasury. Which fees reached it, balances and every robot transaction are public at tidex6.com/treasury.
• 51 contract tests (Foundry) run in CI on every push.

Does not work yet:

• Deposit amounts on the EVM pools are public. Amounts inside the pool (join-split) are hidden; hiding them on the way in is the confidential token that comes next.
• The verifying key is still a development key until the public ceremony at ceremony.tidex6.com closes. The pools are for review and testing.
• USDG on Arbitrum Sepolia is deployed but not run end to end: the Paxos testnet faucet stopped paying out on that chain on 22 September 2026, so there is no test USDG to pay with.
• No swap of fees into gas on the EVM testnets: there is no liquidity to swap against. On Arc none is needed — gas is USDC, the same money the fees arrive in.
• USDG on Solana is on devnet only. The wUSDG wrapper and its pool (GwZ55BcsK39KBmT3oh6jcWQpVm7EpC7p8rFNVWFUvN5U) run on devnet since 23 September 2026; mainnet follows when there is demand for it — the deployment is the same, only paid for.
• Solana fee amounts on the treasury page are as sealed in the note. On the EVM pools the amount is checked against the note's commitment; the Solana confidential pool's commitment does not carry the amount, so a note sealed to the treasury key could claim more than it holds. It could never be collected for more — only displayed.
• On Solana the wrapper is custodial: the underlying USDC/USDT sits in a vault under the operator's key, and the operator sees the send side. A wrapper program with PDA authority is the next step.

Chosen not to do, and why:

• No wallet screening yet. Nothing checks a wallet against sanctions lists or known-hack databases before it enables payments. The check belongs at Enable, where a wallet first registers; the method — an on-chain oracle where the chain has one, outside databases elsewhere — is not decided. It is not in the pool contracts, because deployed pools cannot be changed, and a check in the browser alone can be walked around.
• The Solana verifier cannot be upgraded — by us either. New rules mean a new program at a new address that people choose to move to; nobody can change the rules under money already deposited.
• Poseidon is a separate contract on Stylus. Its 195 round constants do not compress under the 24 KB brotli limit.
• The Stylus pools have no `token()` getter. The relayer keeps each pool's token address in its ow