Glossary

Association set — A curated set of deposit commitments that excludes sanctioned or illicit sources. Every spend proves, in zero knowledge, that its funds descend from this set — membership without identity.

Clean withdrawal — Exiting the pool to a fresh address through a relayer, with gas paid from the shielded balance so the new wallet never has to be funded from a traceable source.

Commitment — A cryptographic hash of a note, stored on-chain in a Merkle tree. It reveals nothing about the note's contents.

Dark crossing — Matching two encrypted orders against each other at the oracle midpoint, settled inside the shielded pool with no public swap.

Emergency exit — Withdrawing directly through the contract with your own proof, with every relayer offline. Guarantees funds can never be trapped.

Encrypted intent — A swap request (asset in/out, size, limits) encrypted to the crossing engine.

Leak Score — A pre-trade rating of how much information a route will expose, derived from the share crossed internally vs. routed publicly, the number and size distribution of public pieces, and the freshness of addresses used.

Note — An encrypted record (asset, amount, owner key, randomness) representing ownership inside the pool. Held on your device.

Nullifier — A one-way tag derived from a note and published when it is spent. Prevents double-spending without revealing which note was spent.

One-time address — A fresh address with no prior history, used by a relayer to submit one public piece of an order.

Oracle midpoint — The mid-price of the referenced oracle feed at the time of a cross. The execution price for every dark cross.

Per-dapp address — A new address for every app you connect to, so activity across apps can't be stitched together.

Proof of innocence — The zero-knowledge proof attached to every spend showing the funds belong to the approved association set.

Re-shield — Automatically returning the proceeds of a public leg into fresh notes in the pool.

Relayer — A network participant that submits transactions from one-time addresses, proxies RPC queries, and pays gas from the shielded balance. Relayers can delay service; they cannot steal funds, decrypt notes, or forge proofs.

Scoped viewing key — A revocable, read-only key limited to one asset and/or a date range, for auditors and tax authorities.

Shielded pool — The set of contracts on Robinhood Chain holding shielded assets and the Merkle tree of commitments.

Timing jitter — Randomized intervals between the public pieces of an order.