# On-chain privacy

Compounding is public. People and auctions are not. Privacy is a tool, not a mixer.

Model: **visible aggregates, confidential individual amounts, auditor in Squads.**

## What stays public (non-negotiable)

- The 70/15/10/5 split and the **aggregate balances** of the four buckets.
- Cell reports (revenue, cost, contribution). A cell without a report does not get treasury.
- Memo **after** LOI, including the closed price.
- `$POOR` supply, Realms votes, 1 token 1 vote.
- Buyback: USDC spent and `$POOR` burned (Jupiter is public spot).
- That a deal is closed, that a cell exists, who the steward is (pubkey).

Hiding these is hiding the job. Forbidden.

## What may be confidential

| Flow | What is hidden | Why |
|---|---|---|
| Scout / steward pay | amount of the individual payment | Individual compensation. The 10% bucket stays visible. |
| Pre-close wire | amount and timing of payment to the seller | Buy fast. Do not gift the auction on-chain. After close, the price goes in the memo. |
| Pre-LOI proposal | facts, cap, target | Constitution §8: public memo *after* LOI. Drafts are not committed in the clear. |

Squads / Realms / cell addresses stay public. Token-2022 Confidential Balances hides **amount and balance**, not pubkeys. That is fine: we know *who* was paid, not *how much* (beyond the aggregate).

## Day-0 mechanism — Token-2022 Confidential Balances

Native Solana (ZK ElGamal, re-enabled on mainnet epoch 982 / June 2026). Not an L2, not a mixer.

1. Mint (or account) with the Confidential Balances extension.
2. **Mandatory ElGamal auditor pubkey.** Every transfer encrypts the amount for sender, recipient, **and** auditor. The proof says the three ciphertexts are the same number.
3. Auditor secret key: shards in Squads (never a single key). Used to decrypt *transfer amounts* for the aggregate report and for a holder who asks for an audit. It does not authorize moving funds. Rotation: keep old keys if history is needed.
4. Public deposit → confidential → transfer → public withdraw (USDC) on the recipient side.

Live **devnet:** mint [`KRTSAyGP…`](https://explorer.solana.com/address/KRTSAyGPag6gGyaL2vRutKVSKe36is7LATzD6D5uv81?cluster=devnet). Auditor `YGSo7f2YmW8jO/VVedJ+WcBuzQ9tZzMgvQjlFpa1pEg=`. Secret in `keys/` Shamir 2-of-3. Mint authority = Squads vault. Pay-reserve: **1 USDC + 1 BPAY**.

Classic USDC **does not** have the extension. Until Circle (or an allowlisted Token-2022 stable) exposes it, confidential pays go through a Token-2022 mint 1:1 with treasury USDC, mint/burn authority = Squads, auditor = Squads. No custom program: Token-2022 mint + vault. If the wrapper is not live, pays stay public USDC — a known limitation, we do not use a mixer “in the meantime.”

## `$POOR`

Confidential Balances: **off** on the voting mint. Governance weights must be reconstructible. Transfer-fee: no. A `$POOR` pay to scout/steward may leave the contributor bucket in the clear (vesting) or, if the amount should be hidden, convert confidential USDC and leave `$POOR` for the vote only.

## Forbidden (treasury and cells)

- Mixers, Privacy Cash, **anonymous** rings (Helius Rings anonymous, analogues). Unreconstructable flow = no audit.
- Confidential Balances **without** an auditor key.
- Hiding aggregate buckets or cell reports “for privacy.”
- Using privacy to dump a cell token/meme.
- Encrypting a post-LOI memo.

Helius Rings / Arcium CSPL / Light: **watchlist**, not allowlist. They enter only with a vote, and only if there is equivalent selective disclosure (auditor / viewing key). ZK Compression (Light/Helius) is *state cost*, not money privacy: usable in Phase 1 for cheap cell accounts, not to hide P&L.

## Pre-LOI proposals

Paper deals in `ledger/proposals/` are public by construction (exercise).
Real originations: `ledger/proposals/drafts/` (not in git). On-chain, when Phase 1 exists, hash of the encrypted blob; in the clear after LOI. `underwriter` on a draft does not print cap/ask on public channels.

## Reports

The reporter publishes contribution and the aggregate split. It does not publish the line “Alice $800, Bob $200”. The Squads auditor can reconstruct the lines. A holder may request an audit; the council produces a decrypt of the amounts, not open pre-LOI memos.