Private computation · Public certainty
Show nothing.Prove it anyway.
Cloakpad is a zero-knowledge proof lab for Solana amounts. Commit to a number, prove a claim about it, and let anyone check the proof. The number itself is never revealed, and nothing you type leaves your browser.
Bulletproofs · ristretto255 · no trusted setup
- Claim
- committed amount at least 100 SOL
- Amount
- not included
- Size
- 672 bytes
Commitment
f6c6190d 856161e2 effcc787 41530a61 b1f07e9c 0a096b0f de638a9e 7239d320Proof first 96 of 672 bytes
48b4902548ef558558df783d534ab1acf3d9acc04f6294bc38a9e80b1d8e73477e7a93708ca4c35df0f8a29d415a9874bfa5de421709586eda450a45d45cdf44789656c30b50e0aa9fb56cb3614cc5303dfd7a7a9d13c571e98df8a4619acd4aHow a proof works
Three steps, each computed in your browser tab.
Step 1
Commit
Your amount goes into a Pedersen commitment with a fresh random blinding factor. Every possible amount fits it equally well, so on its own it says nothing.
Step 2
Prove
A Bulletproof shows the committed amount satisfies your claim: at least X, or between X and Y. The claim is hashed into the proof, so it cannot be swapped afterwards.
Step 3
Verify
Anyone runs two equation checks against the proof. They learn that the claim is true. They do not learn the amount.
Proof lab
Build a payment, choose what it reveals, then prove a claim about it without showing it.
Loading the studio…
Specification
What the lab runs. Each line has a primary source in the references.
- Proof system
- Bulletproofs range proofBünz et al., IEEE S&P 2018, the construction Monero adopted.
- Group
- ristretto255Prime-order group, RFC 9496.
- Challenges
- Fiat–Shamir over SHA-512The claim is bound into the transcript. Edit it and the proof fails.
- Trusted setup
- None258 generators hashed to the curve from public labels (RFC 9380). One button re-derives them.
- Range
- 64-bit“Between” claims aggregate two ranges into one proof.
- Proof size
- 672 bytes736 bytes for an aggregated “between” proof.
- Verification
- Two equation checksRuns in your browser, here or on /verify.
- Runtime
- Web WorkerProving never blocks the page.
- Libraries
- @noble/curves, @noble/hashesIndependently audited. Our protocol code on top of them is not.
Threat model
"Zero-knowledge" describes a technique, not a guarantee. These are the specific properties this tool does and does not have.
What holds
Nothing you type is sent
Proofs are computed in a Web Worker and receipts through Web Crypto, both in this tab. The only requests the studio makes are for its own script files. Check the network panel.
A false claim does not verify
A range proof for an amount that does not meet the claim fails the verifier’s equations. Soundness rests on the discrete-log problem in ristretto255 and on SHA-512 as the Fiat–Shamir hash. “Attempt to cheat” runs exactly that attack.
The amount stays hidden
The commitment uses a fresh random blinding factor, so every amount fits it equally well, and the proof is zero-knowledge. Receipt fields each get their own 256-bit salt, so a hidden value cannot be guessed back from its commitment.
Tampering is detectable
Every byte of a proof and the claim itself feed the Fiat–Shamir challenges, so flipping one bit or editing the claim fails verification. Receipts recompute each commitment and the fingerprint over all of them.
What it does not claim
It does not prove the amount is real
A range proof is about the number inside the commitment, and on this page you typed that number. Nothing ties it to a wallet. In a shielded pool the commitment would already be on-chain, and that anchor is what this does not have.
It does not prove authorship
Proofs and receipts are not signed. Anyone can make their own valid proof for a different commitment, or a different self-consistent receipt. Get the commitment or fingerprint over a channel you already trust.
Disclosure is irreversible
A value you share is public to everyone who receives the file. There is no revocation, and no later disclosure from the same commitment.
Our protocol code is unaudited
The curve and hash libraries (@noble) are independently audited. Our Bulletproofs and receipt code is not, and the prover is not constant-time. The browser and its origin must be trusted: a malicious extension can read inputs before this code sees them.
The Cloakpad token
Fair launch on pump.fun. No presale, no team allocation, no vesting.
- The address appears here first, on this page.
- Nothing is sold or allocated ahead of the launch.
- Check the address here before you send anything anywhere.
Contract address
No contract exists yet. Any address claiming to be the Cloakpad token before it appears on this page is not ours.
The token is a community asset. It is not equity, not a claim on any technology described here, and confers no rights. Nothing on this site is a working privacy product, and the token does not change that.
Roadmap
Each stage depends on the one before it. Only the first has shipped.
Shipped
Make disclosure legible
An interactive model of who learns what, a local commitment tool, and a working zero-knowledge range proof in the browser. Shipped, and the whole of what this site is today.
Next
Define the threat model formally
Write down the adversary, the assumptions and the properties claimed, precisely enough to be attacked on paper before anything is built.
Later
Select a protocol
Choose a proving system and a settlement design, with the custody and trust assumptions of any cross-chain route stated explicitly rather than assumed away.
Later
Independent review
Cryptographic and application audit by reviewers with no stake in the outcome, published in full, before anything touches real funds.
Questions
Is this a working privacy payment system?
No. It is a teaching model with two working tools: local commitment receipts and a real zero-knowledge range proof. There is no wallet connection, no transaction and no bridge. Nothing here moves money.
Is the zero-knowledge proof real?
Yes. The Proof Lab builds a Bulletproofs range proof (the construction Monero adopted in 2018 and Grin uses for hidden amounts) over ristretto255, in your browser: 672 bytes, no trusted setup, checked by two equations. Flip a bit, edit the claim or try to cheat, and it is rejected. What it does not do is tie the committed number to a real wallet.
Are you affiliated with Zcash or Solana?
No. Not with Zcash, the Electric Coin Company, or Solana. "Inspired by" means the design principles informed the research direction — it is not a partnership and not an integration.
Then what is the receipt actually good for?
Showing someone a specific fact about a record while withholding the rest, and letting them check that the disclosed part matches a commitment made earlier. That is a real, narrow, useful primitive. It is not proof that a payment happened.
Can I verify the claims on this page myself?
Yes, and you should. A receipt commitment is SHA-256 over a tagged tuple of the field name, value and salt, and the fingerprint is SHA-256 over all commitments; recompute either with any SHA-256 tool. For the range proof, “Check the generators” re-derives every curve point from its public label in your tab, and /verify checks any proof you are sent.
Where does this run?
cloakpad.fun is hosted on Vercel. Everything on this page runs client-side, so there is no backend to depend on and nothing to go down.
Is my sample data sent anywhere?
No. Every operation runs in your browser: receipts through the Web Crypto API, proofs in a Web Worker. The page fetches its own script files and nothing else. There is no server to receive what you type, no account and no analytics.
References
The papers, RFCs and documentation behind every claim on this page.
Zcash shielded assets3 sources
Protocol and cryptography7 sources
Solana and implementation4 sources
Try the proof lab
No wallet and no signup. Proofs are computed in your tab.