Ponscash

Robinhood Chain · ETH & USDG

Value crosses.
The trail doesn't.

Deposit into a shielded pool and your balance becomes an encrypted note only you can read. Send it, split it, withdraw any amount to any address — the chain settles the value and records nothing about who moved it.

Pre-launch · testnet next, mainnet after audit & ceremony

A B C D E
Euclid I.5 — the pons asinorum, the bridge every student crosses before they can prove anything at all.
Chain
4663Robinhood Chain
Assets
ETH · USDGnative gas token & Global Dollar
Deposit fee
0.30%charged on entry, once
Relay fee
0the relayer pays your gas
Proof system
Groth16BN254, Poseidon hashing
Pool capacity
2238,388,608 notes per pool

Mechanism

Four steps, one circuit

Every operation — deposit, transfer, withdrawal — is the same proof: that the notes going in equal the notes coming out, that you own the ones going in, and that none of them has been spent before. Nothing else is published.

STEP 01

Shield

Your deposit becomes a note. Only its commitment reaches the chain, as a leaf in a Poseidon Merkle tree. The amount and the owner stay off it.

commitment = Poseidon( amount, pubkey, blinding)
STEP 02

Hold

The note's contents are sealed to your key and emitted alongside it. Your balance is not stored anywhere — your client finds it by opening what it can.

sealed with X25519 + XChaCha20-Poly1305
STEP 03

Spend

Spending publishes a nullifier, not a leaf. Double spends are impossible; which note you spent stays unknown.

nullifier = Poseidon( commitment, index, sig)
STEP 04

Exit

A relayer submits the proof and pays the gas, so no funding transaction ever links your deposit address to your destination.

Σ inputs + publicAmount = Σ outputs

Trust model

What Pons can and cannot do

A privacy protocol earns its users by being precise about its own limits. Here are ours, stated plainly rather than buried in the docs.

Non-custodial

Nobody can move your funds

The pools are immutable and have no owner. There is no pause, no upgrade path, no admin key. Only a valid proof against your private key moves a note.

Gated entry

Depositing needs an attestation

Addresses prove eligibility with a credential they already hold. Receiving, transferring and withdrawing require nothing — demanding it would defeat the point, since the recipient must stay unknowable.

Limited authority

The attester only says yes or no

It signs "this address may deposit" and nothing else. It cannot see balances, cannot spend, and revoking a verification blocks future deposits without touching value already shielded.

Honest limit

Privacy comes from the crowd

The cryptography hides you inside the set of everyone who has ever deposited. A pool with three users is not private. Ours grows, and we would rather say so than let the maths imply more than it delivers.

Entry

Three ways in

Credentials live on other chains, so an attester checks yours at its source and signs a short-lived voucher you redeem on Robinhood Chain. One transaction, valid for 90 days.

EAS · Base

Coinbase onchain verification

The attestation Coinbase issues to verified accounts.

BABT · BNB Chain

Binance Account Bound Token

The soulbound token held by verified Binance users.

Ethos · off-chain

Ethos reputation score

A credibility score above the deployment's threshold.

Deployments

Contracts

Everything except the entry gate is immutable once deployed. Addresses are published here and verified on Blockscout as each goes live.

ContractRoleRobinhood Chain
PonsETHPool shielded ETH deploying to testnet
PonsERC20Pool shielded USDG deploying to testnet
PonsVerify attestation gate deploying to testnet
PonsRegistry deposit key directory deploying to testnet
Verifier2 / Verifier16 Groth16 verifiers deploying to testnet

Questions

Before you deposit

Are there fixed denominations?

No. Deposit and withdraw any amount above the floor — 0.01 ETH or 20 USDG after the fee. Amounts are hidden by encryption rather than by everyone using the same round number, so there is nothing to standardise.

Do I need gas to withdraw?

No. A relayer submits withdrawals and private transfers and pays the gas. That is a privacy feature before it is a convenience: paying gas from a fresh address would require funding it, and that funding transaction is exactly the link the pool exists to break.

Can anyone see my balance?

No. Balances exist only as encrypted notes. The operators, the sequencer and every other user see commitments and nullifiers — opaque field elements that reveal neither amount nor owner.

What happens if I lose my key?

The funds are gone. Your Pons key is derived from a wallet signature, so the same wallet recovers it on any device — but nothing outside your control can reconstruct it, and no one can restore it for you. Back it up before the pool holds anything you would miss.

Has it been audited?

Not yet. The contracts and circuits are complete and tested end to end, and the proving keys in the repository come from a single-machine setup, which is fine for testnet and unacceptable for real money. A multi-party ceremony and an external audit both land before mainnet.

Cross once.

Open the app, verify your address, and shield your first deposit in three transactions.

Open app