Cadabra is the all-in-one privacy layer for Solana. Shield tokens into a zero-knowledge private balance, then send, trade and earn unseen. Swap across 120+ chains through multi-hop private routes and intent-based confidential swaps, all from one app. Your keys never leave your browser.
A shielded pool for your balance, plus two independent cross-chain routes. Pick the right tool for each move without leaving the app.
Drop any SPL or Token-2022 asset into sealed notes, then pay, swap and lend without leaving the pool. Your browser produces a Groth16 proof for every move; validators confirm it is correct yet learn nothing about the sender, the size or, with SOL fees, even the asset.
Leave Solana for 120+ networks over chained partner hops. Compare several live routes side by side, fund the winner with a single manual deposit, and skip sign-ups and wallet pop-ups entirely.
Exact-input swaps from Solana to Ethereum, Base, Arbitrum, Optimism, Polygon, BNB Chain, NEAR, Solana and native Zcash. Solvers compete to fill your intent, and execution runs in a private shard with restricted visibility.
Value enters through a public shield, lives as sealed notes, and leaves through a public exit or a confidential cross-chain swap. Everything in between is proven, not revealed.
Any Solana wallet stays your public entry and exit. Nothing else about you is needed.
One wallet signature moves tokens behind the privacy wall. The note is sealed in your browser.
Your balance is the set of notes only your viewing key can open and only your spending key can spend.
Every action spends notes and creates new ones, each with a zero-knowledge proof. A relayer pays the network fee.
Exit to a fresh one-time address, or swap cross-chain with multi-hop routes and intent-based confidential swaps.
Each note commits to a token, an amount and its owner. Only your viewing key can open it, and only your spending key can spend it.
Groth16 proofs built in your browser show the program that balances add up and that you own what you spend.
A relayer submits your proof and pays the network fee. It cannot redirect funds, because the recipient and fee are bound into the proof.
Plenty of crypto projects call encryption, relayers or mixers “ZK”. Those can give you privacy, but they aren’t zero-knowledge proofs. Cadabra’s privacy is built on a real zk-SNARK system, Groth16, with every proof verified on-chain.
“I hid the transaction details so nobody can read them.”
Protects information, but proves nothing about whether the transaction is valid.
“I sent it through another wallet so your address isn’t directly visible.”
A routing or anonymity technique. Useful, but it isn’t a proof.
“I can mathematically prove this transaction is authorized and valid without revealing the secret behind it.”
Cadabra uses all three. Only this one gives the cryptographic proof property.
The chain never needs to know the secret. It only checks whether the proof is valid.
Every note commits to its token, amount and spending authority. Commitments live in a Poseidon Merkle tree. When you spend, your browser builds a proof that says:
The program checks the maths and moves on. The note owner and your wallet are never part of the public inputs: ownership is separated from public execution.
Each spend publishes a nullifier. The chain can enforce “this balance hasn’t already been spent” without ever asking who owns it.
Real ZK doesn’t mean everything is invisible. Public entry and exit amounts, timing and network metadata can still create links. A ZK system is only as strong as its circuits, setup, contracts and key handling.
The protocol details behind ZK Shield, multi-hop private routes and intent-based confidential swaps.
A non-custodial shielded pool on Solana. It uses a UTXO model adapted for zero-knowledge: value lives as notes, the pool stores only commitments, and spending reveals an unlinkable nullifier.
Each note commits to a token (mint), an amount, its owner and a random blinding factor. Its public fingerprint, the commitment, is appended as a leaf to an on-chain Poseidon Merkle tree with 26 levels (67,108,864 leaves).
Spending a note publishes its nullifier, which the program records in a spent registry so the note can never be spent twice. The nullifier cannot be linked to the commitment it spends.
Recipients find payments by trial-decrypting every new note ciphertext with their viewing key, so not even the indexer learns which notes belong to whom.
Transaction(26, 4, 3): up to 4 notes in and 3 notes out per proof. It is a Groth16 SNARK over BN254 with 13 public inputs, verified on-chain with Solana’s alt_bn128 syscalls.
The constraints enforce Merkle membership of every spent note, correct nullifier derivation, ownership through the spending key, and amount conservation: inputs + public amount = outputs + fees.
Proving and verifying keys come from a Powers-of-Tau trusted setup. The verifying key is hard-coded in the program, so verification is fully deterministic.
circuit Transaction(levels = 26, nIns = 4, nOuts = 3) curve BN254 · Groth16 · 13 public inputs hash Poseidon (Merkle tree + commitments) verify alt_bn128 syscalls on Solana assets /circuits/transaction.wasm · transaction.zkey
A relayer broadcasts your proof and covers gas, so private actions never need a wallet signature. Destination, fee and swap terms are baked into the proof hash; tamper with any of them and verification simply fails.
Trades run in two steps (swap_prepare then swap_execute). Your proof locks the input in its own escrow, then the route runs. The program checks that the escrow paid out exactly the input and that the vault received at least your minimum, otherwise it refunds automatically.
Everything grows from a single random 32-byte seed. Your browser branches it into a spend key, a view key and an endless supply of single-use addresses, then locks the lot with your passphrase (PBKDF2 × 600k, AES-GCM) on this device only.
The recovery key, shown once, restores everything on any device. It is not derived from your wallet, so a wallet compromise never exposes your private balance, and vice versa.
| Instruction | Purpose |
|---|---|
| transact | Shield, private transfer or withdrawal with a Groth16 proof (≤4 in, ≤3 out) |
| swap_prepare · swap_execute · swap_refund | Two-step private trade or lending position through an allowlisted program |
| register_asset | Open a vault for a token (anyone; screened on-chain) |
| collect_fees | Sweep protocol fees to the treasury |
| set_* · accept_admin | 2-of-2 multisig governance: fees, caps, pause, allowlist. It can pause but never move funds |
| Action | Public | Stays private |
|---|---|---|
| Shield | Your wallet, the token and the amount entering | Everything you do afterwards |
| Private send | That a transfer happened, the relayer fee, 1–4 notes spent | Sender, recipient, amount and, with private SOL, the token |
| Private trade | The vault traded through an allowlisted route | Who traded and from which notes |
| Withdraw | A one-time address receiving funds | Which notes and which owner paid it |
| Cross-chain swap | Solana deposit and the destination payout | Swap processing (NEAR confidential shard) and no wallet link |
Fees apply when value crosses the privacy wall. Private sends have no protocol fee.
| Action | Protocol fee | Network / relayer |
|---|---|---|
| Shield | 0.3% on top | None (your wallet pays the network fee) |
| Private send | None | Network fee + rent per note spent |
| Private trade / earn | 0.3% of the input | Network fee + rent |
| Withdraw | 0.3% of the amount | Network fee + rent |
| Private route (multi-hop) | Inside the live quote | Solana network fee for your deposit |
| Privacy swap (intents) | 0.40% partner fee, in the quote | Network costs per chain |
Create a wallet in your browser, shield a token, or start a cross-chain private swap. No sign-up.
Launch app