The payer and the holder are strangers.
On a normal launchpad, the wallet that buys is the wallet that holds. Anyone can follow it: copy it, front-run it, or tie it to you. Shroud cuts that link with a zero-knowledge proof.
1. Shroud a note
While a launch is shrouding, you pay in fixed sizes: 0.01, 0.1 or 1 ETH. For each note your browser makes two random numbers, a nullifier and a secret, and sends only their Poseidon hash. The contract hashes that with the size you actually paid and adds it to the launch's Merkle tree. Fixed sizes mean your notes look like everyone else's.
2. One price
When the window closes, anyone can settle. Everyone fills at the same price: ETH raised ÷ 500M tokens. There is no first block to snipe and no bonding curve to front-run. 1% of the raise goes to the platform and 0.5% to the creator; the rest seeds a pool that is locked forever and opens at the sale price. Unused pool-side tokens are burned. If the raise misses the creator's minimum, every note is refunded instead.
3. Claim with a proof
To claim, your browser builds a Groth16 proof that says: “I know the nullifier and secret of some note in this tree, and here is its nullifier hash.” It does not say which note. The contract checks the proof on chain, marks the nullifier hash spent so the note can't be claimed twice, and pays the address baked into the proof, so nobody can redirect it in the mempool.
For the link to stay cut, send the claim from a wallet that didn't pay: the fresh wallet itself, or any unrelated one. The more notes in a launch, the bigger the crowd you hide in.
What stays public
Which wallets shrouded, how many notes and of what sizes, and which addresses claimed. What's hidden is which claim belongs to which payment. Timing still matters: claiming the moment you pay, from an obvious wallet, or the only 1 ETH note in a launch, gives the crowd less cover.
Keep your notes
A note is a bearer key. Whoever has it can claim. Shroud keeps notes only in your browser and offers a backup file after every shroud. Lose both and the tokens can't be claimed by anyone. Manage your notes.
The circuit
About 9,000 constraints: two Poseidon hashes for the note, one for the nullifier hash, and a depth-16 Merkle path (65,536 notes per launch). Recipient, relayer and fee are public inputs, so the proof is bound to them.