A privacy layer for everything you do on Solana

Valon gives your wallet a private balance. Shield any token into it, then send, trade, lend and withdraw without the chain linking any of it back to you. Your keys never leave your browser.

How it works

Value enters through a public shield, lives as sealed notes, and leaves through a public exit. Everything in between is proven, not revealed. Tap a stage.

The three pieces

Quick start

Shield

Moves any registered SPL or Token-2022 token from your wallet into Valon. SOL is wrapped and unwrapped automatically. Your wallet pays the amount plus the 0.3% Valon fee and signs once; the note is sealed in your browser.

Any token can get a Valon vault: if it doesn't have one yet, anyone can open it for about 0.004 SOL of rent. Tokens with features that could put a shared vault at risk (permanent delegates, transfer hooks, pausable mints) are refused on-chain.

Send privately

Pay any Valon address (veil2…; its last characters are a checksum, so a typo is caught) in any token. There's no wallet signature and no Valon fee, only the relayer's network fee. When you hold private SOL, Valon pays that fee in SOL, and the transaction doesn't name the token you sent.

The recipient's app finds the payment by trying to open every new note with its viewing key, so nobody (not even the indexer) learns which notes are whose.

Trade

Swap inside your private balance through Jupiter. On-chain, Valon's vault is the trader. You set a minimum output; if the market can't meet it, nothing is traded and your input returns to your private balance automatically.

Each trade runs in two steps: your proof sets aside the input in an escrow of its own, then the route runs. The program checks the escrow paid out exactly the input and the vault received at least the minimum you approved. The quote and that minimum come from the relayer, so the app compares them with the market price before you approve.

Earn

Lend from your private balance through Jupiter Lend. Your position is a private note of the market's share token (for example jlUSDC), and it grows as the share price rises with interest. Withdraw turns it back into the underlying token, privately.

Withdraw & one-time addresses

Withdraw sends funds to any Solana address. By default it creates a one-time address derived from your vault, so nothing ties it to your wallet. Your recovery key restores every one of them.

Receive works the other way: give a payer a one-time address instead of your wallet. When funds land, shield them back with one tap. It's gasless: the relayer pays the network fee and takes its fee from the deposit, so even a token-only address works.

Invite & earn

Every vault can create an invite link. Friends who shield through it get 50% of Valon's shield fee back for their first 30 days, and you earn 20% of the shield fees they pay for 12 months. Open Invite in the app.

What is public, what is private

Pick an action to see exactly what the chain records and what stays sealed.

Good habits

• Don't withdraw the exact amount you shielded to the same wallet right away.
• Keep a little private SOL so transfers can hide their token.
• Prefer tokens with a big crowd; wait a while between shielding and withdrawing.
• Reach the relayer through a network-level privacy tool if your IP address matters to you.

Fees

Valon's fee is 0.3% each time value crosses the privacy wall: when you shield, trade or withdraw. Private sends between Valon users have no Valon fee. The program enforces the rates; here they are, read live from the chain:

Try it

Keys & recovery

Your vault holds one random 32-byte root. From it your browser derives a spending key (to spend notes), a viewing key (to find and open them) and every one-time address. It's encrypted with your passphrase (PBKDF2, 600,000 rounds → AES-GCM) and stored only in this browser.

• The recovery key (shown once at creation) restores everything on any device. Anyone who has it can spend your private balance.
• It is not derived from your wallet, so a wallet compromise doesn't expose your Valon balance, and vice versa.
• Lose both this browser and the recovery key and the funds are unrecoverable. Nobody, including Valon, can restore them.

Security model

• Non-custodial: only proofs from your keys move your notes. The admin can pause, set fees, caps and allowlisted programs, but cannot move anyone's funds.
• Bound to the proof: recipient, fees and swap terms are hashed into the proof by the program itself; a relayer that changes anything gets an invalid proof.
• Isolated swaps: each trade or lend has its own escrow and signer; an allowlisted protocol can only touch that one.
• Multisig admin: a 2-of-2 multisig, handed over in two steps; it can pause, never move funds.

Testing, review status and live on-chain checks are on the Security page.

Limits & risks

• Anonymity set: privacy grows with the number of people using Valon, and per token for shields and exits.
• Freezable tokens (like USDC) can have their vault frozen by the issuer. The app labels them.
• Emergency pause: the multisig can pause deposits, transfers and swaps; withdrawals stay open. In an incident it can also pause everything leaving the pool for at most about 3 days (it ends by itself, and a new one can start only 7 days after the last).

SDK

@veil/sdk does everything the app does: keys, sync, proofs, and talking to the relayer. Proofs are generated client-side; nothing secret is ever sent.

import { VeilClient } from '@veil/sdk'
import { deriveKeys, rand } from '@veil/crypto'

const veil = new VeilClient({
  connection, programId,
  indexerUrl: 'https://indexer.example', relayerUrl: 'https://relayer.example',
  circuit: { wasm: '/circuits/transaction.wasm', zkey: '/circuits/transaction.zkey' }
})
veil.unlock(deriveKeys(rand(32)))   // keep the 32-byte root safe: it is the vault
await veil.sync()                      // download notes, find yours by trial decryption
console.log(veil.rootStatus)           // 'ok': checked against the program's own root on-chain

// tokens are named by mint (a token's own symbol is never trusted)
const SOL_MINT = 'So11111111111111111111111111111111111111112'
const USDC_MINT = 'EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v'
for (const m of [SOL_MINT, USDC_MINT]) await veil.resolveAsset(m)   // reads each token's Valon config from chain

Relayer & indexer API

Both are plain HTTP and keep no logs of who asked what. Anyone can run their own.

On-chain program

Circuit: Transaction(26, 4, 3), Groth16 over BN254, 13 public inputs, verified with Solana's alt_bn128 syscalls. Notes live in a Poseidon Merkle tree of 2²⁶ leaves.

FAQ

Glossary