# STRK-20

Markdown version of https://ethbeat.org/privacy/projects/strk20

## Summary

**Warning:** Real-time monitoring for this project is not supported.

- Total Value Locked: $1.09 M (-0.16% compared to seven days ago)
- Assets tracked: 7
- Buckets tracked: 7
- Deposits 7D: 123 (-91.5% compared to the previous seven days)
- Deposits 30D: 3.61 K
- Deposits Total: 20.68 K
- Tracked on: Starknet
- Runs on: Starknet
- Attributes: ZK, Transfers, DeFi, Any amount
- Reference app: Bramble v0.10.7 (most private of 5 checked)

### Risks

- Privacy: Link privacy. Public observer: Link at risk (sentiment: warning); Chain analyst: Link at risk (sentiment: warning); Network observer: Link private (sentiment: good); Privileged insider: Link exposed (sentiment: bad); Future adversary: Link exposed (sentiment: bad).
- Trusted setup: Transparent setup (sentiment: neutral). Transparent setup: No trusted setup and no additional setup-related trust assumptions.
- Exit window: None (sentiment: bad). The pool and the anonymizer that owns every shadow account are immediately upgradeable, so users have no delay to withdraw before a malicious upgrade can take effect. This protocol fails the walkaway test: users cannot fully use it if every centralized participant disappears. The prover and discovery service are open and self-hostable. StarkWare's permissioned sequencer alone checks client proofs and includes pool transactions, so users cannot exit without it.
- Reproducibility: Partially reproducible (sentiment: warning). The pool contract, SDK, discovery service and prover are open source. The deployed pool, anonymizer and bridge helpers rebuild from their published source. Source for the AVNU, Endur and escrow helpers is not published. Bramble's store build matches a rebuild of its tag, while its gateway runs closed code.

### About

A shielded ledger on Starknet for any ERC-20 token, with private transfers and DeFi, where one auditor key can decrypt every user's history.

### Links

- Website: https://strk20.starknet.io/
- Docs: https://docs.starknet.io/build/starknet-privacy/overview
- Explorer: https://voyager.online/contract/0x040337b1af3c663e86e333bab5a4b28da8d4652a15a69beee2b677776ffe812a
- Repository: https://github.com/starkware-libs/starknet-privacy, https://github.com/starkware-libs/sequencer/tree/main/crates/starknet_transaction_prover
- Other: https://eprint.iacr.org/2026/474

## Protocol description

STRK-20 lets the user shield any ERC-20 token on Starknet, send it privately, use it in DeFi and withdraw it to any address. Senders, amounts and which deposit funds which withdrawal stay hidden inside the pool. Deposits, withdrawals, the first payment to each new contact and DeFi calls are public.

Users trust the holder of the auditor key, which can decrypt every user's history, and the holder of the screener key, which approves deposits. A multisig can upgrade the [pool](https://voyager.online/contract/0x040337b1af3c663e86e333bab5a4b28da8d4652a15a69beee2b677776ffe812a) and the contract that owns every shadow account without delay. Leaving needs StarkWare's sequencer, which alone checks proofs and includes pool transactions.

### Architecture

Each user registers a viewing key, which the pool stores encrypted to the auditor key. Payments travel over channels: the first payment to a contact opens one and names the recipient, later ones only add encrypted notes. A private transfer needs a registered recipient, and registering takes a transaction and fee from the recipient's own account. A note holds an amount of one token, and spending it publishes a nullifier. DeFi actions use open notes, whose amount a helper contract fills after the swap or loan.

### Flow

1. **Register.** The wallet publishes your viewing key, encrypted to the auditor key.
2. **Deposit.** The holder of the screener key signs off on your address, and the pool takes the tokens and creates a note. Address, token and amount are public.
3. **Transfer.** The wallet proves offchain that you may spend your notes and creates notes for the recipient. A paymaster submits the transaction and takes its fee from your notes.
4. **Withdraw.** The pool pays out to any address. Recipient, token and amount are public, and the withdrawing user is encrypted to the auditor key.

### Shadow accounts

A shadow account is a contract the pool deploys for one user, app and index. The pool withdraws tokens to it, runs the app's calls through it and moves the results back into the user's notes. Shadow account addresses derive from the user's viewing key, so whoever holds that key can find them. The [anonymizer](https://voyager.online/contract/0x04f33230dc57855c6e7eabe66dfa0fde82c5458fd0e54827cdb7cb4c474888a7) owns every shadow account and can move what it holds.

### Keys

The user's Starknet account signs every action, and their viewing key decrypts their notes. The app derives the viewing key on the device from a signature of the account key. Registration cannot be changed, so a leaked viewing key exposes the user's history for good.

### App

The app is an open-source Chromium extension that Starknet Holdings publishes. By default it talks to Starknet Holdings' gateway, which forwards note discovery to StarkWare's discovery service and relayed transactions to AVNU's paymaster. Starkscan, also run by Starknet Holdings, serves the activity list. The settings point the RPC, discovery service, prover and paymaster elsewhere. A self-run discovery service keeps the viewing key from the gateway. A self-run [prover](https://github.com/starkware-libs/sequencer/tree/f2d0c93a057675f6c9eab7292c2fcb13a6dea24d/crates/starknet_transaction_prover) (high hardware requirements) covers transfers and withdrawals, while deposits need a prover with screening credentials.

### Compliance

Every deposit from a Starknet address needs a fresh signature from the pool's screener key. The wallet's prover requests it from a [screening service](https://github.com/starkware-libs/starknet-privacy/tree/fcc7c90f544ceb08621c32616bde29f1fdcbeb54/elliptic-proxy), which checks the address with Elliptic and serves only its credentialed partners. Governance sets a screening policy per helper contract. Five helpers are exempt, among them the CCTP bridge, so USDC bridged in from other chains skips screening. The auditor key is one public key in the pool's storage. Who holds the screener and auditor private keys is not visible onchain, and governance can replace either key at once.

### Fees

Every pool transaction pays a fixed STRK fee, which governance can change at any time, plus gas. Paymasters take their cost from the user's notes.

### Anonymity set

One pool holds every token, but each token forms its own set. Registered users are the upper bound.

## Privacy

**What the protocol promises:** Hides amounts, senders and the link between deposit and withdrawal inside the pool. The first payment to each new contact is public.

**Apps**

- **[Bramble](https://chromewebstore.google.com/detail/jcfafpefcpcejehepoednnollpeenpop)** v0.10.7 (Reference): The ratings assume this app, since 2026-10-27 · Source [d90222a](https://github.com/starknet-innovation/bramble/tree/d90222a2653c997a5cf8d8c6433df5ea10c16112)
- **Ready extension** (Leaks more): Sends the account and viewing key to Ready's servers, with no setting for a self-run discovery service. Fix: Let users set their own discovery service and prover, as Bramble does. · [Source (checked 2026-10-30)](https://chromewebstore.google.com/detail/dlcobpjiigpikoobohmabehhmhfoodbb)
- **Xverse extension** (Leaks more): Its privacy servers refuse Tor, so they get the user's IP along with the account and viewing key. Fix: Accept Tor connections on its privacy servers. · [Source (checked 2026-10-30)](https://chromewebstore.google.com/detail/idnnbdplmphpflfnlkomgpfbpcgelopg)
- **Haven web app** (Leaks more): Reads the account's balances and transfers through Cartridge's public RPC, a third party that refuses most Tor circuits. Fix: Read the chain through Haven's own servers or a user-set RPC, and accept Tor there. · [Source (checked 2026-10-30)](https://go.haven.hn)
- **OffMarket web app** (Leaks more): Reports each deposit, trade and settled position to FullStory, a session recorder that is always on, so FullStory can link them. Fix: Remove FullStory from the pages that handle private actions. · [Source (checked 2026-10-30)](https://offmarket.cx)

[How we pick the reference](https://ethbeat.org/publications/privacy-methodology#reference-app)

Ethereum is public by default. Each protocol is rated on its main privacy promise, like hiding who paid, who received, how much, or which deposit became which withdrawal. Against each adversary, the colour says whether it holds for a careful user with the app's own settings: green yes, yellow only with significant extra work, red no. Fields marked at risk stay private only under the condition in their note.

### Public observer

Link at risk (sentiment: warning)

**Who:** Everyone with a block explorer and some basic tools. Sees every public onchain event, but does no correlation beyond following links. Examples: A curious counterparty, an employer, a journalist.

Transfers inside the pool are encrypted, but the first payment to each new contact writes the recipient's address in cleartext. Deposits and withdrawals show address, token and amount. DeFi actions name their target contract, and a shadow account shows its funding, calls and positions.

**Advice:** Submit every private action through a paymaster. Treat the first payment to a new contact, and any DeFi action, as public.

**Inside**

- Sender: private
- Recipient: exposed. Only at the first payment to each new contact.
- Amount: private
- Asset: at risk. The relay fee names the token sent whenever the app can price it.
- Link: private

**Sources**

- [PrivacyPool contract on Voyager](https://voyager.online/contract/0x040337b1af3c663e86e333bab5a4b28da8d4652a15a69beee2b677776ffe812a)
- [Channel opening carries the recipient address](https://github.com/starkware-libs/starknet-privacy/blob/fcc7c90f544ceb08621c32616bde29f1fdcbeb54/packages/privacy/src/actions.cairo#L329-L334)
- [Deposit and withdrawal events carry address, token and amount](https://github.com/starkware-libs/starknet-privacy/blob/fcc7c90f544ceb08621c32616bde29f1fdcbeb54/packages/privacy/src/events.cairo#L17-L40)

### Chain analyst

Link at risk (sentiment: warning)

**Who:** Scrapes all public data and correlates it: timing, amounts, gas and wallet fingerprints, address clusters. Examples: Chain analytics firms, ZachXBT, data brokers.

Every token except STRK has fewer than 1,000 depositors to hide among. A channel opened in the same transaction as a deposit ties the two together, and most withdrawal addresses have also deposited. Paying gas from the user's wallet instead of a paymaster exposes its fingerprint, account implementation and fee habits, even from a fresh address.

**Advice:** Hold STRK or USDC, open channels in a transaction without a deposit, and withdraw amounts that match no deposit. Wait before exiting and pick a different time of day than the deposit. Exit to a fresh address every time and spend from it with a different wallet than the one that deposited.

**Inside, compared with a public observer**

- Sender: at risk. A channel opened in the same transaction as a deposit names the depositor.
- Recipient: exposed
- Asset: at risk
- Link: at risk. Most withdrawal addresses have also deposited, which pairs the two ends.

**Sources**

- [PrivacyPool contract on Voyager](https://voyager.online/contract/0x040337b1af3c663e86e333bab5a4b28da8d4652a15a69beee2b677776ffe812a)
- [Deposit and withdrawal events carry address, token and amount](https://github.com/starkware-libs/starknet-privacy/blob/fcc7c90f544ceb08621c32616bde29f1fdcbeb54/packages/privacy/src/events.cairo#L17-L40)

### Network observer

Link private (sentiment: good)

**Who:** Sits between the user and the services and sees traffic only: ISPs, VPNs, Tor exits, public RPCs and relayers. Ties requests to a user by content, session or timing: what they name, a shared IP or login, and when they arrive. Services the operator runs count as the insider. Examples: Infura or Alchemy, a Tornado relayer, a wallet vendor selling telemetry, Google captcha or analytics in the dapp frontend.

Every pool request goes through Starknet Holdings' gateway, so AVNU and StarkWare's discovery service see only the gateway. The gateway answers over Tor, and Bramble runs only in Chromium, not in Tor Browser.

**Advice:** Run Bramble with all traffic through an IP-hiding route.

**Inside, compared with a public observer**

- Recipient: exposed
- Asset: at risk. Each private balance check sends CoinGecko every privately held token except STRK.
- Link: at risk. Private only over an IP-hiding route and for common tokens, since CoinGecko's requests single out holders of rare ones.

**Sources**

- [IP-hiding routes we checked](https://ethbeat.org/publications/privacy-methodology#ip-hiding-routes)
- [Default routes go through the operator's gateway](https://github.com/starknet-innovation/bramble/blob/d90222a2653c997a5cf8d8c6433df5ea10c16112/packages/features/privacy/src/config.ts#L17-L19)
- [Token prices come from CoinGecko](https://github.com/starknet-innovation/bramble/blob/d90222a2653c997a5cf8d8c6433df5ea10c16112/packages/features/portfolio/src/tokens/prices-feed.ts#L22)

### Privileged insider

Link exposed (sentiment: bad)

**Who:** Holds an operator role, custodies funds, receives keys or plaintext by design, or delivers the app: upgrade admin, custodian, view key holder, enclave operator, association set provider, hosted prover, registry, frontend host. Examples: A compliance backdoor key, a DAO with an upgrade key, a KMS committee, an ASP operator, a custodial bridge.

Every user's viewing key is escrowed onchain, encrypted to one auditor key that a role holder can replace at any time with no delay. Starknet Holdings' gateway gets the account and viewing key at every unlock, and each proof carries the viewing key. Apps that drive a shadow account or a swap through the pool get the user's main address from the wallet connection. The holder of the screener key can block any screened depositor.

**Inside, compared with a public observer**

- Sender: exposed
- Recipient: exposed
- Amount: exposed
- Asset: exposed
- Link: exposed

**Sources**

- [Viewing key escrowed to the auditor key onchain](https://github.com/starkware-libs/starknet-privacy/blob/fcc7c90f544ceb08621c32616bde29f1fdcbeb54/packages/privacy/src/objects.cairo#L43-L53)
- [Default routes go through the operator's gateway](https://github.com/starknet-innovation/bramble/blob/d90222a2653c997a5cf8d8c6433df5ea10c16112/packages/features/privacy/src/config.ts#L96-L109)
- [Proving request carries the viewing key](https://github.com/starkware-libs/starknet-privacy/blob/fcc7c90f544ceb08621c32616bde29f1fdcbeb54/sdk/src/internal/proof-invocation-factory.ts#L132-L136)
- [Deposits require a screening attestation](https://github.com/starkware-libs/starknet-privacy/blob/fcc7c90f544ceb08621c32616bde29f1fdcbeb54/packages/privacy/src/interface.cairo#L530-L545)
- [The wallet API hands the connected account to the app](https://github.com/starknet-io/types-js/blob/0b483f51f4bc33c7253b209a25136d9d6ec1bc41/src/wallet-api/methods.ts#L42-L51)

### Future adversary

Link exposed (sentiment: bad)

**Who:** Harvest now, decrypt later. Holds every byte ever published and runs the known quantum attacks: elliptic curves, pairings and RSA fall. Hashes, symmetric ciphers and post-quantum schemes stand until an attack on them is known. Examples: An intelligence agency archiving chain data today, then anyone once a break is public.

Whoever breaks elliptic-curve cryptography recovers the auditor key from its onchain public key, and with it every escrowed viewing key and the whole history. Channel keys and note contents use the same elliptic-curve encryption. Accounts created from a wallet signature reduce to that wallet's key.

**Inside, compared with a public observer**

- Sender: exposed
- Recipient: exposed
- Amount: exposed
- Asset: exposed
- Link: exposed

**Sources**

- [Stark-curve ECDH encryption of channel and note data](https://github.com/starkware-libs/starknet-privacy/blob/fcc7c90f544ceb08621c32616bde29f1fdcbeb54/sdk/src/utils/encryptions.ts)
- [Viewing key escrowed under the onchain auditor public key](https://github.com/starkware-libs/starknet-privacy/blob/fcc7c90f544ceb08621c32616bde29f1fdcbeb54/packages/privacy/src/objects.cairo#L43-L53)
- [Auditor public key in pool storage](https://voyager.online/contract/0x040337b1af3c663e86e333bab5a4b28da8d4652a15a69beee2b677776ffe812a)

## Value Locked

The interactive value chart is shown on [the HTML page](https://ethbeat.org/privacy/projects/strk20#privacy-tvl).

## Anonymity sets

### 30 day historic anonymity set

How many unique depositors you could have blended in with if you withdrew on a particular day after depositing during the previous 30 days. This metric is a proxy for the historic anonymity set and shows how it developed over time.

The metric looks backwards: it counts deposits that already happened, including from addresses that have since withdrawn. Your real anonymity also depends on deposits made after yours, which cannot be known in advance.

### Estimated anonymity set by holding duration

An estimate of how many unique depositors you blend in with, depending on how long you leave your deposit in the pool. It is based on historic data of past deposits: each point counts depositors from the preceding period, so holding for up to 30 days effectively means blending in with everyone who deposited during the last 30 days.

The interactive charts are shown on [the HTML page](https://ethbeat.org/privacy/projects/strk20#privacy-anonymity-set).

## Flows

The interactive flows chart is shown on [the HTML page](https://ethbeat.org/privacy/projects/strk20#privacy-flows).

## Assets Breakdown

| Asset | Deposits 7D | Deposits 30D | Deposits Total | Value Locked |
| --- | --- | --- | --- | --- |
| XSTRK | 0 ($0.00) | 3 ($8.81 K) | 17 ($75.43 K) | $489.20 K |
| USDC | 36 ($15.33 K) | 532 ($104.16 K) | 6.79 K ($947.93 K) | $240.00 K |
| STRK | 83 ($23.61 K) | 2.84 K ($442.68 K) | 11.98 K ($1.73 M) | $237.67 K |
| WBTC | 0 ($0.00) | 6 ($29.36 K) | 81 ($106.43 K) | $55.72 K |
| ETH | 1 ($25.90) | 213 ($12.47 K) | 415 ($207.71 K) | $46.23 K |
| strkBTC | 3 ($3.44) | 12 ($55.89 K) | 1.37 K ($512.82 K) | $16.13 K |
| USDT | 0 ($0.00) | 5 ($1.30 K) | 16 ($16.45 K) | $11.50 K |
| Total | 123 ($38.98 K) | 3.61 K ($654.70 K) | 20.68 K ($3.59 M) | $1.09 M |

## Milestones & Incidents

- 2026-10-13: [Shadow accounts launch](https://x.com/StarkWareLtd/status/2110007213331026343). StarkWare opens per-app shadow accounts, which let apps act for pool users without naming them.
- 2026-06-09: [Privacy live on Starknet](https://www.starknet.io/blog/privacy-live-on-starknet/). StarkWare opens the pool to users through the Ready and Xverse wallets.

## Risk summary

### Funds can be stolen if
1. the proof system or virtual Starknet execution model is broken, allowing invalid actions.
2. the Starknet sequencer includes a transaction with fabricated proof facts.
3. the 7/12 multisig deploys a malicious [upgrade](https://ethbeat.org/privacy/projects/strk20#upgrades-and-governance) of the pool or of the anonymizer, which owns every shadow account, with no delay.
4. the 2/4 multisig deploys a malicious [upgrade](https://ethbeat.org/privacy/projects/strk20#upgrades-and-governance) of the pool or of the anonymizer, with a one-day delay.
5. an external DeFi helper or target protocol invoked by the user mishandles assets.

### Funds can be lost if
1. a user loses the Starknet account key or viewing key required to spend their notes.
2. the pool is paused or upgraded so that valid actions fail.

### Privacy can be lost if
1. the holder of the auditor key decrypts users' viewing keys, which exposes their whole history (see privileged insider).
2. the wallet's prover or note discovery service, which receives the viewing key, leaks or keeps it (see privileged insider).
3. an app driving a shadow account or a swap through the pool links it to the user's main address (see privileged insider).
4. a first payment to a new contact, a channel opened beside a deposit or a unique amount links activity (see public observer and chain analyst).
5. Bramble sends CoinGecko every privately held token at each balance check, which can single out holders of rare tokens (see network observer).
6. elliptic-curve cryptography is broken, which opens the auditor key and with it every user's history (see future adversary).

## Upgrades & Governance

A 7/12 multisig holds the governance, security and upgrade roles of the pool and the anonymizer, and can replace either's code at once. A 2/4 multisig owns a delayed executor that can upgrade both behind a one-day delay. The 7/12 and the 2/4 both hold the pool's app role, which sets the fee, the fee collector, the proof validity window and which DeFi helpers need screening. The security governor role, held by the 7/12, can replace the auditor and screener keys at once. Pausing the pool needs a role nobody holds today, which the 7/12 can grant.

## Trusted setup

Risk levels follow the [Trusted Setups Risk Framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381). Yellow (medium risk): all contributions are published and the final output can be verified, the ceremony client is open source, there were at least 30 contributions, participation was open to the public and announced, and participants are publicly identified. Green (lowest risk): everything required for yellow, with at least 150 contributions. Red (highest risk): at least one requirement for yellow is not met. N/A: the proof system needs no trusted setup.

### Transparent setup

- Risk: N/A (no trusted setup)
- Proof systems: Stwo (STARK)

Transparent proving systems require no trusted setups and have no additional setup-related trust assumptions.