Frequently asked questions

That your wallet deposited, and later that tokens were withdrawn to some address, with the tokens and amounts at each end. A withdrawal does not show who made it, unless it goes to an address already tied to you. What happens in between, who paid whom, how much and in which token, is private. See what is private and what is visible.

No person or company does. Pooled tokens sit in token accounts owned by the shielded pool program, and nothing moves them without a valid proof made with your keys. The program can be upgraded by its upgrade authority, which is the trust you place in it. See governance and upgrades.

Notes are owned by identity commitments, and you can only receive notes once yours is in the identity tree. Registration publishes it and gives each guardian node one share of your outgoing viewing key. See register.

Not inside the pool. Every identity-owned note must belong to a registered identity. You can withdraw to any Solana address. See receiving payments.

Nobody can freeze an individual note, but a zone authority can freeze its own zone, after which that zone's notes can leave only through the escape hatch. Governance can stop new deposits of a token, which leaves withdrawals and transfers of it working. It can also freeze the guardian cluster or the fee enclave, or revoke the screener or data endorser, and any of those stops every value transaction. The escape hatch still lets you withdraw a note. A token's own freeze authority could freeze the pool's account for that token. See known risks.

Value transactions stop, because they need all six attesters. The escape hatch withdraws one note at a time without any of them, as long as the tree data and a forester are available. See liveness.

Your account cannot be recovered: every key derives from your wallet's signature. See recovery.

Yes, in Nimbus's apps. Your account comes from the exact signature your wallet makes over the Nimbus message; this is how Nimbus's clients derive keys, not a protocol rule. A wallet or adapter that wraps the message before signing is refused, because the SDK checks the signature over the exact message before deriving any key. Sign with the same wallet each time. See the account signature.

Note encryption is post-quantum. Proofs and signatures are not, so a future quantum attacker could forge them, but could not decrypt notes recorded today. See security levels.

Its submitter is, usually the relayer that carries it. The recipient is not: screening checks a transaction's public parties, and a private transfer has no public deposit or withdrawal. See screening.

Numbered domains whose signing keys must approve transactions moving notes into or out of them. Which zone a note is in is private. See zones.

So your wallet does not sign your private transfers. A relayer cannot change a transaction; it can only submit it or refuse. See relayers.

A protocol fee in basis points per action, set by governance and capped at 5% by the program, an optional relayer tip, and Solana's fee. See the fee model.

SPL and Token-2022 tokens governance has allowed for deposit, whatever extensions they carry, and SOL, which you can deposit as plain or wrapped SOL and which the pool holds as plain lamports. A token keeps its issuer's powers inside the pool, such as a freeze authority or a permanent delegate. See tokens.

The proofs that need your keys are made on your device. A relayer adds the freshness proof, which needs none. See how Nimbus uses proofs.

Because your device makes the proof. Closing the tab stops it.

No. It discloses the note it spends, including its owner. See the escape hatch.

The audit list is to be published by the Nimbus team. The circuits and parts of the on-chain state are machine-checked. See audits and verification.