200M–1B gas in Solidity, roughly 110M even through Stylus, against a 32M per-transaction cap.
No Solidity, Noir or Circom implementation was found as of 12 Sep 2026.
Private on Robinhood Chain. Powered by Monero's key technology.
A private account for tokenized stocks and tokens.
What DECOY does
IllustrationCopy tracker
- walletNVDAbuy
- walletSPYbuy
- youYour row, shown only as identical notes
- walletHOODsell
Hide your stocks
Tokenized stocks sit in a private account, not in a public wallet.
Trade without being copied
No wallet address for copy bots to follow.
Revoke the key
Share a read-only key. Take it back any time; it keeps only what it already saw.
One balance
Fold every burner wallet into one private balance.
Prove without revealing
Show a fact about your funds, never the balance.
Exit without a proof
An exit that still works if the proving system fails.
Four steps. The third is the reason DECOY exists.
The refusals- 01
Fund it
Deposit from a wallet you already hold. DECOY grades that wallet's inbound edges first, and refuses to call a deposit clean when it is not.
- 02
Trade inside a batch
The pool executes, not your address. Wait for cover or execute now — your share of the batch is shown before you commit.
- 03
Delegate sight
Issue a read-only key. It returns a correct balance including every spend, and it can authorize nothing.
- 04
Retire the key
Bump the epoch and churn once. Forward-only — the retired key keeps only what it already saw.
What DECOY will not ship.
Every construction below was priced before it was declined. Its figures are ESTIMATE, 12 Sep 2026. Fork scripts will be published with the contracts; until then these figures cannot be reproduced independently.
Named for the primitive DECOY won't ship.
Monero retired ring decoys in January 2026 when FCMP++ activated. DECOY did not port rings either, and the gas math above is the reason — not a preference. Decoys taught the world what an anonymity set is; this is the next one.
Gas against the cap
- Shipped
- Refused
- Cap
| Operation | Position on a logarithmic gas scale | Gas and provenance |
|---|---|---|
| A claim, Chaum–Pedersen | 24,300 gas · MEASURED | |
| A key image spent, as a nullifier | 24,800 gas · MEASURED | |
| Monero's UnspentProof | 236,138 gas · MEASURED | |
| CLSAG on bn254, 16-member ring | 0.9–1.5M gas · ESTIMATE | |
| Bulletproofs+, one 64-bit range proof | 1.2–1.6M gas · ESTIMATE | |
| CLSAG on ed25519, 16-member ring | 80–100M gas · ESTIMATE | |
| FCMP++ through Stylus | 110M gas · ESTIMATE | |
| FCMP++ in Solidity | 200M–1B gas · ESTIMATE |
Shipped: MEASURED, 12 Sep 2026, on a mainnet fork (forge + anvil ‑‑fork‑url, gasleft() deltas) at 0.0956 gwei and ETH $2,522. Fork scripts will be published with the contracts; until then the shipped figures cannot be reproduced independently. They are re-measured the week the calldata subsidy ends. Refused: ESTIMATE, 12 Sep 2026, priced from the construction and not run; no implementation was found to measure as of 12 Sep 2026.
Show a fact. Never a balance.
- 01
A key that only reads
Shareable. Returns a correct balance including every spend, and authorizes nothing. It is off-chain key derivation, so issuing one touches no contract.
Compare key models - 02
Retirement
Bump the epoch and churn once. Zcash's viewing key cannot be withdrawn after it is shared. Monero has no shared state to withdraw one with. An EVM chain does.
The retirement step - 03
Claims
A Chaum–Pedersen statement at 24,300 gas, and Monero's UnspentProof at 236,138 gas.
See the gas
Key models
Which viewing keys see every spend, and which can be withdrawn once shared.
Key model
Zcash viewing key
- Sees spends
- Yes
- Can be withdrawn
- No — permanent once shared
Key model
Monero legacy view key
- Sees spends
- No
- Can be withdrawn
- No — no shared state
Key model
Monero CARROT
- Sees spends
- Yes
- Can be withdrawn
- No — no shared state
Key model
DECOY
- Sees spends
- Yes
- Can be withdrawn
- Yes — forward-only, one churn batch
Monero's UnspentProof is specified in Zero to Monero 2nd ed. §8.1.5, whose footnote 9 reads “UnspentProofs have not been implemented in Monero.” It has never run on-chain.
The anonymity set, after the attack runs.
k_eff = min( k_batch, k_root, k_value, k_asset )
DECOY runs the published pruning attack against its own chain data every block, and publishes the number that survives it.
k_asset
Token identity — the strongest pruning channel. The asset is a private witness, so the membership proof is asset-blind.
k_root
One tree, one canonical checkpoint root per 512 insertions or 15 minutes. Every spender in a window submits identical bytes.
k_value
Inputs, outputs and exits are ladder-quantized. Published per denomination tier as a histogram.
k_batch
Distinct spenders in your batch. Your share of its notional is shown before you commit.
On day one the tree holds the builder's own seeded notes and k_eff may be 1. The interface says so in those words, and the fraction of the set held by the builder is printed next to the count.
Safety
If the circuit is wrong.
Two production shielded pools answered circuit soundness problems in 2026.
Aztec V5 shipped a proof-forgery bug found by its own team six days after mainnet. A flaw in Zcash's Orchard circuit, found 29 May 2026, was answered on 28 July with an entirely new shielded pool.
DECOY's verifier is generated by the same proving stack as one of them. That is stated here rather than buried.
Mechanisms
Mechanism
An exit that needs no proof
In freeze mode anyone streams the leaf list back on-chain against a keccak hash-chain head. You claim with a plain Merkle path and a signature. No SNARK, no Poseidon, no trusted root, no guardian vote — the one construction that survives a broken verifier.
Mechanism
Solvency as an equality
shieldedSupply[a] + pendingDeposits[a] == balanceOf(pool), checked every block by an independent public monitor. Fees leave the pool at settlement, so this is an equality rather than a useless inequality.
Mechanism
A cap that rises on clean days
Hard on-chain pool cap starting at $250,000, per-note cap $25,000, raised on a published schedule tied to elapsed clean days — never to demand.
- Pool cap at launch
- $250,000
- Per-note cap at launch
- $25,000
Mechanism
The attack tool ships with the product
decoy-prune will be an open-source reimplementation of the published pruning attack, run against DECOY's own data every block and wired straight into the Set Meter.
Five readouts. No wallet, no deposit, no signature.
Direct reads over public endpoints.
Build
Read the contracts before you trust them.
- Not yet published
Contracts
Verified and CREATE2-deployed, with every address published.
- Not yet published
Client SDK
TypeScript. Local scanning, browser proving, no scanner service and no committee.
- Not yet published
Gas & refusals
Every figure on this page, with the fork scripts that produced it.
- Not yet published
decoy-prune
The pruning attack, open source, run against DECOY itself.
- Not yet published
Invariant monitor
Independent, public, per-block, per-asset solvency check.
- Not yet published
Docs
The key ladder, the nullifier construction, and what each of them cannot do.