Zero-knowledge private payment platform on Solana using Privacy Cash SDK
⚠️ IMPORTANT: ShadowPay is currently optimized for personal privacy savings, not P2P transfers.
See Current Limitations below for details.
ShadowPay is a non-custodial privacy layer that enables users to shield their SOL from public view using zero-knowledge proofs. Built on Privacy Cash SDK's UTXO-based encryption model.
How it works:
- Deposit: Your wallet signs a message to derive encryption keys
- Shield: SOL moves into Privacy Cash pool with ZK proofs
- Withdraw: Only you can decrypt and withdraw using your encryption key
- Privacy: On-chain observers see encrypted UTXOs, not amounts or owners
✅ Personal Privacy Balance - Deposit and withdraw to your own wallet with privacy
✅ Zero-Knowledge Proofs - Transactions verified without revealing details
✅ Non-Custodial - Your encryption keys derived from wallet signature, never stored
✅ Fee Transparency - 1% owner fee, clearly disclosed upfront
✅ Transaction History - Track your deposits and withdrawals
✅ Fast & Cheap - Solana blockchain: ~2 second finality, low fees
P2P Transfers NOT Supported - Privacy Cash uses encryption-key-based ownership.
- ❌ Cannot send directly to different wallet via Privacy Cash
- ✅ Alternative: Withdraw to public wallet → Standard Solana transfer
Single-Wallet Requirement - Must use same wallet to deposit and withdraw.
- Why: UTXOs encrypted with your wallet's encryption key
- Multi-device: Same wallet works across devices (uses localStorage)
Multi-Token Partial - SOL fully supported, other tokens in development
See STABILIZATION_SUMMARY.md for technical details.
- NON_CUSTODIAL_CHECKLIST.md - Security audit guide
- PRIVACY_CASH_SDK.md - SDK version & security
- STABILIZATION_SUMMARY.md - Recent changes & fixes
- FEE_SYSTEM_IMPLEMENTATION.md - Fee structure details
- Node.js 16+
- npm or pnpm
- Phantom wallet browser extension
- SOL for testing
npm install
# or
pnpm installcd backend
npm run devRuns on: http://localhost:8080
Environment Setup (.env in backend/):
NODE_ENV=development
PORT=8080
DATABASE_URL=sqlite:./db.sqlite
OPERATOR_SECRET_KEY=<your_keypair_as_numbers>
SOLANA_RPC_URL=https://api.mainnet-beta.solana.comcd frontend
npm run devRuns on: http://localhost:5173
- Open
http://localhost:5173in your browser - Click "Connect Wallet" and approve in Phantom
- Send Tab: Enter amount, select token, enter recipient address
- Receive Tab: View incoming payments
- History Tab: See all your transactions
- About Tab: Learn how privacy works
| Component | Tech | Purpose |
|---|---|---|
| Frontend | TypeScript + Vite + Tailwind CSS | UI, wallet connection, ZK proofs |
| Backend | Express + Node.js + Prisma | API, transaction management |
| Blockchain | Solana + Privacy Cash SDK | ZK proofs, shielded pool |
| Database | SQLite / PostgreSQL | Link & transaction storage |
SEND FLOW:
1. User enters amount, recipient, token
2. Frontend signs authorization message (Phantom)
3. Backend verifies signature
4. Backend executes Privacy Cash deposit
5. Recipient address is encrypted
6. ZK proof validates transaction
7. Funds added to shielded pool
✅ Recipient notified
RECEIVE FLOW:
1. Backend decrypts incoming payments
2. Shows "Available" for unclaimed payments
3. Recipient clicks "Claim" on payment
4. Withdrawal initiated from shielded pool
5. ✅ SOL received in wallet
| Endpoint | Method | Purpose |
|---|---|---|
/api/private-send |
POST | Send private payment |
/api/incoming |
GET | Get incoming payments (Available/Withdrawn) |
/api/history |
GET | Get transaction history |
/api/health |
GET | Health check |
shadowpay-/
├── frontend/
│ ├── src/
│ │ ├── app.ts # Application logic, tab management
│ │ └── flows/ # Privacy Cash integration
│ └── public/
│ └── assets/pay.png # Logo
│
├── backend/
│ ├── src/
│ │ └── routes/ # API endpoints
│ └── prisma/
│ └── schema.prisma # Database schema
│
└── README.md # This file
✅ No Private Keys in Frontend - Only message signing via Phantom
✅ Zero-Knowledge Proofs - Transaction validity verified without revealing data
✅ Non-Custodial - ShadowPay never holds your funds
✅ Encrypted Recipients - Recipient address hidden on-chain
✅ Open Source - Code is verifiable and auditable
cd frontend
npm run build
# Output: frontend/dist/Frontend (auto):
- Backend URL:
http://localhost:8080(development)
Backend (.env):
NODE_ENV=development
PORT=8080
DATABASE_URL=sqlite:./db.sqlite
OPERATOR_SECRET_KEY=<keypair>
SOLANA_RPC_URL=https://api.mainnet-beta.solana.com
✅ Working Features:
- Wallet connection (Phantom)
- Send private payments with ZK proofs
- Receive and claim payments
- Transaction history (10 items/page pagination)
- Incoming payments tab (5 items/page)
- About tab with privacy explanation
- Multiple token support
- Clean UI with 4-tab navigation (Send/Receive/History/About)
- Fork the repository
- Create feature branch:
git checkout -b feature/your-feature - Commit changes:
git commit -am 'Add feature' - Push to branch:
git push origin feature/your-feature - Submit pull request
MIT
- Privacy Cash: https://privacycash.io/
- Solana: https://solana.com/
- Phantom Wallet: https://phantom.app/
Questions? Check the About tab in the app for more details on how privacy works!