Opaque

Demo

About

Opaque is a post-quantum private payments rail for USDC on Arc, built for the confidential-payments market. Current systems can hide a transfer while leaving the authorization key, payment timing, RPC activity, or IP origin exposed. Opaque addresses these leak paths together while providing post-quantum security end-to-end. Users control ERC-4337 smart accounts whose authority comes from FORS+C, a hash-based post-quantum signature scheme. Keys are generated and protected locally in the browser, while PQKeyRegistry and the account validator enforce key use, rotation, and bounded authorization on Arc. USDC is deposited and split into shared fixed-denomination pools—1, 2, 5, 10, 20, 50, and 100 USDC—so payments use interchangeable notes rather than a wallet-specific balance, which allows ring signatures to work. For a payment, the wallet forms an eight-member same-denomination ring: one owned note and seven real decoys. A hash-based MPC-in-the-head proof shows ownership of one eligible note without revealing which member was spent. A one-time nullifier prevents double spending, while the pool enforces real deposits, denomination, recipient binding, and post-quantum attestation before releasing funds. Opaque also protects the network layer. Wallet payments and wallet-specific RPC/Graph queries travel through a three-hop ML-KEM onion mesh with authenticated encryption, padding, batching, delays, and operator-diverse relays. The first hop sees the connection but not the request; the exit can submit the request but cannot identify its origin. The Graph is Opaque’s privacy coordination layer, the brain of the privacy mechanism. Its Arc subgraph indexes aggregate pool and relay conditions that help the wallet choose stronger decoys and better relay paths, so it allows the client to select the decoys while being network aware to provide stronger cover. A typed Graph Client composes this operational state with an independent standardized Arbitrum USDC context, and Privacy Sentinel exposes the combined public context through MCP. Finally, each payment can settle immediately or wait for stronger privacy conditions. The payer’s recipient, threshold, and latest-settlement deadline are sealed to a Chainlink CRE workflow running inside an AWS Nitro confidential environment. CRE releases the payment when the privacy policy is satisfied, or when the deadline arrives. Opaque therefore protects authorization, payment linkage, timing, and network origin as one coordinated, quantum-resilient settlement system.

How it's made

Opaque is a modular TS, Solidity, and Rust system. The web wallet and chrome extension use Vite and TypeScript, with shared packages defining notes, ring inputs, relay messages, sealed intents, and typed module interfaces. Arc contracts are developed with Foundry and use ERC-4337 v0.7 for smart account execution. The account layer replaces a conventional ECDSA owner with a FORS+C hash-based key. PQKeyRegistry stores the current-key commitment, next-key commitment, usage budget, and rotation state. PQAccount and PQValidator connect that authority to EntryPoint UserOperations. Key material is generated and encrypted in the browser; only commitments and bounded authorization state are published on chain. Rotation is pre-committed and accepted only under the current post-quantum key. USDC is held by shared denomination pools for 1, 2, 5, 10, 20, 50, and 100 USDC. The wallet decomposes deposits with a greedy denomination algorithm and submits the resulting notes in one account operation. Each note is represented by a commitment while its spending secret remains local. For a payment, the client selects one owned note and seven eligible same-denomination deposits, ranking candidates using freshness, reuse, activity, and coarse funding-concentration signals. The ring proof uses a hash-based MPC-in-the-head construction. It proves knowledge of one note-opening secret among eight commitments without revealing which signer was used. A one-time nullifier prevents reuse. The attested spend path then enforces real ring membership, denomination, nullifier uniqueness, recipient binding, and post-quantum authorization before the pool transfers USDC. The central design principle is that privacy is **network-adaptive**. The Graph continuously observes public conditions, and Opaque adapts as those conditions shift: the wallet dynamically re-ranks decoys as pool composition changes, while the mesh updates relay choices as reliability, occupancy, selection pressure, and operator diversity change. CRE uses the same versioned readiness signals to decide whether a payment can settle early or should wait until its deadline. Privacy is therefore not a static setting; every payment responds to the current network state. The network layer is a reusable anonymizing transport. Requests are wrapped in three ML-KEM-768 onion layers, encrypted with AES-256-GCM, padded to fixed sizes, batched, and delayed. The same mesh carries payments and wallet-specific RPC/Graph queries, creating cover traffic and preventing query patterns from trivially identifying payment intent. Six registered relays are available and three operator-diverse hops are selected per request. Large proof payloads are chunked, transported, reassembled, and integrity-checked at the exit. The Graph integration has two products. The Arc Subgraph Studio deployment indexes aggregate pool, ring, and relay events for the operational intelligence layer. A typed Graph Client composes that state with an independent standardized Arbitrum USDC source. Privacy Sentinel exposes the combined context through MCP so judges, agents, and developers can inspect the same public signals used by the system. The index publishes aggregates only; it never records a user’s selected note, final ring, route, recipient, or IP. Chainlink CRE runs the confidential release policy. Each payment’s recipient, credential, privacy threshold, and latest-settlement deadline are sealed to a CRE key. A scheduled workflow reads pending envelopes and public Graph aggregates, then decides `WAIT`, `RELEASE`, or `DENY`. Vault DON secrets hold compact seeds and MAC material, while the enclave derives larger cryptographic keys internally. The executor stores ciphertext, checks the released authorization, and submits the Arc settlement without being able to rewrite the sealed terms. "Hacky stuff" (more of creative) we did: - We turned Graph telemetry into a local Markov-chain route policy. Each relay is a state, and transition weights incorporate reliability, batch occupancy, recent selection pressure, and operator diversity. The wallet chooses the next hop dynamically from those weights, discouraging overused or correlated paths while preserving three-hop anonymity. This makes the relay mesh adaptive to live network conditions instead of relying on a static route list. - We turned the relay mesh into a general privacy transport by adding a `QUERY` message type, so wallet-specific Graph and RPC reads receive the same anonymity treatment as payments. - We packaged the Graph signal model as an aggregate-only Substreams module, making the privacy coordination layer reusable by other EVM pools and relay networks. Arc and Circle complete the money path: USDC is both the settlement asset and gas currency, while CCTP V2 provides Sepolia-to-Arc onboarding. Together, these components form a network-adaptive, post-quantum private payment system rather than a collection of isolated privacy features.