Gloam

Gloam

Private money on public chains. Private stablecoin payments for people, teams and AI agents: private by default, provable on demand.

gloam.trade · App · Verify a proof · Research report and deck · How Gloam compares · Docs · Whitepaper · @gloamtrade

Live on mainnet (beta): Robinhood Chain 4663 · Tempo 4217 · real ZK proofs, no mock fills

Stablecoins are becoming how businesses and AI agents pay each other, and every one of those payments is public. Gloam makes them private, and lets the payer prove exactly what someone needs to see: a balance above a figure, that a payment was made, or a payroll total, to one named reader, with an expiry. It is live on Robinhood Chain and Tempo mainnet, in beta with deposit limits. You can pay anyone privately, send money as a claim link, run payroll, swap straight from the private balance (who swapped stays private; the tokens and amounts are public, like any DEX trade), and cash out at once or privately in pieces over time.

Why one owner matters. Privacy splits into two jobs. Shared secrets (sealed auctions, order books, lending pools) need someone to compute on many people's hidden data, so FHE and MPC networks such as Zama and Arcium use a committee that holds keys. A payment has one owner, so the owner proves it on their own device with zero-knowledge proofs, and nobody else ever holds a key. If a committee or operator is breached, everyone can be exposed, past payments included. If one owner's device is breached, one person is. Gloam does not invent new cryptography: it uses the proven ZK maths of the Zcash lineage and builds the payments product on top. Full comparison with Zama, Arcium, Tempo Zones, Helius Privacy and Railgun: gloam.trade/docs/compare.

What is new

Gloam is not new cryptography. It is a new building block for finance: private payments you can prove. As far as our research found, three parts are new:

1. Payroll total proof. payroll_total proves a run of up to 32 payments adds up to exactly a total, all funded by the prover, without showing who got what. We found nothing like it.
2. Proofs scoped to one reader. The label (who the proof is for), expiry, chain and pool are hashed into a public context input bound into the solvency, receipt and payroll_total proofs. Change the label and the proof fails. Anyone can check one in a browser, with no wallet, at /verify. Viewing keys, the usual alternative, show a whole history and cannot be taken back.
3. Private payments for AI agents. A private payment method proposed for the Machine Payments Protocol from Tempo and Stripe (tempoxyz/mpp-specs#376; MPP had no private method), private x402 payments, and an MCP server that gives agents handles instead of secrets, with spending limits.

Not new: the private pool design (Zcash lineage from 2016, Tornado, Railgun, Cloak) and selective disclosure as an idea (Zcash and Railgun viewing keys, Privacy Pools, Zama decryption rights). One honest limit: a reader can still forward a proof. It says who it was for and when it expires, and a designated-verifier mode is next.

Three surfaces, one private core

The vault app is the reference implementation, not the whole product.

All three share one core: a Poseidon note scheme, a depth-20 incremental Merkle tree, circom witness builders, real Groth16 verification, and one canonical intent shape.

Mainnet beta

Gloam is live on Robinhood Chain mainnet (4663) and Tempo mainnet (4217) since Wednesday 21 October 2026, 13:00 UTC. This is beta software handling real money. It was reviewed internally before launch (20 October 2026, no Critical or High findings open), and an independent review on 23 October found no new exploitable contract flaw and eight app issues, whose fixes are being merged. An external audit is planned, not done.

• Fees. Deposits and private payments are free. Cashing out costs 0.25%. A private swap pays the same 0.25% on the amount swapped, plus a price buffer (0.5% on Robinhood Chain, 0.1% on Tempo) whose unused part goes to the treasury. Once fees move to their own treasury wallet (a change queued behind the public timelock), half of them buy back $GLOAM, half of that burned and half kept.
• Beta deposit limits. 500 per deposit and 25,000 in total for each stablecoin; $GLOAM 25,000 per deposit and 250,000 in total. Cash outs and private payments are never limited. Raising a limit or adding an asset waits a public 3-day timelock; the owner can lower limits or close deposits at once.
• Keys. Mainnet proofs use the final keys from the 13-contributor trusted setup (drand round 6561386, release ceremony-final).
• Partners. Raeto funds AI agents from a private Gloam balance, and Agent Wormhole checks an agent's payment request before it pays (MCP 0.4.0, optional).

Addresses are in Contracts below.

What works today (real ZK proofs)

Everything here runs on both mainnets unless the row says otherwise.

Every private action is proof-gated on-chain. No mock fills, no theatrical privacy. If a path cannot be both private and solvent yet, it waits. See contracts/audit/H1-SWAP-SOLVENCY.md.

Selective disclosure: private by default, proven by choice

The answer to the "dark pool" objection. A holder proves one fact about their money to one reader, and nothing else. Four proofs: gloambal1 (exact balance), gloamfunds1 (at least an amount), gloampay1 (a payment was made) and gloamroll1 (payroll total). Each carries a label naming who it is for and an expiry, both bound into the proof, and each is checked off-chain at /verify against the live vault, with no wallet. Make them at /app/disclose.

What they do not prove is said plainly on the verify page: a proof of payment shows a payment was made, not which side of it the holder was on, because notes do not yet bind a recipient key. The original gloamdisc1 format reused the deposit statement, so anyone could copy one from public deposit data; it is retired and never verifies.

Robinhood Chain native

Robinhood Chain is an Arbitrum Orbit L2 (Nitro, mainnet live since July 2026), ETH gas, Ethereum blob DA. Gloam targets what the chain actually ships:

• Chainlink oracles from block zero. RH Chain prices tokenized equities on-chain via standard AggregatorV3 feeds. Gloam's OracleRates module binds sealed-trade rates to the live feed with L2 sequencer-uptime, staleness, and positivity guards, and a ratio-tolerance check that is also on-chain slippage protection. Built and tested (contracts/src/lib/OracleRates.sol) for the sealed trade, which is retired. Private swaps take the DEX pool's own price.
• Tokenized stocks are ERC-20s (18 decimals, ERC-8056 Total-Return value). Deposit limits for stock tokens and other liquid Robinhood Chain tokens are queued behind the 3-day timelock; once they execute, private swaps can buy them into the vault.
• Groth16 runs native. bn254 pairing precompiles are present and the 96 KB code-size cap fits large verifier contracts, so shield / unshield / transfer proofs verify with no special infra.
• First-class ERC-4337 opens the door to gasless private transactions.

Live on Tempo

The same private core runs on Tempo mainnet (4217), the payments-first stablecoin L1, as private stablecoin payments for people and agents. Tempo ships its own operator-run privacy (Zones); Gloam is the self-custodial, permissionless complement, with selective disclosure a user can hand an issuer or auditor. Shield USDC.e, pathUSD, USDT0 or OUSD, send, swap and cash out, proof-gated end to end. Because Tempo blocks native msg.value and pays gas in stablecoins, Gloam shields ERC-20 stablecoins there instead of a native asset. Design and constraints: TEMPO_EXPANSION.md.

Trust, verified

Privacy has to be checkable and correct before it holds real money. Mainnet is beta software handling real money, and this is where it stands.

• Where review stands. An internal pre-mainnet review finished on 20 October 2026 with no Critical or High findings open. An independent review on 23 October found no new exploitable contract flaw and eight issues in the app (amount entry, saving notes, payroll resume and addresses, API key rotation, and two displayed figures), and the fixes are being merged. An external audit is planned, not done. Until then, beta deposit limits cap what each pool can take in.
• Earlier reviews. Kensho reviews of the contracts and an independent review of the circuits (latest 2026-10-11) found no way to steal, inflate, double-spend or redirect pool funds. What they did find is fixed or switched off: an earlier critical drain in the first sealed pool (drained and de-published), value binding at deposit (C1), swap solvency (H1, the sealed trade is retired), an overclaiming proof checker and a copyable legacy disclosure. Every finding and its status: contracts/audit/REMEDIATION.md.
• No admin withdraw, timelocked rule changes. There is no function the team can call to take pooled funds, and notes leave only through an unshield proof. The mainnet pools end setup in the same deploy run that creates them (endSetup()), so a new verifier, a raised deposit limit, a new asset or a higher fee must be queued on-chain and waits a public 3-day delay before it can run (queueChange). Lowering a limit or closing deposits works at once. Verify setupMode() == false on the pools listed below.
• Selective disclosure, not a mixer. Prove balance or a payment to a counterparty or auditor without revealing everything. The right posture for a regulated-sponsor chain.
• Fast vault sync, same privacy. The app loads the vault's public leaf list (every commitment, in order) from /api/vault-leaves in one request instead of walking the chain, rebuilds the Merkle tree in the browser, and uses it only if the root matches the pool's on-chain root; otherwise it reads the chain itself. The request names only the network and is the same for everyone, so the server never learns which notes are yours.
• Honest gates. Mainnet runs on the final keys from the multi-party trusted setup (13 contributors, drand round 6561386, release ceremony-final): the deploy script refuses to create a pool unless the verifiers on chain accept final-key proofs and reject dev-key ones. At launch the owner wallet also receives cash-out fees; a move to a dedicated treasury wallet is queued behind the timelock, and a multisig is planned. The Gloam team runs the relayer: it only submits already-proven transactions and pays gas, and cannot move or redirect money. Note secrets and the receive key are encrypted at rest (AES-GCM under a non-extractable device key, or wrapped by a passkey PRF), audit M-1. A payment someone sends you is moved into a fresh note only you know as you claim it, so the sender cannot spend it back.

Using the SDK

Deposit privately into the pool in a few lines. The SDK mints the note and generates the shield proof; you sign the resolved call. This deposits USDC.e on Tempo mainnet (@gloamtrade/sdk 0.2.2):

import { mainnetNetwork, buildShieldBoundIntent, artifactProver, circuitArtifactUrls, TEMPO_USDCE } from "@gloamtrade/sdk";

const net = mainnetNetwork("tempo")!;
const intent = await buildShieldBoundIntent({
  chainId: net.chainId,
  poolAddress: net.pool,
  asset: TEMPO_USDCE,
  amountWei: 25_000_000n,                    // 25 USDC.e (6 decimals); beta cap is 500 per deposit
  prover: artifactProver(circuitArtifactUrls("shield", net.chainId)),
});

// intent.exec is the resolved shieldBound(asset, amount, commitment, proof) call.
// The wallet approves the pool for the amount first (the pool pulls the token with transferFrom).
// Persist intent.note.secret to spend the balance later.
await wallet.writeContract({ ...intent.exec, abi: shieldPoolAbi });

• Pass a mainnet network explicitly: for backward compatibility the SDK still defaults to the practice testnet. getGloamNetwork(key) takes "robinhood-mainnet" or "tempo-mainnet", and circuitArtifactUrls picks the final keys for a mainnet chain.
• To take payments, scanIncomingPayments reads the payment board for payments sealed to your Gloam address, and sweepReceivedNote moves each into a fresh note so the payer cannot spend it back. See packages/sdk/examples/receive-and-credit.ts.
• cashOutFee(amount) returns what the pool keeps on a mainnet cash out (CASH_OUT_FEE_BPS = 25, 0.25%).

Runnable examples are in examples/: an agent that shields (agent-shield), a pay bot, private x402 and MPP payments, and a web shield. Start a new app with npx create-gloam-app.

Architecture

gloam/
  packages/sdk/          @gloamtrade/sdk  the private path as a reusable package
  packages/mppx-gloam/   private payment method for the Machine Payments Protocol
  packages/create-gloam-app/  starter for a new app on the SDK
  mcp/                   @gloamtrade/mcp  agent server (plan + signed execution)
  examples/              agent-shield, pay-bot, pay-x402, mpp-gloam, web-shield
  app/                   Next.js reference app + docs → Vercel root: app
  contracts/             Foundry · ShieldPoolPayments (mainnet) and ShieldPoolPoseidon (practice network) vaults, verifiers, circuits, audit

Contracts: Robinhood Chain mainnet 4663

Contracts: Tempo mainnet 4217

On both mainnets: deposits and private payments are free, and a cash out costs 0.25%. The pools run on the trusted setup's final keys; read the verifiers from the pool (verifier(), shieldVerifier()).

Circuits (Groth16 on BN254, Circom 2.1.6, Poseidon, depth-20 Merkle membership): shield, transfer, unshield and sealedSwap (retired) for the pool, plus solvency, receipt and payroll_total for the off-chain proofs. Constraint counts and key sets are in contracts/circuits/README.md.

Local

pnpm install
pnpm --filter @gloamtrade/sdk build        # build the SDK
cd contracts && forge test            # contracts
pnpm --filter @gloamtrade/sdk test         # SDK core self-tests

Run the reference app from app/ (next dev), or open gloam.trade/app.

Practice network

Robinhood Chain testnet (46630) and Tempo Moderato (42431) stay up as a free practice network: the same app (switch networks in the app), test funds, no real value. Get testnet ETH and stock tokens from faucet.testnet.chain.robinhood.com, and test stablecoins (PathUSD and friends) from the Tempo faucet (tempo_fundAddress). The testnets run on single-contributor dev keys, fine for test funds only. On the Robinhood Chain testnet you can also shield ETH and hold and send stock tokens (TSLA, AMZN, PLTR, NFLX, AMD) privately; neither is a mainnet pool asset. The SDK and MCP default to the Robinhood Chain testnet for backward compatibility (GLOAM_NETWORKS.robinhood and .tempo are the testnets).

Contracts: Robinhood Chain testnet 46630

Contracts: Tempo Moderato testnet 42431

Earlier testnet pools are superseded and listed in contracts/ARCHITECTURE.md; the pre-C1 Robinhood Chain pool 0x4F38… is drained and retired, never use it.

Guardrails

• Mainnet is beta with real money: deposit limits on, reviewed internally, external audit planned. Say so plainly.
• The sealed trade stays retired. Private swaps are live on mainnet: always say the tokens and amounts are public.
• Real privacy only. Never fake or mock a private success.
• Selective disclosure over opacity. Verifiable, not just hidden.
• Brand: monochrome with a green tint (#2e7d53 light, #8fd3ad dark), Aeonik, light and dark. Calm, spacious, plain-language.

No private keys in-repo. Deploy with DEPLOYER_PK env only. Mainnet uses the trusted setup's final keys (app/public/circuits/final); the practice network's keys are dev artifacts. See SECURITY.md.

Contact: hello@gloam.trade · @gloamtrade · Telegram t.me/gloamhq. Found a security issue? See SECURITY.md.