Skip to main content
Four things sit between your app and a private balance. Only the first is something you write code against; the rest are things you rely on or verify.

​
The SDK

@cloak.dev/sdk is the integration surface for apps and wallets.
  • Exposes the UTXO flows: transact, transfer, partialWithdraw, fullWithdraw, swapWithChange, and transactBatch
  • Builds notes, generates the proof, and assembles the transaction
  • Sources Merkle proofs, handles stale-root retries, and maps errors
  • Includes the chain scanner and the compliance export helpers
Everything private happens here, on the client. See Cloak SDK.

​
The on-chain program

The shield pool is the verifier and state machine. It is the authority for everything that matters.
  • Mint-scoped pools, each with its own PDAs for the pool, treasury and Merkle tree
  • Enforces proof validity, root membership, nullifier uniqueness and transfer invariants
  • Collects the fee, from that pool’s own on-chain config — nothing else in the system charges one
  • Supports the direct transact path and the two-phase swap flow
See Shield Pool Program and Fee model.

​
The circuit artifacts

Proving needs the ceremony bundle, which is published and digest-pinned.
  • One transaction circuit, 2 inputs and 2 outputs, 9 public signals
  • The SDK fetches the bundle and verifies its digests before it proves, so a substituted artifact fails closed
  • The deployed program only accepts proofs from the verifying key it was built with
See Circuits, and Release notes to verify the digests yourself.

​
Your RPC

You bring your own Solana RPC and pass it as connection, built with createCloakRpc(rpcUrl). Cloak hosts none and requires no particular provider, and never inspects, replaces or proxies it.
  1. Platform Overview
  2. Transaction Flows
  3. Shield Pool Program
  4. Circuits