Program
The program has undergone an independent security audit, and the deployed bytecode is built from
the audited release.
Verifying key and circuits
The transaction circuit’s verifying key comes from the multi-party trusted-setup ceremonycloak-transaction-0.2.0 (6 named contributors plus a public final beacon). The circuit has 42,672
constraints and 9 public inputs.
Proving artifacts are published at
https://storage.googleapis.com/cloak-circuits/circuits/0.2.0/.
The older circuits/0.1.0 artifacts are no longer accepted; proofs built from them fail on-chain.
Verify it yourself
Fees and minimums
Fees are enforced on-chain by the program from a per-poolPoolConfig. Nothing else in the system
charges a fee.
Fees apply to withdrawals and swaps only. Deposits and private sends carry no protocol fee (network
fees only). Full breakdown: Fee model.
Compliance
- Deposits are risk-screened on-chain: a signed risk quote is bound to the deposit and checked by the program.
- Withdrawals and swaps use a signed withdraw authorization issued after off-chain screening; the withdraw authorizer is set per pool.
- Viewing keys let a user disclose their own history to an auditor. See Compliance.
SDK — current release 0.2.5
Published 2026-09-17. The program, the verifying key and the circuits/0.2.0 bundle did not
change with it; 0.2.5 is a client-side release.
- Built on
@solana/kit.connectionis aCloakRpcfromcreateCloakRpc(rpcUrl), addresses are KitAddressstrings, anddepositorKeypairis aKeyPairSigner.@solana/web3.jsis an optional peer dependency used by the wallet-adapter bridge. Migration table: Solana Kit integration. - Batch signing.
transactBatchruns N private spends behind one wallet approval. See Batch signing. - Bridging in. SDK surface for bringing USDC in from another chain. See Bridging in.
- One-signature SPL deposits. The opt-in
relaySupplementalAltoption means an SPL deposit that needs a supplemental lookup table asks the user to sign once instead of twice. - Removed in 0.2.5:
keypairToAdapterand theWalletAdaptertype.RelayAuthSigneris now a Kit signer, built withmessageSignerFromCallback.