How OBSCURA works

A shielded pool on Base. What follows is the whole mechanism, in the order it happens.

The problem

Every chain built on Ethereum shares the same flaw: your wallet is a glass house. Anyone can open a block explorer and read your balance, every swap you made, every address you paid and every address that paid you. Send someone 20 USDC once, and they can read your financial life from that moment on.

Monero proved years ago that money can be private by default. But Monero lives on its own island — no smart contracts, no DeFi, no Base. OBSCURA closes that gap: a private room inside the chain you already use.

Private notes

When you shield, the pool does not credit a public balance. It creates a note: a commitment that only your key can open. The contract stores the commitment in a Merkle tree alongside everyone else's, and nobody can tell what any of them contains. 

note       = (amount, asset, lineage, ownerKey, blinding)
commitment = Poseidon(Poseidon(amount, asset, lineage, ownerKey), blinding)
tree.insert(commitment)

The tree is the anonymity set. Every note ever shielded — every asset, every owner — sits in the same tree, which is why each new deposit makes every older one harder to pick out.

Proofs and nullifiers

To spend a note, you do not reveal it. Your wallet builds a zero-knowledge proof that says, at once:

  1. these notes exist in the tree,
  2. I own them,
  3. they have not been spent before,
  4. and what goes in equals what comes out.

The contract checks the proof and records a nullifier — a one-time tag that prevents double spending without saying which note it belonged to. The note itself stays hidden, and so do the new notes the transaction creates. 

transact(proof, publicSignals, extData)
  require verify(proof)
  require !spent[nullifier[0]] && !spent[nullifier[1]]
  spent[nullifier] = true
  tree.insert(newCommitment[0..1])

Everything a relayer could want to change — the recipient, the amount leaving, its own fee, the ciphertexts — is hashed into the proof. A relayer that edits one byte produces a transaction the pool rejects.

Stealth addresses

Taking a page from Monero, you publish one OBSCURA address and never reuse an address on chain. Every note created for you is sealed to a fresh ephemeral key derived from yours, so no two payments to the same person look related. Your wallet finds its own notes by trying to open every ciphertext the pool has emitted — a scan that happens entirely in your browser.

Association sets

Private does not have to mean opaque. An association set is a published list of deposits that a provider considers in scope. When you spend, your proof also shows that the deposit your funds descend from is inside that set — without revealing which deposit it is.

Honest users keep their privacy and the pool stays clean. The set lives in its own contract, it can only ever be a filter, and the pool accepts the last sixty-four sets published, so a proof built a day ago still lands.

The escape hatch

A filter that cannot be escaped is a lock. So the pool has one more door: reveal which deposit a note descends from, and the pool pays it back — to the address that made that deposit, and to nobody else. No set is consulted, no fee is taken, and no one can refuse it.

That is the guarantee behind every other promise on this page: whoever every set leaves out can still walk out of the pool on their own.

xXMR

xXMR is Monero itself, on Base, one for one. The reserves sit in Monero wallets whose view keys are published, so the balance behind the token is something anyone can read on Monero. The contract enforces it: the supply can never exceed the reserve that was last attested, and nothing can be minted against an attestation older than seven days. Redemption is never gated.

$OBSCURA

Fixed supply, minted once, no mint function and no owner. It does three things:

  • Fees. The pool charges a small fee on shielding and unshielding. It lands in the staking contract, in the asset it was charged in, and stakers split it. What stakers earn is what the pool collected — there are no fixed returns.
  • Relayers. Relayers submit transactions so a user's own wallet never appears next to their withdrawal. They stake OBSCURA to operate and earn the fee the user put inside the proof.
  • Governance. Stakers vote on supported assets, fee levels and association set providers, through a timelock.

What governance cannot do is written into the pool rather than into a vote: the fee has a ceiling of 1% in the contract, the address fees are paid to is immutable, unlisting an asset only closes deposits, and nothing can pause a withdrawal.

What it costs

Proving happens in your browser. The proving key is 22 MB, fetched once and then kept by the browser; a proof takes a few seconds on a laptop. Nothing about the witness ever leaves the tab.

Contracts

Everything is verified on Basescan. The circuits, the ceremony and the deployment scripts are the same ones the tests run.