Real-world value,
settled in the dark.
NoirRail shields tokenized treasuries, invoices, and credit on Stellar. Amounts and positions hide behind zero-knowledge proofs — openable on demand, in proof, to your auditor. A rail you can see through, but no one can see into.
↑ hover any shielded value to reveal it
Where tokenized real-world assets already live
The value moved on-chain. The privacy did not. Public ledgers leak strategy — so size retreats into walled gardens. Privacy is the unlock.
The primitive
Confidentiality and auditability, together.
The two properties institutions actually need but rarely get at once. NoirRail makes confidentiality a protocol property — not a platform one.
Shielded by default
Amounts and holder positions never touch the public ledger. The chain stores a Merkle root and a nullifier set — nothing legible.
Arbitrary value, bound on-chain
Not a fixed-denomination mixer. The deposited amount is recomputed into the note's commitment on-chain, so a note is worth exactly what was escrowed.
Recipient-bound
The payee is bound inside the proof. A watcher who copies a pending transaction cannot redirect the funds.
Auditable on demand
Viewing keys and selective-disclosure proofs let a holder prove a fact — “under the limit”, “approved set” — without revealing the figure.
In-browser proving
snarkjs runs in a Web Worker. The secret note, the witness, the keys — none ever cross the network boundary.
One pairing per settlement
A single Groth16 verification over BLS12-381, native on Soroban. Everything else is cheap bookkeeping over commitments and roots.
Shielded by default
Amounts and holder positions never touch the public ledger. The chain stores a Merkle root and a nullifier set — nothing legible.
The settlement path
A value is a note.
Spending it reveals only a one-time nullifier — never the note. Everything else is a Merkle proof of inclusion, checked in zero knowledge. The link between a deposit and a spend never appears on-chain.
No amount. No owner. No counterparty. Just commitments, a bounded root history, and spent nullifiers.
Deposit becomes a secret
A tokenized asset enters the pool. The holder posts a commitment; the balance vanishes from public view. Transparent at the edge, sealed thereafter.
Settle privately
Prove ownership of an unspent note and mint recipient notes. Amounts, sender, and receiver stay hidden; a nullifier prevents double-spend.
Exit in daylight, by choice
Prove a valid note and a bound recipient, then release to a transparent address. The one moment value re-enters the light — on your terms.
Deposit becomes a secret
A tokenized asset enters the pool. The holder posts a commitment; the balance vanishes from public view. Transparent at the edge, sealed thereafter.
Auditability without surveillance
The right party sees the right thing. No one sees everything.
Privacy a regulator can't inspect is a liability. Disclosure is mandatory by design — there is no master key, and no single party can unmask the rail.
| Party | Amount | Counterparties | History |
|---|---|---|---|
| Public / chain | hidden | hidden | hidden |
| Holder | full | full | full |
| Auditor (granted) | full | scoped | scoped |
| Counterparty | one tx | self only | hidden |
Questions, answered plainly
Frequently asked.
No. Disclosure is a first-class design goal, not an escape hatch. Holders grant viewing keys and produce selective-disclosure proofs so auditors keep a verifiable, revocable line of sight. NoirRail separates privacy from anonymity.
See for yourself
Settle a shielded value, right now.
Launch and move a position on Stellar testnet — amounts cyan and sealed, the proof generated in your browser, the settlement on-chain in seconds.