Confidential prime brokerage for tokenized equities on Solana.
Shield positions, require threshold approval, settle privately, and disclose only to an authorized audit quorum.
Warning
Kakure Prime is a pre-release research prototype. It is unaudited, uses development proving parameters, and is intended only for localnet/devnet demonstrations. Do not use it with real funds or securities.
| Experience | Link |
|---|---|
| Live product | kakure-prime.vercel.app |
| Kakure Wallet | Download the browser extension |
| 60-second judge walkthrough | Launch guided demo |
| Finalized Devnet lifecycle | Inspect deposit → private 3-of-5 settlement → withdrawal |
| Pitch video | Watch the pitch |
| Technical walkthrough | Watch the technical demo |
| Stocklana submission brief | SUBMISSION.md |
| Build/originality disclosure | STOCKLANA.md |
The fastest judging path is: inspect the 9/9 real private E2E evidence, watch the proof-first pitch, then open the guided demo for the sponsor integrations and product narrative. Every finalized transaction and verifier program shown in the pitch links directly to Solana Explorer.
Tokenized equities are programmable, global, and fast—but their ownership graph is public. A fund that accumulates a position reveals its strategy. A company that distributes equity reveals recipients and amounts. A multisig protects keys, but still publishes the signer set, threshold, balances, and every movement.
Kakure Prime gives funds, DAOs, family offices, and global teams a confidential settlement layer:
- Shielded positions: amounts, assets, recipients, and signer structure are hidden behind commitments.
- Threshold custody: dealerless FROST DKG creates a configurable
t-of-nportfolio; no single signer holds the custody key. - Private settlement: Groth16 proofs enforce ownership, value conservation, and quorum approval on-chain.
- Selective auditability: notes are additionally encrypted to a rotatable committee key, requiring an authorized quorum to disclose.
- Self-custody: proofs are generated by the user; the coordinator and indexer are not trusted with funds or plaintext positions.
| Surface | Status | Evidence |
|---|---|---|
| Noir circuits + Groth16 proving | 9/9 real E2E passing | Deposit → 3-of-5 transfer → recipient scan → withdrawal, with negative tests |
| Solana shielded pool | Real private path on Devnet | Pool · deposit · private transfer · withdrawal |
| FROST custody and encrypted coordination | Working | Dealerless DKG, threshold signing, encrypted relay |
| Token-2022 routing | Working in code/localnet | Asset-program validation and deposit/withdraw routing |
| PreStocks policy rail | Live in judge demo | Official API allowlist and ±15% token-to-mark mandate |
| Pyth settlement-risk rail | Live when entitled | Server-only broker; freshness and confidence enforcement |
| Meteora DBC | Traded on devnet | Pool · finalized buy |
| Hosted judge walkthrough | Live | Sponsor/deployment evidence is live; the five settlement clicks are intentionally simulated |
| Zero-install browser proving | Live devnet bundle | Deposit/withdraw use the real worker-based Go/gnark WASM prover with persistent artifact caching, prepared-circuit reuse, and a SHA-256-pinned development artifact bundle |
| Kakure Wallet extension | Working | Manifest V3 provider injection, encrypted local signer, 15-minute auto-lock, Devnet/Mainnet separation, explicit transaction review, real SOL broadcast, and Explorer handoff |
| Public Devnet lifecycle | Finalized and independently inspectable | Deposit, private 3-of-5 settlement, and withdrawal each link to their finalized Solana Explorer transaction; the evidence page also links the three matching Groth16 verifier programs |
The minimum cryptographic flow now runs end to end on public Devnet: real verifier CPI, dealerless FROST DKG, 3-of-5 settlement, recipient scanning, exact vault withdrawal, and three failure paths. The full seven-circuit suite also runs locally in about 130 seconds. The hosted walkthrough labels its guided clicks and links directly to finalized Explorer evidence.
- The official PreStocks API is the allowlist; no competing pre-IPO token is integrated.
- Contract addresses must be valid Solana keys and returned assets must satisfy the app's policy checks.
- Live token and mark prices feed a ±15% mandate; out-of-policy settlement is blocked before shielding.
- The selected official contract and policy decision remain visible to judges.
- Kakure discovers the canonical
Crypto.AAPLX/USDfeed. - An authenticated server-side broker keeps
PYTH_API_KEYout of the browser. - Settlement rejects prices older than 30 seconds or confidence intervals wider than 100 bps.
- If the account is not entitled to AAPLx, the app transparently uses live
Crypto.SOL/USDas a cross-market health gate rather than fabricating an equity price.
- Official SDK configuration with a 100 bps discovery fee decaying to the 25 bps protocol minimum over 24 hours.
- DAMM v2 graduation with 10% permanently locked migration liquidity.
- Real devnet configuration, receipt mint, pool, quote, and finalized buy transaction.
- The curve is intended for price discovery around a transferable receipt representing shielded equity exposure—not a generic memecoin launch.
flowchart LR
subgraph client[User-controlled client]
W[React app / CLI]
P[Native prover or browser prover]
K[Encrypted local keystore]
W --> P
W --> K
end
subgraph services[Untrusted, replaceable services]
C[Coordinator<br/>encrypted DKG + signing relay]
I[Indexer<br/>roots, paths, ciphertexts, nullifiers]
end
subgraph solana[Solana]
POOL[kakure_pool<br/>commitments + nullifiers + SPL vaults]
V[Groth16 verifier programs]
POOL -->|CPI verification| V
end
W <-->|encrypted envelopes| C
W <-->|public chain mirror| I
W -->|proof + public inputs| POOL
POOL -->|events| I
Funds are represented as UTXO-style notes. Each note commits to its asset, value, owner, randomness, and audit ciphertext. The pool stores only commitments, Merkle roots, and spent nullifiers. A valid proof shows that a spend owns an unspent note, conserves value, and—when group-owned—contains a valid FROST quorum signature.
The coordinator sees encrypted envelopes, session identifiers, and timing. The indexer sees public program events and encrypted note payloads. Neither service is trusted to authorize a spend or learn plaintext positions.
| Artifact | Address / transaction |
|---|---|
| Kakure pool | CTBujgpdNFHAYg9WGDWjgGa68AxYuT1TKQBkRYnv6cBf |
| Deposit Groth16 verifier | 21sN3juRFvjxBokrkB2tNisFpiRnpXTq42XrzbJ3XtxM |
| 3-of-5 transfer Groth16 verifier | CNoKnfajTr8XQXs4D84cy89C993KSn4bs5tXZ9Xmofwb |
| Withdrawal Groth16 verifier | 25pR3qcZynCSUxx7atAwahaCih6GeNzEt923YksuPMg4 |
| Finalized private path | Deposit → 3-of-5 transfer → withdrawal |
| Meteora DBC config | 8wqCNyoxQMUGRJwXngG2wxVLzqduTazi2nDjcuoCqbFT |
| Meteora pool | 58Hx2oENZDdiZHqsrxbZRNypMQKpt4rGbLGEXy8sTbcW |
| Shielded-equity receipt | Eqi8f5wf2fDWKriZUGC8qRS9ueYwhf37LDpZupaSbfJ8 |
| Finalized DBC buy | 57ro…1to |
The public pool routes circuit IDs 0, 3, and 2 to their matching deposit, 3-of-5 transfer, and withdrawal Groth16 verifier programs. The remaining four circuits in the full suite are local-only. The setup is unaudited and uses development parameters; never custody material assets here.
| Path | Purpose |
|---|---|
circuits/ |
Seven Noir circuits, shared constraints, KATs, and build pipeline |
programs/kakure_pool/ |
Native Solana pool, vault routing, commitment tree, nullifiers, compliance key |
programs/mock_verifier/ |
Explicitly test/demo-only verifier |
packages/sdk/ |
Notes, scanning, FROST/DKG, threshold decryption, transaction builders |
packages/prover/ |
Native witness generation, Groth16 proving, proof compression |
packages/prover-wasm/ |
Browser-prover build work and benchmarks |
packages/indexer/ |
Solana event follower, Merkle mirror, witness/nullifier HTTP API |
packages/coordinator/ |
Encrypted relay for DKG and threshold-signing sessions |
packages/helper/ |
Local native-prover bridge for the web treasury flow |
packages/cli/ |
Group, deposit, proposal, signing, execution, and audit commands |
apps/web/ |
React product, judge demo, treasury, claim, and audit surfaces |
tests-litesvm/ |
Program-level integration tests |
e2e/ |
Full localnet flow with real proofs and negative cases |
- Linux x86_64 or WSL2
- Node.js 22 and pnpm 10
- Rust, Solana CLI, Go, Noir, and Sunspot
- Approximately 8 GB RAM and 5 GB free disk
git clone https://github.com/unspecifiedcoder/kakure-prime.git
cd kakure-prime
bash scripts/bootstrap.sh
# Real local-validator protocol flow: DKG → deposit → private transfer → withdraw
just e2e-scenarioRun the web stack:
just helper-dev # native proving bridge; prints a short-lived bearer token
just web-dev # opens the React app on localhostPhantom connection requires Chrome or Brave with the Phantom extension enabled. The Codex in-app browser and other extensionless embedded browsers cannot inject Phantom.
pnpm install --frozen-lockfile
pnpm build
pnpm test
just build-circuits
just build-programs
just verify-programs-reproducible
just e2e-scenarioprograms/deploy/*.so contains the binaries loaded by the local validator. just verify-programs-reproducible rebuilds them in a scratch directory and compares SHA-256 hashes so stale or modified binaries are detectable.
- Note ownership and value conservation
- Nullifier uniqueness and double-spend prevention
- Threshold approval inside the multisig circuits
- Binding of public inputs to the proof
- Asset-program validation for SPL Token and Token-2022 routing
- Threshold-encrypted compliance payloads with committee-key rotation
- Development Groth16 setup parameters
- Unaudited circuits, programs, and Sunspot toolchain
- Four supplementary verifier circuits remain local-only
- A local helper for treasury-side proving
- A browser prover using development-only proving parameters
- The anonymity set of the active pool
- Deploy the three matching Groth16 verifier programs required by the minimum private path and route the Devnet pool to them.
- Deploy the four supplementary verifier programs that complete the seven-circuit suite.
- Execute and record a standard Kakure Wallet Devnet transfer with review, local signing, and finalized Explorer evidence.
- Execute and document the complete real private pool path locally: deposit → 3-of-5 proof-backed settlement → recipient scan → withdrawal, including replay/stale-root/insufficient-quorum rejection.
- Execute and record the complete private pool path on public Devnet: deposit → proof-backed 3-of-5 private settlement → withdrawal, with finalized Explorer links in the UI.
- Add GitHub Actions for workspace tests, web build, Rust tests, reproducible program binaries, and secret scanning.
- Obtain direct Pyth entitlement for the canonical AAPLx feed so the live gate no longer needs the disclosed SOL fallback.
- Add a real PreStocks asset settlement transaction, not only official catalog/policy enforcement.
- Exercise the DBC lifecycle through graduation/migration; evaluate mainnet only after security review.
- Audit Token-2022 extension combinations per supported asset and add property/fuzz tests.
- Add service health checks, RPC failover, metrics, alerts, and an indexer-lag indicator in the UI.
- Multi-party trusted-setup ceremony and independent circuit/program audit.
- Multithreaded browser proving and proof-artifact caching.
- Hardware-wallet testing, encrypted-backup import/recovery UX, auto-lock policy, and independent wallet security review.
- Scheduled distributions, multi-asset batches, policy templates, and accountant exports.
Kakure Prime transparently builds on Kakure, an Apache-2.0 project by the same author that predates Stocklana. The pre-existing foundation includes the base ZK circuits, FROST custody, pool program, SDK, and private-payment flow. Stocklana work adds Token-2022 equity compatibility, xStocks presets, the official-only PreStocks policy rail, the Pyth settlement-risk gate and server broker, the Meteora DBC receipt/configuration/pool/trade, hosted infrastructure, and the equity-focused judge experience. See STOCKLANA.md for the detailed disclosure.
Apache-2.0. See LICENSE.