Security
What is private, from whom, and the limits we know about.
Who sees what (ramp mode)
| Observer | Sees |
|---|---|
| The public | The anchor paid Shield; Shield used the pool. Not the user's address, not who received what |
| The anchor | The user and the amount (it does the KYC) |
| Shield | Which account owns which keys (it is the ASP), and each intent |
| The auditor | Every note: owner and amount |
Protections
- Spending keys never leave the user's browser.
- Onboarding needs the account's SEP-53 signature over the exact keys.
- Starting a deposit needs the account's SEP-53 signature over the amount, and each signed request works once.
- Only the payment the anchor reports funds an intent; intent memos are random.
- The view key only reaches the auditor's process, never a browser.
- Operator, omnibus and auditor are three different keys.
- Logs never pair a user's address with an amount.
Known limits
- The anchor's payment and Shield's deposit share the amount and the time, so they can be linked (batching is next).
- In direct mode, the user signs their own transfers, so their account shows as a pool user (a relayer fixes it).
GET /v1/users/{account}is public: it tells whether an account uses Shield.- The asset issuer could enable clawback later; it is not
AUTH_IMMUTABLE. - Unaudited developer-preview contracts; the public RPC keeps about 7 days of history.
Full threat model: docs/threat-model.md.