SABERENT PROTOCOL

Privacy with
clear boundaries.

PrivaPace is a confidential asset protocol being built on Arc. It lets people hold encrypted balances and transfer value without publishing internal transfer amounts.

Underlying tokens are held by vault contracts. A user’s spending and viewing keys stay with the user. PrivaPace’s operator does not approve individual transfers or hold the keys needed to spend a user’s balance.

Contract governance

The existing testnet deployment uses immutable contracts. New upgradeable deployments are separate and must display their governance terms in the app. Governance can change their contract code after at least 48 hours. A guardian can pause the protocol, including withdrawals. Keeping your keys does not remove this governance trust.

The app checks the configured implementations and governance settings before proofs and transactions. If they change, it stops until the deployment has been reviewed. These checks are not a security audit.

How it works

1. Connect and enable privacy

   Connect your wallet to the configured network, unlock your confidential account, and follow the wallet prompts. On first use, enabling your account also publishes its encryption key in a setup transaction. There is no website signup or password. Returning users only need to unlock.

2. Deposit a supported asset

   Choose an asset and approve its vault to receive tokens. Deposit the amount you choose. Deposits appear first as pending funds; make them available before sending or withdrawing.

3. Send privately

   Enter the wallet address of a recipient who has enabled confidential receiving for this asset, and an amount. Your browser builds a zero-knowledge proof. The vault checks the proof before updating the encrypted balances.

4. Withdraw to your wallet

   Choose an amount from your available balance. A valid withdrawal proof releases that amount of the underlying token to your connected wallet.

Each supported token has its own vault and accounting. Assets do not become interchangeable. Support is configured per deployment; arbitrary token deposits are not enabled.

Can a new wallet receive confidential funds?

Yes, through a private payment link. Choose Private payment link when sending, enter the intended wallet address and amount, and confirm the creation and funding transactions. The recipient does not need to visit the app first. Share the link privately with them.

Funds wait in a payment contract. The recipient opens the link, connects the intended wallet, enables their confidential account, and claims. The amount stays confidential. Claimed funds appear as pending in their account. The sender can refund an unclaimed payment after seven days. This is a claimable payment, not an automatic deposit into the recipient’s account.

Anyone with the link can read that payment’s amount. The link alone cannot spend it. Keep it private and retain it for any later funds sent to the same payment contract. Senders can recover links from Your created payments using the same wallet and account key. Creating a payment without confirming funding leaves an empty offer.

Direct confidential transfers still require the recipient to enable receiving once. Zama’s shared network encryption model supports a different experience. PrivaPace keeps individual viewing keys and uses claimable payments for wallets that have not enabled receiving. Issuer restrictions continue to apply and can block claims or refunds.

What is confidential?

PrivaPace protects the amount of an internal transfer and the encrypted balance held in a vault. It does not hide every detail of a transaction.

Public vaults are designed without a global auditor key. A separately configured disclosure policy must always be explicit. Earlier development deployments may have different disclosure settings; check a vault’s configuration before using it.

Public deposits, withdrawals, timing, and wallet activity can reveal patterns. Confidential amounts should not be understood as anonymous transactions.

Your keys & recovery

The vault holds tokens; your keys authorize spending. This distinction means that neither a website password nor an operator’s server can replace your confidential account key.

The app derives your viewing key from a signed message for your account, network and vault. During first use, it checks that your wallet reproduces that signature. You can download a password encrypted viewing key backup from the account panel and restore it on another browser without repeating the original signature. Your wallet still authorizes every spend.

Keep a separate backup for each account, vault and network. The file reveals these identifiers. Anyone with the file and password can read your private transfer history. Use a unique strong password, store it separately and test recovery. We cannot reset the password or replace a lost viewing key. Losing the backup and access to the original key can make funds inaccessible.

This recovery format is experimental and requires independent security review before public launch. Restore checks the key against the vault before unlocking your balance.

Signing and proof generation happen in your browser. Never send a wallet seed phrase or private key to PrivaPace or to anyone claiming to provide support.

Network & status

Network

Arc Testnet · 5042002

Release

Development

Production launch

Not live

Independent security review

Required before production

The application only enables transactions when a deployment is configured. It displays connected-wallet balances and contract data; it does not simulate deposits or successful transfers.

A PrivaPace operator indexes public events and monitors settlement. Arc’s consensus validators finalize the network’s blocks. Running a PrivaPace operator does not make it an Arc consensus validator.

Official contracts

These are the only PrivaPace contracts on Arc Testnet. Before you deposit, check that your wallet is sending to one of these addresses. Anyone can deploy look-alike contracts; an address that is not listed here is not PrivaPace.

• ConfidentialAssetVaultExplorerVerified source
  0x26e632294D526CF2C036C8427E3d1a21928D3ccA

  USDC confidential vault: holds deposits, verifies proofs

• AssetRegistryExplorerVerified source
  0xF175EfD8a1C83e3c63212CD31e1bCFf36d9b30D6

  Supported assets and verifier versions

• ConfidentialVaultFactoryExplorerVerified source
  0x75593C7616b60C40715970D789BAD7B2B0c78a66

  Creates vaults

• TransferVerifierExplorerVerified source
  0x2ed31e0D60d2Fdac9ae8FF1e9DAaD9b9198f00A1

  Groth16 verifier for confidential transfers

• WithdrawVerifierExplorerVerified source
  0x113310866372Ff6656Fe51FA8C91C6095e45C8d9

  Groth16 verifier for withdrawals

• RegisterVerifierExplorerVerified source
  0x2af44caF7a27A26b0b0DD7F57959d850443bb6e7

  Groth16 verifier for viewing-key registration

• ConfidentialPaymentFactoryExplorerVerified source
  0xebeBd48733abC499a98C680b674694E95C3c11c1

  Private payment links

Every contract’s source is an exact match on Sourcify. The proof keys come from a development ceremony and the contracts have not had an independent audit, so this deployment is for test tokens only. The same list, with bytecode and proof-file hashes, is published as machine-readable JSON.

Run an operator

Anyone can run a PrivaPace operator. It reads the vault’s public events from Arc, checks every block against the one before it, and can cross-check a second RPC provider. It holds no keys, sends no transactions and cannot approve, block or reorder a transfer. It is not an Arc validator and earns nothing.

Independent operators make history verifiable. Each one publishes a checkpoint: a hash of every indexed vault event up to a block. If two operators report the same checkpoint at the same block, they indexed identical history. If they differ, one of their data sources is wrong, and you can see it.

Operator scope

1d476532b385c493…

Checkpoint format

privapace-history-v1

First sync on public RPC

About 1–2 days

The operator runs with Docker and PostgreSQL. Setup, hardware and comparison steps are in the operator guide that ships with the source code.