Security model
Who can do what — and, more importantly, what nobody can do.
Trust model
| Actor | Can | Cannot |
|---|---|---|
| Solana program | verify proofs, move pool funds only as a valid proof directs, record spent notes | be bypassed — it's the only authority over pool funds |
| You | prove ownership of your notes, spend them, share a read‑only viewing key | forge a proof, spend someone else's note |
| Relayer | choose to submit a spend, pay gas, collect its fee | forge or alter a spend, steal funds, or learn your notes' contents |
| Murk's servers | serve public chain state, help you sync + submit | move, freeze, or read your funds; link your activity |
| Admin | pause the pool, set fees | touch your notes, mint unbacked value, read your balance |
Privacy isn't protected by hiding data from Murk's servers — it's protected by the cryptography. Amounts and owners live inside commitments and encrypted notes; spent‑note markers can't be linked to the notes they came from; the recipient's key is a private input to the proof, so it never appears on‑chain.
What this guarantees
- Non‑custodial. Only your keys can spend your notes. No operator can move or freeze them.
- Permissionless relaying. The relayer fee is paid to whoever submits the transaction, so anyone can run a relayer — you're never locked to one.
- No unbacked money. The program only ever moves funds that a valid proof accounts for.
- Always exit. Even under compliance revocation, an emergency exit returns your funds to you.
- Chain‑recoverable. Your funds and history can be rebuilt from the chain with just your wallet, even if every Murk server disappeared.
Honest limits
- Privacy grows with the crowd. Your anonymity comes from blending with other users' activity; a nearly empty pool offers less cover than a busy one.
- Endpoints are public by design. Veiling and revealing touch public addresses — that's inherent, not a leak.
- Network‑level metadata. Murk doesn't log identifying request data, but for full network‑level anonymity route your traffic through a privacy network (e.g. a VPN or Tor).