Shield, send, withdraw

Your shielded key

The first time you open the app, one wallet signature derives your shielded key in the browser (domain string lethe.fi shielded key v1). It sends no transaction and costs no gas. Wallets that sign deterministically give the same key on every browser, so your notes come back on another machine.

Shield

You choose HYPE or USDC and an amount. Your browser builds a Groth16 proof over the note, and your wallet sends one transact transaction. USDC needs one approve first, since the pool pulls it with transferFrom. A shield costs only gas, about a cent at today's prices.

Send inside the pool

Paste a shielded address and an amount. The proof spends up to two of your notes and creates two: the recipient's and your change, in a random order. The relayer sends it, so no wallet signs. The chain sees two nullifiers and two commitments. You can seal a message of up to 64 bytes in the note, and every note is padded to the same size whether it has one or not.

Withdraw

You name any address. The proof binds the recipient, the amount, the relayer and its fee, so nothing can be changed on the way. The relayer sends it and pays the gas, and for USDC it forwards a little HYPE so the new wallet can pay for its next transactions. The pool's withdrawal is an in-chain transfer and settles in a block.

Moving coins out of Elysium to HyperEVM is a separate step through the rollup and takes about 6 days. It has nothing to do with Lethe.

How notes are found

Every note is encrypted to its owner's shielded key and published with its commitment. Your browser reads the commitments and tries to decrypt each one with your key. Scanning the chain from a browser does not work here (recent log queries are capped at 10,000 blocks), so a small indexer keeps the list of commitments. Your browser rebuilds the tree and compares the root with the one on chain before it proves anything, so the indexer is trusted for availability only.