A lottery where
nobody loses.
Deposit USDC and keep it. Only the yield is played, so your principal is never at risk — and your balance, your odds and the winner stay encrypted on-chain.
How it worksOdds proportional to stake, with the stakes hidden.
The pool keeps one running cursor over a space of tickets. A deposit claims the next slice of it, so your odds are exactly your share — and because the cursor is a ciphertext, your slice never moves a number anybody can read.
What an observer actually sees.
On a transparent chain a prize-savings pool publishes every depositor's balance, every wallet's odds, and the winner of every draw. Here the same reads come back as ciphertext handles.
Every value on the right is an euint64 handle. Balances and ranges decrypt for their owner and nobody else. The winning ticket decrypts for nobody at all — not the keeper, not the deployer.
Only the yield is ever at stake.
Principal goes to work in a yield venue and stays yours. The surplus above it — and only the surplus — becomes the prize one depositor wins.
harvest() can only ever move what a venue earned above deployed principal, and it is permissionless. There is no code path that spends principal on a prize.The confidential ledger and the real jackpot.
Zama's FHE coprocessor does not exist on Base; Megapot exists nowhere else. So the encrypted ledger lives on Ethereum, the lottery position lives on Base, and Circle's CCTP joins them — with the destination fixed at burn time, so a keeper can delay the flow but never redirect it.
- Encrypted per-user ledger
- Encrypted ticket space
- The draw and the winner
- Buys tickets as a contract
- Claims winnings
- Sends proceeds home
Try the whole cycle on Sepolia.
Deposit, watch a draw, decrypt what you won, withdraw in full. The test assets are free, and the principal comes back whatever happens.