What's encrypted
Pool-wide aggregates are public by necessity — the money sits in a real yield venue and a real lottery, where its size is visible regardless. Every per-user quantity is not.
What's encrypted
Zama FHEVMPool-wide aggregates are public by necessity — the money sits in a real yield venue and a real lottery, where its size is visible anyway. Every per-user quantity is not.
| Quantity | On-chain | Readable by |
|---|---|---|
| Your deposit amount | euint64 ciphertext | only you |
| Your pool balance | euint64 ciphertext | only you |
| Your odds (ticket range) | two euint64 ciphertexts | only you |
| The winning ticket | euint64 ciphertext | nobody |
| Who won, and how much | select(hit, prize, 0) | only you |
| Your withdrawal amount | euint64 ciphertext | only you |
| Pooled totals, prize size | plaintext | everyone |
The three moments something becomes public
Every plaintext this protocol ever produces, and the reason each one is unavoidable.
A draw needs a plaintext modulus, and the principal sits in a public venue anyway. Deposits between two closes hide inside the batch.
The sum, never its composition.
Never by whom. The anonymity set is everyone who claimed — which is why claiming is cheap and rational for all.
Never decrypted, by anyone
no key path existsThese handles receive FHE.allowThis and nothing else. The contract can compute on them homomorphically; no party — you, the keeper, governance, or Zama — can ever read them.
What still leaks
Amounts are hidden; participation and timing are not. That address X deposited, claimed or withdrew at time T is public. A pool with one depositor has no anonymity set at all, and correlation over time is a real attack on a thin pool. Claim gas also scales with how many ticket ranges you hold — never with whether you won.
Your Megapot allocation is public on purpose. Anyone can read that you chose 25%; nobody can read 25% of what. It has to be plaintext because the yield split is computed from the two tracks' public ticket totals, and that ratio is the only thing keeping the split fair between depositors who opted in and those who did not. It snaps to quarters so a choice lands in a bucket shared with other people rather than becoming a fingerprint — but if you are the only one who changes allocation between two round closes, the movement in the Megapot ticket total is yours, and the percentage is known, which narrows your balance. Change it in company, not in isolation.
The wrap boundary is public. Turning USDC into cUSDC, and back again, is an ordinary ERC-20 transfer of a visible size. Encryption protects the ledger between those two edges, not the edges themselves — so wrapping exactly what you deposit, or unwrapping a large amount shortly after a win, links the two.