Pay the team. Publish no salary table.
Shielded grants, bug bounties, and contributor payouts on Starknet. Who receives and how much stays private, while the public legs stay honestly, verifiably public.
Flat pool fee per private operation right now: … - read live from the pool contract in your browser, never hardcoded.
shield → allocate privately → unshield
Cloakra settles organizational payouts inside the STRK20 privacy pool, so a bounty never doxxes the researcher and a team split never publishes the salary table - while every claim it makes stays checkable onchain.
Modules
Three modules, one set of rails
Shield and unshield are hash-proven on mainnet; private transfers and the atomic split ride the same wallet API against the same pool. Every operation is signed by your own wallet, never by a server.
StealthSplit
Team payoutsOne shielded balance split atomically into per-contributor balances. All transfers land or none do - and inside the pool, co-workers can't read each other's allocation.
GhostBounty
Security researchBounty payouts land in the researcher's shielded balance - the payout transaction names no recipient, no amount, and nothing linking them to your program.
StealthGrant
Grant roundsA whole grant round disbursed in one atomic transaction. Each grantee sees only their own award - the recipient list and per-grant amounts never appear onchain. Only the org's total deposit is public.
How it works
Shield once, allocate privately, unshield on your terms
Step 1
Shield
The org deposits STRK into the STRK20 pool. This leg is public - address and amount. From here on, activity inside the pool carries no readable link back to it.
Step 2
Allocate privately
Splits, bounties, and grants settle inside the pool as encrypted notes. Recipients, amounts, and the link to your org are unreadable - each recipient sees only their own balance.
Step 3
Unshield when needed
Recipients withdraw to a public address on their own schedule. The withdrawal is public; its link back to your deposit is not. Timing and amounts are visible, so patience is part of the privacy.
Why it holds up
Privacy without the hand-waving
Runs in your browser
No backend, no server keys. Every operation is signed by your own wallet, and Cloakra cannot read a shielded balance without the wallet's consent prompt.
No custom contracts
The pool's own batch call settles many transfers in one atomic transaction, so there is no bespoke Cairo to audit or trust - only the canonical STRK20 pool.
Fees read live, never guessed
The flat pool fee is read from the contract at render and re-checked at signing. It changed mid-sprint, which is exactly why nothing here hardcodes it.
Proof, not promises
The mainnet transactions in our submission file are re-verified against Starknet in your browser. A fabricated hash renders a red NOT FOUND.
Receipts an auditor can total
One signature per run commits every recipient and amount; each recipient gets only their own row. Drop a whole run on /verify and it verifies each row, totals what passes, and reports coverage.
Honest on both ends
Payers are warned when an amount echoes their own deposits. Recipients are warned when an unshield echoes another account's deposit, looks like an equal share of one, or lands in a quiet pool.
The problem
Every payout is a disclosure
A bounty payout doxxes the researcher
Pay a white-hat publicly and you've permanently linked their wallet - and often their identity - to the vulnerability they found.
A team split publishes the salary table
On a transparent chain, splitting a grant among contributors shows every teammate exactly what every other teammate makes.
A grant round exposes every recipient
Funding projects onchain broadcasts your entire allocation strategy - who, how much, and when - to competitors and attackers alike.
Who it's for
Built for organizations that pay people
DAOs & protocol treasuries
Pay contributors without publishing the whole compensation table onchain.
Bug bounty programs
Reward researchers without linking their wallet to the disclosure.
Grant programs
Fund a full round in one transaction without exposing the grantee list.
Open-source maintainers
Split sponsorship among maintainers without ranking them publicly.
Agencies & studios
Settle contractor payouts without revealing rates to every other client.
Anyone paying a team
The public legs stay public; who received what does not.
Full disclosure
What's private, what isn't
Cloakra never overclaims. The privacy is the broken link between deposits and withdrawals - not invisibility of the public legs.
| Private (inside the pool) | Public (onchain) |
|---|---|
| Who receives a split, bounty, or grant | The org's deposits into the pool (address + amount) |
| Per-recipient amounts | Any withdrawal to a public wallet (address + amount) |
| The link between payer and payee | That an address interacted with the pool, and when |
Submission proof
The mainnet transactions recorded in strk20.json - verified against Starknet in your browser right now, not claimed.
- checking…
- checking…
- checking…
- checking…
FAQ
Questions, answered
Where do my funds actually sit?
In the canonical STRK20 pool contract on Starknet mainnet, controlled exclusively by your wallet. Cloakra has no backend, holds no keys, and cannot move or see anything without your wallet's signature or consent prompt.
What does a private operation cost?
The pool charges a flat fee per private operation, and Cloakra reads it live from the contract - it was 6 STRK at last check, and it changed mid-sprint, which is exactly why nothing here hardcodes it. On shields the fee is deducted from the deposited amount.
What stays public?
Deposits into the pool (your address and amount), withdrawals out of it (recipient address and amount), and the fact plus timing of pool interactions. What's hidden is who received, how much, and the link between payer and payee. Every screen labels which side it touches.
What do recipients need?
A privacy-enabled wallet (Ready) with private tokens enabled - a one-time in-wallet registration whose flow deposits 6 STRK that the pool fee consumes. Dapp-initiated operations cannot trigger registration; the UI says so rather than failing cryptically.
Can Cloakra read my shielded balance?
Only through your wallet, only when you press the button, and only after the wallet's own consent prompt. Capability detection is a version query - the app never reads wallet data to feature-detect.
How does an accountant audit a private payroll?
With receipts. After a run settles, the paying account signs one statement committing to every recipient and amount; each recipient gets a file carrying only their own row. Drop a whole run's receipts on /verify and it verifies every row, checks the signature and settlement once, totals what passes, and reports coverage - receipts present against the count the org signed. It proves the attestation, never the shielded transfer itself.
When is it safe for a recipient to unshield?
Not right away, and not the exact row. Before an unshield opens the wallet, Cloakra reads the pool's recent public activity by every account and warns if the amount echoes another account's deposit, looks like an equal share of one, repeats your own earlier withdrawals, or lands in a quiet pool with a thin crowd. The pool's current crowd is shown on the dashboard so you can see it before you type an amount.
Why should I believe any of this?
Don't - verify. Three mainnet transaction hashes are recorded in strk20.json and re-verified against Starknet in your browser on this very page. A fabricated hash would render a red NOT FOUND. The repo's verify script additionally requires the transactions to have emitted STRK20 pool events.
