Lowkey
Open

Spec

Lowkey is a private trading workspace on Solana mainnet. This page covers how it works, which parts are post-quantum and which are not, what stays private, and how to check a proof without trusting this website.

How it works

  • Vault. A random seed created in your browser. Every key Lowkey uses (pool spending key, identity key, burner accounts) is derived from it.
  • Shield. Your connected wallet deposits SOL, USDC or USDT into the Cloak shielded pool. The funds become private notes only your vault can spend.
  • Send. Private transfers inside the pool to another Lowkey private address. The relay submits the zero-knowledge proof, so your key never signs it on chain.
  • Trade. Shielded swaps spend private SOL notes directly: the relay routes them through Jupiter and the tokens land in a fresh burner or your Q-Vault. Selling swaps on the burner and shields the SOL back.
  • Flex. The attestor checks you control the accounts you include, reads their swap history, and signs the metrics you chose to show.

Vault and keys

  • The seed is encrypted with your passphrase using PBKDF2-SHA256 (600,000 rounds) and AES-256-GCM, and stored in this browser only.
  • The recovery key starts with lowkey1 and has a checksum, so typos are caught. Restoring it with a new passphrase brings back the same balance, burners and handle.
  • Lowkey never receives your seed, passphrase or recovery key. Clearing browser data deletes the vault. Funds stay on chain, and only the recovery key gets them back.
  • Your wallet pays deposits and signs relay authorizations. It does not derive or restore the vault.
  • Unlocked keys live in memory and are wiped when you lock the vault or close the tab.

Shielded swaps

A shielded swap never touches your wallet. Your vault proves ownership of private SOL notes with a Groth16 proof built in the browser, the Cloak relay submits it and pays the gas, the pool routes the SOL through Jupiter, and the output lands in a brand new account derived from your vault.

  • On chain, an onlooker sees a pool swap of that size and a new account receiving tokens. Nothing links either to your wallet.
  • Split mode breaks one order into up to four uneven legs, each into its own burner, with random gaps between them, so sizes and timing are harder to match.
  • If a swap times out, the pool refunds the principal as a private note your vault can find again from its keys.
  • USDC and USDT inputs, or a paused pool swap, fall back to the burner path: a private withdrawal into a burner that swaps on Jupiter itself.

Post-quantum

A large quantum computer running Shor's algorithm breaks elliptic-curve keys like Ed25519 and X25519. Lowkey puts everything it controls on NIST post-quantum algorithms, always paired with a classical one so a flaw in either alone does not break it.

  • Identity. Your handle has an Ed25519 key and an ML-DSA-65 (FIPS 204) key, both derived from your vault. Every registration and request carries both signatures and the server requires both.
  • Proofs and badges. The attestor signs every record with Ed25519 and ML-DSA-65 over the same canonical bytes. Proof pages verify both in your browser.
  • Sealed requests. Proof and badge requests contain your addresses, so they are encrypted in the browser with X25519 plus ML-KEM-768 (FIPS 203) to the attestor's published key. Only the attestor process can open them.
  • Transport. The site negotiates the X25519MLKEM768 hybrid key exchange in TLS 1.3.
  • Vault at rest. AES-256-GCM. Grover's algorithm halves symmetric key strength, which still leaves 128-bit security.
  • Not post-quantum. Solana transaction signatures (Ed25519, every account including burners) and the Cloak pool (Groth16 over BN254, X25519 note encryption). Q-Vault is the answer for holdings.

Q-Vault

Q-Vault is a Solana program that holds SOL and tokens behind Winternitz one-time signatures: 34 keccak hash chains of 256 steps. Hash-based signatures do not depend on elliptic curves, so Shor's algorithm does not apply. Each spend reveals one key and the vault rotates to the next, so a key is never used twice. Keys derive from your vault seed, so the recovery key restores them. The program is built and tested and goes live once it is deployed on mainnet.

Privacy model

Lowkey makes you harder to follow. It does not make you invisible.

  • Private sends hide the amount and recipient from anyone reading the chain.
  • Deposits are public: wallet, token, amount and time. Withdrawals publish the recipient, token, amount received and time.
  • Swaps are public, from burner accounts that have no on-chain link to your wallet beyond the pool.
  • The Cloak relay registers a viewing key for sanctions screening. It can decrypt your notes and see vault activity linked to the funding wallet.
  • RPC requests go through Lowkey's proxy to an upstream provider, which can see request metadata. Cloak and Jupiter receive requests from your browser.
  • The pool is young. Timing and matching amounts can still link a deposit to a withdrawal. Split amounts and wait between moves.

Fees and limits

  • Shield: no pool fee. Minimum 0.01 SOL, 1 USDC or 1 USDT.
  • Private send: no pool fee.
  • Withdraw: 0.30% plus 0.005 SOL, or 0.45 USDC/USDT, plus network fees. The app reads live pool config and says when it falls back to these values.
  • Shielded swap: the pool's live swap fee plus Jupiter routing, no Lowkey fee. The burner path needs a little extra private SOL for network costs.
  • Proofs: free, one every two minutes per handle, up to 10 addresses.

Proof of alpha

A proof is a signed statement, not a zero-knowledge proof. The attestor verifies a signature from every included address, reads its swap history for the period, computes the metrics and signs only what you chose to show.

  • Periods: 7, 30 or 90 days, or all history (capped by scan limits).
  • Metrics: return, win rate, max drawdown, trades, average hold time and realized PnL. Each one is exact, a range, or hidden. Hidden metrics are left out of the record entirely.
  • Return is realized PnL over capital deployed, valued in SOL, using average cost per token. Realized PnL in USD uses the SOL price at signing.
  • The public record holds the handle, period, address count, a salted commitment to the addresses, the metrics and the signature. Addresses are dropped after signing.

Verify a proof

Every proof page checks both signatures in your browser. To check them yourself, fetch the record and the attestor keys, rebuild the canonical JSON without the sig and sigPq fields (keys sorted, no whitespace) and verify the Ed25519 and ML-DSA-65 signatures.

const { attestation: a } = await (await fetch("/api/alpha/<id>")).json();
const { publicKey, pq } = await (await fetch("/api/alpha/attestor")).json();
const { sig, sigPq, ...body } = a;
const msg = new TextEncoder().encode(canonical(body)); // sorted keys
ed25519.verify(bs58.decode(sig), msg, bs58.decode(publicKey));
ml_dsa65.verify(b64(sigPq), msg, b64(pq.mldsa65)); // see the wire format in lib/shared/pq.ts

A valid signature proves Lowkey's attestor vouched for those numbers. It does not prove the math independently, so you are trusting the attestor's calculation.

Holder badges

  • Prove token holdings across linked wallets and burner accounts. Tokens inside the private pool do not count.
  • Tiers: Bronze 250k, Silver 1M, Gold 5M, Obsidian 20M tokens.
  • A badge lasts 7 days. The tier, address count and expiry are public. The wallets are not.
  • Badges open once the token is live. Until then the app says so.

Risks

  • No independent audit of Lowkey or the Cloak pool has been published.
  • The pool program has a Squads multisig upgrade authority, so upgrades can change how it behaves.
  • Proof circuits come from a public multi-party ceremony, and the SDK checks the circuit file hashes before use.
  • Lose the recovery key and the browser data together, and nobody can help you get funds back.