Getting started

Architecture

Cowl is a set of contracts and services on Robinhood Chain that let you hold and trade tokenized stocks with your book shielded from the public ledger — while keeping the ability to disclose, on your terms.

The big picture

  you ── app / CLI / SDK
        │  signed ZK proof
        ▼
  Gasless Relayer ──────────► ZK Shielded Pool ──► On-chain Verifier
        (pays gas)                  │  ▲
                                    │  └── Compliance Screen (deposits)
                                    │
        view key ──► auditor        ├── Fee Collector ──► stakers / burn / treasury
        unshield ──► stealth addr   └── notes: commitments + nullifiers
                       Robinhood Chain · Arbitrum L2 · settles in USDG

Components

Component	Role
Shielded pool	Holds private notes; deposits, private trades, and withdrawals settle here.
Verifier & circuits	Checks the zero-knowledge proof for every state change on-chain.
Relayer network	Pays gas and broadcasts your shielded transactions so no wallet points back at you.
Compliance screen	Screens funds at the boundary so tainted assets never enter the pool.
Fee collector	Routes protocol fees to stakers, buyback & burn, and the treasury.
$COWL staking	Secures the relayer and prover set; distributes protocol fees to stakers.

Data model

Notes. Value in the pool is held as private notes, not account balances.
Commitments. The chain stores a commitment to each note — never the amount, asset, or owner.
Nullifiers. Spending a note publishes a nullifier that prevents double-spends without revealing which note was spent.

Trust boundaries

Your keys stay on your device. No service can move your funds.
A relayer can drop a transaction, but never read amounts or deanonymize you.
Disclosure is opt-in and scoped — there is no switch that makes an account public.

Where the pieces live

Contracts and circuits are open source under the Cowl-Protocol org. See the security model for the guarantees each component makes.