Security

Trust model

A privacy protocol earns trust by naming exactly who can do what. Here is Cowl’s answer: what no one can do, what the team can still do and the walls around it, and the path that ends with no one holding anything.

What no one can do

  • Touch your funds. Notes move only with a valid ZK proof from your keys. There is no admin path to freeze, seize, or redirect a note — the contract has no such function to call.
  • See your positions. Amounts, assets, and owners are inside the proofs. Not the team, not a relayer, not the sequencer — nobody reads a shielded balance without your view key.
  • Mint value from nothing. The pool enforces per-token value conservation on chain, independent of the proofs: it never pays out more of a token than was ever deposited. Even a broken verifier hits that wall.
  • Gatekeep participation. Shielding, spending, and running a relayer are permissionless. No allowlist, no accounts, no API keys.

What the team can do — and the walls around it

One power exists: the pool’s owner can replace a proof verifier. It exists for one reason — if a circuit bug is ever found, an immutable pool with no swap path could never be fixed, only abandoned. The power is fenced in three ways:

FenceWhat it means
Seven-day timelockA swap is proposed on chain and waits a week before it can execute. Anyone who distrusts it has that week to withdraw — the pool cannot stop them.
Value-conservation capEven a malicious verifier cannot withdraw more of a token than the pool ever received. The blast radius is bounded by design.
RenouncementOwnership can be renounced, permanently. After that the verifiers are frozen and the swap power ceases to exist — mathematically, not as a promise.

What Cowl inherits

Cowl settles on Robinhood Chain, an Arbitrum-based L2, and inherits its trust model: the sequencer orders transactions and could delay or censor them. What it cannot do is read a shielded balance or move pooled funds — the proofs and the conservation cap hold regardless of who orders the blocks. Choosing the chain where the users and liquidity are is a deliberate trade, made with eyes open.

Relayers

A relayer’s only power is to ignore you. The proof binds the recipient, the relayer, and the fee before it leaves your machine, so a relayer can submit your spend exactly as proven or not at all — never redirect it, never overcharge it, never see inside it. Any install can run one, and a censored spend routes to the next.

The path to zero

The direction is one-way: powers get burned, not accumulated. Mainnet deploys as a single immutable release — no proxy, no upgrade path. Audits harden the circuits. Then ownership is renounced and the last power leaves the building.

PowerTodayAfter renouncement
Move or freeze user fundsNo oneNo one
Read shielded balancesNo one without your view keyNo one without your view key
Replace a verifierOwner, after a public seven-day waitNo one, ever
Censor a transactionSequencer or a relayer — route around eitherSame, with a wider relayer set
Verify, don't take our word
Every claim on this page is on chain. The pool’s owner, timelock, and per-token cap are public state — read them on the contracts page, or watch the governance events listed under onchain events.