Trust model
A privacy protocol earns trust by naming exactly who can do what. Here is Cowl’s answer: what no one can do, what the team can still do and the walls around it, and the path that ends with no one holding anything.
What no one can do
- Touch your funds. Notes move only with a valid ZK proof from your keys. There is no admin path to freeze, seize, or redirect a note — the contract has no such function to call.
- See your positions. Amounts, assets, and owners are inside the proofs. Not the team, not a relayer, not the sequencer — nobody reads a shielded balance without your view key.
- Mint value from nothing. The pool enforces per-token value conservation on chain, independent of the proofs: it never pays out more of a token than was ever deposited. Even a broken verifier hits that wall.
- Gatekeep participation. Shielding, spending, and running a relayer are permissionless. No allowlist, no accounts, no API keys.
What the team can do — and the walls around it
One power exists: the pool’s owner can replace a proof verifier. It exists for one reason — if a circuit bug is ever found, an immutable pool with no swap path could never be fixed, only abandoned. The power is fenced in three ways:
| Fence | What it means |
|---|---|
| Seven-day timelock | A swap is proposed on chain and waits a week before it can execute. Anyone who distrusts it has that week to withdraw — the pool cannot stop them. |
| Value-conservation cap | Even a malicious verifier cannot withdraw more of a token than the pool ever received. The blast radius is bounded by design. |
| Renouncement | Ownership can be renounced, permanently. After that the verifiers are frozen and the swap power ceases to exist — mathematically, not as a promise. |
What Cowl inherits
Cowl settles on Robinhood Chain, an Arbitrum-based L2, and inherits its trust model: the sequencer orders transactions and could delay or censor them. What it cannot do is read a shielded balance or move pooled funds — the proofs and the conservation cap hold regardless of who orders the blocks. Choosing the chain where the users and liquidity are is a deliberate trade, made with eyes open.
Relayers
A relayer’s only power is to ignore you. The proof binds the recipient, the relayer, and the fee before it leaves your machine, so a relayer can submit your spend exactly as proven or not at all — never redirect it, never overcharge it, never see inside it. Any install can run one, and a censored spend routes to the next.
The path to zero
The direction is one-way: powers get burned, not accumulated. Mainnet deploys as a single immutable release — no proxy, no upgrade path. Audits harden the circuits. Then ownership is renounced and the last power leaves the building.
| Power | Today | After renouncement |
|---|---|---|
| Move or freeze user funds | No one | No one |
| Read shielded balances | No one without your view key | No one without your view key |
| Replace a verifier | Owner, after a public seven-day wait | No one, ever |
| Censor a transaction | Sequencer or a relayer — route around either | Same, with a wider relayer set |