Hindsight
Request access

Confidential USDC payments that stay sealed after Q-Day

For payroll, supplier and treasury payments on Solana. Every amount is a 32-byte commitment on chain; only the payee and the auditor can open it, with ML-KEM-768.

your note

Payee
—
Seen by
Auditor
—
4,024 / 4,096 B per transfer

Every note is copied the moment it lands

Validators and archival RPC nodes keep each commitment and both envelopes. Keeping them costs an archive only storage.

Copied13 notes · 31,824 bytes

Q-Day, read from the archive

A quantum computer starts with the copies. Token-2022 confidential transfers keep an ElGamal handle for each amount, D = r·P, with the key P on chain. One discrete log per key opens the amount.

One auditor key opens a whole mint

Every Token-2022 transfer also carries a handle for the mint’s auditor: solve that one key and every amount the mint ever moved lies open. A Hindsight note has no handle to solve. Its commitment hides the amount perfectly, and its openings travel under ML-KEM-768.

Token-2022 confidential transfersReadable 24 of 24

HindsightReadable 0 of 24

How a note moves

  1. The payer’s client commits to the amount with a fresh random r, proves both the note and the new balance lie in [0, 2⁶⁴), and seals the opening twice. The range proof, the note and both envelopes travel in one v1 transaction.

  2. The pool’s auditor decrypts its envelope, checks that v·G + r·H equals C_note, and attests notes in batches. Where the pool requires it, nothing can be accepted before that.

  3. The payee decrypts the other envelope, runs the same check, and accepts: the program adds C_note to the payee’s balance commitment, closes the note and refunds its rent to the payer.

  4. A payee can only take in a note whose opening checks out. One that fails goes back to the payer, who created the opening and can always take it back.

One v1 transaction, measured on a local validator4,024 / 4,096 B
  • Compute budget and the rest87
  • Auditor envelope1,208
  • Payee envelope1,208
  • Note fields110
  • Range proof1,001
  • 9 accounts and blockhash320
  • Signature and header90

One transfer, proof, note and both envelopes, in one v1 transaction

4,024of 4,096 bytes

Measured on a local validator, Agave 4.3.0, with the program deployed and native proof verification on.

amounts, whole: no 48-bit cap and no split into 16 and 32 bits
64-bit
compute units for a whole transfer, 200,000 of them the range proof, measured on a local validator
226,570
bytes in a payee’s X-Wing key, registered once
1,216
bytes per envelope, one for the payee and one for the auditor
1,208
bytes in a note account, its rent refunded to the sender when the note closes
235

How long must a payment stay secret?

Salaries, supplier pricing, treasury positions, legal settlements and advisory fees stay sensitive for a decade or more. Set how long; the line shows the deadlines that lifetime runs past.

Paid in 2026 and secret for 10 years: it must hold until 2036.

  • 2030EU data confidential for 10+ years protected from quantum attack
  • 2030NIST 112-bit ECDH, ECDSA and RSA deprecated
  • 2031UK NCSC highest-priority migrations complete
  • 2035NIST quantum-vulnerable public-key algorithms disallowed

Its lifetime runs past 4 of 4 deadlines.

What ships with the pool

  • Attests notes in batches, with a p95 target under 10 seconds
  • Holds its X-Wing key for each epoch in its own service, apart from the API
  • A console with CSV and ledger exports and selective-disclosure reports

Run a payroll cycle on Hindsight

Hindsight is opening to design partners who pay salaries, suppliers or treasury flows in USDC on Solana. Tell us what you run and we set up a first cycle with you.

Requests open with the launch

This form opens here when the service goes live. Meanwhile, the docs and the papers describe how it works.