Privacy for a market that forgot to have any

Stock tokens on Robinhood Chain settle on a public ledger. Every position, entry, exit and running balance is readable by anyone with a block explorer, permanently and without consent. That is a worse privacy posture than the market these instruments were built to mirror, where only the venue sees the tape.

RhMask is a privacy layer for those assets. It gives holders a way to receive unseen using ERC-5564 stealth addresses derived entirely in the browser, a way to pay and be paid privately through a three-scan QR flow that needs no server, and a way to be paid in stock tokens for securing the protocol. No component takes custody, and no server ever sees a private key.

The privacy claim is narrow and deliberate. RhMask unlinks identity from receiving addresses. It does not hide settlement, does not obscure amounts, and is not a mixer. Every surface in the product states which of those applies.

A wallet holding tokenized equity is a public portfolio. Given one address, an observer can reconstruct cost basis, size, timing and counterparties. Three consequences follow, and all three are already visible on chain.

• Adverse selection. A visible position invites front-running and quote fading. The larger the holder, the worse the fills.
• Coerced disclosure. Paying someone once reveals your whole balance history to them, forever, with no way to revoke it.
• Chilled participation. Funds and treasuries cannot use an instrument that broadcasts their book, which caps the market's serious capital.

The usual answer is a pooled mixer. That is the wrong tool here: it co-mingles funds, it creates a compliance problem for regulated assets, and it does nothing about the fact that a payer learns your address. RhMask takes the opposite approach. Nothing is pooled; every payment simply arrives somewhere new.

The system is three layers. Only the middle one touches a server, and only to reach third-party routers on your behalf.

┌─ Surfaces ────────────────────────────────────────────────┐
│  Web app  (Next.js)          Browser extension (MV3)      │
│  keys · QR · claim · sweep   chips · receipts · same keys  │
└──────────────┬────────────────────────────┬───────────────┘
               │  all crypto client-side    │
┌──────────────▼────────────────────────────▼───────────────┐
│  Edge routes: quote · order · tokens · vault · rpc         │
│  holds router keys, never key material, fails closed       │
└──────────────┬─────────────────────────────────────────────┘
               │
┌──────────────▼─────────────────────────────────────────────┐
│  Robinhood Chain 4663 · stock tokens · (planned) announcer, │
│  registry, MaskVault, RevenueRouter, ProofLedger            │
└────────────────────────────────────────────────────────────┘

The RPC pass-through deserves a note. Several consumer networks hijack the chain’s RPC hostname at the DNS level, which makes a healthy endpoint look dead and silently breaks balance reads. Routing browser traffic through the application’s own origin removes that failure mode without asking anyone to change their network.

Stealth addresses follow ERC-5564 on secp256k1. A recipient publishes a meta-address built from two public keys: spending and viewing. A sender derives a fresh address for every payment.

Sender                              Recipient
─────────────────────────────       ─────────────────────────────
r ← random scalar
R = r·G                        →    R arrives with the payment
S = r·K_view                        S = k_view·R          (equal)
h = keccak256(compress(S))          h = keccak256(compress(S))
tag = h[0]                          skip unless tag matches
P = K_spend + h·G                   p = k_spend + h  (mod n)
addr = keccak(P)[12:]               addr == keccak(p·G)[12:]

Only the recipient can compute p, so only the recipient can spend. The view tag is a one-byte filter that lets a scanner discard the overwhelming majority of announcements with a single comparison.

Key storage is optional and local. With a passphrase set, the key set is sealed with AES-256-GCM under a key derived by PBKDF2-SHA256 over 310,000 rounds through WebCrypto. The sealed blob format is shared byte-for-byte between the web app and the extension, so one backup restores in either.

Until an announcer contract is deployed, the sender must hand the ephemeral key to the recipient. RhMask makes that step the product rather than a footnote: it is a QR code.

The receipt fields are exactly the fields of the ERC-5564 announcement event. When the announcer contract ships, a background scanner replaces the QR with no change to the format, and the QR remains as the offline path for payments made without publishing anything on chain.

$MASK buys access and fee discounts. It never buys route quality; routing is identical for everyone, holder or not. Its single distinguishing property is what it pays: stakers receive a basket of stock tokens, not more $MASK.

Revenue converts to the basket on-chain and streams to stakers. The design depends on one on-chain fact: that a contract can hold and transfer the issuer’s stock tokens. That was verified against mainnet by simulating transfers of every basket token from real holders to a contract address. It holds today, and it is re-verified before each release because the tokens are upgradeable proxies controlled by their issuer.

Supply is fixed with no mint function and no admin keys. The launch is a fair launch on a public bonding curve: no presale, no team allocation, and the launch transaction hash is published.

Stated without softening, because a privacy product that oversells itself is worse than none.

• Issuer control. Stock tokens are upgradeable proxies. The issuer can change behaviour under the same address, including transfer restrictions that would break the vault design.
• Metadata leakage. Settlement is public. Timing and amount analysis can still link activity, especially for unusual sizes.
• Out-of-band receipts. Until the announcer ships, a lost receipt means the recipient cannot locate funds that are already theirs.
• Key loss. There is no recovery path by design. A lost spending key is a permanent loss.
• Unaudited contracts. No contract is deployed yet. Nothing in the vault section should be treated as live until an audit is published.
• Regulatory surface. Tokenized equities sit in a moving regulatory perimeter that varies by jurisdiction and may restrict availability.

• ERC-5564: Stealth Addresses
• ERC-6538: Stealth Meta-Address Registry
• ERC-7683: Cross-Chain Intents
• EIP-7702: Set EOA account code
• RhMask source and verification scripts