> For the complete documentation index, see [llms.txt](https://stoxfi.gitbook.io/stoxfi-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://stoxfi.gitbook.io/stoxfi-docs/privacy-model.md).
# Privacy Model
StoxFi provides confidentiality of financial values during confidential settlement.
It does not provide anonymity of participants.
The protocol is designed to keep confidential balances and transfer amounts encrypted while addresses, transaction activity, asset type, and the public entry and exit points remain visible onchain.
This distinction defines the StoxFi privacy model.
### Privacy Boundary
**StoxFi Privacy Model**
The StoxFi lifecycle begins with a public shield, enters a confidential settlement environment, and ends with a public unshield.
Confidentiality applies to balances and transfer amounts within that confidential interval.
### What Remains Confidential
While a position exists inside the confidential environment, a public observer cannot determine the user's confidential balance.
The observer also cannot determine the amount transferred between two users during a confidential transfer.
The confidential values protected by StoxFi include:
1. Confidential user balances
2. Confidential transfer amounts
3. Whether a transfer moved the requested value or silently moved zero
4. How a shielded position was divided across subsequent confidential transfers
5. Encrypted total supply from public observers
These values remain encrypted during confidential execution.
### What Remains Public
StoxFi does not conceal the existence of transactions or the addresses interacting with the system.
A public observer can see:
1. User addresses
2. The asset being used
3. Exact shield amounts
4. Exact unshield amounts
5. Sender and recipient addresses during confidential transfers
6. Transaction timing
7. Transaction frequency
8. Total collateral locked for each stock
9. Gas payer information
10. Transaction fees
11. CCIP message identifiers associated with shield activity
The protocol therefore separates **transaction visibility** from **financial value visibility**.
A confidential transfer is visible as an interaction.
Its amount is not.
### Visibility Matrix
| Information | Publicly Visible |
| --------------------------------- | ---------------- |
| User address | Yes |
| Asset type | Yes |
| Shield amount | Yes |
| Unshield amount | Yes |
| Confidential transfer amount | No |
| Confidential balance | No |
| Sender and recipient relationship | Yes |
| Transaction timing | Yes |
| Transaction frequency | Yes |
This is the core visibility model of StoxFi.
### Shield Privacy
Shielding is public.
The user transfers an exact amount of the underlying ERC 20 into StoxVault.
That transaction is visible on Robinhood Chain.
The corresponding mint instruction also contains the recipient and confidential unit amount in cleartext.
As a result, shielding should not be described as a private transaction.
The shield operation establishes the starting point of the confidential position.
Confidentiality begins with subsequent confidential balance activity.
### Transfer Privacy
Confidential transfer amounts remain encrypted.
The amount is encrypted before being submitted to ConfidentialStock and remains encrypted while the contract evaluates the transfer and updates balances.
The resulting event contains:
`from`
and
`to`
It does not contain an amount.
A public observer can therefore determine that one address interacted with another through ConfidentialStock but cannot read the value transferred.
### Silent Zero Behavior
The confidential transfer architecture also prevents transaction failure from directly exposing balance information.
If the requested transfer cannot be completed because of insufficient funds or recipient capacity, StoxFi can select encrypted zero.
The transaction can therefore complete without revealing whether the requested amount was actually moved.
A public observer cannot determine from transaction success alone whether the confidential transfer moved the requested value or zero.
### Balance Privacy
ConfidentialStock balances are stored as encrypted `euint64` values.
The holder can obtain access to their own encrypted balance and privately decrypt it through the supported decryption process.
The balance is not made publicly decryptable.
Public observers therefore cannot read the confidential position directly from contract state.
### Redemption Privacy
Redemption ends the confidential interval.
A confidential amount is first burned and associated with a redemption request.
That burned amount is then deliberately made publicly decryptable.
The resulting clear amount is required so that StoxFi can authorize the release of an exact quantity of the underlying ERC 20 from StoxVault.
The unshield amount is therefore public by design.
### Address Visibility
StoxFi does not hide addresses.
The sender and recipient of a confidential transfer remain visible.
The addresses interacting with shield and redemption operations also remain visible.
StoxFi should therefore not be described as an anonymous or untraceable protocol.
Its confidentiality applies to financial values rather than participant identity.
### Timing and Frequency
Transaction timing remains public.
An observer can see when an address shields, interacts with ConfidentialStock, transfers confidentially, requests redemption, finalizes redemption, and receives underlying collateral.
The frequency of these interactions is also observable.
This creates the possibility of activity based inference even when the transfer amount itself remains encrypted.
### Correlation
Shield and unshield values are public.
Transaction timing is public.
Addresses are public.
As a result, observers may attempt to correlate activity across the StoxFi lifecycle.
A shield and later unshield may be easier to associate when the confidential pool contains very little independent activity.
The relationship becomes less directly inferable when multiple positions and confidential transfers exist between entry and exit.
StoxFi does not claim to eliminate this form of correlation.
### Address Reuse
Address reuse remains observable.
If the same address repeatedly shields, transfers, or redeems, those interactions can be associated with that address.
Confidential transfer amounts remain encrypted, but address reuse can still reveal patterns of activity.
### External Interaction Metadata
The browser application communicates directly with third party RPC endpoints and the external FHE relayer.
These external services can observe network level interaction context associated with requests made through them.
This does not reveal the confidential value onchain, but it remains part of the broader privacy boundary of the current architecture.
### Asset Specific Confidentiality
Confidential positions are separated by asset.
Each supported stock has its own confidential representation.
An observer can therefore determine which confidential stock contract an address is interacting with.
The asset type is not hidden.
The confidentiality applies to the balance and transfer amount associated with that asset.
### Accurate Privacy Terminology
The following descriptions accurately reflect the current StoxFi implementation:
**Confidential amounts**
**Encrypted balances**
**Amounts hidden from public view**
The following descriptions do not accurately describe the current implementation:
**Anonymous**
**Untraceable**
**Zero knowledge**
**Fully private**
**No one can see your transactions**
StoxFi uses fully homomorphic encryption for confidential computation. It does not use a zero knowledge architecture for confidential transfers.
### Privacy Model Summary
StoxFi makes financial values confidential without attempting to make blockchain activity invisible.
During the confidential interval:
**Balances are encrypted.**
**Transfer amounts are encrypted.**
**Participant addresses remain public.**
**Transaction timing remains public.**
**The asset remains identifiable.**
At entry, the shield amount is public.
At exit, the unshield amount is public.
The resulting privacy model is therefore centered on confidential balances and transfer amounts within an otherwise observable onchain settlement lifecycle.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://stoxfi.gitbook.io/stoxfi-docs/privacy-model.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
