Orbital Privacy Layer
Confidential asset shielding backed by a trusted execution environment (TEE). Encapsulate your liquidity in SpaceNox so balances and transfers stay encrypted on-chain while the gateway settles intents inside the TEE boundary.
Your balances
Wrap USDC
Unwrap cUSDC
Confidential transfer
Two steps: (1) you submit an RSA-encrypted intent on-chain — only opaque calldata is public. (2) the SpaceNox gateway decrypts with the KMS-matching RSA key, signs proofs, and calls executeConfidentialIntentBatch so your cUSDC balance decreases and the recipient's increases. Without step 2, balances do not move.
Send via ENS stealth address
Register Fluidkey material in Swarm, then drop USDC at a fresh one-time stealth address per resolve. The recipient sweeps every funded stealth address into cUSDC and confidentially transfers the balance to their main wallet — breaking the on-chain link between sender and final recipient.
Register ENS stealth (Swarm)
One-time setup: prove you own the ENS name on Ethereum mainnet, then store your Fluidkey viewing/spending material in Swarm via @armsves/swarm-kv. After this, senders resolve fresh stealth addresses through SpaceNox without any external stealth gateway.
Stealth drop (ENS)
Send USDC to an ENS name the recipient has registered in Swarmvia SpaceNox (see “Register ENS stealth (Swarm)”). Each drop asks the SpaceNox server for the next one-time stealth address; the server reads Fluidkey material from SwarmKV and increments a nonce row there — no hosted Sneaky gateway. The owner then sweeps funded stealth addresses into cUSDC and confidentially transfers to their main wallet, so the on-chain link from your wallet to theirs is broken.
Stealth sweep (owner)
Scan every stealth address SpaceNox has issued for your ENS name (nonce counter in Swarm), then sweep funded ones into your main wallet confidentially: approve → wrap → confidential transfer to you. Run it from the same wallet that registered the name in Swarm. Use the Unwrap card to redeem the cUSDC back to USDC.
Encryption Protocol
RSA-PKCS#1 v1.5 to the gateway’s RSA-2048 public key, computed in your browser before signing. The chain only ever sees opaque ciphertext.
Read technical specsPrivacy Model
Wrap, transfer, and unwrap payloads are encrypted client-side. Decoy candidate sets and batched intent settlement hide the real recipient and amount on-chain; the gateway TEE holds the keys that decrypt and settle.
View design notesTrust Architecture
The gateway runs inside a trusted execution environment (TEE). It holds the ETH signer and RSA private material used to decrypt intents and produce proofs — keys never ship to the browser.
Node status