NETWORK EXPLORERreconnecting· devnet
Check the network yourself.
A snapshot of the shielded pool’s public state on Solana devnet, taken at most once a minute and read by this page every 30 seconds. Every number below is public. None of them names a sender or a recipient.
Devnet onlyStyx v2 has run on Solana devnet since 2026-10-07. No real funds. Not externally audited. v1 stays on devnet as the fallback and will not go to mainnet.
- Notes in the v2 crowd
- n/a
- all amounts together, spent notes included
- Pool transactions
- n/a
- payments, withdrawals, link claims and merges, one proof each
- SOL held
- n/a
- the balance of the v2 vault account
- Last checkpoint
- n/a
- checkpoint n/a; the pool posts one every 750 slots
Source: /api/metrics/v2. Waiting for a snapshot.
01THE V2 CROWD
One crowd, every amount
v1 kept one pool per size. v2 keeps one tree of notes for SOL, whatever their value. Each square is a note written to it: by a deposit, by a v1 note moved in, or as one of the two outputs of a pool transaction. The count includes spent notes and the zero-value outputs some pool transactions write, so fewer notes are unspent. On devnet, most of them come from our own test wallets.
Deposits per size
A deposit enters in one of ten sizes, and it is public: its wallet, its size and its time. These are the counts per size since the pool opened, read from the deposit events of the v2 vault. They say nothing about the payments made inside the pool.
n/a
02THE OBSERVER TEST
What the chain shows of a v2 payment
One payment on a transparent chain, next to what anyone reading Solana sees of the same payment in Styx v2: a deposit, made earlier and public, then the pool transaction that pays.
DEMO
Standard chain
Styx v2 · a deposit, earlier
Styx v2 · the payment
A standard explorer prints the sender, the recipient, the amount and the memo of one transfer. In Styx v2 the deposit is public: the wallet, its size and its time. The payment is a pool transaction that our relayer signs and pays for. It publishes two nullifiers, two new commitments, two sealed records and a proof, with a public payout of zero, and no commitment of the note it spends, so nothing on chain names your deposit. A withdrawal to a Solana address is different: its amount and its destination are public. What remains is matching: the receiver knows the amount and roughly the time, and when few people deposited since your deposits, or few deposited at least the amount you pay, that can point to you. The app says so before you send (white paper v2, sections 2 and 5.5).
03V2 PROOF
One circuit, checked on chain
Every pool transaction carries one proof, built in your browser and checked in full by a Solana program before any SOL moves (white paper v2, section 4).
- Proof
- A STARK from hash functions only: SHA-256 and Poseidon2. No elliptic curve, no setup ceremony.
- Circuit
- One circuit (identifier 8) for every pool action: two notes in, two notes out.
- Size
- 173,664 bytes, always that length.
- On chain
- Written in 46 chunks of 3,840 bytes, then checked by 11 transactions: 8 fragments and 3 parts of a final phase.
- Records
- Each carries an X-Wing key encapsulation (ML-KEM-768 with X25519).
- Wallet
- Your Solana wallet, its signatures and its deposits stay Ed25519.
Devnet only. Not externally audited. The white paper quotes no v2 soundness figure until the format is reviewed externally.
GbVM5yvetrSD194Hnn1BXnR56F8ZWNKnij7DoVP9j27c
DpqfTShwGBKQVe21EDHpg6rxkWsMYVVmbMUuK33nnAJN
V1 (FALLBACK)
v1, the fallback
v1 stays deployed on devnet as the fallback and will not go to mainnet. Its figures, pools and circuits below are read and shown as before.
- Total Value Shielded
- n/a
- across all denomination pools
- Shielded Notes
- n/a
- deposited across all denomination pools
- Active Pools
- n/a
- denominations with deposits
- STARK Circuits
- 8
- hash-based, no trusted setup
Source: /api/metrics. Waiting for a snapshot.
04THE OBSERVER TEST
Same payment. Two chains.
What a transparent chain publishes for one payment, next to what the chain shows for the same payment made through this web app: two transactions instead of one.
DEMO
Standard chain
Styx · your payment
Styx · the spend, later
A standard explorer prints the sender, the recipient, the amount and the memo of one transfer. Through this web app the chain shows two: your public payment to this deployment, and later a spend from a key that is not your wallet to a payout address made for that note, with a circuit-7 proof and no commitment. A chain reader cannot match the spend to your payment by its fingerprint. This deployment can: it handed you that note. On a quiet pool the minutes between the two can pair them, and every note is 1 SOL, so the amount stays public.
05POOL SIZES
The crowd your note sits in
Each square is one note deposited in a pool of identical notes. A web withdrawal carries no commitment, so to a chain reader it could be any note of its pool still unspent: a smaller crowd than this count, which includes spent notes. Against this deployment, for a note it handed you, the crowd is one; against the clock on a quiet pool, it can be one too.
Reading the network…
06PROOF SYSTEM
Eight STARK circuits
Hash-based, with no trusted setup and no elliptic curve inside the proof. The deployed verifier accepts all eight; the web app proves on three of them (README.md, Architecture).