Siphon.Money

Siphon Protocol (siphon.money) is a unified platform for private, anonymous DeFi execution—“trade without a trace.” Traders and AI agents deposit into a ZK privacy vault, compose strategies (visual builder or natural language), and keep trigger prices and amounts encrypted with fully homomorphic encryption (FHE / TFHE) so intent stays hidden from front-runners, MEV bots, and on-chain surveillance. Vault spends use Groth16 proofs so deposit and withdraw linkage stays broken; notes are encrypted client-side before syncing to the execution layer.

How it works: users deposit and receive ZK notes; strategy bounds are encrypted in the browser (the FHE client key never leaves the device by default); the trade executor monitors live prices (e.g. Pyth) and asks an FHE engine whether conditions are met without seeing plaintext targets; on trigger, settlement can withdraw privately, swap via Uniswap V3, or use atomic swapAndDeposit so principal never sits in an executor EOA. Optional TEE (Phala) supports more autonomous triggering when the key is sealed to attested hardware.

Compliance is eligibility and risk control, not a full KYC dossier: World ID Identity Check proves age ≥ 18 and an allowlisted issuing country via document-backed ZK attestations (no name/DOB/document numbers stored), with ToS/Privacy acceptance and hard gates on private deposits, encrypted strategy arming, and API-key purchase. Nullifier↔wallet binding limits one World ID to one wallet. Chainalysis OFAC screening can screen depositors/recipients on mainnets before sensitive flows.

For agents and automation, siphon-money-mcp (Model Context Protocol) lets clients shield capital, arm confidential limit strategies (e.g. USDC→ETH), and settle on Base through the same FHE + ZK path as the dapp—installable via npx without cloning the monorepo, with prepaid API keys for metered access. Primary deployment target is Base; the stack spans Next.js dapp, Solidity vaults/entrypoint, Circom ZK, Rust FHE engine, Python trade executor, indexing (Ponder / The Graph), and agent SDK/MCP surfaces.

We built Siphon as a composed private-execution stack, not a single app: a Next.js 15 / React 19 dapp (wagmi/viem, XYFlow builder) talks to Solidity vaults + Entrypoint on Base, Circom/Groth16 circuits (snarkjs / optional rapidsnark relayer), a Rust tfhe-rs FHE engine, and a Python trade-executor that stores encrypted strategies, schedules monitoring, and settles spends. Client-side WASM does FHE keygen/encrypt and ZK proving; note secrets are AES-GCM encrypted with a wallet-derived key before syncing to the executor DB. Wallet-signed auth (X-Wallet-Address / signatures) gates user writes; prepaid sk_ API keys meter the agent path.

Lifecycle: deposit → Merkle/Poseidon commitment + local ZK note → encrypt trigger bounds in-browser → executor polls Pyth Hermes → FHE engine compares ciphertext vs live price → on trigger, ZK withdraw / Uniswap V3 swap / atomic swapAndDeposit (spend → swap into dst vault → mint new note in one tx so principal never parks on an executor EOA). Indexing is dual-plane: Ponder + Postgres is source of truth for ordered vault leaves (ZK proofs must not flood RPCs); The Graph subgraph feeds agents/MCP anonymity-set and swap context, with Uniswap V3 Base subgraph for pool depth before arming. Compliance uses World ID Identity Check (age ≥ 18, country allowlist via ZK attestations—no PII stored) plus Chainalysis OFAC screening on sensitive flows. Agents use siphon-money-mcp (npx) bundling FHE WASM + proving artifacts so Cursor/Claude can shield, arm confidential LIMIT_SELLs, and settle without cloning the monorepo. Optional Phala TDX decryptor seals the FHE client key for autonomous trigger-bit decryption when browser-in-the-loop isn’t enough.

Partners that mattered: Zama/tfhe-rs for sealed price conditions; World for privacy-preserving eligibility without a KYC dossier; Pyth for oracle feeds into FHE compares; Uniswap for settle liquidity; The Graph / Ponder for live agent context vs leaf truth; Phala for TEE autonomy; Base as primary settlement chain.

Notable hacky bits: default “browser-in-the-loop” (server never holds the FHE client key—decrypt the 1-bit trigger locally); shipping ~FHE WASM + zkeys inside an npm MCP package so agents work zero-clone; swapAndDeposit as custody + privacy fix vs executor-EOA parking; Graph+Ponder dual plane instead of ripping out the old indexer; World ID nullifier↔wallet binding + HMAC cookie as lightweight compliance without storing documents; plaintext-client-key env only for agent demos where TEE sealing isn’t wired.