Fuyu Protocol
Learn how the Pool stores private notes and executes spends and external actions.
The shared Pool#
Fuyu holds assets in the Pool and represents private claims as note commitments. The browser proves ownership, tree membership and value conservation. The Pool checks the proof and records unique nullifiers to consume the inputs.
For an external action, an approved adapter calls the public venue and measures what it returns. Finalization creates the holder's private note for that result.
Understand note openings, nullifiers and the point where outputs become spendable.
Privacy & Trust BoundariesSee which note details stay private and what observers can still learn.
Controllers & AuthorizationRequire a wallet or claim controller to approve spending a note.
Fees & GasRead the relay fee policy and see who pays gas for each funding and payment path.
Smart ContractsChoose a contract for funding, private transfers, merchant payments or recovery.
ActionPoolFund private notes, spend them with proofs, and settle external actions through ActionPool.
Deposit PortalsReceive ERC-20 transfers at a Portal, then credit private notes or recover uncredited tokens.
Controllers and Claim LinksRequire wallet approval for private spends and set recipient and refund windows for claim links.
Payment RailsUse prepaid sessions, authorization holds and subscriptions, with fixed funding and payout terms.
Routers and AdaptersBatch private spends and run fixed swap, yield or payment-credit operations through the Pool.
Policies and GovernanceManage source policies, delayed configuration changes and coverage renewal.
Accounts and Receiving DirectoryStore encrypted account records and publish receiving descriptors with wallet approval.
Earn ContractsUse Flex shares, Term shares and withdrawal tickets through the Earn vault and Pool adapter.
Migration ReceiversReceive a source withdrawal, credit a fixed private account and recover uncredited funds after a deadline.
Core and surrounding contracts#
The selected core embeds its verifier and has no proxy, verifier setter, administrator withdrawal or forced migration. Its ordinary exit follows the original ownership and accounting rules. New features use peripheral contracts and offchain tools.
The publisher controls admission data, supported tokens and action routes. It has no private account keys or custody authority through those permissions.
| Component | Handles |
|---|---|
| Pool and verifier | Reserves, notes, nullifiers and the original spending rules |
| Adapters | Permitted venue calls and measured returns |
| Router | Ordered transactions without taking custody |
| Controllers | Extra approval for Safe or claim notes |
| Portals | Plain transfers credited to a fixed private recipient |
| Directory | Receiving descriptors and key generations |
| App and proving workers | Account recovery, proof preparation and holder consent |
Ask questions with FPL#
FPL and holder-run proofs let the holder choose to answer supported questions. They do not change spending permission. The Pool stores opaque policy attachments without interpreting the language.
Check which questions the audit compiler supports. FPL syntax, a local evaluated answer and a verified proof are different outputs with different uses.
Using the implementation#
The repository includes contracts, circuits, test files and a development app. It uses development proof keys. Production keys, independent review, mainnet and physical-device acceptance are still outstanding.
Use the specifications and whitepaper when building an integration. Before using a deployment, check its runtime and proof-file hashes against the release you intend to trust.