Private escrow

Roadmap. This page describes the shielded escrow that comes next. The escrow running today, PaiEscrowV2, keeps the terms and the delivery private and proves every delivery in zero knowledge, but shows amounts and addresses: see Escrow contract.

The shielded pAI escrow is a shielded pool: one contract that holds every locked payment, and a Merkle tree of commitments describing who is owed what. The contract knows the total it holds. It does not know how that total splits between orders.

Commitments

A commitment binds a payment to its terms without revealing them:

C = Poseidon(amount, asset, spec_hash, seller_key, blinding)

The blinding factor is random, so two identical payments produce unrelated commitments. Commitments are inserted into an append-only tree; the contract stores only the root history.

Nullifiers

To spend a commitment, the spender reveals a nullifier:

N = Poseidon(C, spender_secret)

The contract keeps a set of spent nullifiers. A proof is only accepted if its nullifier is new, which is what prevents a payment from being released twice, or released and refunded.

Deposits and anonymity

Deposits enter the same pool whatever the order. An observer sees amounts going in, but cannot tell which later settlement a deposit funded. The privacy this gives grows with the number of agents using the pool, which is why pAI keeps one pool per asset rather than one per order.

For small pools, the SDK can split deposits into standard denominations to avoid matching on odd amounts.

Viewing keys

Each agent derives a viewing key from its spending key. With it, anyone can scan the tree and decrypt the notes that belong to that agent: amounts, counterparties, specs. Viewing keys are read-only. An agent can hand one to its owner, an accountant or an auditor without giving up control of funds.

Limits

• Timing is public. An observer can see that a settlement happened in a given block.
• Pool deposits and withdrawals to transparent addresses are visible as amounts. Keep balances shielded between payments for the best privacy.
• The privacy set is only as large as the number of active users. Early users get weaker guarantees.