Deeper
Production gate
The checklist a network must pass before UMBR points real money at it.
- Gate passed
- No network yet
- Real funds
- Not supported
- Mainnet
- Not configured
Why this page exists#
Testnet software can be wrong cheaply. Software holding real money cannot. A shielded pool also has a property that makes mistakes worse: because balances are private, a bug that creates or loses funds may not be visible from outside until it is too late.
So UMBR keeps a written gate. A network gets a mainnet pool only after every item below is done and shown to be done. Today no network has passed it, which is why no mainnet is configured and why the app hides mainnets entirely. This page lists what is left; it is not a claim that any of it is finished.
Status today
Gate order#
Freeze the circuits
No more changes to the statements the proofs make. Any later change restarts the gate.Run the setup ceremony
Produce the proving and verification keys with many independent contributors.Independent security review
Circuits and contracts reviewed by outside parties; findings fixed and re-checked.Deploy and configure
Deploy the pool on the target chain and set its address and deploy block in the environment.Operations ready
Relayer isolated and limited, monitoring live, incident plan written and rehearsed.Open with caps
Start with low deposit limits and raise them only as the system earns it.
Setup ceremony#
UMBR's proofs use Groth16. Groth16 needs a per-circuit trusted setup: a random secret is mixed into the keys and must then be destroyed. Whoever knew the full secret could make proofs of false statements, which in a pool means spending money that is not theirs.
A phase-2 ceremony splits that secret across many people. Each contributor adds their own randomness and throws it away. The keys are safe as long as at least one contributor was honest. The gate requires:
- Multiple independent contributors, from different organisations, not only the UMBR team.
- A transcript anyone can verify, linking each contribution to the next.
- A public random beacon applied at the end.
- Published final keys whose hashes match the verifiers that get deployed.
The keys used on testnet today come from a development setup and are not fit for real funds.
Contracts and configuration#
Before real funds, the circuits and contracts get an independent security review, and the deployment has to match what was reviewed.
| Check | What passing means | State |
|---|---|---|
| Independent review of circuits | An outside team reviews every circuit for soundness: that no proof can be made for a false statement. | Open |
| Independent review of contracts | The pool, verifiers and token handling are reviewed, findings are fixed, and the fixes are re-checked. | Open |
| Verification keys match the ceremony | The keys in the deployed verifiers are the ones the ceremony produced, and anyone can check that. | Open |
| Pool deployed and recorded | NEXT_PUBLIC_UMBR_POOL_<chainId> and NEXT_PUBLIC_UMBR_POOL_BLOCK_<chainId> set for the network, nothing else changed. | Open |
| Asset list fixed | Only the stablecoins named for that network can be shielded; decimals checked against each token. | Open |
Operations#
The relayer and the app are the parts of UMBR that run as services. They cannot steal funds, because destinations and fees are bound inside each proof, but they can fail, be abused or be attacked.
| Check | What passing means | State |
|---|---|---|
| Relayer key isolation | The relayer key lives in a secret store, is used for nothing else and holds only enough for gas. | Open |
| Relayer limits | Rate limits and spend caps on the relayer, so a fault or abuse cannot drain it or flood the chain. | Open |
| Monitoring | Alerts on pool events, unknown roots, relayer failures, RPC errors and balance drift. | Open |
| Incident plan | Who is called, how the app is paused or set to read-only, and how users are told, written and rehearsed. | Open |
| Reporting channel | A private, watched channel for security reports, with an expected reply time. | Open |
Still ahead#
All of it. In order: freeze the circuits, run the ceremony, commission the reviews, then the configuration and operations work above. Progress will show up on product status and on /mainnet. If you want to contribute to the ceremony, review the circuits, or report something you found, send a direct message to @umbrtrade on X; for security issues start the message with security. The threat model describes what is in scope.