Security
What we hide, what we assume, and what can never break
Privacy claims deserve a precise threat model. This page states who Intelena defends against, what each convenience layer is trusted to do, and the one guarantee that holds regardless: your funds can always leave.
Adversaries
Who we defend against
| Adversary | What they see today | What they see on Intelena |
|---|---|---|
| Block explorer / wallet tracker | Full balance and history per address | Aggregate pool flows only; no per-user balance or history |
| Copy trader | Positions and entries in real time | Nothing — crossed trades never hit a public pool |
| MEV / front-running bot | Pending order size and direction | Fragmented, jittered pieces from fresh addresses; crossed volume never enters the mempool as a swap |
| Stop hunter | Resting triggers and limit levels | Encrypted triggers that reveal nothing until filled |
| Network observer | IP ↔ address correlation via RPC | Queries proxied through the relayer network |
Trust assumptions
What each party can and cannot do
Relayers
Can: Delay or refuse service.
Cannot: Steal funds, decrypt notes, or forge proofs. The emergency exit removes them from the withdrawal path entirely.
Oracle
Can: Determine the midpoint price used for dark crossing.
Cannot: Affect custody. Manipulation would affect crossing price for a pair, not who owns what.
Association-set curator
Can: Decide which deposit sources are approved.
Cannot: See who spends, or block a spend that already has a valid proof. Policy and operator are documented and will be decentralized over time.
Zero-knowledge circuits
Can: Enforce ownership, non-double-spend, and set membership.
Cannot: Be trusted blindly. Soundness depends on the proving system and circuit correctness — both to be independently audited before mainnet.
Invariants
Guarantees that don't depend on anyone
Funds can always exit
The emergency exit lets you withdraw directly through the contract with your own proof, with every relayer offline.
No plaintext balances anywhere
Notes are decrypted only on your device. No contract, indexer, or Intelena server holds balances.
No double spend
Every spend publishes a nullifier bound to the note. The same note cannot be spent twice, and the nullifier reveals nothing about which note it was.
Residual exposure is disclosed
The public leg is minimized and fragmented, not eliminated — and the Leak Score shows it before you sign.
Audits and responsible disclosure
Circuit and contract audits will be published before mainnet. Security researchers can reach the team through the channels listed in the documentation; a disclosure policy and scope will be published alongside the audit reports.