Get paid.
Not exposed.
No payment has ever been processed.
A checkout that doesn't leak the customer.
When a shop takes a normal on-chain payment, every customer's wallet and spend is readable by anyone, including competitors. Tillshade explores a checkout where that stays shielded and the merchant still gets books they can stand behind.
Shielded customer wallet
The paying wallet is meant to be unlinkable from the merchant's public address, so a customer's wider holdings are not on display at the till.
Per-payment amounts hidden
Individual sale amounts are not published in readable form, so the public cannot reconstruct a shop's daily takings or pricing from the ledger.
A proof for the books
The merchant is meant to receive a cryptographic settlement proof for each payment, so accounting and refunds do not depend on public transparency.
Ring up. Seal. Settle. File.
An intended flow, not a shipped one. Nothing here is deployed, and details may change as the design is tested on devnet.
Ring up
The merchant creates a payment request for a sale. The amount is committed, not posted in plain text.
Customer pays
The customer pays from their wallet into a shielded pool, in a way meant to break the public link to their main address.
Seal
A proof shows the payment matches the request without revealing who paid or how much. Observers see a sealed entry.
Settle & file
The merchant receives funds and a settlement proof to keep for their records, refunds, and tax.
Who can see what.
Precise on purpose. This aims to reduce what the public can learn about each sale. It is not a promise that nothing can be learned.
- Customer wallet identity. Not linked to the payment in public view.
- Per-payment amount. Not readable on the ledger.
- Which customer paid which merchant. The pairing is not published.
- A settlement proof for each payment, for their own books.
- The funds, once the proof verifies.
- Whatever the customer chooses to share in person, such as an order reference.
- That a payment was settled and when.
- That the proof is valid, checkable by anyone against the program.
- The program's logic and, once published, its source and audit status.
Known limitations — please read
- Not anonymity. Tillshade aims to reduce on-chain linkability. It does not hide a customer from the merchant in person, from card or camera records, or from anyone who correlates timing, funding sources, or off-chain data.
- Early concept, devnet-stage. There is no live product, no deployed program, and no mainnet. Do not send real funds anywhere in connection with this page.
- Not audited. No third-party security audit has been done. Payment code must be audited before it is trusted with real value.
- Merchants still have obligations. Shielding customers from the public does not remove a merchant's duties to keep records, collect taxes, or follow consumer and anti-money-laundering rules where they apply.
- Not an affiliated project. Not affiliated with or endorsed by pump.fun, the Solana Foundation, or any other project or company.
- Follow your local laws. You are responsible for complying with the laws, sanctions, and tax rules that apply to you. Privacy is not a shield for illegal activity.
What exists today.
Anything not live says so. These fill in only when they are real.