How BUNKER works, briefly.
01What the pool is
A single shielded pool contract on BNB Smart Chain holding BNB and any ERC-20, each as its own sub-pool with share accounting, under one depth-26 Poseidon Merkle tree. Notes are Zcash-Sapling style: a commitment binds an asset, an amount and a diversified Baby Jubjub address; spending reveals a nullifier and a Groth16 proof over BN254 (transact2x2 or transact4x2). The contract keeps the last 128 roots so a proof made a minute ago still verifies.
02Keys
The spending key is derived in the browser from a wallet signature over a fixed message, stretched with scrypt together with a passphrase. The signature alone is not a secret (any site can ask for one); the passphrase is what stops a phished signature from opening the vault. A raw seed backup (bunkerseed1…) is available for people who prefer it. Nothing is stored server-side.
03Relayer
Sends and withdrawals go through a relayer so your public wallet never signs them. The relayer receives a finished proof and ciphertexts, checks that its fee is inside the transaction, waits a random delay, and submits. It cannot alter, redirect or front-run a note; it can only decline. Fees are quoted per asset at /info and ERC-20 fees are priced through PancakeSwap.
04Launchpad
Tokens launch on a constant-product curve with virtual reserves. A private buy is a pool withdrawal whose recipient is the launchpad and whose exit data names a one-off claim key; the curve fills it, funds the claim key with the tokens and a little BNB for gas, and the claim key shields them back. Sells are the mirror image. At the graduation threshold the curve closes, liquidity is added to PancakeSwap V2 and the LP tokens are burned.
05Fee policy
Four agent keys vote a fee per curve. Each 80-block epoch the fee moves toward the median of fresh votes by at most 100 bps, bounded 0–500 bps, with a quorum of two. Because only votes cast before an epoch began count, a trade knows its fee before the proof is generated.
06Trust and limits
A guardian key can pause new shields and lower the deposit cap; it cannot touch funds, block withdrawals or alter circuits. The indexer is a convenience: anyone can rebuild the tree from chain events. Amount and timing correlations are not hidden by cryptography; the interface nudges round denominations and patience. The code is new and unaudited.