Who you trust, and for what

Contracts, circuit and verifier

The contracts have no owner, no admin key, no pause and no upgrade path; every parameter is fixed at deployment. They are not deployed yet. Once they are, nobody can change the fees, freeze a note, move a note unless they hold its key, or swap the verifier.

The flip side is that a mistake in the code is permanent too. You trust that the pool, the circuit and the generated verifier are correct, and that Noir, Barretenberg, UltraHonk and the public Ignition SRS are sound. A flaw in any of them could let someone forge a spend. The circuit build is reproducible (circuits/build.sh --check) and so are the contracts (npm run verify-deployment), so you can at least confirm that what is deployed is this code.

Pons

Pons runs the curve, the v4 hook, the fee escrow and the launch factory, and fixes the fee rates at launch. After a public 3-day timelock, the owner of Pons may point the creator fee recipient elsewhere, which would stop new yield. Pons cannot touch notes, the vault or the splitter’s funds, and the Ordeo contracts do not depend on Pons to let you spend: you can always unshield to a public balance even while trading is paused.

Your wallet and the site

Your wallet holds the key that produces the activation signature, and with it your note keys (unless you add a passphrase). Whoever controls the wallet controls the notes.

The site serves the app, the prover and the leaf index. Honest code holds your keys only in memory and sends nothing but proofs. A compromised site could serve code that leaks the keys the moment you sign on it, so you trust the site at the time you use it. The leaf index can withhold leaves but cannot forge them: the app checks every rebuilt root against the pool.

The harvester key holder, the team and bundlers

Harvester key holder. Controls the holders’ half of the fees from the moment the splitter pays it until it is spent on ORDEO for the vault. It could stop buying or keep that ETH. It cannot touch notes, the vault or the team’s half. Because fees arrive gradually, its balance stays small.

Team. Receives half of the fees at a fixed address. It holds no key with any power over the contracts.

Bundlers. See your request and the IP address it came from. A bundler can submit or refuse; the recipient, the amount, its fee and a sale’s terms are all beyond its control. It could hold a proof until the root ages out, after which you prove again or submit yourself.

RPC nodes and the sequencer

RPC node. The endpoint your wallet and the app talk to sees your IP, what you read and what you submit. It can refuse or answer wrongly, but signing for you or forging a proof is beyond it, and a wrong tree root is caught by the app’s check.

The chain’s sequencer. Decides the order and the timing of transactions on Robinhood Chain. It can delay or reorder them. Forging a proof, or altering what one binds, is outside its power.

Summary