Block explorers, indexers, analytics firms
All on-chain data: the desk contract as sender, every recipient, amount, token, time, calldata, and every event a contract emits.
HONEST SCOPE.
NOT HIDDEN CLAIMS.
What Raqio protects, and what it cannot. Amounts, timing, the desk contract address and every contract event stay public.
WHO CAN
SEE WHAT.
Raqio is the private execution desk for Elysium. Privacy here means one thing: the wallet that owns the funds or the eligibility does not appear as the destination on-chain. This page preserves the desk threat model kept in the repository.
Validators, sequencers, RPC providers
The same, plus the submitting IP and mempool timing.
Route provider (Relay) and its solvers
For cross-chain legs only: every quote, deposit and fill. Its public request feed lists user → recipient pairs without authentication (verified).
Wallet providers
The connected wallet address, every signed transaction and message, the dapp origin.
Raqio hosting operators
Everything in the database: operations, legs, labels, memos, unrevealed plans, approvals, the original CSV.
Your desk operators and approvers
Everything in your organisation, by design. Viewers see redacted addresses.
DEFINED.
NOT IMPLIED.
Implemented and tested
- Roles (Owner, Desk operator, Approver, Viewer) enforced on the server in every API route.
- Organisation isolation: every query is scoped by the session's organisation, never by a client-supplied id.
- Viewers receive redacted addresses from the API, not only in the UI.
- Four-eyes approval: the last editor of the leg set cannot approve it. DelegatedTreasury enforces the same rule on-chain.
- Approvals bind to a hash of the leg set and are invalidated by any change.
- Append-only audit events for every state change, download and export, enforced by the data layer and by database triggers.
- Labels, memos, unrevealed plan legs and CSV originals are encrypted at rest (AES-256-GCM).
- Rate-limited sign-in and sign-up; the server refuses to start in production with placeholder secrets.
- Idempotency keys and a duplicate-send guard: a leg is never re-sent while its last attempt is pending or unknown.
- Not-before is respected by the worker and, for StealthDesk, by the contract.
Not implemented
- Hiding amounts, timing or the desk contract address. All of it is public on Elysium.
- Hiding the claim link: PrivateClaim emits an event that names both the eligible account and its recipient.
- Mixing, shielded pools, zero-knowledge transfers or any privacy protocol.
- Verifying a recipient for Tokens with transfer restrictions. Transfer restrictions apply; a fresh, unverified address cannot hold them.
- Gasless claims, prize or reward settlement, non-EVM addresses.
- Externally anchored audit storage; per-organisation KMS keys; hardware-key or SSO authentication.
On Elysium
The owning wallet funds a desk contract (PrivateClaim, StealthDesk, OtcEscrow or DelegatedTreasury). Every payout is then a public transfer from that contract to a recipient. The owner is not the destination, but the funding transfer, each payout and each event are visible and can be correlated by amount and timing.
Cross-chain legs
When funds start on another chain, the wallet deposits with Relay on the origin chain and a solver pays the desk on Elysium. The incoming transaction does not name the wallet, but amounts, timing and the provider's public request listing still correlate the two. This is obfuscation against casual inspection, nothing stronger.
PRECISE WORDS.
HONEST LIMITS.
Anonymous. Untraceable. Unlinkable. Invisible. Private transactions. If you see any of these in Raqio, it is a bug.
SEC-01 / ELYSIUM 99801 / USDG / APPEND-ONLY AUDIT / FOUR CONTRACTS