How a Hushfund note works.

01Overview

Hushfund is a fixed-denomination private vault for USDC on Ethereum Mainnet. Each deposit creates a note: a secret string generated in your browser. The vault stores only a commitment, a hash of that note, in a Merkle tree. Later you prove with a zero-knowledge proof that you know a note in the tree, without revealing which one.

While deposited, funds are supplied to Aave and a Morpho vault and earn variable yield. You can withdraw a note once, or borrow against it and later repay.

02Fixed deposits

Only native Circle USDC on Ethereum Mainnet (chain ID 1) is accepted. Bridged or wrapped variants, other chains, testnets and L2s are not supported. Each denomination is a separate vault contract; custom amounts are not possible, because fixed sizes are what make deposits indistinguishable from one another.

1. Choose a denomination and make sure your wallet holds that much native USDC.
2. Your browser generates the note secrets and the commitment locally.
3. Save the note, and optionally an encrypted backup, before continuing.
4. You sign a USDC receiveWithAuthorization for exactly the denomination. Its nonce is bound to your commitment, so the signature cannot be reused for a different deposit.
5. The transaction is submitted (by the relayer when gas is sponsored). The vault supplies the funds to Aave and Morpho and inserts your commitment.

The vault records a bucketed yield index with each deposit, so deposits in the same period share an index and look alike.

03Notes, proofs, Merkle tree and nullifier

A note looks like hushfund-usdc-100-ethereum- followed by 256 hexadecimal characters. It encodes the denomination, the network and the secrets behind your commitment.

Withdraw, borrow and repay each require a proof generated in your browser with Barretenberg. The proof shows you know a note in the vault's Merkle tree and binds the exact action details: recipient, relayer, relayer fee, borrow amount, chain and vault. Your note never leaves the browser.

When a note is spent, the contract records its nullifier. Each note can be spent exactly once; a second attempt fails with "note already spent". If the tree changes while your proof is built, the contract may reject an unknown root and the proof must be generated again.

Proof generation is CPU-heavy and may take from several seconds to a minute or more on phones. Keep the tab open and in the foreground.

04Variable yield from Aave and Morpho

Each vault supplies USDC to Aave V3 and to a Morpho ERC-4626 vault. Funds are split in the ratio of the two strategies' indices, and a note's value follows their average (blended) index.

Yield is variable and not guaranteed. It changes with lending market conditions and can fall to near zero. The APY shown in the app is derived from observed history and may report that there is not enough history yet. Past rates do not predict future ones.

The owner may propose moving funds to new strategy contracts. Any migration waits at least 2 days after it is proposed.

05Withdrawal, fees and liquidity

Paste a note, enter a recipient and generate the proof. The contract checks the proof, marks the nullifier as spent and transfers the payout:

payout = denomination × current yield index ÷ note yield index − protocol fee − relayer fee

• Protocol fee: set per vault in basis points by the owner and capped by the contract at 100 bps (1%). The fee in effect when your transaction executes applies.
• Relayer fee: quoted at the time of the action and included in the proof. It may be sponsored at zero, depending on server configuration.
• Rounding: deposits use the next yield-index bucket, so rounding can slightly reduce the payout of an immediate withdrawal. The smallest USDC unit is 0.000001.
• Liquidity: the owner cannot pause withdrawals, but they need enough liquidity in Aave or Morpho at that moment. If a market is fully utilised, try again later.
• A note with an active loan cannot be withdrawn until the loan is repaid.

06Borrowing against a note

You can borrow against a note without withdrawing it. The contract enforces a maximum loan-to-value of 70% of the note's current value. The note stays in the vault as collateral and is locked while the loan is active.

Debt grows at the vault's own blended yield rate from the moment you borrow, so it tracks what the collateral earns. Debt uses upward integer rounding. There is no liquidation mechanism in the contract; the collateral stays locked until repaid. New loans can be paused by the owner.

07Repayment and replacement notes

Repaying requires the collateral note and a proof. You sign a USDC authorization slightly above the current debt (the app adds a 0.1% buffer for blocks mined meanwhile); anything above the exact debt is refunded in the same transaction.

• The old note is retired permanently.
• A fresh replacement note with the same yield index is inserted. Save it before signing, exactly like a deposit note.
• If you lose the replacement note, the old note cannot be used instead.

The replacement gives a later withdrawal a new note identifier, but timing, recipients and other public activity can still reveal a link to the loan.

08Gas sponsorship and its limits

When sponsorship is enabled, deposits and repayments are submitted by the relayer so you do not need ETH for them. Sponsorship is an operational service, not a contract guarantee.

• It is limited by a per-wallet quota for new deposits and loans, and by a shared daily budget.
• Repayments and withdrawals are exempt from the per-wallet quota but still need a valid authorization and remaining budget, and can fall back to requiring your own gas.
• Sponsorship can change or end.