NOMAD. Leave no trace.

Every step leaves a footprint

On a public chain, every move you make is written in the sand forever. Your first deposit, your swaps, the wallets you paid, the ones that paid you. Anyone who knows one of your addresses can follow the trail back through your entire history.

Monad is one of the fastest chains ever built: ten thousand transactions a second, parallel execution, near instant finality. That speed is a gift. It also means your trail grows faster here than anywhere else.

NOMAD is the wind that covers your tracks.

What NOMAD is

NOMAD is a set of contracts on Monad with no owner, no pause and no upgrade path. If a token exists on Monad, it can travel with NOMAD, and nobody has to agree to it first.

Three ideas sit at its core:

1. Caravans. Private pools that anyone can open, for any token.
2. Oases. Private swaps between Caravans.
3. The Wind. The privacy that grows as more people travel together.

Caravans

Most privacy protocols decide for you which assets get privacy. NOMAD does not. Anyone can open a Caravan for any token on Monad in a single transaction. Once it exists, anyone can join it.

Joining

When you deposit into a Caravan, your tokens become a note: a commitment only your keys can open. The contract records the commitment in that Caravan's Merkle tree. From outside, nobody can see who owns what, or how much.

What your wallet hands over is a precommitment — Poseidon(pubKey, blinding) — and nothing else. The chain fixes the amount it actually received and the lineage itself, so neither can be forged and neither reveals the owner:

openCaravan(token) -> caravanId

join(caravanId, amount, precommitment)
  label      = Poseidon(caravanId, depositIndex)
  commitment = Poseidon(amount, caravanId, label, precommitment)
  tree.insert(commitment)

Travelling inside it

To send tokens privately, your wallet produces a zero knowledge proof: these notes exist, they are mine, they have not been spent. The contract checks the proof and records a nullifier for each note so it cannot be spent twice. Sender, receiver and amount stay hidden.

travel(caravanId, proof, ext)
  require tree.isKnownRoot(proof.root)
  require !spent[nullifier]  for each
  spent[nullifier] = true
  tree.insert(commitment)    for each

Leaving it

You can leave a Caravan to any fresh address on Monad. The link between the wallet that joined and the wallet that leaves is gone, like footprints after the wind.

Trails

A note carries the lineage of the deposit it came from, and every note a travel creates inherits it. That means your balance in a Caravan is held as one trail per deposit, and a single transaction spends from one trail.

It is a real constraint, and it buys something real: because lineage survives every move, a withdrawal can say which set of deposits it descends from. Without that, an association claim would mean nothing.

Mirage: one name, endless paths

Share one NOMAD address publicly. Every payment sent to it lands on a new one time address that only you can find and spend.

Ten people can pay you ten times, and on chain it looks like ten unrelated wallets. You receive in public. You hold in private.

The scheme is the one described in ERC-5564, over secp256k1. The payer takes an ephemeral key, multiplies it by your viewing key, and offsets your spending key by the hash of the shared point:

S       = ephPriv · viewPub
k       = keccak(S)
stealth = addr(spendPub + k·G)
announce(stealth, ephPub, viewTag = k[0])

You recover the same point from the other side with your viewing key. The viewTag is the first byte of the hash, so your wallet skips 255 of every 256 announcements without touching the curve at all.

Oases: private swaps

A nomad does not only travel. A nomad trades. Oases let you swap between Caravans without ever stepping into the open — private MON for private USDC, or any token for any other, while both sides stay shielded.

Orders are gathered into a batch and settled together through Uniswap v4, at one rate for everybody in it. Monad's parallel execution is what makes this work: batches settle in about a second, so privacy does not cost you speed.

Orders go in standard rungs — 1, 2 or 5 times a power of ten — so two orders of the same size are, on chain, the same thing twice. That is what makes a batch unpickable, and it is why the app asks you to split a swap across rungs rather than typing an arbitrary number.

Settling is permissionless and paid: anyone can do it once the window has passed, and takes a small cut out of the output for the trouble. If a batch is never settled — a pool went dry, a route was wrong — it can be turned around after a week and every order comes back, one for one, as a note in the Caravan it came from.

The Wind

Privacy is a crowd. When ten people share a Caravan, a withdrawal could belong to any of ten deposits. When ten thousand share it, any of ten thousand.

Every new traveller makes everyone already inside harder to follow. Every token that gets its own Caravan brings new people into the desert. That is why NOMAD is permissionless: the more assets can travel, the more people travel, and the stronger the Wind blows for all of them.

Private, but provable

Covering your tracks does not mean hiding from everyone. NOMAD gives travellers tools to prove what they choose.

View keys

Share a read only key with an accountant, an auditor or a partner. They see your path. Nobody else does.

Association sets

When you leave a Caravan, you may prove that your funds descend from a set of deposits that excludes flagged addresses, without revealing which deposit is yours.

Anyone may publish a set, and the claim is always optional. A set that one party could switch off would be a gate, and a gate is the thing NOMAD does not have: with no claim at all, the withdrawal still goes through. What a traveller chooses is whether to say where their funds came from.

Proof of payment

Prove a specific payment was made, without exposing your balance or the rest of your history.

You decide who sees your footprints. By default, the wind takes them.

Guides: relayers that leave no link

Leaving a Caravan to a fresh address raises a question: who pays the gas? If you fund the new address from your old wallet, you just redrew the trail.

Guides solve this. They submit your transaction and pay the gas, and take a small fee from the note itself. Your new address never needs to be funded from a known wallet.

A Guide cannot steal: the fee goes to the address you signed into your own proof, in the same transaction, and nothing else about the note is theirs to touch. What they can do is waste a submission, and that is what the bond is for. Guides stake $NOMAD to operate; a Guide that misbehaves loses part of it, and what is taken is burned rather than paid to anyone, so nobody is ever rewarded for finding fault.

$NOMAD

One billion, minted once, in the constructor. No mint function, no owner, no pause, no blacklist, no transfer hook. There is nothing in the token that anyone — including whoever deployed it — can turn against a holder.

1. Fees. NOMAD charges where an amount is already public: joining, leaving, and settling an Oasis batch. A travel inside a Caravan is free, because its amount is hidden, and a percentage of a hidden number is not something that can be taken honestly. What the protocol earns goes to $NOMAD stakers.
2. Guides. Relayers bond $NOMAD to operate and earn relay fees from the notes they carry.
3. Governance. Holders vote on fee levels, on which association set providers are recommended, and on whether a misbehaving Guide loses part of its bond.

The Council cannot call an arbitrary address with arbitrary calldata — that shape is a back door however it is labelled. It has five typed actions on three known contracts, each already bounded by that contract's own immutables. The worst a captured Council can produce is fees at their 1% ceiling and a slashed Guide. It cannot touch a Caravan, cannot pause anything, and cannot stop anyone leaving.

What stakers earn depends on how much NOMAD is used. Nothing is fixed, nothing is promised.

What this does not do

Zero knowledge circuits are complex. NOMAD's are small, pinned to a ceremony whose final randomness is a Monad block hash anyone can check, and exercised against real proofs in the test suite — but they are software, and software has bugs.

Privacy also depends on how you use it. Joining and leaving with the same amount a minute later gives away more than any explorer could. A Caravan with few travellers offers little cover. A trail that always moves in round numbers is a signature.

And privacy tools are regulated differently around the world. Know the rules where you live.

Nothing here is financial advice.

Walk on

The desert is open. Any token. Any traveller. No permission needed.

Move as fast as Monad allows, and let the wind do the rest.

NOMAD. Leave no trace.