Seedelf Wallet

A Cardano wallet with a private balance built in. Stake and send in public, or pay anyone privately through Seedelf.

Seedelf Wallet is a Cardano wallet with a private balance built in: Seedelf, the stealth wallet on Cardano. It's one wallet with two sides: a public account for everyday Cardano, and a private balance where no UTxO says who owns the money. It runs on Cardano mainnet, with real ADA. To try it without real money, switch it to preprod, Cardano's test network, on the welcome screen or in Settings, with a recovery phrase you don't use on mainnet: the same phrase has the same keys on both networks, so anyone comparing them can tell they're one wallet's. ADA there is test ADA, from the Cardano testnet faucet, with no value. The wallet marks preprod on every screen. Seedelf hides who owns money. Each payment to a Seedelf reaches its owner under a fresh copy of their key, so no UTxO says who owns it, and payments to the same Seedelf can't be linked to each other. Spending is proven with a zero-knowledge proof and a one-time key, so it doesn't reveal the spender either. What you can do: • Create a wallet, or restore one from a 12, 15 or 24-word recovery phrase, and lock it with a password. • Use its public accounts: normal Cardano accounts that any wallet can pay, and that pay any address, ADA Handle or Seedelf, several at once. A phrase from Lace or Eternl opens that wallet's accounts, and the wallet finds the ones the phrase has used. • Stake the public account with a pool, from a list of every live pool, and spend or withdraw the rewards. • Delegate its voting power: always abstain, always no confidence, or a DRep you find by name. • Be your own DRep: register the public account, vote on the open governance actions, and retire to get the deposit back. Governance sites such as GovTool can connect too, when you allow it. • Create a Seedelf: a name you give out so that anyone can pay you privately. • Make ADA and tokens private: move them from the public account into your private balance. • Send privately to any Seedelf by its name, several at once. • Make money public: pay any Cardano address or ADA Handle from the private balance. Or remove a Seedelf. • Connect Cardano sites (dApps) to the public account, as with any Cardano wallet, or to a private session: a one-time account funded from your private balance, so the wallet gives the site only that account, not your public account. Its funding is public, though, and money you made private yourself leads back to your public account. It's off until you turn it on in Settings, and sites are never given the private balance. • Swap privately through Minswap: each swap runs from a new one-time account, funded from your private balance, and everything comes back into it afterwards. Your public account isn't in the swap's transactions, though anyone can follow the money back through its funding. The wallet asks Minswap for an order with the least you'll accept, checks where the transaction Minswap builds pays, and shows what the swap will cost before you approve it. • Mix through Lovejoin: the spare ADA a private session brings back goes through Lovejoin, a mixer of 10 ADA boxes on Cardano, so what comes back is harder to tie to the session on chain. You can turn that off in Settings, or bring any one back directly. You can also mix from the Lovejoin tile. Lovejoin has had no third-party audit, only its makers' own review, and the wallet says so where you choose it. On mainnet the wallet mixes only once Lovejoin's pool holds 30 boxes that aren't yours, so there are enough other boxes to mix with; until then a return comes back directly and says why. • Read any transaction before it is signed, on every review and when a site asks for a signature: where the money goes, what contracts run and with what data, the certificates, the note and the metadata, and the raw bytes if you want to take them elsewhere. Nothing is looked up to show it, so reading a transaction tells nobody that you read it. • Use it in English, Spanish or Japanese: it follows Chrome's language, and Settings changes it. What it doesn't hide: • Amounts, tokens, timing and which transactions spend which outputs are public, as with any Cardano wallet. • Making money private, and making it public again, link your public account to what you move. Each screen says what it links, and the wallet warns you before a step ties your accounts together. • The server the wallet reads Cardano through sends every transaction, and giveme.my, the collateral service we run, sees every private one, both from your IP address. So they can tie your private payments and Lovejoin boxes to your public account: Seedelf and Lovejoin hide them from people reading the chain, not from the services that carry them. • A Lovejoin box hides only among other people's boxes that come back into a Seedelf around the same time, one of up to 9 at the default depth, and fewer while few people use it. • Privacy grows with the number of people who use Seedelf and Lovejoin, and today there are few. Private money earns no staking rewards: it has no staking part, which is what keeps your Seedelfs from being linked together. Money that sits can stay staked in the public account, and be made private when it should move privately. How it works: • Everything is built and signed inside the extension. The cryptography and the transaction building are Rust, compiled to WebAssembly and shipped in the package. • Your recovery phrase never leaves your device. It's encrypted with your password (Argon2id and ChaCha20-Poly1305). • The wallet talks to a few services, and each sees your IP address. On mainnet, our own server reads the chain and submits your transactions, and logs neither your IP address nor what you ask; Koios, a public Cardano API, reads and submits on preprod, and on mainnet for anything ours can't answer, or for everything if you turn ours off in Settings. giveme.my, which we run, adds shared collateral to private payments, so your own address stays out of them, and sees each one. CoinGecko gives ADA's price on mainnet, unless you choose no currency. Minswap quotes and builds your swaps, only when you swap. Blockfrost's IPFS gateway gives an NFT's image, only when you press Show image on it. Lovejoin is a contract on the chain, reached through those servers. • It adds nothing to web pages unless you turn on connecting sites. Then it adds only the standard Cardano wallet entry (window.cardano) to https pages, so any https site can see you use Seedelf Wallet, as with any Cardano wallet, and it asks you before anything is signed. • There's no sign-up, and no analytics or tracking. Open source (MIT): https://github.com/logical-mechanism/Seedelf-Wallet