Built to be verified,
not trusted.
Beil never holds your keys, and its contracts won't move funds without a valid proof from them. Here is how it's tested, where review honestly stands, and what you can check on-chain yourself.
Loading test results…
What's done, and what happens before caps are lifted.
- In progress
Internal adversarial review
Contracts, circuit, SDK and servers reviewed by people other than their authors, with every finding fixed and turned into a regression test.
- In repo
Automated test suite
Six suites in the repository, from circuit witnesses to real Groth16 proofs replayed against the pool contract. The counts below fill in once CI publishes them.
- In progress
BSC mainnet-fork testing
End-to-end runs on a fork of BNB Chain with the real PancakeSwap and Venus contracts: shield, private swap, private lending, exit.
- Single-operator
Trusted setup
Finalized 17 Oct 2026. Phase 1 is the public PSE Perpetual Powers of Tau. Phase 2 was run by the Beil team as a single operator (two contributions), sealed with public drand randomness (round 6558914). It is sound as long as that operator destroyed their contribution randomness; it is not a multi-party ceremony. Final proving key sha256 140aaefc…27e5440. Full transcript and hashes →
- Audit: pending
External audit
An independent audit of the contracts and circuit. The auditor, scope and report will be linked here when it is complete; deposit caps stay low until then.
- Not yet
Mainnet launch
Immutable contracts with a Safe multisig as admin, per-token caps raised gradually, and a launch checklist that must pass first. Launch post (draft)
Every suite, every release.
Tap a suite to see what it covers. The numbers are read from /security/tests.json, which CI rewrites on each release.
Loading…
Guarantees, exercised with hostile inputs.
Each guarantee is tested against the real contracts with inputs that must be refused. We publish what is guaranteed, not how anyone might try to break it.
Every note spends once
Spending a note publishes its nullifier; the pool refuses any nullifier it has seen, and the circuit refuses duplicates within one transaction.
…Only valid proofs move funds
The contract rebuilds all 13 public inputs itself, from the chain id to every amount, and verifies the Groth16 proof against them. Change anything and it no longer verifies.
…Funds go where you said
Recipient, relayer and fee are hashed into the proof. Nobody in between can redirect or inflate them.
…Trades and lending are bounded
Swaps run only through allowlisted adapters, in one transaction; the pool measures what it received and reverts below your minimum output.
…Simple, capped fees
0.3% to shield, trade or withdraw; private sends carry no Beil fee. Each rate is capped at 1% in code, and fees are kept apart from user funds.
…Limited, two-step governance
Admin powers are narrow, can't move user funds, and change hands only when the new holder accepts. Withdrawals can't be paused by the normal pause.
…Unsafe tokens are refused
Every deposit checks the pool's real balance change, so fee-on-transfer and rebasing tokens revert instead of leaving the pool short.
…Spam and capacity limits
Per-deposit limits and per-token caps, field and range checks on every value, and fixed-size ciphertexts on every output.
…No blocking by third parties
A front-run permit can't stop a gasless shield, and nobody can replay a sponsored deposit with their own notes.
…By design
Generated and encrypted in your browser; proofs are built there too. Relayers and indexers never get your keys or learn which notes are yours. Like any server they see your IP address.
There is no function that moves notes without the owner's proof, and no upgrade path to add one later: the contracts are immutable.
PancakeSwap and Venus are reached only through allowlisted adapters that hold nothing between calls.
Anyone can run a relayer or an indexer. The app checks the indexer's data against the root the pool records on-chain, so it can't be shown a balance that isn't there.
Don't take our word for it.
These values are read by your browser directly from BNB Chain, and the proving files are hashed on your device.
Read straight from a BNB Chain RPC endpoint by your browser, not from our servers.
When the pool is live, this panel reads its root, fees, pause flags, owner and treasury directly from the chain. Until then there is nothing on-chain to check, and we won't show placeholder numbers.
Proving keys
- Circuit
- Groth16 · BN254 · 4 in, 3 out · 13 public inputs · tree depth 26
- Published proving key SHA-256
- Published with the setup ceremony
- Published verification key SHA-256
- Published with the setup ceremony
Found something?
Please report it privately before telling anyone else, so users stay safe while it's fixed. Include steps to reproduce and the commit you looked at.
A security contact address will be published here before launch.