A shielded pool on Robinhood Chain, live on mainnet.
0.1 · 1 · 10 ETH. Tokenized stocks next.
Your portfolio shouldn’t be a public wallet. The pool is live on Robinhood Chain mainnet, in three fixed amounts, with nobody holding a key to it. Try it walks you through the whole thing — deposit, receipt, proof, withdrawal — in your browser, with no wallet to connect and nothing to sign.
Treasury · creator fees
— / 2.6 ETH
2.6 ETH deploys the program on mainnet · 2.6 ETH seeds the crowd and opens the pool · Not deployed yet
The creator's own wallet, filled by pump.fun creator fees, read live from the chain. Sending ETH to it buys nothing and gives no right. Deployment costs are rent Robinhood Chain charges for storing the program. LedgerHold is not affiliated with Ledger.
The program is written, the circuit compiles, the code has been through an adversarial review. What stands between it and mainnet is the rent Robinhood Chain charges to store it — the number moving above, read live from the chain.
Now
The program is deployed, the three pools are open, and a deposit and a withdrawal have run through it — the two signatures are above, on an explorer that is not ours.
Now
The proving key came from one machine. A public phase one is open: contribute two minutes of randomness and it stops depending on us. The upgrade authority is revoked once the new key is in — not before, or the weakness would be frozen for good.
Next
A withdrawal you submit from your own wallet links the wallet that paid to the address that received. A relayer sends it for you, its fee sealed in the proof. Then the whole flow moves into the page, so using this stops requiring a terminal.
No dates are promised. If a step cannot be done properly, the honest outcome is that the pool never holds real money.
What exists, what does notOn a public chain, anyone with your address can read every position, every trade and every transfer.
| Asset | Name | Amount | Value |
|---|---|---|---|
| AAPLx | Apple | 120 | $40,639.20 |
| TSLAx | Tesla | 45 | $16,962.75 |
| NVDAx | NVIDIA | 300 | $67,869.00 |
| USDC | USD Coin | 18,250 | $18,246.35 |
| Total | $143,717.30 |
Last transfer 2,500 USDC → 9fQ…T4a
Would you show this to everyone?
A pool hides the middle, not the edges. Send, hold the receipt, withdraw: three things happen, in order, and this site never asks you to approve a transaction.
| Asset | Qty | Value |
|---|---|---|
| AAPLx | 120 | $40,639.20 |
| TSLAx | 45 | $16,962.75 |
| NVDAx | 300 | $67,869.00 |
| USDC | 18,250 | $18,246.35 |
| Total | $143,717.30 |
| Field | You see | Everyone sees |
|---|---|---|
| From | 7xK…92F | 7xK…92F |
| To | Alice | Alice |
| Amount | $16,933.00 | $16,933.00 |
| Asset | AAPLx | AAPLx |
On a public chain, anyone can read your positions and every payment you make.
Public · deposit
Send 0.1, 1 or 10 ETH to the program, from whatever wallet you already use. Three sizes and no others, because an unusual amount is a name. This step is public: your address, the amount, and one fingerprint.
Private
Before you send, your browser draws two random numbers and publishes only their fingerprint. That receipt is the only claim on the deposit — there is no account, no copy, no recovery. Every deposit that joins while you wait is another one yours could be.
Public · withdraw
Paste any address. A proof says you hold a receipt for one of the deposits, without saying which, and a relayer sends it. The destination needs no ETH, no history and no link to you.
A withdrawal proves it belongs to someone in the pool, and says nothing more. So privacy here is arithmetic: the more deposits of your size are waiting, the less your exit says. That also means the pool is weakest when it is new.
See the tickersTokenised stocks already trade on Robinhood Chain. The pool is designed for them later — it is not built for them.
Every Robinhood Chain transaction has a fee payer, written into the chain in the clear. Pay it yourself and that wallet is the link you came here to remove; a fresh destination has no ETH to pay with at all. A relayer submits the proof and takes its fee from the withdrawal. It cannot change where the money goes.
Deposits land on a PDA: a Robinhood Chain address computed from the program itself, with no private key behind it. None was ever possible. There is nothing to steal, leak, seize or walk away with.
Ledger Nano S · model by rtql8d · CC-BY-4.0
No private key exists for the pool address.
One way out: a withdrawal with a valid proof.
The update authority gets revoked before mainnet.
One key survives deployment, so that new deposits can be stopped if a flaw turns up. It cannot move a lamport, cannot block or delay a withdrawal, cannot change the code and cannot see anything hidden. Steal it and you can annoy people, not rob them.
Two random numbers, drawn in your browser, that never leave the page. Whoever holds them can withdraw that deposit; lose them and the ETH stays in the pool for good. There is no reset, because a reset would be the back door this whole design exists to avoid.
Deposit once, and the chain stops being a running account of what you own and who you pay. ETH first, because it is the smallest thing worth auditing. Tokenised stocks are the point of the project, and they are not built.
Requirements, written so they can be checked against the code. Not deployed, not audited.
Read what holdsHolding it opens the pool pages today, and its creator fees are what pay to put the program on mainnet. That is the whole deal until the deploy: you hold, the treasury fills, the program goes up. One cell below is live at launch; the other three wait on a pool that is not deployed.
Live
Creator fees from the token paid the rent Robinhood Chain charges to store the program. That is not a plan, it is the transaction that put the pool on mainnet — and the wallet is on this page. The pool itself is open to everyone: no token is needed to use it, and nothing asks you to connect or sign in.
Planned
Every deposit pays one small fee, and holding the token makes that fee smaller. A lower price is the only reward for using LedgerHold — never a payout.
Planned
Fees pile up on a PDA, an address with no key. Anyone can then call the instruction that buys the token on the market and burns it: not ours to run, not ours to withhold.
Planned
Burn tokens to mint an access key — capped, numbered, yours. It opens the app and lowers your fee for good. It never owns your deposit: a key in a public wallet must not point at what is in the pool, or the pool is pointless.
Planned
The relayer that submits your withdrawal takes its cut from that same fee, sealed inside the proof. It cannot raise it, and it cannot change where the money lands.
Planned. Every step would be an ordinary Robinhood Chain transaction, so the buy and the burn can be read on an explorer, and the total burned shown here would be read from the chain rather than from a database of ours.
No per-user tiers, no history, no account, no profile. The fee is a property of the deposit in front of the program, not of a customer it recognises. A private pool has no business knowing who you are, and a discount must never become the way it finds out.
Nothing marked planned is running: no pool, so no fee, nothing accumulating and nothing burned. The token is not a share, pays no yield, gives no revenue and entitles you to nothing. Its price comes from a market, not from a promise of ours.
What the token doesNot a share. Pays nothing. Promises no return. The pool is not deployed, so its fees and burns do not exist yet. LedgerHold is not affiliated with Ledger.
An illustration of the three moves, with example figures: nothing to approve, nothing signed, nothing on-chain. The mechanism is real; the pool is not deployed.
