The UX Problem With Privacy Wallets
Most privacy-preserving blockchains ask users to start from scratch. A new seed phrase. A new desktop or mobile app. A new mental model for how custody works. A separate balance to manage. For most people, this is where the story ends — not because they don't want privacy, but because the cost of adopting an entirely new wallet stack is too high.
The result is that on-chain privacy remains a feature used almost exclusively by people who already understand cryptography. Everyone else just accepts transparent transactions as the default, even when they'd prefer not to.
Sanect takes a different approach. Shielded transfers on Sanect work with MetaMask — the wallet you already have. No new seed phrase. No new app. No second identity to manage.
The Sanect Approach: Derive From What You Have
The insight is straightforward: your MetaMask key already controls entropy you own. Instead of asking you to generate and secure new key material, Sanect derives privacy keys deterministically from a MetaMask signature.
When you want to use shielded transfers, the Sanect dApp requests a personal_sign of a fixed, domain-separated derivation message. You sign it in MetaMask exactly as you'd sign any other message — one click, one confirmation. No gas, no transaction. Just a signature.
From that signature, the browser runs HKDF-SHA256 to derive two keys:
- Viewing key — lets you see your incoming shielded notes, but cannot spend them
- Spending key — derived from the viewing key, signs withdrawals from the shielded pool
Both keys are computed entirely client-side and never leave your browser. The dApp discards them when the session ends. The next time you visit, you sign the same derivation message again and recover the same keys deterministically.
The Derivation Message
The message signed is a fixed, human-readable string that is domain-separated for Sanect. It never changes. This means the keys derived are stable across sessions, devices, and dApp versions — as long as you use the same MetaMask address.
Because the derivation is deterministic, losing your viewing key is not a disaster. Sign the derivation message again from the same address and you recover it instantly.
What a Viewing Key Is — and Isn't
A viewing key gives read access to your shielded balance. Specifically, it lets you trial-decrypt the encrypted memos attached to shielded notes on-chain. When you find a note that decrypts cleanly, you know it was sent to you.
A viewing key cannot spend funds. You can hand your viewing key to an auditor or a tax tool and they can see what you received without any ability to move your assets. This is a meaningful privacy property: selective disclosure is possible without custody risk.
The spending key is what authorizes withdrawals. It signs the UltraHonk proof that proves you own a note and are entitled to spend it. The spending key is derived from the viewing key, so both are always recoverable from your MetaMask signature.
The Shielding UX, Step by Step
- You click Shield in the Sanect dApp and specify an amount
- The dApp calls
personal_sign— MetaMask shows you the derivation message - You confirm. Keys are derived via HKDF-SHA256 in-browser
- The dApp constructs a shielded note and generates an UltraHonk proof locally via Noir's WASM prover
- The transaction is broadcast: your SNCT is locked in the ShieldedPool contract and the commitment is added to the on-chain Merkle tree
From this point, the note is in the shielded pool. Your address is no longer linked to what was sent or to whom it may eventually be transferred within the pool.
The Privacy Guarantee and Its Limits
Once funds are in the shielded pool, the sender-receiver link is broken. On-chain observers can see that some address deposited some amount, but they cannot determine who the note is addressed to, and they cannot correlate deposits to withdrawals without external information.
What remains public: deposit amounts, withdrawal amounts, and the timing of both events. Sanect does not claim to hide amounts — only to sever the on-chain link between sender and recipient. Users who require amount privacy should wait for a future note-splitting mechanism.
For most practical use cases — shielding salary payments, moving funds without broadcasting your holdings to every counterparty you interact with — the current model is a significant and usable improvement over fully transparent transactions.