← Back to Archive
Privacy Payments / Solana Case Study

Ghost Pay

A privacy-first payments app live on Solana mainnet: shielded vaults, proof-backed transfers, and viewing keys for the people who still need to see the books.

Built solo for the Superteam Frontier Hackathon 2026.

Next.js Solana Solana Wallet Adapter Zero-Knowledge Proofs

Architecture Overview

A Next.js frontend talking to Solana mainnet through the wallet adapter, with the privacy layer built on top: shielded vaults hold balances, transfers out are authorised by zero-knowledge proof, and recipients claim through stealth UTXOs. Viewing keys are issued separately from spending authority, which is what lets an auditor read an account without being able to move anything in it.

The Challenges

Spending Without Publishing the Ledger

Problem

Solana is a public ledger. A payments app built directly on it exposes every balance and every counterparty by default, which rules it out for payroll or anything else a user would consider private.

Solution

Balances live in shielded vaults rather than in a plain token account, and leaving a vault goes through a zero-knowledge proof instead of an ordinary transfer. The receiving side claims through stealth UTXOs, so neither end of a payment has to be readable to settle it.

Paying People, Not Addresses

Problem

A base58 address is unusable for everyday payments, and it gets worse when the job is paying a list of people rather than one person.

Solution

Payments resolve .sol names, so a recipient is a name instead of a 44-character string, and payment links cover the case where the sender has no address at all. For a list, CSV payroll runs the whole batch in one pass.

Privacy That Still Allows an Audit

Problem

A wallet that nobody can read is unusable for anyone who has to show their books to an accountant, an auditor or a business partner. Privacy that forces you to hand over your keys is not privacy.

Solution

Viewing keys separate the ability to read an account from the ability to spend from it. Issuing one gives a third party read-only visibility into the account's activity, and nothing else.