NoxSafe
Confidential payroll rails for Safe{Wallet} · iExec Nox · ERC-7984
Live on SepoliaSafe · ERC-79842-of-3 multisig
Confidential payroll for Safe · iExec Nox
Owners approve the cap.
Nobody reads the salaries.
Pay DAO contributors from your Safe with every amount encrypted end-to-end. Owners approve who gets paid and a public budget cap — individual salaries stay sealed, enforced against the cap in encrypted space, visible only to each recipient and an auditor you choose.
The devastating detail: an over-cap line pays encrypted zero while the public “spend ≤ budget” flag stays true — verifiable, and it leaks no amount.
Roster #1 · one view, three truths
Ada
Dev · 0x4cd3…46FF
0x9f3a··2b1c
Mirayou
Designer · 0x2641…Ea7A
0x9f3a··2b1c
Wren
Writer · 0xd37D…611E
0x9f3a··2b1c
Probe
Over-cap · 0xaeF5…980f
0x9f3a··2b1c
spend ≤ cap ✓ TRUE
Public + Etherscan see only sealed handles and the green cap flag — never a single amount.
Verify every claim yourself — zero mock
Live proof, not a mock
The full quarter lifecycle is proven on Ethereum Sepolia, governed by a real 2-of-3 Safe. Every stat below is reproducible — open
/verify for the on-chain event stream and tx hashes.Sepolia
Live on Ethereum
2-of-3
Real Safe multisig
0
Tests passing
0%
Contract coverage
The one flow — narrow and deep
One multisig batch onboards the rail
From there payroll runs on the queue the owners already know.
1
Wrap float → cUSD
USDC wraps 1:1 into confidential cUSD (float ≡ cap).
2
Grant time-bound operator
setOperator(rail, quarterEnd) — revocable, no Safe module.
3
Owners approve cap + roster
Two owners sign the who + the public cap; never the amounts.
4
Execute — amounts sealed
Per line: over-cap pays encrypted zero, cap flag stays true.
5
Auditor reads all lines
Per-handle viewer ACLs — recipients see one line, auditor sees all.
The product · runs inside app.safe.global
Try the treasurer flow
The treasurer experience lives in an iframe inside the unmodified Safe UI. Everything below is proposed to the owners as standard queue items — the trust flow never changes.
Read-only storyboard of a flow that is already live on Sepolia (no wallet/env needed to browse). The roster builder parses your CSV for real; the primary buttons reveal the real on-chain tx that performed each step. Full multisig run:
npm run e2e:safe. Proof in /verify.Set up confidential payroll
Meridian Collective · one multisig batch · owners sign the queue item they already know.
Budget cap (public)
25,000.000000 cUSD
Float to wrap
25,000.000000 cUSD float = cap
Operator expiry
2026-09-30
| # | Call | Why |
|---|---|---|
| 1 | usdc.approve(cUSD, 25,000) | let the wrapper pull the float |
| 2 | cUSD.wrap(safe, 25,000) | USDC → cUSD 1:1 (float ≡ cap) |
| 3 | cUSD.setOperator(rail, 2026-09-30) | time-bound, revocable operator |
| 4 | rail.configure(treasurer, 25,000) | treasurer + PUBLIC budget cap |
Blast radius if the rail misbehaves = the wrapped float, which equals the approved cap. The Safe’s unwrapped USDC is untouchable.
Why judges can trust it
Every claim is on-chain-checkable
On real infra
Not a stub
The full confidential-payroll lifecycle runs on Ethereum Sepolia, governed by a real 2-of-3 Safe. Onboard, propose, approve, execute and audit each land a real proof transaction on Etherscan.
On your Safe
Nothing modified
The rail holds zero Safe execution rights — it is a time-bound ERC-7984 operator, not a Safe module. Same contracts, same owners, same signing queue. Revoke with one setOperator(rail, 0).
Honest by design
Amount-privacy, stated plainly
Recipients and the public cap stay public; the treasurer sees plaintext client-side while composing payroll. We say so here, in the README and in /verify. No overclaiming.
How it works · FAQ
Straight answers
Every one backed by the on-chain proof in
/verify.Does it change our Safe?
No. The rail holds zero Safe execution rights — it is a time-bound ERC-7984 operator(
setOperator(rail, quarterEnd)), not a Safe module. Same contracts, same owners, same signing queue. Revoke any time with one setOperator(rail, 0) from the queue.Can the rail drain the treasury?
No. Its worst-case blast radius is the wrapped float, which the app sets equal to the approved cap (
float ≡ cap) — so the worst case is the approved spend. The Safe’s unwrapped USDC is untouchable.Are salaries hidden?
Yes. Amounts are sealed end-to-end via Nox confidential tokens (ERC-7984) and the budget cap is enforced entirely in encrypted space (
le+select). The multisig queue shows who gets paid and the public cap — never how much.What happens to an over-cap line?
It pays
encrypted zero via select — on-chain indistinguishable from any other payout — while the publicly-decryptable “spend ≤ budget” flag stays true and leaks no amount.Who can read the amounts?
Each recipient decrypts only their own line via per-handle viewer ACLs; an auditor can be granted all lines if the DAO chooses. The treasurer sees plaintext client-side while composing payroll (inherent to building it).
Is this a mock?
No — it is live on Ethereum Sepolia via a real 2-of-3 Safe running the full confidential-payroll lifecycle on-chain, with 195 tests green and 100% contract coverage. See /verify for the real tx hashes on Etherscan.
Ready when you are
Pay a number only the right people can read.
Owners approve the cap and the roster on the queue they already know. Every salary stays sealed, enforced against the cap in encrypted space — live on Ethereum Sepolia.