Built for the WTF!! Hackathon · iExec Nox

🏦NoxSafe

Confidential payroll rails for Safe{Wallet} multisigs.

Live on Ethereum Sepolia ERC-7984 · Intel TDX Real 2-of-3 Safe
0xA1…contributor██████
0xB4…designer██████
0xC7…engineer██████
CAP ≤ 25,000✓ true
The one line

Owners approve
the cap.
Nobody reads the salaries.

Safe is the treasury standard for DAOs and startups — and radically transparent by design. Every contributor's comp is public in the signing queue before it's paid, and on-chain forever after.

Problem · the transparency tax NoxSafe · 03

Your treasury is
a poaching list.

A DAO ops lead queues the Q3 contributor payroll in Safe. Two signatures away from execution — and every amount is already public in the queue. Competitors, recruiters, and salary-comparing teammates read it straight off the multisig.

"Either I accept the leak, or I ship payroll to a custodial processor — and throw away the multisig guarantees we chose Safe for."

— DAO operations lead · pays 5–50 contributors monthly

app.safe.global — pending queue (public, pre-execution)
transfer → 0xA1…contributor6,000 USDC
transfer → 0xB4…designer4,200 USDC
transfer → 0xC7…engineer9,000 USDC
transfer → 0xD2…advisor2,000 USDC
↑ Visible to anyone, forever — before a single signature.
Solution · route only the amounts NoxSafe · 04

Keep the Safe exactly as it is —
send only the amounts through Nox.

Same contracts, same owners, same signing queue. One multisig batch wraps the payroll float (USDC → cUSD) and grants a time-bound, revocable ERC-7984 operator to the PayrollRail. Owners approve who gets paid and a public cap. Line amounts stay encrypted end-to-end — the same roster, three truths.

Sealed to the queue

The public multisig sees recipients and the 25,000 cap. Never a line amount. The queue item owners sign looks like every other.

Audience · everyone

One line, per recipient

Each contributor decrypts exactly their own payout — 4,200 from the live Nox gateway. Their teammates can't.

Audience · that recipient

All lines, for the auditor

One on-chain grant opens every line to the DAO's auditor — read-only. Etherscan still shows nothing.

Audience · auditor on grant
Hero moment · cap enforced in encrypted space NoxSafe · 05

The over-cap line pays
encrypted zero — the public flag
stays true.

Six sealed lines. One is over budget. The contract never learns any amount — it compares in ciphertext, pays the min, and publishes a compliance flag that leaks no number. On-chain, the encrypted-zero line is indistinguishable from any other transfer.

// executePayroll — per line, entirely in encrypted space
ebool ok = Nox.le(Nox.add(spent, amt), toEuint256(cap));
euint256 pay = Nox.select(ok, amt, toEuint256(0));
Nox.allowPublicDecryption(ok); // audit, no amount
cUSD.confidentialTransferFrom(safe, to, pay);
RecipientProposedCap ≤ 25kActually paid
contributor██ 6,000true██ 6,000
designer██ 4,200true██ 4,200
engineer██ 5,000true██ 5,000
ops██ 4,800true██ 4,800
writer██ 4,000true██ 4,000
advisor██ 2,000false██ 0  ⛔
ProofΣ 26,0005 × true
1 × false
Σ 24,000 ≤ 25k

Proposed 26,000 · Paid 24,000 · Cap 25,000   —   "spend ≤ budget = true"

How it works · the Safe is never modified NoxSafe · 06
app.safe.global · UNMODIFIED NoxSafe Safe App iframe · safe-apps-sdk encryptInput ×N → sealed roster Safe v1.4.1 (2-of-3) same contracts · same owners two owners sign the batch Recipient decrypt own line Auditor decrypt all lines ETHEREUM SEPOLIA cUSD Wrapper ERC20 → ERC-7984 wraps the float PayrollRail.sol ERC-7984 OPERATOR only le · select · zero exec rights /verify — public judge page RosterProposed · Approved · Paid events · Etherscan links publicDecrypt(okHandle) → cap-compliance, no amounts setOperator(rail, quarterEnd) — from the Safe queue revoke anytime → setOperator(rail, 0) iExec Nox · Intel TDX Nox Gateway TEE ACL + proof validation encrypt / decrypt inside a hardware enclave per-handle viewer ACLs batch tx approve · wrap · setOperator · configure confidentialTransferFrom handles
Live demo · onboard → propose → approve → execute → audit noxsafe.edycu.dev · 07
01

Onboard in one batch

Owners sign one familiar queue item — four txs, one signature flow.

app.safe.global/apps · NoxSafe
1
1 approve(cUSD, float)
2 wrap(USDC → cUSD)
3 setOperator(rail, quarterEnd)
4 configure(treasurer, cap = 25,000)
Sign batch (2-of-3)
02

Propose a sealed roster

Upload a CSV; amounts encrypt client-side, never touch the queue.

app.safe.global/apps · roster
2
0xA1…contributor   sealed
0xB4…designer      sealed
0xC7…engineer     sealed
Propose roster #1  rosterHash 0x9f…
03

Approve & execute

Owners approve the hash from the queue; execute pays six lines.

sepolia.etherscan.io · executePayroll
3
approveRoster(1) — 2-of-3 signed
executePayroll(1) — 6 lines settled
tx 0x62bf1ca4…b093d2
310,617 gas / payout
04

Decrypt & audit

Recipient sees their line; auditor sees all; Etherscan sees nothing.

noxsafe.edycu.dev/verify
4
recipient decrypt → 4,200
auditor decrypt-all → 26,000 proposed / 24,000 paid
cap flags → true×5 + false×1
publicDecrypt: "spend ≤ budget = true"
Trust story · operator, not module NoxSafe · 08

We didn't ask the Safe to trust a module
with its treasury. We delegated a capped, expiring token authority.

The common approach

Enable a Safe Module

  • Grants arbitrary execution rights over the Safe.
  • Blast radius = the entire treasury.
  • Needs a bespoke, separately-audited contract.
  • New trust surface owners must reason about.
NoxSafe

A time-bound ERC-7984 operator

  • cUSD.setOperator(rail, quarterEnd) — expires on its own.
  • Rail holds zero Safe execution rights. USDC is untouchable.
  • Float wrapped = cap, so float ≡ cap.
  • Revoke with one setOperator(rail, 0) from the queue.
Worst case = the approved spend. Nothing more.
Why only Nox · the SDK is the engine NoxSafe · 09
le + select

Cap enforced in encrypted space. Over-cap lines pay an encrypted zero — on-chain indistinguishable from any transfer. No amount ever decrypts on-chain.

per-handle viewer ACL

addViewer grants each recipient exactly their own line, and the auditor every line — selective disclosure without a registry.

allowPublicDecryption

Publishes a "spend ≤ budget" compliance flag anyone can verify — that leaks no line item and not even the total.

setOperator + ERC20→7984 wrapper

Time-bound token authority plus the on/off ramp for the float — the two primitives that make "operator, not module" possible.

Remove Nox and you'd need an FHE coprocessor, a disclosure registry, a custodial processor, and a bespoke audited Safe module — four systems and a worse trust story.

Proof · real 2-of-3 Safe · zero mock data NoxSafe · 10
195
tests green · 67 contract + 128 unit
100%
own-contract coverage · all metrics
310,617
gas / confidential payout
814ms
decrypt p50 · p95 2.0s
Demo Safe (2-of-3)0x3Bd273B4…AFaF9642
PayrollRail0xE7158dAE…5370ED8
ConfidentialUSD (cUSD)0x82C281D7…7468991
executePayroll tx0x62bf1ca4…b093d2
Onboarding batch tx0x682907a5…af72e1
Bench · encrypt ×102.6s · 264 ms/line
✅ Full quarter lifecycle proven on-chain — onboard · propose · approve · execute · decrypt · audit. Not a mock.
Honest limitations · stated, not buried NoxSafe · 11
01
The treasurer sees plaintext amounts client-side.
Inherent to composing a payroll — someone assembles the numbers. The protected asset is the public queue and the chain, and those never see a line amount.
02
The operator grant covers any amount until expiry.
ERC-7984 semantics. Mitigated by short expiry plus wrapping only the float — float ≡ cap, so worst case is still the approved spend.
03
The total float and recipient addresses are public.
Only the line amounts are the protected asset. Who's on payroll and the aggregate budget are intentionally on-chain and auditable.
04
Beta SDK, pinned.
0.1.0-beta.13 locked for reproducibility — with 15 dated frictions filed back to iExec in feedback.md.
The ask

Owners approve the cap.
Nobody reads the salaries.

Add the Safe App to your own test Safe from the README — the full confidential-payroll lifecycle runs live on Sepolia in under 10 minutes. Then tell us where the trust model bends.
NoxSafe 🏦 · WTF!! Hackathon · iExec Nox
Live on Ethereum Sepolia
Real 2-of-3 Safe · zero mocks
195 tests · 100% contract coverage
Scan → noxsafe.edycu.dev
01 / 12
move · P notes · Esc grid
NoxSafe · slide overview — click any slide to jump