Confidential payroll rails for Safe{Wallet} multisigs.
Safe is the treasury standard for DAOs and startups — and radically transparent by design. Every contributor's comp is public in the signing queue before it's paid, and on-chain forever after.
A DAO ops lead queues the Q3 contributor payroll in Safe. Two signatures away from execution — and every amount is already public in the queue. Competitors, recruiters, and salary-comparing teammates read it straight off the multisig.
"Either I accept the leak, or I ship payroll to a custodial processor — and throw away the multisig guarantees we chose Safe for."
— DAO operations lead · pays 5–50 contributors monthly
Same contracts, same owners, same signing queue. One multisig batch wraps the payroll float (USDC → cUSD) and grants a time-bound, revocable ERC-7984 operator to the PayrollRail. Owners approve who gets paid and a public cap. Line amounts stay encrypted end-to-end — the same roster, three truths.
The public multisig sees recipients and the 25,000 cap. Never a line amount. The queue item owners sign looks like every other.
Each contributor decrypts exactly their own payout — 4,200 from the live Nox gateway. Their teammates can't.
One on-chain grant opens every line to the DAO's auditor — read-only. Etherscan still shows nothing.
Six sealed lines. One is over budget. The contract never learns any amount — it compares in ciphertext, pays the min, and publishes a compliance flag that leaks no number. On-chain, the encrypted-zero line is indistinguishable from any other transfer.
Proposed 26,000 · Paid 24,000 · Cap 25,000 — "spend ≤ budget = true"
Owners sign one familiar queue item — four txs, one signature flow.
Upload a CSV; amounts encrypt client-side, never touch the queue.
Owners approve the hash from the queue; execute pays six lines.
Recipient sees their line; auditor sees all; Etherscan sees nothing.
Cap enforced in encrypted space. Over-cap lines pay an encrypted zero — on-chain indistinguishable from any transfer. No amount ever decrypts on-chain.
addViewer grants each recipient exactly their own line, and the auditor every line — selective disclosure without a registry.
Publishes a "spend ≤ budget" compliance flag anyone can verify — that leaks no line item and not even the total.
Time-bound token authority plus the on/off ramp for the float — the two primitives that make "operator, not module" possible.
Remove Nox and you'd need an FHE coprocessor, a disclosure registry, a custodial processor, and a bespoke audited Safe module — four systems and a worse trust story.