Moros - Private Financial Infrastructure on Stellar

Overview

Moros is private financial infrastructure on Stellar Mainnet for Circle USDC. It provides reusable shielded balances, commitment and nullifier notes, zero-knowledge verification, proof relays, encrypted output indexing, and cross-device recovery for private financial applications.

The infrastructure currently powers two production products:

• Moros Pay provides private USDC payments, signed requests, encrypted recovery, and withdrawals.
• Moros Predict provides private USDC prediction markets with pooled liquidity and proof-bound payouts.

Moros won Stellar Build Station Pune 2026 on July 25 after the program ran from July 4 to July 25. It was also selected for the Stellar Builder Residency Jaipur, held from August 21 to August 25, 2026. Both products use real Circle USDC on Stellar Mainnet, while XLM is used only for network fees and account reserves.

The Problem

Public blockchain payments expose a financial graph. Wallets, counterparties, amounts, timing, and repeated activity can be connected into a permanent payment history. A fresh wallet does not solve the problem when every transfer still reveals its source, destination, and value.

Public prediction markets create a related leak. They expose a trader's wallet, side, quantity, timing, and price impact, making copying, front-running, and strategy reconstruction straightforward.

Moros separates private user activity from public solvency. Stellar records the commitments, nullifiers, proofs, and aggregate accounting needed to protect funds without publishing internal payment or position history as plaintext.

Moros Pay

Moros Pay turns the privacy layer into a focused payment experience for Circle USDC.

Users can:

• Create or restore a private identity from recovery words
• Add Circle USDC from an existing Stellar wallet to a reusable shielded balance
• Receive through a rotatable payment code that does not expose a public Stellar account
• Create fixed or open-amount signed payment requests with expiry
• Verify payment codes, request signatures, network, vault, asset, and amount policy locally
• Send private USDC while receiving reusable private change
• Recover encrypted balances, contacts, requests, and payment history across devices
• Withdraw private USDC to a valid Stellar account

Payment links keep the signed request inside the URL fragment, so the request payload is not sent to the web server as part of the path.

How a Private Payment Works

1. Create a Private Identity

The client derives network-scoped spending, viewing, encryption, request-signing, and recovery material locally. A Moros payment code carries the private recipient information needed to create an encrypted output without revealing a Stellar account.

2. Shield Circle USDC

The user authorizes a public deposit into the payment vault. The client creates encrypted outputs for the private identity and binds the transition to a zero-knowledge deposit proof.

3. Verify the Recipient

The sender pastes a payment code or opens a signed request. The client validates its checksum, network, vault, asset, signature, amount policy, and expiry before generating a proof.

4. Prove and Relay

The client selects one, two, or four private input notes, creates recipient and change outputs, and generates the matching Groth16 proof. The relay submits the proof-bound contract invocation without receiving the private witness.

5. Recover and Reuse

The recipient discovers encrypted vault outputs and decrypts matching notes locally. Received USDC can remain private and be reused for another payment. Encrypted sync preserves recovery without giving the database readable balances or history.

6. Withdraw When Needed

The owner proves control of private notes and directs Circle USDC to a Stellar account. Published nullifiers prevent the same notes from being spent twice.

Moros Predict

Moros Predict is Stellar's first private prediction market and the first live financial application built from the Moros privacy engineering.

Users shield Circle USDC once and reuse it across encrypted YES or NO positions, pooled liquidity, claims, refunds, and withdrawals. Orders clear in aggregate LMSR epochs, so the visible probability moves only after a batch executes. Reflector feeds resolve supported crypto, foreign-exchange, and gold markets, while proof-bound claims convert winning positions back into private USDC.

The public chain records market definitions, aggregate execution, collateral accounting, resolution, commitments, and nullifiers. Individual position ownership, side, quantity, and private portfolio history are not published as plaintext.

Zero-Knowledge Architecture

Moros uses 22 Circom Groth16 circuits over BN254 across its two products.

Payment Proofs

Seven payment circuits cover:

• Deposits that convert public Circle USDC into private notes
• Private transfers using one, two, or four input notes
• Withdrawals using one, two, or four input notes

The fixed public statement binds the action, context, membership root, nullifiers, output commitments, encrypted output hashes, attachment hash, and public amount without revealing the private witness.

Prediction Proofs

Fifteen prediction circuits cover:

• Deposits, transfers, withdrawals, orders, claims, and refunds
• Liquidity funding, exits, and redemption
• Execution change and treasury transitions
• Exit requests, cancellations, and matching
• Aggregate batch execution

Moros Pay and Moros Predict use separate mainnet vaults, verifiers, state, and proving manifests. This isolates payment activity from market activity while allowing both products to reuse the same privacy principles and client cryptography.

Infrastructure

The payment layer includes:

• A Soroban payment vault that holds Circle USDC and validates private note transitions
• A Groth16 verifier for the registered payment circuit shapes
• A Rust payment core with WebAssembly bindings for browser integrations
• A payment API and relay for proof-bound contract submissions
• An indexer that discovers encrypted outputs without becoming the source of truth for note ownership
• Ciphertext-only synchronization for private profiles, contacts, requests, receipts, and activity
• Network-scoped manifests that bind every client to one network, vault, verifier, asset, and artifact set

Moros Predict extends the system with a shared shielded market vault, LMSR market contracts, a market factory, pooled and isolated liquidity vaults, a resolver registry, Reflector price resolution, epoch coordination, and automated settlement operations.

Privacy Boundary

Public on Stellar

• Deposits and withdrawals at the public boundary
• Contract addresses, commitments, spent nullifiers, and proof verification
• Aggregate payment vault and market accounting
• Market definitions, batch totals, prices, oracle resolution, and terminal state

Not Published as Plaintext

• Private note ownership and reusable private balances
• Internal payment counterparties and history
• Private contacts, requests, and receipts stored in encrypted sync
• Individual prediction position ownership, side, and quantity
• Private LP shares, claims, refunds, and portfolio history

Tech Stack

• Contracts: Rust, Soroban SDK, Stellar Asset Contracts, and SEP-41 token interfaces
• Proofs: Circom, Groth16, BN254, commitments, nullifiers, and encrypted outputs
• Shared Client Core: Rust, WebAssembly, Poseidon hashing, Baby Jubjub, and canonical CBOR
• Applications: Next.js, React, TypeScript, Stellar SDK, Stellar Wallets Kit, and Tailwind CSS
• Services: Node.js, proof relays, encrypted output indexing, Reflector integration, and automated keepers
• Data: Stellar RPC, Horizon, Supabase Postgres, and AES-256-GCM encrypted synchronization
• Production: Stellar Mainnet, real Circle USDC, Vercel applications, and supervised services

Challenges and Solutions

Private Payments Without Losing Solvency

The payment vault publishes commitments and nullifiers instead of a readable internal ledger. Groth16 proofs bind every state transition, and nullifiers ensure that private notes cannot be replayed.

Private Recipients Without Public Accounts

Moros payment codes carry the private recipient material needed to encrypt an output. Signed payment requests additionally bind the recipient, asset, amount policy, network, vault, creation time, and expiry.

Durable Recovery Without Plaintext Storage

The client encrypts private state before synchronization. Infrastructure can store and return padded ciphertext, but balance ownership, contacts, requests, and payment history are recovered only by the client.

One Privacy Layer, Multiple Financial Products

Payments and prediction markets use separate production contract graphs while sharing the core commitment, nullifier, encryption, proof, and recovery patterns. New financial applications can reuse those primitives without duplicating the entire privacy stack.

What I Learned

• How to design reusable private financial infrastructure instead of a single isolated privacy feature
• How to connect 22 proof circuits, browser cryptography, Soroban contracts, relays, indexing, and encrypted recovery
• How to separate payment and market state while preserving shared engineering across products
• How to operate production Stellar contracts that settle real Circle USDC on Mainnet