Treasury
Anyone can check how much came in, how much went out, and which pull request each payout was for.
- Treasury totals
- Published viewing key
- Attestation viewer
Where the money sits
Two Solana vaults collect fees. The enclave’s Zcash wallet pays developers. All three are public; only payout wallets are kept private.
Solana vault (Squads)
Launchpad treasury
At least 50% of every launchpad coin's creator fees
Owed to the repos those coins name, recorded per repo in a public ledger.
D16YwA4Z…4sMvSCSolscanSolana vault (Squads)
Tamga treasury
80% of the Tamga token's creator fees
A general fund: the starter fund, then the matching fund for launchpad repos.
J2yuLeJq…Pv5wmQSolscanZcash, in the sealed enclave
Payout treasury
What the vaults move across to Zcash
Shielded, with its key inside attested hardware. It pays merged pull requests only, and its viewing key is published so anyone can recount it.
The Tamga team’s wallet is public too
It receives the team’s 20% of every launchpad coin’s creator fees and of the Tamga token’s. Anyone can see what it takes in.
Each Squads vault moves money only through a proposal signed by one of its two signers, both held by the Tamga team, and every movement is public on-chain.
How the treasury pays
Two kinds of repo are paid, each from its own money. The rules are part of the policy the enclave runs, and it checks every payout against them.
From the Tamga treasury
Repos on the approved list
- The general fund, fed by 80% of the Tamga token’s creator fees, pays only repos on the approved list.
- The Tamga team picks them by hand: a few starter repos, and the launchpad repos it chooses to match. Nothing is matched automatically.
- Every approved repo gets an equal share of the general fund, within the caps.
- Changing the list means a new enclave policy, published like the rest.
From their own earmark
Launchpad repos
- No approval and no minimum age. People who buy a launchpad coin judge its repo for themselves: naming a repo doesn’t mean its maintainers back the coin.
- Paid only from the repo’s own earmark, the share its coins’ fees put in the launchpad treasury. Never from the general fund, and never from another repo’s earmark.
- Money paid in before NU7 is earmarked to the repo it was deposited for, as soon as the Zcash mainnet treasury goes live.
- The usual checks still apply: the repo is public, isn’t a Tamga team repo and opted in with its own file; issues opened by the pull request’s author are refused; the review wait and the caps apply.
Caps
- Per pull request
- 0.50TAZ
- Per day, every payout
- 1.00TAZ
- Per month, every payout
- 10.00TAZ
- Per repo, per month
- 2.00TAZ
Read from the policy the enclave runs on this network. The daily and monthly caps count every payout, launchpad repos included.
Earmarks are public, signed orders
A launchpad repo’s earmark reaches the enclave as a signed order, published like every other enclave record. Each order is tied to a real delivery at the enclave’s separate launchpad address, so it can only assign money that actually arrived from the launchpad treasury, and only once.
The key that signs orders decides which repo a delivery belongs to. It can’t create, reuse or move any other money. Anyone can recheck every order against the launchpad ledger and the bridge’s public swap records, using the files below.
Orders the enclave accepted
Order 1Test order
16 Oct, 04:55 UTC
1 delivery
- Repo id 90000005550.12TAZ
Totals
As counted by a view-only wallet holding the published viewing key, at height 4,508,119 (16 Oct, 11:29 UTC).
Check the totals yourself
The treasury publishes its full viewing key. It lets anyone see every coin that comes in and goes out. It can’t move funds, and it can’t see which wallet was paid.
- 1
Copy the viewing key
Unified full viewing key, testnetuviewtest1y3lmgty6ujqvtg4wcp0vfqydtc9ar6d2vu0erlzxxaql7uaq4a00zml0gpp6zzmwnpy0s65qml58h4tn0uc77eu97fkhu2wfwl5gyv8ek2rhnkph09gxlc42yksrjfq26wvxxj8ua6syf76d7nhumh74hz5qkjgrskrdhyskz7v6at557p5cpk07fdzlkfr9q4qhzw8vp305yfz67rcx0plc9d3vm9f7a2terna69tae4tw69p0jy3aukxu0tqcr2ezkac0r86ce6zhyf5upjyvdgt757z50anx33ct6p64erp56uses24twxjz5rau75v2d0eph35yujg5rnsvhjn4l3esysw2tswqt763zlh24skdvqw9gvvteyg9ctph0g3memqszhy4x68y9jfr480rum65gnnfe9yj5mwlvfdjpqws37uuggn2e2rnewt3pr2n0lamkjjwfyc9kqxv4qr7my9gw6ngd02dmjhsxltu9typ0rckwwf7a
- 2
Import it into a wallet that can watch a viewing key
Any Zcash wallet or command-line tool that supports view-only accounts will do. Your wallet must support Zcash’s current shielded pool.
- 3
Let it scan, then compare
Its balance should equal the balance above, and the total it has sent should equal total out. Every outgoing transaction should match a payout receipt by its transaction id.
- 4
Look for the payout wallets
You won’t find them. The enclave sends each payout with its outgoing copy discarded, so even the viewing key sees only that money left, and how much. Not which wallet it went to.
The enclave that holds the key
The treasury’s spending key is designed to be created inside attested hardware, and the attestation names the exact code it runs.
- Provider
- Phala Cloud (dstack, Intel TDX)
- Code hash
- cd9aadbd…feccb9
- Enclave key
- b1d2810f…05432a
- Boot record
- cd2d8654…000682
- Report data
- ef28dfec…60a885commits to the enclave key
- Policy
- 43d84bee…fe4beeCaps: 0.50TAZ per PR, 1.00TAZ a day, 10.00TAZ a month
- Payouts
- Running
- Log head
- 9ea894c3…87eb5a16 entries
Checking the hardware itself
Fetch the boot record's quote and check it with the provider's verifier. It ties this enclave key to this code hash on genuine hardware.
Show the full log (16 entries)Hide the log
| # | What | When | Id |
|---|---|---|---|
| 15 | shielding | 16 Oct, 04:57 UTC | 9ea894c3c0…eb5a |
| 14 | earmarks | 16 Oct, 04:55 UTC | aba4750d44…7a34 |
| 13 | upgrade applied | 16 Oct, 04:12 UTC | e76f5a07ed…ca21 |
| 12 | boot | 16 Oct, 04:12 UTC | cd2d86546f…0682 |
| 11 | shielding | 16 Oct, 01:59 UTC | 23617c93d5…9da2 |
| 10 | upgrade applied | 16 Oct, 01:39 UTC | 8c290fb8e7…ad49 |
| 9 | boot | 16 Oct, 01:39 UTC | fcf3bdd2b1…2272 |
| 8 | boot | 16 Oct, 01:33 UTC | 472c40ccf8…7e81 |
| 7 | payout | 14 Oct, 15:48 UTC | ac8ca873cd…5abf |
| 6 | upgrade applied | 14 Oct, 15:47 UTC | 2db73b92f9…ecd6 |
| 5 | boot | 14 Oct, 15:47 UTC | 94fa3ef2f3…348a |
| 4 | boot | 14 Oct, 15:20 UTC | 30703cd168…982a |
| 3 | upgrade applied | 14 Oct, 14:29 UTC | cf86d273f0…09cf |
| 2 | boot | 14 Oct, 14:29 UTC | dcb15b4d3f…6e5c |
| 1 | boot | 14 Oct, 13:36 UTC | c0746e10ab…69f6 |
| 0 | boot | 14 Oct, 13:30 UTC | 5de08d99f9…7921 |
What this can’t do
- Fees sit in the creator wallet on Solana until claimed and bridged; we bridge right after claiming. The bridge (NEAR Omni Bridge) has its own custodians.
- Maintainers are the arbiter. A maintainer could favour friends, or rewrite a contributor's fix enough to avoid the similarity flag. Caps and the public record limit this; there's no dispute arbiter in v1.
- Who did the work and how much they earned are public. Moving the exact amount from the shielded pool to an exchange can link it back.
- Payouts go only to Unified Addresses with an Orchard receiver; your wallet must support Zcash's current shielded pool.
- The operator can stop the enclave, which pauses payouts. It can't move funds.
- Tax and reporting are still yours. This is not a way around tax, sanctions or the law.
- Hosting is paid by the team, not the treasury.