These are the cryptographic primitives the design is built from. Corio has no integrations and no partners.
Rollout
01InkLaunch chain
02BaseThen
03ArbitrumThen
04OptimismThen
Why Ink
Ink names privacy among the principles it was built to bring on-chain, and it hosts no shielded pool today. One chain done properly beats a logo in four grids.
Public now
The client SDK, the protocol design, and the full API reference. You can build against the real interface today, and the interface will not change at launch.
Same everywhere
One pool design, one proof system, one SDK. A note behaves identically on every chain Corio reaches.
The SDK exports the rollout as CHAIN_PLAN, so your code can light up each network as Corio reaches it rather than waiting on an announcement.
What Corio does from day one on Ink.
Spend from an address the chain has never seen beside your deposit.
Prove a note descends from a screened set: provenance, not identity.
Proofs are built client-side. The note never leaves your machine.
One TypeScript SDK is the whole integration surface. Read it today.
Why this design exists
A public ledger leaks more than anyone agreed to.
One address is a permanent, queryable record of your salary, your counterparties, your position sizes and your mistakes.
That was never a decision anyone made. It is a side effect of how the ledger was built.
Anonymity on its own contaminates the people using it.
A pool that proves nothing about where money came from is a pool legitimate users cannot safely enter, because they inherit the reputation of everyone else inside it.
Corio is not a mixer, and the distinction is the whole design: a mixer proves nothing about origin, which is precisely the property this replaces.
Corio’s design separates the two questions.
A spend carries a proof of membership in a screened association set, and nothing else. The verifier learns provenance without learning identity.
The design is public now, so it can be argued with before launch rather than after.
Three ways to move money, compared honestly.
Corio loses two of these rows outright. They are left in, because a column of all-green is a sales table rather than an analysis.
Property
Public wallet
Unscreened mixer
Corio
Custody
You hold the keys
You hold the keys
You hold the keys. No administrative withdrawal path is specified
Who can see your balance
Anyone, permanently
Nobody, while funds remain pooled
Nobody. Balances are commitments in a Merkle tree
Link between deposit and spend
Direct and permanent
Broken, with nothing offered in its place
Broken on-chain. Reconstructable only by you, from your own note
What you can prove about provenance
Everything, involuntarily
Nothing. That is the problem
Membership of a named, screened association set
New trust assumptions
None
The pool contract
Contract, circuit, set curator, and relayer. More than either alternative
Publicly auditable
Fully — it is just the chain
Usually open source
No. Contracts and circuits will be closed source
Where you can use it
Every chain, today
Several chains, today
Coming soon on every major L2, starting with Ink
How it would work.
Four stages, the same on every chain Corio reaches.
You deposit into the pool. The contract records a commitment (a hash of your note) and nothing that identifies you.
Your wallet
Corio pool
Merkle tree
Commitment
Your note stays on your machine. The chain holds only the commitment; the secret that opens it never leaves your device.
Your machine
Note secret
Viewing key
On-chain
Commitment only
To spend, you build a zero-knowledge proof locally: your note is in the tree, and it descends from a screened association set. The witness never leaves the process.
Association set
Screened root
Local prover
Membership proof
A relayer submits the proof so the withdrawal is not paid for by an address linked to you. Recipient and fee are bound into the proof, so the relayer cannot redirect it.
Corio pool
Nullifier spent
Fresh address
Integrate now. Connect on launch day.
The client is public today and its interface will not change at launch. It exports the rollout order, so your code can light up each chain as Corio reaches it.
Clone the repository and read it. A package by this name on a public registry is not ours.
import { CHAIN_PLAN, DEPLOYMENTS }
from"@coriolab/sdk";
CHAIN_PLAN.ink; // "target-launch-chain"
CHAIN_PLAN.base; // "planned"
CHAIN_PLAN.arbitrum; // "planned"
CHAIN_PLAN.optimism; // "planned"// Each chain flips as it goes live, so you// ship once and light up as Corio lands.const live = Object.entries(DEPLOYMENTS)
.filter(([, d]) => d !== null)
.map(([chain]) => chain);
Corio Labs is building a shielded pool, in public, for every major L2.
Public ledgers expose more than anyone agreed to. One address is enough to reconstruct balances, counterparties, position sizes and history, permanently, for anyone who cares to look.
The usual fix trades one exposure for another: attach an identity to every action and let an intermediary vouch for you. Corio separates the two questions instead, proving that funds descend from a screened set without proving who holds them.
The protocol contracts and circuits will be closed source. The client SDK, the protocol specification and the API surface are public and in this repository, published ahead of launch because the API surface determines what the service can learn about its users, and that is worth arguing about before it holds money rather than after.