The only Solana unlock that nobody sees coming.
Penumbra is private comp infrastructure for Solana. Token vesting, payroll, and grants all run through one set of rails — unlocks become unobservable, investors still get attestations, contributors never get doxxed. Built on Umbra.
Every Solana token unlock is public. Every cliff gets front-run.
Whale-watchers, MEV bots, and analysts stalk every vesting schedule on chain. Cliffs crater prices before recipients can even claim. Foundations "solve" this by delaying vesting or pre-announcing OTC sales — both terrible. Meanwhile every DAO contributor paid in stablecoins hands a block-explorer their full comp history.
Three modules, one rail
Unobservable token unlocks
Vesting cliffs that complete without a single public observer knowing the size, timing, or recipient. Foundations ship quarterly attestations to investors over scoped viewing keys.
Private payroll & grants
Monthly stipends, research grants, contractor retainers — streamed privately on the same rails. Employers fund once, recipients claim gasless.
Scoped disclosure & tax prep
Contributors issue fiscal-year grants to their accountant. Umbra's MPC re-encrypts just that window. 8949-ready CSVs, nothing more.
How an unobservable unlock flows
- 01Foundation shields tokens
Vesting supply deposited into a PDA-held Encrypted Token Account. Public balance zeroes out.
- 02Program schedules tranches
PenumbraScheduler (Anchor) stores cliff + slope, never amounts. Anyone can poke it to tick.
- 03Keeper ticks
Program CPIs into Umbra: `…EncryptedBalanceToReceiverClaimableUtxoCreatorFunction`. UTXO drops in the stealth pool.
- 04Investor claims
`getClaimableUtxoScannerFunction` + receiver-claimer. Relayer pays gas. Nothing on-chain links to the tranche.
- 05Quarterly attestation
Foundation issues year-scoped TVK to each investor via `getComplianceGrantIssuerFunction`. LP reports ready.
Why this is only possible with Umbra
Encrypted Token Accounts
Every recipient holds an on-chain ETA — amounts Rescue-ciphered, shielded from public indexers.
Stealth Pool UTXOs
Scheduled unlocks land in Umbra's mixer as receiver-claimable UTXOs. Groth16 ZK proofs sever every sender ↔ recipient link.
Hierarchical Viewing Keys
Foundations derive per-investor, per-fiscal-year TVKs from one MVK via a Poseidon hash chain. Transparency for the cap table, invisibility for the market.
PDA-custodied ETAs
Umbra separates spending from decryption — so a vesting PDA can hold funds, the Anchor program can disburse on schedule, and no single key ever sees both.
None of this works on vanilla Solana, on confidential-transfer extensions alone, or on a ZK rollup. Penumbra needs the full Umbra stack: PDA-controllable encrypted balances, stealth-pool UTXOs, and the time-hierarchical viewing-key derivation.