A decentralized protocol on Stellar Soroban that verifies zero-knowledge proofs of stealth payment delivery without ever holding user funds. Funds move peer-to-peer via native Stellar ClaimableBalances. The protocol verifies the math, never the money.
The Pakana Node is the protocol-layer infrastructure for private payments on Stellar. It is built around a single unusual property: it never custodies user funds. Funds move directly between sender and recipient via Stellar's native ClaimableBalance primitive sent to a stealth address. The Pakana Node's only job is to verify, on-chain, that a Groth16 zero-knowledge proof of correct delivery is valid.
Concretely, the Node is three coordinated components: an off-chain Rust ingestor that watches Stellar Horizon for proof submissions, the PakanaTracker Soroban smart contract that performs on-chain ZK verification using Stellar Protocol 25's BN254 host functions, and a fee-bumping relayer that allows users to submit proofs without holding XLM for fees. None of these components has discretionary control over user funds at any point.
The Pakana Node is designed to fall outside Money Services Business and Virtual Asset Service Provider classification. It does not pool, hold, exchange, or transmit user funds. It is a math verifier and a relayer. The architectural separation between fund movement (Stellar native primitives) and proof verification (PakanaTracker) is deliberate and central to the compliance story.
Three primitives compose to produce a private, on-chain-verified payment with no protocol custody.
The sender computes a stealth address from the recipient's public viewing key plus a fresh nonce. Only the recipient can recognize and spend from it. The Stellar ledger sees only an unlinkable address.
Payment is a standard Stellar ClaimableBalance from sender to stealth address. Settlement is final at Stellar consensus. No bridge, no pool, no escrow contract. The Pakana Node never touches the funds.
The sender submits a Groth16/BN254 proof to the PakanaTracker Soroban contract. The contract uses Stellar Protocol 25's BN254 host functions to verify the proof on-chain in a single transaction. Verified proofs gate any downstream action.
The Pakana Node runs as a primary–satellite system to balance authoritative verification against developer accessibility. The Primary Node has no inbound HTTP, performs ingestion and ZK verification, and is the single source of truth. Satellite Nodes are read-only replicas that expose the developer-facing UI and API. This separation means the verification gate cannot be subverted through API abuse, and developer integrations cannot accidentally introduce custody.
| Component | Role | Trust Surface |
|---|---|---|
| Primary Node | Ingest Stellar events, verify ZK proofs, sign fee bumps | No public HTTP; mTLS replication only |
| PakanaTracker | On-chain Soroban contract, atomic ZK-gated verifier | Public; proofs are publicly verifiable |
| Satellite Node | Read-only replica, dashboard, public API | Public HTTP; cannot mutate authoritative state |
| Stellar Network | Settlement and finality of ClaimableBalances | Stellar validators; existing trust assumption |
Each verified ZK proof on the PakanaTracker contract burns a small LBX fee. The fee is split three ways: one third to the Primary Node operator that performed verification, one third to the Satellite Node operator that submitted the proof on the user's behalf, and one third to a bounty and admin pool used to fund security audits, ZK circuit work, and ecosystem grants. Operators are paid for the work they perform. Integrators pay LBX denominated in proofs verified, not in fiat-denominated subscription fees.
LBX is a Stellar-native asset issued from GAYKBKQV56NMAUHFWJX3MM4LEK4HA6A7O5LYYDHQXN4URZAMM4B52BCS. Total supply is fixed and fully distributed to the contract factory account at issuance. There is no inflation, no minting authority retained by the issuer, and no rebasing.
Three production surfaces use the Pakana Node as their verification and settlement layer.
The flagship multiplayer hidden-fleet ZK game. Every move generates a Groth16 proof verified by PakanaTracker. Same circuits, same node, same LBX economy as private payments — proves the protocol generalizes beyond money.
An x402-gated podcast platform where listeners pay USDC per episode via Pakana stealth payments. Disbursements to creators settle through the same Soroban contract used for the protocol's own fee distribution.
Privacy-preserving search and indexing infrastructure. x402 micropayments for premium endpoints route through a Pakana Satellite facilitator, demonstrating how AI agents pay for data access without doxxing themselves.
The Node is open infrastructure. Integrate stealth payments into your application or run a Satellite Node and earn LBX from every proof you submit. Early access for SDK and operator program is open now.