> ## Documentation Index
> Fetch the complete documentation index at: https://docs.confiroll.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Ecosystem and integrations

> Every component Confiroll builds on and exactly how each one is used: Stellar, Soroban, Stellar Wallets Kit, OpenZeppelin, Nethermind, Circle CCTP, and the Stellar Disbursement Platform.

Confiroll composes proven building blocks from the Stellar ecosystem rather than reinventing
them. Each component does one job. This page names every part of the stack and shows how
Confiroll uses it, with links to the deep-dive pages.

## Powered by

<CardGroup cols={3}>
  <Card title="Stellar" icon="star">
    The settlement network. Confiroll settles every confidential payout on Stellar.
  </Card>

  <Card title="Soroban" icon="file-contract">
    Stellar's smart-contract platform. Runs the confidential token, the vault, the payslip
    anchor, and the passkey wallet.
  </Card>

  <Card title="Stellar Wallets Kit" icon="wallet">
    Wallet connection and signing. Connects Freighter, xBull, Albedo, and more.
  </Card>

  <Card title="OpenZeppelin" icon="lock">
    The Confidential Token that hides amounts on-chain.
  </Card>

  <Card title="Nethermind" icon="shield-halved">
    The on-chain zero-knowledge verifier for the confidential token's proofs.
  </Card>

  <Card title="Circle CCTP" icon="arrow-right-arrow-left">
    Cross-Chain Transfer Protocol. Bridges canonical USDC into the confidential balance.
  </Card>

  <Card title="Stellar Disbursement Platform" icon="gears">
    Vendored and headless. Channel-account pool, fee-bump, submit, and retry.
  </Card>

  <Card title="Privy" icon="envelope">
    Email sign-in with an embedded Stellar wallet, no seed phrase.
  </Card>

  <Card title="Noir and bb.js" icon="microchip">
    The proving toolchain that builds each payout's zero-knowledge proof in your browser.
  </Card>
</CardGroup>

## At a glance

| Component                       | What it is                            | How Confiroll uses it                                                       | Learn more                                                     |
| ------------------------------- | ------------------------------------- | --------------------------------------------------------------------------- | -------------------------------------------------------------- |
| Stellar                         | The base settlement network (testnet) | Settles every payout; CAP-15 fee-bumps make actions gas-free                | [Architecture](/developers/index)                              |
| Soroban                         | Stellar smart contracts               | Hosts the confidential token, `CctpVault`, `PayslipAnchor`, `PasskeyWallet` | [Soroban contracts](/developers/contracts)                     |
| Stellar Wallets Kit             | Multi-wallet connect and signing      | SEP-10 sign-in and the Fork B transfer signature (`signTransaction`)        | [Non-custodial model](/developers/non-custodial-model)         |
| OpenZeppelin Confidential Token | Amount-hiding token primitive         | The token Confiroll pays with; register, deposit, transfer, merge, withdraw | [Confidential token flow](/developers/confidential-token-flow) |
| Nethermind                      | Soroban zk verifier                   | Verifies the UltraHonk proofs on-chain; mainnet is gated on its audit       | [Confidential token flow](/developers/confidential-token-flow) |
| Circle CCTP                     | Cross-chain USDC bridge               | Burn, attest, mint into the vault, deposit into the confidential balance    | [Funding](/developers/funding)                                 |
| Stellar Disbursement Platform   | Transaction submission service        | Channel accounts, fee-bump, submit, retry (not its disbursement API)        | [SDP integration](/developers/sdp-integration)                 |
| Privy                           | Email embedded wallets                | Email sign-in that exchanges a Privy token for a session JWT                | [API reference](/developers/api-reference)                     |
| Noir and bb.js                  | zk proving toolchain                  | Builds transfer and withdraw proofs client-side (keccak transcript)         | [Confidential token flow](/developers/confidential-token-flow) |

## Stellar

Stellar is the settlement layer. Every confidential payout, deposit, merge, and withdrawal is
a Stellar transaction. Confiroll runs on the Stellar **testnet**. Two Stellar features are
load-bearing:

* **CAP-15 fee-bumps.** One account pays the network fee for another account's transaction.
  This is how the fee sponsor makes every user action cost **0 XLM**.
* **Source-account authorization.** Because the employer is the transaction source, the
  confidential token's `from.require_auth()` is satisfied by an ordinary envelope signature,
  not a fragile auth entry. This is the basis of Fork B.

The live SDP `stellar.toml` and health surfaces are served from `sdp.confiroll.com`, and the
BFF from `api.confiroll.com`.

## Soroban

Soroban is Stellar's smart-contract platform. Confiroll runs four Soroban components:

<CardGroup cols={2}>
  <Card title="Confidential Token" icon="lock">
    The OpenZeppelin token that holds encrypted balances and hides transfer amounts.
  </Card>

  <Card title="CctpVault" icon="vault">
    The employer-owned landing point for bridged USDC that deposits it into the confidential
    balance.
  </Card>

  <Card title="PayslipAnchor" icon="fingerprint">
    Stores one tamper-evidence hash per payroll cycle, never contents or amounts.
  </Card>

  <Card title="PasskeyWallet" icon="key">
    A seedless contract account authorized by a WebAuthn passkey.
  </Card>
</CardGroup>

All four are immutable and store zero secrets. See
[Soroban contracts](/developers/contracts) for functions, storage, and the on-chain testnet
addresses.

## Stellar Wallets Kit

Confiroll connects wallets with **Stellar Wallets Kit v2.5**, which supports Freighter, xBull,
Albedo, and other Stellar wallets behind one interface. It does two jobs:

<Steps>
  <Step title="Sign-in (SEP-10)">
    The wallet signs a one-time SEP-10 challenge. This proves account ownership and issues a
    session. It moves no funds and costs nothing.
  </Step>

  <Step title="Authorize a payout (Fork B)">
    The wallet signs the confidential transfer's envelope with `signTransaction`. Confiroll
    never uses `signAuthEntry`, which is unreliable across wallets. The employer is the
    transaction source, so a plain signature authorizes the transfer.
  </Step>
</Steps>

<Note>
  Because signing is a plain envelope signature, all major Stellar wallets work, and Confiroll
  can fee-bump the signed transaction without ever holding a key. See
  [The non-custodial model](/developers/non-custodial-model).
</Note>

## OpenZeppelin Confidential Token

The privacy primitive is OpenZeppelin's **Confidential Token**. It behaves like a USDC-backed
token, but balances and transfer amounts are encrypted on-chain. Each account holds a
confidential scalar `sk`, from which the client derives a viewing key `vk`, a spending key `Y`,
and a public viewing key `PVK`. The lifecycle is `register`, `deposit`, `confidential_transfer`,
`merge`, and `withdraw`.

A `confidential_transfer` carries **no plaintext amount argument**: the value lives inside the
proof and the encrypted event fields, readable only with a viewing key. Deposit and withdraw
amounts are public by design. Full detail, including what is public versus hidden at each step,
is on [Confidential token flow](/developers/confidential-token-flow).

## Nethermind

The confidential token's zero-knowledge proofs are generated with **Noir** and **bb.js**
(`UltraHonk`) and verified **on-chain on Soroban** by **Nethermind's verifier**. The proving
transcript uses **keccak** Fiat-Shamir because that is what the on-chain verifier expects; a
proof built with any other transcript fails verification.

<Warning>
  Mainnet amount-hiding is gated on the **OpenZeppelin and Nethermind audit** of the confidential
  token. Until that audit completes, Confiroll runs on testnet and makes no mainnet privacy
  claim. See [Security and claims](/developers/security-and-claims).
</Warning>

## Circle CCTP

To bring canonical USDC across chains, Confiroll uses Circle's **Cross-Chain Transfer Protocol
(CCTP)**. On testnet the source chain is Base Sepolia.

<Steps>
  <Step title="Burn">
    USDC is burned on the source chain.
  </Step>

  <Step title="Attest">
    Circle attests the burn.
  </Step>

  <Step title="Mint into the vault">
    The attested message mints USDC into Confiroll's `CctpVault` contract.
  </Step>

  <Step title="Deposit">
    The vault deposits the USDC into the employer's confidential balance in one call.
  </Step>
</Steps>

The vault is owned by the employer, not Confiroll. See [Funding](/developers/funding).

## Stellar Disbursement Platform

Confiroll vendors the **Stellar Disbursement Platform (SDP) v6.6.1** (Apache-2.0) and runs it
**headless**. It is not used as a disbursement platform. It provides reliable submission
infrastructure only:

<CardGroup cols={2}>
  <Card title="Channel-account pool" icon="layer-group">
    Pre-provisioned accounts that source outbound transactions.
  </Card>

  <Card title="Fee-bump, submit, retry" icon="paper-plane">
    Wraps a queued operation, fee-bumps it from the distribution account, submits, and retries.
  </Card>
</CardGroup>

Confiroll keeps SDP close to upstream with a single patch: the TSS sponsored-transaction
handler accepts an ed25519 (G-address) sponsored account, not only a contract address. See
[SDP integration](/developers/sdp-integration).

## Also in the stack

<CardGroup cols={2}>
  <Card title="Privy" icon="envelope">
    Email sign-in. Privy creates an embedded Stellar wallet and issues an access token that the
    BFF exchanges for a session JWT. See [API reference](/developers/api-reference).
  </Card>

  <Card title="Noir and bb.js" icon="microchip">
    The Aztec proving toolchain. Noir solves the witness and bb.js generates the UltraHonk
    proof, both in your browser, so `sk` and amounts never leave your device.
  </Card>
</CardGroup>

## How they fit together

```mermaid theme={"system"}
flowchart TB
    subgraph Client["Your browser"]
      W["Stellar Wallets Kit / Privy<br/>sign-in + signature"]
      P["Noir + bb.js<br/>build the ZK proof"]
    end
    subgraph Confiroll["Confiroll (holds no user keys)"]
      API["payroll-api (BFF)<br/>session + fee-bump"]
      SDP["Headless SDP<br/>channels + submit + retry"]
    end
    subgraph Chain["Stellar testnet (Soroban)"]
      CT["OpenZeppelin Confidential Token"]
      V["Nethermind verifier"]
      VAULT["CctpVault"]
    end
    CIRCLE["Circle CCTP<br/>burn + attest"]

    W --> API
    P --> API
    API -->|CAP-15 fee-bump| CT
    SDP -->|batch| CT
    CT --> V
    CIRCLE --> VAULT
    VAULT --> CT
```

Sign in with a wallet or email, build the proof in your browser, and Confiroll fee-bumps the
signed transfer onto Stellar, where the OpenZeppelin token executes and the Nethermind verifier
checks the proof. Funding flows in through Circle CCTP and the vault. Confiroll holds no user
keys at any point.