Privacy model
Venuo protects the mapping between a contribution commitment and its later claim.
Protected property
A valid claim proves that an entitlement exists in the finalized sale set without publishing which commitment is being spent. The proof is bound to the selected destination, and a one-time nullifier prevents reuse.
| Protected | Still visible |
|---|---|
| Which commitment produced a claim | Funding wallet and contribution amount |
| Direct contribution-to-destination mapping | Sale and contribution timing |
| Claim redirection by a copied proof | Claim destination and allocation |
| Repeated use of one entitlement | RPC, relayer, browser, and device metadata |
Effective claim set
Privacy depends on the set of sale commitments that remain plausible sources for a claim, not on raw participant count. That set shrinks with a thin sale, a claim submitted immediately after close, shared browser/RPC/relayer identifiers, or funding the destination from the contribution wallet. Its size is not a probability of identification — one strong external link can outweigh a large onchain set.
Participant behavior
- Use a fresh destination that is not funded by the contribution wallet.
- Avoid reusing identifiers across contribution and claim sessions.
- Do not consolidate the claimed tokens immediately into a known wallet.
- Protect the claim secret and its backup as spend authority.
Risks
Private allocation removes one public link; it does not remove the ordinary risks of token sales or public blockchains. The claim secret controls the entitlement — losing it may block a claim or refund, and disclosing it may let another party use it. Token value, liquidity, and creator statements are independent risks Venuo does not control. Sale funds and inventory also depend on program logic, account validation, and Solana network behavior.