# Monero via Cake Wallet Markdown version of https://l2beat.com/privacy/projects/monero-cake-wallet ## Summary **Warning:** This route has no Ethereum contracts. Real-time monitoring is not supported. - Metrics: Not tracked. Data tracking is not available for this project. - Tracked on: Ethereum - Attributes: Bridged, Transfers, Any amount ### Risks - Privacy: Link privacy. Public observer: Link private (sentiment: good); Chain analyst: Link private (sentiment: good); Network observer: Link at risk (sentiment: warning); Privileged insider: Link exposed (sentiment: bad); Future adversary: Link exposed (sentiment: bad). - Trusted setup: No setup (sentiment: neutral). No setup: This project does not have a ZK system and thus no setup-related trust assumptions. - Exit window: None (sentiment: bad). Funds in transit sit with the swap service, which can steal them. This protocol fails the walkaway test: users cannot fully use it if every centralized participant disappears. Deposit and payout both depend on the swap service. If it stops, funds in transit are lost or refunded at its discretion. - Reproducibility: Partially reproducible (sentiment: warning). Cake Wallet and Monero are open source. The swap services run closed systems. ### About A shielded ledger round trip: Cake Wallet's swap screen moves Ethereum funds into Monero and back, handing each leg to a centralized instant exchange. ### Links - Website: https://cakewallet.com, https://www.getmonero.org - Docs: https://docs.cakewallet.com/features/basic/swap, https://docs.cakewallet.com/support/swap, https://docs.cakewallet.com/features/privacy-and-security/privacy-settings, https://www.getmonero.org/library/Zero-to-Monero-2-0-0.pdf - Repository: https://github.com/cake-tech/cake_wallet, https://github.com/monero-project/monero - Social: https://x.com/cakewallet, https://x.com/monero - Other: https://github.com/cake-tech/cake_wallet/blob/main/PRIVACY.md, https://changenow.io/faq/kyc-aml, https://kycnot.me/service/trocador ## Protocol description Cake Wallet lets users move funds out of one Ethereum address and into a new one through Monero, which hides the path between them. Its swap screen sends the funds to an exchange service that pays out XMR. A second swap later turns the XMR back into an Ethereum asset. Both Ethereum transfers are public. Users trust the swap services, which hold the funds during each swap, and Cake Labs, which ships the wallet and picks the services. A service can hold a deposit until the user passes identity checks, and a party holding the records of both legs can link them. Funds in transit sit with the service, so leaving depends on its payout or refund. ### Architecture Monero hides which output a transaction spends with ring signatures. Each input names 16 outputs, the real one and 15 decoys the wallet picks, and proves that one of them is spent. The rings stay public forever. This protects against observers who see only the chain. Shielded pools such as Tornado Cash, Privacy Pools or Zcash's shielded pool prove membership in the whole pool. A withdrawal there hides among all deposits, even from a party that knows one of them. ### Flow 1. **Quote.** EVM asset to XMR: the app polls every enabled service and takes the best rate unless the user picks one. 2. **Ethereum to the service.** The app sends the amount, the Monero payout address and Cake's API key, for some providers with a markup. The Ethereum wallet address goes along as refund address. The service returns a deposit address it controls. The deposit is a plain, public transfer from the user's wallet. It goes first to the Blink Labs private mempool, on by default, then to the RPC. 3. **Into Monero.** The service sends XMR to the payout address. The transaction hides sender, recipient and amount. 4. **Inside Monero.** The user can self-transfer the XMR any number of times. Outputs unlock after ten blocks. 5. **Back to Ethereum.** From the Monero wallet the user picks XMR to the Ethereum asset. The app sends the Ethereum exit address and, as refund address, a subaddress not yet used for a swap. The service returns a Monero deposit address, the wallet pays it, and the service pays the exit address from its hot wallet. ### App An EVM wallet in Cake has one address. It is sent as refund address on entry, and an exit to the same wallet pays the very address that deposited. On entry, picking an in-app Monero wallet pays to its primary address every time, so a service can tie a user's entries together. [Built-in Tor](https://docs.cakewallet.com/features/privacy-and-security/built-in-tor) is off by default. Without it, the swap services, Blink, Etherscan, the nodes, Cake's price API and Moralis see the user's IP. Moralis receives every Ethereum wallet the app opens, and the app offers no switch for it. With Tor on, every call shares one circuit for up to ten minutes, so each leg needs its own app session. Keeping both Ethereum wallets in the app links them for Moralis whenever both are opened close together. ### Swap services Each service sees its whole leg. The entry service always knows the output it paid, because it created it. The exit service receives the Monero transaction and sees its rings. A party holding both legs therefore finds its payout output in the rings behind the exit. If all of the XMR is paid back, the received amount also matches the payout minus the public fee. Self-transfers in between only widen the search, by about 30 times per transaction. The swap screen lets the user pick a different exchange for each leg. Cake Labs holds no user funds, and the app talks to each service directly. ### Compliance Services can freeze a deposit automatically and hold it for identity and compliance checks, as [ChangeNOW documents](https://changenow.io/faq/kyc-aml). ### Fees Cake ships its API keys, and for some providers a markup, as build secrets, so its share of the fee is set outside the source. ## Privacy **What the protocol promises:** Hides which funds leaving Ethereum come back as which, by passing them through Monero between two custodial swaps. Both Ethereum legs are public. Ethereum is public by default. Each protocol is rated on its main privacy promise, like hiding who paid, who received, how much, or which deposit became which withdrawal. Against each adversary, the colour says whether it holds for a careful user with the app's own settings: green yes, yellow only with significant extra work, red no. Fields marked at risk stay private only under the condition in their note. ### Public observer Link private (sentiment: good) **Who:** Everyone with a block explorer and some basic tools. Sees every public onchain event, but does no correlation beyond following links. Examples: A curious counterparty, an employer, a journalist. The Monero transactions between the deposit into a swap service and the payout from its hot wallet hide sender, recipient and amount. Both Ethereum transfers show address, token and amount. **Advice:** Exit to a new in-app Ethereum wallet made with Create New Recovery Phrase. **Inside** - Sender: private - Recipient: private - Amount: private - Asset: exposed. Only XMR exists inside. The source asset is public on Ethereum. - Link: at risk. An EVM wallet in Cake has one address, so exiting to the wallet that deposited pays the address that deposited. **Sources** - [The deposit is a plain transfer from the wallet to the address the service returned](https://github.com/cake-tech/cake_wallet/blob/7ce3cd75c3fd0c0add1cead41038ab8806ffebde/lib/view_model/exchange/exchange_trade_view_model.dart#L200-L206) - [An EVM wallet has a single address](https://github.com/cake-tech/cake_wallet/blob/7ce3cd75c3fd0c0add1cead41038ab8806ffebde/cw_evm/lib/evm_chain_wallet_addresses.dart#L11-L38) - [Every input names 16 ring members](https://github.com/monero-project/monero/blob/v0.18.5.1/src/cryptonote_core/blockchain.cpp#L3268) - [Amounts are encrypted to the recipient](https://github.com/monero-project/monero/blob/v0.18.5.1/src/ringct/rctOps.cpp#L672-L720) ### Chain analyst Link private (sentiment: good) **Who:** Scrapes all public data and correlates it: timing, amounts, gas and wallet fingerprints, address clusters. Examples: Chain analytics firms, ZachXBT, data brokers. Only amount and timing can pair a deposit into a swap service with a payout from a hot wallet serving every asset the service trades. **Advice:** Withdraw common amounts rather than everything at once. Wait before exiting and pick a different time of day than the deposit. Exit to a fresh address every time and spend from it with a different wallet than the one that deposited. **Inside, compared with a public observer** - Asset: exposed - Link: at risk. A round trip of similar amount and timing pairs the two Ethereum legs. ### Network observer Link at risk (sentiment: warning) **Who:** Sits between the user and the services and sees traffic only: ISPs, VPNs, Tor exits, public RPCs and relayers. Learns IP addresses, timing, fingerprints and ciphertext. Services the operator runs count as the insider. Examples: Infura or Alchemy, a Tornado relayer, a wallet vendor selling telemetry, Google captcha or analytics in the dapp frontend. Built-in Tor sends every call over one shared circuit for up to ten minutes, so only separate app sessions keep the legs apart. Moralis receives every Ethereum wallet the app opens, so deposit and exit wallets kept in the app pair up whenever both open close together. **Advice:** Turn on built-in Tor and restart the app, since the Ethereum client keeps the connection it started with. After the entry, delete the deposit wallet from Cake and restart, so later sessions only see the exit wallet. **Inside, compared with a public observer** - Asset: exposed - Link: at risk. Private only over built-in Tor, with each leg in its own app session. **Sources** - [Built-in Tor is off unless the user enables it](https://github.com/cake-tech/cake_wallet/blob/7ce3cd75c3fd0c0add1cead41038ab8806ffebde/lib/store/settings_store.dart#L1590) - [Opening a wallet connects its node and sends its address to Moralis](https://github.com/cake-tech/cake_wallet/blob/7ce3cd75c3fd0c0add1cead41038ab8806ffebde/lib/reactions/on_current_wallet_change.dart#L94-L113) - [Embedded Tor config: one SocksPort, no isolation flags](https://github.com/cake-tech/cake_wallet/blob/7ce3cd75c3fd0c0add1cead41038ab8806ffebde/cw_core/lib/utils/tor/torch.dart#L65-L70) - [The Ethereum client binds its proxy setting once](https://github.com/cake-tech/cake_wallet/blob/7ce3cd75c3fd0c0add1cead41038ab8806ffebde/cw_evm/lib/clients/evm_chain_client.dart#L24) ### Privileged insider Link exposed (sentiment: bad) **Who:** Holds an operator role, custodies funds, receives keys or plaintext by design, or delivers the client: upgrade admin, custodian, view key holder, enclave operator, association set provider, hosted prover, registry, frontend host. Examples: A compliance backdoor key, a DAO with an upgrade key, a KMS committee, an ASP operator, a custodial bridge. Each swap service custodies its leg and can hold the funds until the user passes identity checks, and identities on both legs link them. The entry service knows the XMR output it paid the user, and the exit service sees the rings of the transaction that pays it. Together they find that output in the rings behind the exit, and self-transfers only widen the search. **Inside, compared with a public observer** - Sender: at risk. Rings that reference the service's payout output point to the spend of the user's XMR. - Asset: exposed - Link: at risk. A service can hold either leg until the user provides identification. **Sources** - [Breaking Monero: poisoned outputs, the attack by a counterparty on both sides](https://www.monerooutreach.org/breaking-monero/poisoned-outputs.html) - [ChangeNOW: automated AML holds, KYC through SumSub, refund minus fees](https://changenow.io/faq/kyc-aml) ### Future adversary Link exposed (sentiment: bad) **Who:** Harvest now, decrypt later. Holds every byte ever published and runs the known quantum attacks: elliptic curves, pairings and RSA fall. Hashes, symmetric ciphers and post-quantum schemes stand until an attack on them is known. Examples: An intelligence agency archiving chain data today, then anyone once a break is public. Whoever breaks elliptic-curve cryptography recovers every Monero output key from public chain data, so every ring shows its real spend. A known address also yields its view key, and anyone learns a service's address by starting a trade. The user's XMR can then be followed from the entry service to the exit service, where amounts and timing pair it with both Ethereum legs. **Inside, compared with a public observer** - Sender: exposed - Recipient: at risk. Readable for outputs to known addresses, and the services know the user's address. - Amount: at risk. Readable for outputs to known addresses. - Asset: exposed - Link: exposed **Sources** - [A key image is the output key hashed to a point times its private key](https://github.com/monero-project/monero/blob/v0.18.5.1/src/crypto/crypto.cpp#L621-L628) - [Zero to Monero: one-time addresses, amount encryption and key images (chapters 4 to 6)](https://www.getmonero.org/library/Zero-to-Monero-2-0-0.pdf) ## Risk summary ### Funds can be stolen if 1. a swap service does not pay out. 2. a service's hot wallet is compromised during the trade. ### Funds can be frozen if 1. a service holds the deposit pending identity verification. 2. a service refunds minus fees and blacklists the deposit address. ### Privacy can be lost if 1. a service holds a leg until the user identifies, since identities on both legs link them (see privileged insider). 2. one party sees both legs, like one service used twice, and finds its payout in the rings behind the exit (see privileged insider). 3. swap services, Blink, Etherscan, Moralis, the RPC and the Monero node see the user's IP, since Tor is off by default (see network observer). 4. elliptic-curve cryptography is broken, which reveals the real spend in every ring (see future adversary). ## Upgrades & Governance Three parties change this swap route, each instantly and offchain since there are no onchain contracts. ### Cake Labs LLC (the wallet) Cake picks the swap services, their defaults and its API keys with each app release. Cake Wallet is MIT-licensed and self-custodial. ### The swap services (the custodians) Each service sets its own terms, limits and compliance rules and can change them at any time. ### Monero (the chain) Rules change through scheduled hard forks. The mainnet table ends at version 16, active since block 2,689,608 (August 2022), with a ring size of 16.