# Monero via Cake Wallet Markdown version of https://l2beat.com/privacy/projects/monero-cake-wallet ## Summary **Warning:** This route has no Ethereum contracts. Real-time monitoring is not supported. - Metrics: Not tracked. Data tracking is not available for this project. - Tracked on: Ethereum - Attributes: Bridged, Transfers, Any amount ### Risks - Trusted setup: No setup (sentiment: neutral). No setup: This project does not have a ZK system and thus no setup-related trust assumptions. - Exit window: None (sentiment: bad). No contract and no delay. The swap service can hold funds in transit. Cake can change providers with an update. This protocol does not pass the walkaway test: users cannot fully use it if all centralized protocol participants disappear. Deposit and payout both depend on the swap service. If it stops, funds in transit are lost or refunded at its discretion. - Privacy: Link privacy. Public observer: Link private (sentiment: good); Chain analyst: Link private (sentiment: good); Network observer: Link exposed (sentiment: bad); Privileged insider: Link exposed (sentiment: bad); Future adversary: Link exposed (sentiment: bad). - Reproducibility: Partially reproducible (sentiment: warning). Cake wallet and Monero are open source. Every service that swaps Monero is a closed exchange. ### About A round trip from Ethereum into Monero and back through the swap screen of Cake Wallet, which hands each leg to a centralized instant exchange. Monero's ledger serves as the privacy pool. ### Links - Website: https://cakewallet.com, https://www.getmonero.org - Docs: https://docs.cakewallet.com/features/basic/swap, https://docs.cakewallet.com/support/swap, https://docs.cakewallet.com/features/privacy-and-security/privacy-settings, https://www.getmonero.org/library/Zero-to-Monero-2-0-0.pdf - Repository: https://github.com/cake-tech/cake_wallet, https://github.com/monero-project/monero - Social: https://x.com/cakewallet, https://x.com/monero - Other: https://github.com/cake-tech/cake_wallet/blob/main/PRIVACY.md, https://changenow.io/faq/kyc-aml, https://kycnot.me/service/trocador ## Protocol description Monero via Cake Wallet can be abstracted as a privacy pool with Ethereum as its base: a centralized swap service takes Ethereum assets and pays out XMR into Monero. To come back, XMR goes to a swap service that pays out to any Ethereum address. Cake Wallet, a self-custodial multi-currency wallet, holds both wallets and embeds both swaps. No Ethereum contract is involved. The service is a custodian for the duration of each swap. ### Flow 1. **Quote.** EVM asset to XMR: the app polls every enabled service and takes the best rate unless the user forces one. 2. **Ethereum to the service.** The app sends amount, Monero payout address, the Ethereum wallet address as refund address, and Cake's API key, for some providers with a markup. The service returns a deposit address it controls. The deposit is a plain, public transfer from the user's wallet, sent first to the Blink Labs private mempool (on by default), then to the RPC. 3. **Into Monero.** The service sends XMR to the payout address. The transaction hides sender, recipient and amount. 4. **Inside Monero.** Every spend names 16 earlier outputs, the real one and 15 decoys picked by the wallet. Outputs unlock after ten blocks. 5. **Back to Ethereum.** From the Monero wallet the user picks XMR to the Ethereum asset. The app sends a subaddress not used for a swap before as refund address, and the Ethereum exit address, receives a Monero deposit address from the service and pays it from the Monero wallet. The service pays the Ethereum address from its hot wallet. ### Architecture Monero hides which output a transaction spends with ring signatures: each input names 16 outputs and proves that one of them is spent, without saying which. The rings stay public forever. This works against observers who do not know where the coins came from. It fails against anyone who knows one of the outputs, because they only have to look for it in the rings behind a later transaction. A privacy pool entry is always such a known output. Here the swap service creates the payout. With an onchain bridge as base, everyone would know it. The exit is known as well: the exit service receives the Monero transaction and sees its rings. So a party holding both legs, or a screening vendor both services use, finds its payout output in the ring of the exit transaction if the XMR is paid straight back, and the payout amount minus the public fee if all of it is paid. Self-transfers in between only widen the search, by about 30 times per transaction. Over the week to block 3,772,293 (September 2026), a service creating one in a hundred Monero outputs is left with about 6 candidates after one self-transfer and about 180 after two, before it uses amounts, timing, IP or Cake's API key. Shielded pools such as Tornado Cash, Privacy Pools or Zcash's shielded pool prove membership in the whole pool without naming any deposit, so a party that knows a deposit, but not its secret, cannot find the withdrawal onchain. ### Privacy considerations Both Ethereum legs are public. The entry service knows everything about its leg: addresses, amounts, IP and Cake as the integrator. The exit service knows the Ethereum exit address, amount and IP. Client defaults weaken this. An EVM wallet in Cake has one address: it is sent as refund address on entry, and exiting to the same wallet pays the very address that deposited, so entry and exit are publicly linked unless the exit goes to a new in-app wallet from a fresh seed. On entry, picking an in-app Monero wallet pays to its primary address every time. Built-in Tor is off by default, so swap APIs, Blink, Etherscan, the RPC, Cake's price API and Moralis, which cannot be switched off, see the user's IP. With Tor on, all calls share one SOCKS port without isolation, so calls within ten minutes can share a circuit, and the Ethereum client only uses Tor after a restart. ### Custody, fees and compliance Both legs are transfers to and from custodial exchange-controlled wallets. The centralized swap providers used by Cake can automatically freeze funds while in-flight and hold them for KYC and compliance checks, as documented in their terms of service. Cake ships its API keys, and for some providers a markup, as build secrets, so the fee cannot be verified from source. Cake Labs holds no keys and proxies nothing. ### Anonymity set Each spend hides among its 16 ring members, and the rings behind them. Against a party that knows the entry output, the effective set is the number of its own payouts in those rings. Against everyone else, entry and exit amounts are public on Ethereum, so the set is the entries that could match an exit in amount and time. ## Privacy **What the protocol promises:** Hides which funds leaving Ethereum come back as which, by passing them through Monero between two custodial swaps. Both Ethereum legs are public. On public blockchains like Ethereum, all actions transparent by default. A privacy protocol can at best cut the link between addresses or offer privacy while deposited. The colour says whether a careful user can keep the link, amount or recipient private against that adversary: green yes, yellow only outside supported options or by accepting another leak, red no. Fields marked at risk stay private only under the condition in their note. ### Public observer Link private (sentiment: good) **Who:** Everyone with a block explorer and some basic tools. Sees every public onchain event, but does no correlation beyond following links. Examples: A curious counterparty, an employer, a journalist. Nothing public ties the deposit into a swap service to the later payout from a service hot wallet, because the Monero transactions in between hide sender, recipient and amount. Both Ethereum transfers show address, token and amount. **Advice:** Exit to a new in-app Ethereum wallet created from a fresh seed, never the wallet that deposited. **Inside** - Sender: private - Recipient: private - Amount: private - Asset: exposed. Only XMR exists inside. The source asset is public on Ethereum. - Link: at risk. An EVM wallet in Cake has one address, so exiting to the wallet that deposited pays the address that deposited. **Sources** - [The deposit is a plain transfer from the wallet to the address the service returned](https://github.com/cake-tech/cake_wallet/blob/b7247dd0969d9004e49ce592b855cff2c7706fd6/lib/view_model/exchange/exchange_trade_view_model.dart#L200-L206) - [An EVM wallet has a single address](https://github.com/cake-tech/cake_wallet/blob/b7247dd0969d9004e49ce592b855cff2c7706fd6/cw_evm/lib/evm_chain_wallet_addresses.dart#L11-L38) - [Every input names 16 ring members](https://github.com/monero-project/monero/blob/v0.18.5.1/src/cryptonote_core/blockchain.cpp#L3268) - [Amounts are encrypted to the recipient](https://github.com/monero-project/monero/blob/v0.18.5.1/src/ringct/rctOps.cpp#L672-L720) ### Chain analyst Link private (sentiment: good) **Who:** Scrapes all public data and correlates it: timing, amounts, gas and wallet fingerprints, address clusters. Examples: Chain analytics firms, ZachXBT, data brokers. Only amount and timing can pair the two Ethereum legs: a deposit into a swap service and a payout from a hot wallet that serves every asset the service trades. **Advice:** Withdraw common amounts rather than everything at once. Wait before exiting and pick a different time of day than the deposit. Exit to a fresh address every time and spend from it with a different wallet than the one that deposited. **Inside, compared with a public observer** - Asset: exposed - Link: at risk. A round trip of similar amount and timing pairs the two Ethereum legs. ### Network observer Link exposed (sentiment: bad) **Who:** Sits between the user and the chain and sees web2 traffic only: RPC providers, relayers and broadcasters, indexers, ISPs. Learns IP addresses, timing, browser fingerprints, ciphertext and what becomes public. Assumes Tor to send transactions and, where the client has an RPC setting, an own node to read the blockchain. Examples: Infura or Alchemy, a Tornado relayer, a wallet vendor selling telemetry, Google captcha or analytics in the dapp frontend. With Tor and own nodes, the two legs stay apart unless they run in the same app/tor session. Cake's Tor has one SOCKS port without isolation, so Moralis, which cannot be switched off, and Blink and Etherscan, if left on, can see both Ethereum wallets on one circuit. **Advice:** Turn on Tor, switch off Blink and Etherscan, set your own Monero node and Ethereum RPC, then restart the app, since the Ethereum client keeps its first connection. Wait and restart it again between the legs. **Inside, compared with a public observer** - Asset: exposed - Link: at risk. Ethereum wallets opened in one session share a Tor circuit toward Moralis. **Sources** - [Built-in Tor is off unless the user enables it](https://github.com/cake-tech/cake_wallet/blob/b7247dd0969d9004e49ce592b855cff2c7706fd6/lib/store/settings_store.dart#L1561) - [Embedded Tor config: one SocksPort, no isolation flags, no control port](https://github.com/cake-tech/cake_wallet/blob/b7247dd0969d9004e49ce592b855cff2c7706fd6/cw_core/lib/utils/tor/torch.dart#L65-L70) - [The Ethereum client binds its proxy setting once](https://github.com/cake-tech/cake_wallet/blob/b7247dd0969d9004e49ce592b855cff2c7706fd6/cw_evm/lib/clients/evm_chain_client.dart#L24) - [Every wallet switch sends the address to Moralis, gated only by the API key](https://github.com/cake-tech/cake_wallet/blob/b7247dd0969d9004e49ce592b855cff2c7706fd6/cw_evm/lib/clients/evm_chain_client.dart#L615-L640) - [Blink and Etherscan toggles under Connections](https://github.com/cake-tech/cake_wallet/blob/b7247dd0969d9004e49ce592b855cff2c7706fd6/lib/src/screens/settings/connection_sync_page.dart#L64-L79) ### Privileged insider Link exposed (sentiment: bad) **Who:** Holds a protocol operator role or receives keys or plaintext by design: upgrade admin, sequencer, decryption or view key holder, TEE vendor, association set provider, hosted prover, note registry. Examples: A compliance backdoor key, a DAO with an upgrade key, a KMS committee, an ASP operator. The swap-in service that pays your XMR knows that output, and the service you exit with sees the rings of your Monero transaction. One party holding both finds its output in the rings behind the exit. Each service also holds the addresses, amounts, IP and Cake's API key of its leg, screens them and can hold the funds until KYC. **Advice:** Force different services for entry and exit. Self-transfer the XMR several times, hours to days apart, and never pay the exit service the whole amount. **Inside, compared with a public observer** - Sender: at risk. Rings that reference the service's payout output point to the spend of your XMR. - Asset: exposed - Link: at risk. Private only if no party holds the records of both legs. **Sources** - [Breaking Monero: poisoned outputs, the attack by a counterparty on both sides](https://www.monerooutreach.org/breaking-monero/poisoned-outputs.html) - [The user can force a provider, otherwise the best rate wins](https://github.com/cake-tech/cake_wallet/blob/b7247dd0969d9004e49ce592b855cff2c7706fd6/lib/view_model/exchange/exchange_view_model.dart#L596-L603) - [Trocador is asked for partners of KYC grade C or better and both addresses are forwarded](https://github.com/cake-tech/cake_wallet/blob/b7247dd0969d9004e49ce592b855cff2c7706fd6/lib/exchange/provider/trocador_exchange_provider.dart#L226-L240) - [Cake ships its API key with the providers](https://github.com/cake-tech/cake_wallet/blob/b7247dd0969d9004e49ce592b855cff2c7706fd6/tool/utils/secret_key.dart#L15-L106) - [ChangeNOW: automated AML holds, KYC through SumSub, refund minus fees](https://changenow.io/faq/kyc-aml) - [Upgrades & Governance](https://l2beat.com/privacy/projects/monero-cake-wallet#upgrades-and-governance) ### Future adversary Link exposed (sentiment: bad) **Who:** Harvest now, decrypt later. Holds every byte ever written onchain plus any retained logs, and future cryptanalysis such as a large quantum computer that breaks elliptic-curve key exchange and pairings, but not hashes, symmetric ciphers or lattices. Examples: First well-funded insiders, then everyone in a potential post-quantum future. A quantum computer recovers the key of every ring member from the chain alone, recomputes its key image and so finds the real spend of every ring, which turns the XMR's path from payout to exit into a public trail. The services' records of payout and deposit then join the Ethereum legs. **Inside, compared with a public observer** - Sender: exposed - Recipient: at risk. Readable for every output to an address the attacker knows, as the services know yours. - Amount: at risk. Readable for every output to an address the attacker knows. - Asset: exposed - Link: exposed **Sources** - [A key image is the output key hashed to a point times its private key](https://github.com/monero-project/monero/blob/v0.18.5.1/src/crypto/crypto.cpp#L621-L628) - [Zero to Monero: one-time addresses, amount encryption and key images (chapters 4 to 6)](https://www.getmonero.org/library/Zero-to-Monero-2-0-0.pdf) ## Risk summary ### Funds can be stolen if 1. a swap service does not pay out. 2. a service's hot wallet is compromised during the trade. ### Funds can be frozen if 1. a service holds the deposit pending identity verification. 2. a service refunds minus fees and blacklists the deposit address. ### Privacy can be lost if 1. one party sees both legs: one service, Trocador or a vendor the services share. It finds its own payout output in the rings behind the exit transaction, and self-transfers in between only widen that search. 2. the exit is paid to the same Ethereum wallet that deposited, since an EVM wallet in Cake has only one address. 3. the XMR is swapped back in a matching amount and time. 4. the same Monero payout address is reused on entry, the default for an in-app receiver. 5. swap APIs, Blink, Etherscan, Moralis, RPC and Monero node see the same IP. Tor is off by default and not circuit-isolated. 6. elliptic-curve cryptography is broken, which reveals the real spend in every ring. ## Upgrades & Governance No onchain governance, no contracts, instant change permissions. Three parties can change the swap routes. ### Cake Labs LLC (the wallet) MIT-licensed and self-custodial. Cake runs no swap backend. Privacy defaults, all user-changeable: Tor off, swap mode "Enabled", Blink on, Etherscan on, Cake's price API on, Cake's Monero node, publicnode's Ethereum RPC. Moralis token discovery is always on. ### The swap services (the custodians) Fully centralized, custodial and intransparent. ### Monero (the chain) Rules change through scheduled hard forks. The mainnet table ends at version 16, active since block 2689608 (August 2022) with a ring size of 16.