Payment Rails CROPS Dashboard
Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.

Umbra Cash

transferEthereum Assessed on Ethereum (chain 1)app.umbra.cash

Ratings apply to this deployment only. Treat them as unverified for other chains. Why this deployment: umbra-js lists the same Umbra address on every chain, with mainnet first and the earliest start block (umbra-protocol@07a64aee umbra-js/src/classes/Umbra.ts L44-L92), and the frontend's supportedChains puts Mainnet first (frontend/src/components/models.ts L50-L61). Unit: the Umbra contract 0xFb2d…5401 and StealthKeyRegistry 0x31fe…38f3 on Ethereum. Excluded: Optimism, Polygon, Base, Arbitrum and Gnosis deployments of the same code, the optional UmbraBatchSend and Uniswap withdraw hook, and testnets.

At a glance

Category
Protocols for privacy-preserving transfers
Chain
EthereumEthereum
CROPS tally
18 of 23 hold up
Security audits
3 published
Offered
Everywhere
Last edited
2026-10-13 · History
  1. Censorship Resistance0 FailsWeakest: Admin pause or freeze powers; Token and chain freeze risks disclosed
  2. Open1 WeakWeakest: Can be self-hosted
  3. Free2 PartialWeakest: Open-source licences; Protection against relicensing; No proprietary dependencies
  4. Privacy2 PartialWeakest: Tracking and analytics; Data collected beyond payment; Third parties in the payment flow; Endpoints can be changed
  5. Security0 FailsWeakest: Token approval scope

Where it is offered

Offered everywhere, per the provider's code or documents. Checked 2026-10-09. Not scored.

The contracts have no address or country checks, and neither umbra-js nor the app has a country gate; the app's terms name no restricted countries. umbra-js refuses sanctioned addresses (hardcoded lists and the Chainalysis oracle), which is address-level screening, not geographic.

Evidence (1)1 verified
  1. Verified

    Sends check only the toll and amounts; a search of frontend/src, umbra-js/src and netlify for country, geo and restricted found no country gate.

    ScopeLift/umbra-protocol · contracts-core/contracts/Umbra.sol

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Censorship Resistance

Who can block valid use, and can users route around them?

0 FailsPillar rating: weakest of 5
3 of 5 Partial or better

What would raise this pillar

Admin pause or freeze powers

Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

The contract cannot pause, freeze or block addresses, and withdrawals are untouched by any admin. But the owner, a single EOA, can set the per-payment toll to any value, which would make new sends uneconomic or impossible for everyone, with no delay. The toll is 0 today. Judgment call: a toll is an anti-spam fee, not a pause, but because it is unbounded and EOA-held it can stop settlement, so anchor 0 (EOA-held role).

Evidence (3)3 verified
  1. Verified

    The only owner powers are setToll, setTollCollector and setTollReceiver (L67-L85). Every send must pay exactly the current toll (L112-L115, L138), and the toll has no upper bound; there is no pause, blacklist or allowlist, and withdrawals do not check the toll.

    ScopeLift/umbra-protocol · contracts-core/contracts/Umbra.sol

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

  2. Verified

    owner() is 0x5777…7232, an address with no code (EOA), also listed as admin in contracts-core/deploy-history/mainnet-latest.json; toll() is 0 at block 26153546.

    0xFb2d…5401 on sourcify.dev

    0xFb2d…5401 explorer · Sourcify · block 26153546 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

  3. Verified

    The owner address has no code at block 26153546.

    0x5777…7232 on etherscan.io

    0x5777…7232 explorer · Sourcify · block 26153546 · checked 2026-10-09

Settle without the provider

Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2

3 Strong

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

A payer sends by calling the contract directly; ETH goes straight to the stealth address, tokens wait in the contract until the stealth key withdraws them, directly or through anyone it signs for. The address and ABI are in the public SDK. We did not run a transaction.

Evidence (2)2 verified
  1. Verified

    sendEth and sendToken are open to any caller; withdrawToken is called by the stealth address itself, and withdrawTokenOnBehalf can be submitted by anyone holding the stealth address's signature.

    ScopeLift/umbra-protocol · contracts-core/contracts/Umbra.sol

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

  2. Verified

    The deployed Umbra contract is an exact Sourcify match whose source equals Umbra.sol at 07a64aee apart from a trailing newline; the address is documented in umbra-js (Umbra.ts L44).

    0xFb2d…5401 on sourcify.dev

    0xFb2d…5401 explorer · Sourcify · block 26153546 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Reliance on hosted services

Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3

3 Strong

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Settlement needs only the contracts, the SDK and an RPC. The closed Umbra API relayer is optional: the stealth address can withdraw itself, or any account can submit its signed withdrawal. The indexer is optional too. Judgment call: withdrawing tokens without the relayer needs gas from elsewhere, which affects privacy, not settlement, so 3.

Evidence (2)2 verified
  1. Verified

    Announcement scanning uses a subgraph if configured and falls back to RPC logs on failure; chainConfig may set subgraphUrl to false.

    ScopeLift/umbra-protocol · umbra-js/src/classes/Umbra.ts

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12

  2. Verified

    The app's relayer and token list come from the hardcoded Umbra API (mainnet.api.umbra.cash), whose code is not public; the contract accepts withdrawTokenOnBehalf from any submitter.

    ScopeLift/umbra-protocol · frontend/src/utils/umbra-api.ts

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Neutral settlement, disclosed filtering

Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

The contracts are neutral. The SDK screens addresses against public lists and the Chainalysis oracle, visibly in code, and the direct contract path bypasses it (C2 = 3). Judgment call: this meets anchor 3 in substance, but the repo's umbra-js 0.3.0 is not on npm (latest is 0.2.2), so there is no package to pin and we ran no trace; 2.

Evidence (2)2 verified
  1. Verified

    assertSupportedAddress rejects recipients and destinations on hardcoded banned lists and, for single recipients, those flagged by the Chainalysis sanctions oracle 0x40C5…C8fb; it is called on send and withdraw (Umbra.ts L227, L268, L336, L397).

    ScopeLift/umbra-protocol · umbra-js/src/utils/utils.ts

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

  2. Verified

    The deployed contract has no address or country checks.

    0xFb2d…5401 on sourcify.dev

    0xFb2d…5401 explorer · Sourcify · block 26153546 · checked 2026-10-09

Token and chain freeze risks disclosed

Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Chains are enumerated in the SDK, but supported tokens live only in a hosted API response, and we found no statement that issuer freezes can lock tokens held by the Umbra contract or a stealth address. Scored 0: not enumerated in code or docs.

Evidence (1)1 verified
  1. Verified

    The app's supported-token list is fetched from the Umbra API (/tokens?chainId=) at runtime; the contract accepts any ERC20.

    ScopeLift/umbra-protocol · frontend/src/utils/umbra-api.ts

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Open

Is the whole stack visible?

1 WeakPillar rating: weakest of 4
3 of 4 Partial or better

What would raise this pillar

  • Can be self-hosted reaching Partial: Reproducible with minor undocumented steps, recorded.

Contracts verified onchain

Does the deployed bytecode match public source, and can a third party rebuild it? O1

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Both settlement contracts are full Sourcify matches and the build settings are in the repo. Judgment call: anchor 3 also needs a build from the pinned commit that reproduces the bytecode; the repo files differ by a trailing newline, which changes the metadata hash, and we did not rebuild, so 2.

Evidence (2)2 verified
  1. Verified

    Sourcify returns exact_match for Umbra and StealthKeyRegistry (and UmbraBatchSend); their sources equal the repo files apart from a trailing newline.

    0x31fe…38f3 on sourcify.dev

    0x31fe…38f3 explorer · Sourcify · block 26153546 · checked 2026-10-09

  2. Verified

    Hardhat pins solc 0.8.7 and 0.7.6 with optimizer runs 999999, matching the Sourcify compilation settings.

    ScopeLift/umbra-protocol · contracts-core/hardhat.config.ts

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Whole stack published

Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2

2 Partial

Best evidence: VerifiedChecked 2026-10-09 10 days ago

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Contracts, SDK, frontend, subgraph and deploy history are public. The backend (Umbra API relayer and token list) and the production Ponder indexer are closed. Judgment call: their API types are committed in the frontend, which we accept as the schema for 2.

Evidence (1)1 verified
  1. Verified

    The monorepo holds contracts-core (with deploy history), contracts-periphery, umbra-js and the frontend; umbra-subgraph holds the subgraph. The Umbra API and Ponder indexer code are not in any ScopeLift repo we found; their request and response types are in frontend/src/components/models.ts.

    ScopeLift/umbra-protocol · frontend

    commit 07a64aeef3 · checked 2026-10-09

Can be self-hosted

Can a stranger reach a working deployment from the README? O3

1 Weak

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-12 7 days ago

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Build and run documentation exists, with an .env.example. Reproduction not attempted, so capped at 1.

Evidence (1)1 verified
  1. Verified

    The README gives development instructions (install, env setup from .env.example, build and test per workspace).

    ScopeLift/umbra-protocol · README.md

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12

Interfaces and data export

Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo? O4

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

ABIs, events and the API's types are in the repo. We found no payee export in a non-proprietary format. Scored 2.

Evidence (1)1 verified
  1. Verified

    Announcement and TokenWithdrawal event schemas are in the contract; ABIs ship in umbra-js, and the Umbra API types are in frontend/src/components/models.ts.

    ScopeLift/umbra-protocol · contracts-core/contracts/Umbra.sol

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Free

Does the license actually let a third party fork, modify, and run it?

2 PartialPillar rating: weakest of 3
3 of 3 Partial or better

What would raise this pillar

Open-source licences

Does every repository needed to run the product carry an OSI-approved license? F1

2 Partial

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Every required component is MIT. The optional subgraph repo has no licence. Scored 2.

Evidence (1)1 verified
  1. Verified

    The umbra-protocol monorepo (contracts, SDK, frontend) is MIT; umbra-subgraph has no licence (GitHub license API returns null).

    ScopeLift/umbra-protocol · LICENSE.txt

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Protection against relicensing

Can the provider unilaterally relicense future versions, and has it committed not to? F2

2 Partial

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-12 7 days ago

UnreviewedAssessed by AI research agent (seed), 2026-10-09

No CLA and no relicensing; no written licence-stability commitment. Scored 2.

Evidence (1)1 verified
  1. Verified

    Contributions are by fork and PR with no CLA; LICENSE.txt has been MIT since 2020-05-21 (commits ee79a21e, 6e31df6b, d0c1e113, ec1646d8 only changed copyright text).

    ScopeLift/umbra-protocol · README.md

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12

No proprietary dependencies

Does a production deployment need a proprietary plugin or hosted-only service? F3

2 Partial

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

The protocol runs with public code and any RPC. The closed Umbra API and Ponder indexer are optional for the protocol, but a self-hosted copy of the app loses token sends and relayed withdrawals without them. Scored 2: optional proprietary components.

Evidence (1)1 verified
  1. Verified

    The frontend falls back to an empty token list if the Umbra API fails, so the hosted app's token sends and relayed withdrawals depend on the closed API; the SDK and contracts do not.

    ScopeLift/umbra-protocol · frontend/src/utils/umbra-api.ts

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Privacy

What can an observer learn, and did the user knowingly choose it?

2 PartialPillar rating: weakest of 5
5 of 5 Partial or better

What would raise this pillar

Tracking and analytics

Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1

2 Partial

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-12 7 days ago

UnreviewedAssessed by AI research agent (seed), 2026-10-09

The SDK and frontend ship no analytics or telemetry. Judgment call: absence shown only in code, with no package for the current SDK and no trace, is capped at 2.

Evidence (1)1 verified
  1. Verified

    No analytics, telemetry, error-reporting or fingerprinting dependency; bnc-notify is initialised without a dappId in UI-only mode (frontend/src/utils/alerts.ts L7-L10).

    ScopeLift/umbra-protocol · frontend/package.json

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12

Data collected beyond payment

Does the flow collect anything beyond addresses, amounts, token, and chain? P2

2 Partial

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-12 7 days ago

UnreviewedAssessed by AI research agent (seed), 2026-10-09

The protocol takes only a stealth address, amount, token, ephemeral key and ciphertext; there is no account or form. The hosted app's servers and the Umbra API log IP addresses, disclosed in a privacy policy committed to the repo and avoidable by using the SDK. Judgment call: the only extra data is IP logging on optional hosted services, disclosed in a versioned document, so 2 rather than 1.

Evidence (1)1 verified
  1. Verified

    The privacy policy says hosting providers may log request IP addresses, retained up to 90 days, and that no cookies are used.

    ScopeLift/umbra-protocol · frontend/src/pages/PrivacyPolicy.vue

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12

Payments linkable onchain

What do calldata and events reveal about who paid whom for what? P3

3 Strong

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Each payment goes to a fresh stealth address that observers cannot tie to the payee; the payer, amount and token are public. The link reappears if the payee withdraws to a known address, funds the stealth address from a known account, or batches withdrawals; the README states these limits. Judgment call: this is a stealth-address pattern with no invoice data, so 3 on what the code reveals; withdrawal hygiene is behavioural.

Evidence (1)1 verified
  1. Verified

    Announcement emits the stealth address, amount, token, ephemeral public key x-coordinate and a 32-byte ciphertext; TokenWithdrawal emits the stealth address and the acceptor.

    ScopeLift/umbra-protocol · contracts-core/contracts/Umbra.sol

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Third parties in the payment flow

Which third parties see a request during a payment, and can they be swapped out? P4

2 Partial

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Beyond the RPC, the app sends requests to ScopeLift's API and indexer and to Etherscan, TxPrice and POAP; the Chainalysis check is an RPC read. All are named in code. The Umbra API URL is hardcoded; the RPC and subgraph URLs come from env or SDK config. Judgment call: 2, as the hardcoded API is avoidable by using the SDK.

Evidence (1)1 verified
  1. Verified

    Recipient public-key lookup by transaction history calls Etherscan-family APIs; the app also calls the Umbra API (umbra-api.ts L36), the Ponder proxy, TxPrice and POAP APIs, and WalletConnect.

    ScopeLift/umbra-protocol · umbra-js/src/classes/TxHistoryProvider.ts

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Endpoints can be changed

Can RPC and indexer URLs be changed, and is the indexer code public? P5

2 Partial

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

RPC and indexer are configurable in the SDK, and the subgraph code is public. Judgment call: the production indexer is a Ponder deployment whose code we did not find, and the app has no UI setting, so 2.

Evidence (1)1 verified
  1. Verified

    The SDK takes the provider from the caller and accepts a custom chainConfig with any subgraphUrl or false (RPC logs only); the app reads RPC and indexer URLs from env at build time.

    ScopeLift/umbra-protocol · umbra-js/src/classes/Umbra.ts

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Security

Who can cause loss, lock users in, or change the rules?

0 FailsPillar rating: weakest of 6
4 of 6 Partial or better

What would raise this pillar

Who holds funds in transit

Who holds funds between payer and payee, and can the provider redirect them? S1

3 Strong

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

ETH payments are direct transfers to an address only the payee controls; token payments sit in a non-upgradeable contract that releases them only on the stealth key's instruction. No role can redirect funds.

Evidence (2)2 verified
  1. Verified

    ETH is forwarded to the stealth address in the same call; tokens are recorded in tokenPayments and released only to an acceptor chosen by the stealth key. collectTolls moves only the contract's ETH balance (tolls).

    ScopeLift/umbra-protocol · contracts-core/contracts/Umbra.sol

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

  2. Verified

    Implementation slot zero (no proxy); ETH balance 0 at block 26153546.

    0xFb2d…5401 on sourcify.dev

    0xFb2d…5401 explorer · Sourcify · block 26153546 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Who can upgrade the code

Who can change the contract code, and with how much notice? S2

3 Strong

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Non-upgradeable. The owner can change only the toll settings (see C1).

Evidence (1)1 verified
  1. Verified

    Umbra and StealthKeyRegistry have zero EIP-1967 implementation and admin slots, are exact Sourcify matches, and their source has no upgrade, delegatecall or selfdestruct path.

    0xFb2d…5401 on sourcify.dev

    0xFb2d…5401 explorer · Sourcify · block 26153546 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Token approval scope

How large an allowance does the SDK ask users to grant, and for how long? S3

0 Fails

Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-12 7 days ago

UnreviewedAssessed by AI research agent (seed), 2026-10-09

The app requests an unlimited allowance by default without saying so. The spender is immutable and pulls only from msg.sender, which limits the exposure, but the anchor concerns the scope requested. Scored 0.

Evidence (1)1 verified
  1. Verified

    When the allowance is short, the app approves MaxUint256 to the Umbra contract (and to UmbraBatchSend at L1157-L1163); no unlimited-approval wording was found in the en-US strings.

    ScopeLift/umbra-protocol · frontend/src/pages/AccountSend.vue

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12

Funds safe if provider disappears Derived

If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Derived from S1=3, C2=3, C3=3, O3=1. Payees keep their funds without ScopeLift: ETH is already in the stealth address, and tokens can be withdrawn by calling the contract with keys derived client-side. Sending can continue via the SDK and an RPC, provided the owner EOA does not raise the toll (C1). A public frontend exists but was not reproduced (O3=1). Judgment call: 2.

Evidence (1)1 verified
  1. Verified

    The contract is not a proxy and withdrawToken / withdrawTokenOnBehalf are open to the stealth key or its signature (C2).

    0xFb2d…5401 on sourcify.dev

    0xFb2d…5401 explorer · Sourcify · block 26153546 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Secrets and webhook handling

Are secrets kept out of client bundles and are webhooks signed and verified? S5

2 Partial

Best evidence: VerifiedChecked 2026-10-19 today

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Spending and viewing keys are derived from a wallet signature in the browser and never sent anywhere. There are no webhooks or merchant keys. Explorer and RPC keys ship in the client bundle. Judgment call: 2 for the bundled read-only keys.

Evidence (1)1 verified
  1. Verified

    umbra-js reads ETHERSCAN_API_KEY and per-chain explorer keys from process.env, and the frontend .env.example lists them with RPC URLs, so a browser build embeds them; they authorise only explorer and RPC quota.

    ScopeLift/umbra-protocol · umbra-js/src/classes/TxHistoryProvider.ts

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

Audits and bug bounty

Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6

1 Weak

Best evidence: VerifiedChecked 2026-10-12 7 days ago

UnreviewedAssessed by AI research agent (seed), 2026-10-09

Audit reports are linked, but we could not read an audited commit from either report, so we cannot tie them to the deployed bytecode. No bug bounty or SECURITY file found. Scored 1: audit report only.

Evidence (1)1 verified
  1. Verified

    The FAQ states the contracts were audited by ConsenSys Diligence (2021-03 report) and umbra-js by Least Authority; the Least Authority PDF resolves, while the ConsenSys page returned 403 to curl and was not read.

    ScopeLift/umbra-protocol · frontend/src/i18n/locales/en-US.json

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12

Security audits 3

Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.

DateAuditorTypeScopeCovers deployed codeFindings
2021-05-25Least AuthorityAuditumbra-js SDK (stealth key derivation, encryption, scanning, ENS/CNS key lookup) at 48991f0fab
umbra-js has had about 90 commits since June 2021, so the shipped SDK has moved on from the audited code.		Partly3 issues (64-bit default stealth security, missing curve check, noble-secp256k1 key bias) and 3 suggestions; issues resolved, verification at 3796fa74
2021-04-22Cure53Auditnoble-secp256k1 library (shared dependency used by umbra-js for elliptic-curve operations), around v1.2
Funded by Umbra and a Gitcoin grant and linked from the Umbra FAQ. umbra-js now depends on @noble/secp256k1 ^1.7.1, later than the audited version.		Partly1 high, 2 medium, 1 informational; the three security issues confirmed fixed
2021-03ConsenSys DiligenceAuditUmbra.sol and IUmbraHookReceiver.sol; cursory review of the ENS StealthKeyResolver at fa2e17367d
Umbra.sol changed after the audit only for the two fixes (7cfdc81b, d6e4235f) and visibility/formatting edits, so the deployed Umbra contract is close to the audited code; the deployed StealthKeyRegistry was written in August 2021 and is not in scope. Off-chain code was excluded.		Partly1 minor finding (fixed) and 4 recommendations (1 fixed)

Compiled from: The app FAQ ("Has Umbra been audited?" in frontend/src/pages/FAQ.vue at umbra-protocol@07a64aee), the ScopeLift/umbra-protocol and umbra-subgraph repos (no audits folder), ConsenSys Diligence's audit page (HTML returned 403 to scripted requests; the PDF resolves), Least Authority's publications, Cure53's report list and the paulmillr/noble-secp256k1 audit folder. No audit of StealthKeyRegistry (added August 2021), the Umbra API, relayer or Ponder indexer was found. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.

Operational and procurement

Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.

Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 9 evidenced, 0 attested, 8 absent, 26 not applicable, 2 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.

Group A: operational facts

Fees

Evidenced
ComponentPaid byAmountBasis
providerpayerToll 0 ETH per send on Ethereum (toll() = 0)Contract parameter; setToll is onlyOwner (an EOA), unbounded and emits no event. The sender commits to the current toll in sendEth, which blocks owner front-running of a single send.
providerpayeeRelayer fee for token withdrawals, quoted per token by the Umbra API and deducted from the withdrawn tokensOptional; set by ScopeLift's closed API (mainnet.api.umbra.cash/tokens/<token>/estimate). ETH withdrawals and self-withdrawals pay no relayer fee.
networkpayerEthereum gas for the send; gas for withdrawal paid by the stealth address or by the relayerNetwork fee, not set by the protocol.

The toll is per chain; only Ethereum was read. The relayer's fee amounts are not published.

  1. Verified

    toll() returns 0 on Ethereum mainnet. Umbra.sol L64-L69 lets the owner set any toll; sendEth (L95-L120) requires the sender's toll commitment to equal it and forwards msg.value minus toll.

    0xFb2d…5401 on sourcify.dev

    0xFb2d…5401 explorer · Sourcify · block 26153752 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

  2. Verified

    The app's relayer client uses https://mainnet.api.umbra.cash and fetches a fee estimate per token (getFeeEstimate, L89-L93); withdrawal-fees.ts L27-L30 returns a zero fee for the native token.

    ScopeLift/umbra-protocol · frontend/src/utils/umbra-api.ts

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

  3. Verified

    The FAQ explains that ETH goes straight to the stealth address, tokens are withdrawn directly or through a relayer ("By default, the Umbra app uses a relayer from the Umbra team"), and that a toll is charged only on cheap networks to deter spam.

    ScopeLift/umbra-protocol · frontend/src/i18n/locales/en-US.json

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-12

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Custody model

Evidenced

Self-custody

Agrees with S1 (3). ETH goes directly to the stealth address; tokens wait in the non-upgradeable contract until the stealth key releases them.

Evidence shared with CROPS: S1 item 1, S1 item 2

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Licences and registrations

Absent

ScopeLift runs the optional relayer and the app, not a custodial service. No regulator register was searched by name.

  1. Verified

    The Terms of Service name ScopeLift, a Pennsylvania LLC, as owner of the app and cite no licence, registration or regulator (searched for licen, regulat, money transmit); the privacy policy and FAQ say nothing either.

    ScopeLift/umbra-protocol · frontend/src/pages/TermsOfService.vue

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Cash-out options

N/A: falls to the institution

Token-to-address rail. The payee withdraws ETH or tokens to an address it controls; converting them to local currency is outside the protocol.

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

First deployment

Evidenced

2021-04-30 (block 12343914): Umbra contract 0xFb2d…5401 created (tx 0x1dbb9dfe…134a) by the owner EOA 0x5777…7232; StealthKeyRegistry followed at block 13098125 (2021-08-26).

  1. Verified

    Sourcify creation data gives tx 0x1dbb9dfe4f83466be6ce1cdd19ac690636f02aeb2804785509ead7084fd7134a at block 12343914; the receipt has contractAddress 0xfb2d…5401 and status 1; block 12343914 is dated 2021-04-30 UTC, matching deploy-history/mainnet-2021-04-30T20:19:57.768Z.json and umbra-js's mainnet start block.

    0xFb2d…5401 on sourcify.dev

    0xFb2d…5401 explorer · Sourcify · block 12343914 · checked 2026-10-09

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Operating entity

Evidenced

ScopeLift (Pennsylvania limited liability company), US-PA

The exact registered name and entity number were not read from the Pennsylvania Department of State register (its search is an interactive web app), so no register_url. The GitHub org lists Philadelphia, PA.

  1. Verified

    The terms define ScopeLift as "the Commonwealth of Pennsylvania Limited Liability Corporation that owns the Umbra App and Site".

    ScopeLift/umbra-protocol · frontend/src/pages/TermsOfService.vue

    commit 07a64aeef3 · checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Security incidents

Evidenced

Absence of a found incident is not evidence that none occurred.

No post-mortem found in the repo, FAQ or app pages. GitHub issue search in umbra-protocol for exploit, incident, vulnerability, hack and security returned no incident report.

  1. Verified

    No published security advisories for ScopeLift/umbra-protocol.

    api.github.com/repos/ScopeLift/umbra-protocol/security-advisories

    checked 2026-10-09

  2. Verified

    The contract is not upgradeable and its only OwnershipTransferred event is the constructor's (block 12343914, to 0x5777…7232); no admin path moves user funds (S1).

    0xFb2d…5401 on sourcify.dev

    0xFb2d…5401 explorer · Sourcify · block 26153752 · checked 2026-10-09

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Product changes affecting users

Evidenced
  • 2021-04-30: Umbra contract deployed on Ethereum mainnet. source
  • 2021-08-26: StealthKeyRegistry deployed on mainnet. source
  • 2021-10-29: Same contracts deployed on Polygon. source
  • 2022-03-02: Deployed on Optimism and Arbitrum. source
  • 2023-06-01: Deployed on Gnosis Chain. source
  • 2024-02-19: Deployed on Base. source

The mainnet contract has never been replaced. Toll changes emit no event, so any past toll changes on mainnet cannot be listed from logs; toll() reads 0 today.

  1. Verified

    Timestamped deploy records per network (mainnet 2021-04-30, registry-mainnet 2021-08-26, polygon 2021-10-29, optimism and arbitrum 2022-03-02, gnosis_chain 2023-06-01, base 2024-02-19).

    ScopeLift/umbra-protocol · contracts-core/deploy-history

    commit 07a64aeef3 · checked 2026-10-09

UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09

Volume transacted (verified only)

Unknown

not computed on 2026-10-19: eth_getLogs: Archive requests require a personal token. Get one at: https://www.allnodes.com/publicnode

Judgment call. Every send emits one Announcement with the amount in clear, so settlement is observable, but a per-token sum needs the script to read the token from topic 2. Until then the spec yields a payment count, not a value. Not computed; the maintainer runs scripts/volumes.mjs.

UnreviewedAssessed by AI research agent (operational), 2026-10-09

Group B: institutional due diligence

ControlStateWhat was found
Assurance and certifications
B1.1 ISO 27001, developer organisation
Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?		N/A: falls to the institution
implied from the component list
B1.2 ISO 27001, hosting and support organisation
Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?		N/A: falls to the institution
implied from the component list
B1.3 SOC 2 Type II or ISAE 3000/3402 reports
Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?		N/A: falls to the institution
implied from the component list
B1.4 Independent source-code security review before go-live
Was the application reviewed by an independent party before launch, and is the report linked?		EvidencedConsenSys Diligence audited the contracts (2021-03) and Least Authority audited umbra-js; audited commits not tied to the deployed code. See CROPS S6.
CROPS S6
B1.5 Penetration testing
Is the service penetration-tested before go-live and at least every three years, with results available?		N/A: falls to the institution
implied from the component list
B1.6 Vulnerability scanning cadence
Are the platform and the application scanned for vulnerabilities at least every six months?		N/A: falls to the institution
implied from the component list
Vulnerability and patch management
B2.1 Security contact and disclosure policy
Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?		Absentnone of 2 repo(s): ScopeLift/umbra-protocol ✗ no security policy file; ScopeLift/umbra-subgraph ✗ no security policy file
source 1 · source 2
B2.2 Patch service levels
Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?		N/A: falls to the institution
implied from the component list
B2.3 Dependency and vulnerability scanning in CI
Do the public repositories run dependency or code scanning automatically?		Absentnone of 2 repo(s): ScopeLift/umbra-protocol ✗ no scanning config or workflow step found; ScopeLift/umbra-subgraph ✗ no scanning config or workflow step found
source 1 · source 2
Incident reporting and continuity
B3.1 Incident reporting commitment
Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?		N/A: falls to the institution
implied from the component list
B3.2 Backups and restore testing
Are customer records backed up daily and restores tested on a schedule?		N/A: no such service
implied from the component list
B3.3 Recovery plan
Is there an approved and tested recovery plan for the service?		N/A: no such service
implied from the component list
B3.4 Status page and post-mortems
Does the provider publish service status and post-mortems for incidents?		N/A: falls to the institution
implied from the component list
Identity and access (operator side)
B4.1 MFA for end users
Can or must end users protect accounts with multi-factor authentication?		N/A: no such service
implied from the component list
B4.2 MFA and separate accounts for privileged access
Is privileged access protected by MFA and kept on separate accounts?		N/A: falls to the institution
implied from the component list
B4.3 Periodic access reviews
Are user access rights reviewed at least annually and privileged accounts at least six-monthly?		N/A: falls to the institution
implied from the component list
B4.4 Segregation of duties and joiner-mover-leaver controls
Is there a documented segregation-of-duties model and a joiner-mover-leaver process?		N/A: falls to the institution
implied from the component list
B4.5 Session timeout
Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?		N/A: no such service
implied from the component list
API and integration
B5.1 API authentication, browser to server
Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?		N/A: falls to the institution
implied from the component list
B5.2 API authentication, server to server
Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?		N/A: falls to the institution
implied from the component list
B5.3 Token expiry
Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?		N/A: falls to the institution
implied from the component list
B5.4 Export controls
If an API exports data, does it limit volumes and log exports?		N/A: falls to the institution
implied from the component list
Data protection and privacy governance
B6.1 Data classification and encryption
Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?		N/A: falls to the institution
implied from the component list
B6.2 Production data kept out of test environments
Does the provider state that production or real personal data is not used in development and testing?		N/A: falls to the institution
implied from the component list
B6.3 Data retention and deletion on termination
What is retained, for how long, and is customer data removed on termination?		EvidencedHosted services: server logs with IP addresses kept no more than 90 days; IP addresses of registered users and posts no more than 5 years. Stated aim to drop IP logging later.
Cross-reference CROPS P2. Applies to the optional hosted app, relayer and indexer, which ScopeLift runs.
source 1
B6.4 Data protection impact assessment and roles
For systems holding personal data, has a DPIA been completed and are controller and processor defined?		N/A: falls to the institution
implied from the component list
B6.5 Data processing or sharing agreement available
Can a customer obtain a data processing agreement or equivalent?		N/A: falls to the institution
implied from the component list
Logging and monitoring
B7.1 Audit logging
Are account changes, logins and activity on important records logged and retained?		N/A: falls to the institution
implied from the component list
B7.2 Central monitoring and endpoint detection
Are logs sent to a managed SIEM and is endpoint detection running on all platforms?		N/A: falls to the institution
implied from the component list
Hosting and network
B8.1 Hardened hosting
Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?		N/A: falls to the institution
implied from the component list
B8.2 Deployment configuration and infrastructure as code
Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?		Absentnone of 2 repo(s): ScopeLift/umbra-protocol ✗ no deployment configuration; ScopeLift/umbra-subgraph ✗ no deployment configuration
source 1 · source 2
Engineering practice in public repositories
B9.1 Default branch protected
Does the default branch require reviews and passing checks, with no direct pushes?		Absentnone of 2 repo(s): ScopeLift/umbra-protocol ✗ no branch rules visible (classic branch protection is not readable without push access); ScopeLift/umbra-subgraph ✗ no branch rules visible (classic branch protection is not readable without push access)
source 1 · source 2
B9.2 CI runs on pull requests
Does every pull request trigger automated checks?		Evidencedsome of 2 repo(s): ScopeLift/umbra-protocol ✓ 1 workflow file(s); ScopeLift/umbra-subgraph ✗ no .github/workflows
source 1 · source 2
B9.3 Tests run in CI
Do the CI workflows run the test suite?		Evidencedsome of 2 repo(s): ScopeLift/umbra-protocol ✓ test command in a workflow; ScopeLift/umbra-subgraph ✗ test command in a workflow
source 1 · source 2
B9.4 Coverage reported
Is test coverage measured and reported (the partner expects 85%)?		Evidencedsome of 2 repo(s): ScopeLift/umbra-protocol ✓ coverage tooling referenced; ScopeLift/umbra-subgraph ✗ coverage tooling referenced
source 1 · source 2
B9.5 Versioned releases
Are releases tagged with immutable semantic versions?		Absentnone of 2 repo(s): ScopeLift/umbra-protocol ✗ latest tags: @umbra/umbra-js@0.0.1-alpha.0, @umbra/frontend@0.0.2, @umbra/contracts@0.0.2; ScopeLift/umbra-subgraph ✗ no tags
source 1 · source 2
B9.6 Signed tags or commits
Are release tags or recent commits cryptographically signed?		Absentnone of 2 repo(s): ScopeLift/umbra-protocol ✗ 0 of 10 recent commits signed; ScopeLift/umbra-subgraph ✗ 2 of 10 recent commits signed
source 1 · source 2
B9.7 Changelog
Is a changelog maintained with the code?		Absentnone of 2 repo(s): ScopeLift/umbra-protocol ✗ no changelog or release notes; ScopeLift/umbra-subgraph ✗ no changelog or release notes
source 1 · source 2
B9.8 Contribution and branching model documented
Does the README or contribution guide state how changes are proposed, reviewed and released?		Evidencedsome of 2 repo(s): ScopeLift/umbra-protocol ✓ contribution section in README; ScopeLift/umbra-subgraph ✗ none found
source 1 · source 2
Architecture documentation
B10.1 Architecture documentation
Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?		EvidencedLogical architecture only, in the app FAQ (keys, stealth addresses, Announcement scanning, relayed withdrawals, hooks) and a code-reading guide; the FAQ says developer documentation is not yet written. No infrastructure view of the hosted API or indexer.
source 1
Commercial and financial
B11.1 Contracting entity
Which legal entity would an institution contract with, and in which jurisdiction?		EvidencedScopeLift, a Pennsylvania limited liability company, owns the app and site and makes them available under the Terms of Service.
source 1
B11.2 Funding of ongoing operation
How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?		Unknown
The onchain toll is 0 on Ethereum (see fees), so the protocol earns nothing there; how ScopeLift funds maintenance of the app, relayer and indexer is not stated in any source found. The toll on cheaper chains was not read.
B11.3 Termination terms
What happens to customer funds and data on termination by either side?		EvidencedEither side may terminate; ScopeLift may suspend or end access to the app at its discretion without notice. Funds are unaffected because they sit at stealth addresses or in the non-upgradeable contract (CROPS S4).
source 1
CROPS S4
AI components
B12.1 AI in the payment path
Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?		Absent
source 1
B12.2 AI controls documented
If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?		Unknown
implied from the component list

Scope of assessment

Components in the payment path

ComponentRolePublicLicenceOperatorRequired
Umbra contractcontractsYesMITScopeLift (owner EOA sets toll only; no proxy)Yes
StealthKeyRegistry (or ENS records) for receiver public keyscontractsYesMITnone (no admin functions)Yes
umbra-js SDK (stealth key derivation, scanning, sends)sdkYesMITuserYes
Ethereum mainnet and a JSON-RPC endpoint of the user's choiceledgerYesLGPL-3.0Ethereum validators; RPC chosen by the userYes
Umbra API (token list, fee estimates, withdrawal relayer)relayerNoproprietaryScopeLiftNo
Hosted Ponder indexer behind the /api/ponder Netlify proxyindexerNoproprietaryScopeLiftNo
Umbra subgraph (The Graph)indexerYesnoneScopeLiftNo
app.umbra.cash frontendfrontendYesMITScopeLift (Netlify)No
Etherscan-family APIs (recipient key lookup from tx history)apiNoproprietaryEtherscanNo
Chainalysis sanctions oracle lookup in umbra-js (0x40C5…C8fb)otherNoproprietaryChainalysisNo

Repositories

RepositoryRoleLicense
ScopeLift/umbra-protocolcontractsMIT
ScopeLift/umbra-subgraphindexernone

Contracts

RoleAddressSource verified
Umbra (payments and announcements)0xFb2d…5401 explorer · Sourcifysourcify
StealthKeyRegistry0x31fe…38f3 explorer · Sourcifysourcify

Assessor notes

Unit: Ethereum Umbra 0xFb2d…5401 and StealthKeyRegistry 0x31fe…38f3; the same addresses exist on Optimism, Polygon, Base and Arbitrum and were not read. Reads at block 26153546 via publicnode. tollCollector is an EOA (0x12aE…2615) and tollReceiver an account with EIP-7702 delegation code whose VERSION() returns 1.3.0 (0xb443…17F9). The ConsenSys Diligence audit page returned 403 and was not bypassed. No transactions, UI runs, traces or self-host attempts.