Overview
Grail launches tokens on Ethereum and lets people buy and sell them from a private balance, without their wallet appearing on the trade.
The main idea
On a public launchpad, every buy is tied to a wallet. Trackers and copy traders watch the wallets that buy early, so a good entry becomes a signal for everyone else, and a wallet's whole history is open to anyone who looks.
Grail separates the two things that usually come together. Tokens launch in the open, in an ordinary Uniswap v3 pool that every terminal can see from the first block. Buyers who want privacy trade that same pool from a Railgun private balance. The pool still gets a normal swap, and the market still gets a price, but the chain shows Railgun's adapter contract as the trader instead of the buyer's wallet.
Everything happens on one site. A person connects a wallet, creates a private balance, deposits and trades, and the proofs run in their browser.
What the chain shows
| Action | Public | Not public |
|---|---|---|
| Create a token | The creator's wallet, the token, its pool and the creator's first buy | Nothing. Launches are public by design |
| Deposit | The depositing wallet, the amount and that it entered Railgun | Which private address received it |
| Private buy or sell | The token, the amounts, the RelayAdapt contract as trader and the broadcaster as sender | Whose private balance paid and received |
| Withdraw | The recipient and the amount | Which private balance it came from |
| Public buy or sell | Everything, as on any exchange | Nothing |
These are the protections and their edges. Security and limits covers what they do not protect against, such as matching a deposit to a trade by timing and amount.
What Grail is built on
| Layer | What it does | Who runs it |
|---|---|---|
| Uniswap v3 | The market. Every token has a 1% pool from its first block | Uniswap contracts on Ethereum |
| Railgun | Shielded balances, zero-knowledge proofs, RelayAdapt and Private Proofs of Innocence | Railgun's contracts and public POI nodes. Grail uses them as any other integrator would |
| GrailLaunchpad, GrailToken, GrailLocker | Deploy tokens, create pools, lock liquidity and split fees | Immutable contracts. The owner is a Safe with narrow powers |
| The browser | Holds the recovery phrase, scans notes and builds every proof | The user |
| Broadcaster | Sends private transactions and pays gas, for a fee taken from the private balance | Grail |
| Tree snapshot | A ready-made copy of Railgun's public tree, so the first open takes minutes | Grail |
| Indexer and API | Token lists, charts, trades and token images | Grail |
Where to go next
- Design decisions: why each part is built the way it is.
- Using Grail: the steps, from connecting a wallet to withdrawing.
- The first sync: how a browser gets Railgun's tree without a 25-minute sync.
- Token launches: how tokens, pools and locked liquidity are created.
Grail is an independent project built on Railgun's public contracts and SDK. Railgun contributors do not run, review or endorse Grail, and they did not write this documentation. Their own documentation is at docs.railgun.org.