Protocol & DevelopersSepolia Operations

Sepolia deployment

The current checkpoint protocol is deployed on Sepolia (chain 11155111). Pool: 0xB45A19e83dAE4BCe6ddC60a1644f4C1D460104b2. The canonical deployment, browser configuration, proof bundle, RPC allowlist and service code pins are in config/sepolia config/sepolia. There is one selected protocol deployment; all four proof routes and adapters belong to it.

The 11 October 2026 deployment confirmed all 50 transactions from blocks 11887254 through 11887357, consuming 753,526,750 gas and 0.0075352675 Sepolia ETH. The installer verified contract runtime hashes, registry bindings, all four proof assets and EIP-2612 signatures for all nine disposable tokens, including rejection of altered permits. Live gas estimates must be used: the pinned fork rehearsal consumed 108,178,182 gas and does not reproduce current Sepolia state-creation pricing.

The proof manifest is f160ff4385049eaa1ab9f4b0bd40c6e8b9c801737ec33b2b6277a164e4b688a6. Development proof assets are suitable only for disposable test tokens. Mainnet qualification and acceptance remain separate release gates.

The production frontend is built from this directory. The hosted intent service must be initialized for this exact pool and code pins before gasless submission becomes available. Frontend discovery rejects a service advertising a different pool; direct wallet submission remains available. Service rollout is an operator step, separate from publishing this repository.

Production browser acceptance

The live browser test in sepolia-live.spec.ts apps/web/e2e/sepolia-live.spec.ts uses https://app.sealpool.app and actual Sepolia transactions. It does not substitute the deployment configuration, RPC responses, proof files, or intent service. The wallet bridge signs with a dedicated disposable test wallet.

Verified on 11 October 2026: wallet-funded USDC and WETH deposits, USDC-to-USDT swap, a 25 USDC private withdrawal, and public/private long and short margin. Each margin lifecycle completed open, add collateral, repay, reduce and close; per-asset debt returned to zero. Account recovery and saved-balance reload also passed. One measured reload showed the account in 1.741 seconds, including page loading; this is a single measurement, not a device-independent latency guarantee.

The withdrawal receipt is 0x0d4fb04fe24b08bed6a995222094504b221f4cf9dbe34c518f154a381e81425b. The browser verified the wallet's received amount and the successor account after reload. Its recovery/proving/submission/reload test took 3.7 minutes on the test machine; cryptographic proof generation remains device-dependent and is distinct from loading saved balances or reading quotes. Interrupted, unexposed proof drafts can be retried after reload; exposed actions remain subject to reconciliation.

Gasless production acceptance is pending operator rollout of the hosted service. It must advertise this pool and deposit, swap, margin, and publicMargin. The zero-ETH test rejects wallet transaction requests and checks USDC/WETH permit and deposit typed-data signatures. It must pass against the actual hosted endpoint before gasless deployment acceptance is complete.

All 61 source contracts were verified on Etherscan; eight minimal proxies reference their verified implementation. Explorer license metadata for the four generated verifiers still needs correction to match their GPL-3.0 SPDX source declarations. Resubmission with the matching license reports already verified and does not update that metadata. There is no source or bytecode mismatch.

Release sequence

Freeze the source commit and run circuit, SDK, frontend, contract, relayer, real-proof and fork checks. Prepare all four browser artifacts with npm run prepare:account-state. Build the contracts with the pinned toolchain. Retain source hashes, verification keys and proof-manifest digests.
Start an isolated Anvil fork of Sepolia at a recorded block, preserving chain ID 11155111, and simulate the complete deployment. Use the intended deployer/guardian address, public browser RPC and explicit transaction/cumulative gas budgets. Simulation sends no transaction to Sepolia.
Review the simulated transaction list, predicted addresses, total gas, authorities, nine test assets, mock Aave reserves, swap routes and both margin adapters. The core includes four raw PLONK verifiers, four adapters, a fixed registry and PrivacyPool; the deposit and private-margin adapters require checkpoint proofs.
Broadcast only the exact reviewed plan, with the same deployer nonce, source/artifact digests, authorities and RPC policy. The deployer key remains outside the repository. Record receipts and verify runtime code, registry ordering and all configured assets at confirmed blocks. Resume interrupted broadcasts from their journal; do not deploy a second partial set.
Generate the browser configuration, proof bundle, RPC allowlist and relayer runtime pins from that one deployment record. Initialize the service for the fresh pool in simulation mode, provision its executor and delivery database, and verify its advertised chain, pool, submission key and asset-denominated quotes.
Install the verified release into a staging frontend. Run the acceptance matrix below against the real service and Sepolia contracts, then activate the service and frontend configuration together. Do not expose submission while the configured service or contracts fail identity checks.
Monitor transaction acceptance, inclusion latency, quote latency, RPC errors and checkpoint mismatches. Keep immutable deployment receipts and account recovery files. An incident disables affected submission controls and service execution; it does not alter immutable verifier routes.

Rehearsal and broadcast commands

Run the pinned Anvil binary against the selected Sepolia RPC on an unused loopback port. Set SEAL_TESTNET_RPC_URL to that loopback endpoint for the simulation, and SEAL_TESTNET_PUBLIC_RPC to a credential-free public endpoint. Supply the reviewed addresses explicitly:

npm run testnet:deploy -- --allow-development-proofs \
  --rpc-url http://127.0.0.1:8546 \
  --public-rpc-url "$SEAL_TESTNET_PUBLIC_RPC" \
  --operator "$SEAL_DEPLOYER_ADDRESS" \
  --run .local/releases/sepolia-simulation

This creates a reviewable deployment journal and proof bundle. Verify the simulated contracts and matching installer through the fork RPC while retaining the intended public endpoint in the deployment plan:

npm run testnet:install -- --run .local/releases/sepolia-simulation \
  --rpc-url http://127.0.0.1:8546 \
  --output .local/releases/sepolia-staging

After review, broadcast uses a distinct output directory, the live RPC and the successful simulation directory:

npm run testnet:deploy -- --allow-development-proofs --broadcast \
  --rpc-url "$SEAL_TESTNET_RPC_URL" \
  --public-rpc-url "$SEAL_TESTNET_PUBLIC_RPC" \
  --operator "$SEAL_DEPLOYER_ADDRESS" \
  --plan .local/releases/sepolia-simulation \
  --run .local/releases/sepolia-deployment

SEAL_TESTNET_PRIVATE_KEY is required only for broadcast. SEAL_TESTNET_MAX_GAS_GWEI and SEAL_TESTNET_MAX_ETH bound execution cost; choose them after reviewing the simulation. The script refuses a changed plan or exceeded budget. Accepted production proof assets use the separate prepare-sepolia.ts qualification path; development proof authorization cannot satisfy a mainnet gate.

Acceptance matrix

USDC deposit with zero wallet ETH: permit signature, deposit EIP-712 signature, real relayer submission, exact USDC fee, receipt reconciliation and successor checkpoint. Repeat with existing allowance, direct wallet submission and a lost service response.
Swap, transfer, claim, reclaim, consolidation and full withdrawal: correct proof context, values, fees and checkpoint transition; duplicates and modified signatures fail atomically.
Public and private margin: long and short open, add, repay, reduce, close and pending proceeds; gasless and direct execution; live health and liquidity errors; isolated account liquidation. Public revisions and private owner tags match the account file.
Account reload: immediate saved balance and positions, background freshness status, latest-file/Google prompt on a spent marker, cross-device conflict handling, reorganization detection and recovery. Incoming notes remain discoverable independently.
UX: cached quotes and bounded parallel reads, no RPC inventory scan for an account without positions, visible signing/proving/submission/confirmation progress, and responsive navigation during proving.
Custom RPC: endpoint and chain validation, no credential disclosure, read-only proxy restrictions, lagging log-backend recovery and explicit pending/unavailable status without losing local state.

Installation and service

npm run testnet:install -- --run <verified-run> --output apps/web/public verifies the deployment and installs its matching assets. SEAL_TESTNET_RUN=<verified-run> npm run build:testnet produces the Sepolia frontend; npm run build:web produces the Sandbox preview. A build sends no transaction. A push alone does not deploy contracts or authorize a mismatched configuration.

Initialize the service using the selected run's testnet-config.json and relayer-pins.json, following service setup intent-service-rs/SETUP.md. Do not overwrite a service journal or executor identity for another pool. Verify /relay/info before activating the corresponding frontend binding. Keep provider credentials server-side; users may select their own RPC in Settings.

Testnet assets and mock venues have no monetary value and do not reproduce every production Aave or Uniswap behavior. The mock operator controls reserve state and prices for testing. Sandbox balances are fully simulated and remain a separate network choice.