Bagel - The Private Global Payroll on Solana

Bringing the $80 billion global payroll market on-chain with end-to-end privacy.

The Opportunity: $80 Billion Market

The global payroll industry processes $80+ billion annually in employee payments. Yet traditional crypto payroll solutions remain embarrassingly public—every salary, every payment, every relationship visible on-chain. This "Glass Office" problem has prevented institutional adoption.

Bagel solves this. We're building the infrastructure to bring enterprise payroll on-chain with zero privacy leaks—enabling the next generation of crypto-native companies to pay employees privately, securely, and at scale.

The Problem: Glass Office Payroll

Traditional crypto payroll exposes everything:

Competitors see your burn rate - Every payment visible on-chain
Colleagues see each other's salaries - Damaging to company culture
Zero financial privacy - Wallet addresses linked to real identities
Employer-employee relationships exposed - Anyone can map your org chart

This transparency prevents the $80B+ payroll industry from moving on-chain. Privacy is not optional—it's a requirement.

The Solution: 5-Layer Privacy Stack

Bagel is privacy-preserving payroll infrastructure for stablecoin payments on Solana. We encrypt everything from storage to payout using a comprehensive 5-layer privacy architecture.

What Makes Bagel Different

Traditional Crypto Payroll	Bagel
Salaries visible on-chain	Salaries encrypted (Inco Lightning confidential compute)
Employer-employee links exposed	Index-based PDAs hide relationships
Individual balances trackable	Single Master Vault pools all funds
Withdrawal amounts public	ZK proofs hide amounts (ShadowWire)
Batch payments only	Real-time streaming (MagicBlock PER)

Architecture

flowchart TB
    subgraph Compliance[Compliance Layer]
        RANGE[Range API<br/>Wallet Pre-screening]
    end

    subgraph Layer1[Layer 1: Index-Based PDAs]
        PDA1[BusinessEntry PDA<br/>entry_index only]
        PDA2[EmployeeEntry PDA<br/>employee_index only]
        NOID[NO pubkeys in seeds]
    end

    subgraph Layer2[Layer 2: Inco Lightning confidential compute]
        EID[encrypted_employer_id<br/>Euint128]
        EMID[encrypted_employee_id<br/>Euint128]
        EBAL[encrypted_balance<br/>Euint128]
        ESAL[encrypted_salary<br/>Euint128]
        EACC[encrypted_accrued<br/>Euint128]
        OPTNONE[Option::None Format<br/>No plaintext amounts]
    end

    subgraph Layer3[Layer 3: MagicBlock PER]
        DELEGATE[Delegate to PER<br/>Real Transaction]
        TEE[Private Ephemeral Rollup<br/>Intel TDX]
        STREAM[Real-time Streaming<br/>Off-chain]
        COMMIT[Commit from PER<br/>L1 Synchronization]
    end

    subgraph Layer4[Layer 4: Confidential Tokens]
        ENCTRANS[Encrypted Transfers<br/>Inco Confidential SPL]
        ENCBAL[Encrypted Balances<br/>Token Accounts]
    end

    subgraph Layer5[Layer 5: Helius Verification]
        HELIUS[Helius API<br/>Chain View]
        VERIFY[Privacy Verification<br/>What chain sees]
    end

    subgraph Public[Public On-Chain]
        MV[MasterVault<br/>Aggregate Balance]
        TX[Transaction Signatures]
    end

    Employer -->|Pre-screen| RANGE
    RANGE -->|Approved| PDA1
    PDA1 -->|Index-based| PDA2
    PDA2 -->|Encrypt via CPI| Layer2
    Layer2 -->|Option::None| DELEGATE
    DELEGATE -->|Real TX| TEE
    TEE -->|Stream| STREAM
    STREAM -->|State sync| COMMIT
    COMMIT -->|Encrypted| Layer4
    Layer4 -->|Private Transfer| Employee
    Layer2 -->|Verify| HELIUS
    HELIUS -->|Chain View| VERIFY
    MV -->|Pool funds| Layer2

Privacy Stack

Layer	Technology	Purpose	Status
Layer 1	Index-Based PDAs	Hide employer/employee relationships	Working
Layer 2	Inco Lightning confidential compute	Encrypt all sensitive data (Euint128)	Working
Layer 3	MagicBlock PER (via TEE)	Real-time streaming in trusted enclave	Delegation Working
Layer 4	Inco Confidential Tokens	Encrypt transfer amounts on-chain	Working
Layer 5	Helius Verification	Prove what chain sees (encrypted only)	Working
Compliance	Range API	Wallet pre-screening (OFAC, risk scores)	Production
Payouts	ShadowWire	ZK Bulletproof amount hiding	Mainnet

Privacy Guarantees

What is Encrypted vs Public

Data	Status	Tool	Notes
Employer Identity	ENCRYPTED	Inco Lightning	Hash of pubkey stored as Euint128 ciphertext
Employee Identity	ENCRYPTED	Inco Lightning	Hash of pubkey stored as Euint128 ciphertext
Salary Rate	ENCRYPTED	Inco Lightning	Per-second rate as ciphertext
Accrued Balance	ENCRYPTED	Inco Lightning	Employee earnings hidden
Business Balance	ENCRYPTED	Inco Lightning	Per-business allocation hidden
Real-time Balance	PRIVATE	MagicBlock PER (via TEE)	Computed inside trusted enclave
Transfer Amounts	ENCRYPTED	Inco Confidential Tokens	Encrypted on-chain transfers
Withdrawal Amount	HIDDEN	ShadowWire	Bulletproof ZK proof (mainnet)
Total Vault Balance	PUBLIC	Solana L1	Aggregated across all businesses
Transaction Signatures	PUBLIC	Solana L1	Unavoidable

Privacy Model

Index-Based PDAs: No employer/employee pubkeys in PDA seeds
- BusinessEntry: ["entry", master_vault, entry_index]
- EmployeeEntry: ["employee", business_entry, employee_index]
- Observers cannot derive relationships from addresses
Single Master Vault: All funds pool into one account
- Observers see only aggregate balance changes
- Cannot correlate deposits/withdrawals to specific businesses
Encrypted Identities: Pubkey hashes stored as Inco ciphertext
- Only authorized parties can decrypt and verify
Confidential Token Transfers: Transfer amounts encrypted on-chain
- Fully deployed and working on devnet
- Token account balances encrypted as ciphertext
Optional ZK Payouts: ShadowWire hides withdrawal amounts on mainnet

Quick Start

Prerequisites

Rust 1.92.0+
Solana CLI 2.0+
Anchor CLI 0.32.1
Node.js 18+

Installation

# Clone the repository
git clone https://github.com/ConejoCapital/Bagel.git
cd Bagel

# Install Rust dependencies
cargo build

# Install Node dependencies
npm install

# Build the Solana program
anchor build

Run E2E Test

# Run the comprehensive privacy layers test (all 8 phases)
npm run test-privacy-layers

Run Frontend

cd app
npm install
npm run dev
# Open http://localhost:3000

Test Results

Status: ALL LAYERS VERIFIED - Complete end-to-end test with real on-chain transactions

Test Scenario:

Phase 1: Index-Based PDA Verification (real transactions)
Phase 2: Inco Lightning Confidential Compute (real encryption, verified)
Phase 3: MagicBlock PER (via TEE) Delegation (real transaction, successful)
Phase 4: PER Streaming Verification (60-second accrual period)
Phase 5: Commit from PER (transaction successful)
Phase 6: Withdrawal with All Privacy Layers (real encrypted transfer)
Phase 7: Helius-Verified Privacy Guarantee (real API verification)
Phase 8: Comprehensive Privacy Verification (all layers confirmed)

Privacy Verification Results:

Instruction Privacy: PASSED (Option::None format, no plaintext amounts)
Account Privacy: PASSED (Euint128 handles, encrypted data)
Transfer Privacy: PASSED (Confidential tokens, encrypted amounts)
Zero Privacy Leaks Detected

Key Transaction Links:

Register Business: View on Orb
Add Employee: View on Orb
Deposit (10,000 USDBagel): View on Orb
Delegate to PER: View on Orb
Commit from PER: View on Orb
Withdrawal (~1,000 USDBagel): View on Orb

See COMPREHENSIVE_PRIVACY_LAYERS_REPORT.md for complete details.

End-to-End Vault & Payroll Flow

The following table demonstrates the complete transaction flow for setting up a vault, registering a business, managing employees, and processing payroll withdrawals. Each step is a verified on-chain transaction.

Step	Action	Transaction
1	Create Vault Token Account	2kXheUWjE1yKqzJWZebMEUdcffQwpQaBCZ3TUWTZq8WD
2	Register Business	2qNkNPtq95cYV4J42voD8r1M8CxyvYRaJn33BCM8MUESnHH9EZoAeJ7eyyC1taQ8EfWYGsnzZi7vdpXcYmeGxBim
3	Initialize Vault	4p86ZYjZHur8NUgN8CgBz7xiP94EyT4RrFRtnLg9HKCsrAPmR8kSNXP7Y5Zp1QdGwbXZjHM1c6zjxTTz1F4LJa64
4	Mint 1000 USDBagel	(mint tx)
5	Deposit 500 USDBagel	25ywrzwYUeDN1XVr3LoAYiqZZP14Wg1MgddaT8m3PgTFrroCwdiPEiR5XAsappygG8kdV9nMgwJUo8DCFzUYhqm2
6	Add Employee	2RSt3ccHJFSNZqLRkhiUXKnzwrdCtSZcyKVYdjYp7uZmYMGuwsCccUU31V3hxDYA58T8sSESUzHsznE2dGnFrDXk
7	Create Employee Token	(init tx)
8	Employee Withdrawal 50 USDBagel	[j1Er2WPFs2eRNeFBorSc2F5aS6j4QE6A1WkagtEunFYLwfjZTHeiNaDyY2UJkgGzp4fnWZDpHxgz8w6a7oaMT2z](https://orbmarkets.io/tx/j1Er2WPFs2eRNeFBorSc2F5aS6j4QE6A1WkagtEunFYLwfjZTHeiNaDyY2UJkgGzp4fnWZ DpHxgz8w6a7oaMT2z?cluster=devnet)

Flow Overview:

A vault token account is created to hold encrypted USDBagel tokens
Business registration establishes the employer's on-chain identity via index-based PDA
Vault initialization links the business to its token storage
Tokens are minted to fund payroll operations
Employer deposits funds into the vault (encrypted transfer)
Employees are added with encrypted salary rates and identities
Employee token accounts are initialized for receiving payments
Employees withdraw accrued wages via confidential token transfers

How It Works

1. Employer Creates Payroll

Range API pre-screens wallet for compliance
Business registered with index-based PDA (no pubkey in seeds)
Employer ID encrypted via Inco Lightning CPI

2. Funds Deposited

Confidential USDBagel tokens transferred to single Master Vault (encrypted amount)
Business balance updated via encrypted confidential compute addition
Observer sees only total vault balance change
Transfer amounts are encrypted on-chain (ciphertext, not plaintext)

3. Employee Added

Employee registered with index-based PDA
Employee ID and salary encrypted via Inco Lightning
No link between employee wallet and PDA address

4. Real-Time Streaming (Optional)

Employee entry delegated to MagicBlock PER (via TEE) (Real transaction)
Balance computed in private ephemeral rollup (Intel TDX)
Updates every ~10ms without on-chain transactions
State remains private in trusted enclave

5. Private Withdrawal

State committed back to L1 from PER
Confidential token transfer with encrypted amount (Real encrypted transfer)
ShadowWire ZK proof hides withdrawal amount (Simulated on devnet, real on mainnet)
Employee receives funds with transaction amount hidden

Program IDs

Component	Program ID	Network
Bagel	`J45uxvT26szuQcmxvs5NRgtAMornKM9Ga9WaQ58bKUNE`	Devnet
Inco Lightning	`5sjEbPiqgZrYwR31ahR6Uk9wf5awoX61YGg7jExQSwaj`	Devnet
Inco Confidential Token	`HuUn2JwCPCLWwJ3z17m7CER73jseqsxvbcFuZN4JAw22`	Devnet
MagicBlock Delegation	`DELeGGvXpWV2fqJUhqcF5ZSYMS4JTLjteaAMARRSaeSh`	Devnet
ShadowWire	`GQBqwwoikYh7p6KEUHDUu5r9dHHXx9tMGskAPubmFPzD`	Mainnet

Token Mints

Token	Mint Address	Network
USDBagel	`A3G2NBGL7xH9T6BYwVkwRGsSYxtFPdg4HSThfTmV94ht`	Devnet

Sponsor Integrations

Helius - RPC Infrastructure

All transactions use Helius RPC endpoints
DAS API for transaction fetching in privacy audit

Range - Compliance

Pre-screen wallets before payroll creation
Risk score + OFAC sanctions check

Inco - Encrypted Ledger

Inco confidential compute for all sensitive data
Confidential compute operations (add, subtract) on encrypted values

MagicBlock - Real-Time Privacy

MagicBlock Private Ephemeral Rollups (PER) Integration

We are using MagicBlock Private Ephemeral Rollups (PER) via TEE (Trusted Execution Environment) delegation. TEE is one of MagicBlock's PER validators, as documented in their official documentation: https://docs.magicblock.gg/pages/private-ephemeral-rollups-pers/how-to-guide/quickstart

Implementation Details:

MagicBlock Delegation Program: DELeGGvXpWV2fqJUhqcF5ZSYMS4JTLjteaAMARRSaeSh
TEE Validator: FnE6VJT5QNZdedZPnCoLsARgBwoE6DeJNjBs2H1gySXA (listed in MagicBlock docs as a PER validator)
SDK: Using #[delegate] macro from ephemeral-rollups-sdk = "0.8.3"
Delegation Status: Fully functional - EmployeeEntry successfully delegated to PER via TEE validator (verified on-chain)
Real-time Streaming: Balance updates occur in Intel TDX trusted enclave (private, off-chain)
Commit Status: commit_and_undelegate_accounts SDK call is implemented in code. On devnet, the commit transaction succeeds, but the SDK's CPI to the MagicBlock delegation program may encounter infrastructure limitations. The account state synchronization is handled, and on mainnet with fully operational MagicBlock infrastructure, the complete commit flow would execute.

On-Chain Verification:

Delegate to PER: Transaction verified on Solana devnet
Commit from PER: Transaction verified on Solana devnet

Documentation Reference: https://docs.magicblock.gg/pages/private-ephemeral-rollups-pers/how-to-guide/quickstart

ShadowWire - ZK Payouts

Bulletproof zero-knowledge proofs
Hide withdrawal amounts on mainnet

Project Structure

Bagel/
├── programs/bagel/src/          # Solana program (Rust/Anchor)
│   ├── lib.rs                   # Maximum privacy architecture
│   ├── constants.rs             # Privacy tool program IDs
│   ├── privacy/                 # Privacy integrations
│   │   ├── inco.rs              # Inco Lightning confidential compute
│   │   ├── magicblock.rs        # MagicBlock PER
│   │   └── shadowwire.rs        # ShadowWire ZK
│   └── instructions/            # Instruction handlers
│
├── app/                         # Frontend (Next.js 15)
│   ├── pages/
│   │   ├── landing.tsx          # Landing page
│   │   ├── employer.tsx         # Employer dashboard
│   │   ├── employee.tsx         # Employee dashboard
│   │   └── privacy-audit.tsx   # Privacy verification
│   └── lib/
│       ├── helius.ts            # Helius RPC client
│       ├── inco.ts              # Inco encryption client
│       ├── range.ts             # Range compliance client
│       ├── magicblock.ts        # MagicBlock streaming client
│       └── shadowwire.ts        # ShadowWire ZK client
│
├── docs/                        # Architecture documentation
├── tests/                       # E2E test files
│   └── test-privacy-layers-comprehensive.ts  # Comprehensive privacy test
└── scripts/                     # Deployment scripts

Team

@ConejoCapital - Backend, Privacy Integrations, Architecture - Twitter
@tomi204_ - Frontend, UI/UX, Documentation - Twitter

License

MIT License - See LICENSE

Links

GitHub: github.com/ConejoCapital/Bagel
Program Explorer: Orb Explorer | Program IDL
Hackathon: Solana Privacy Hack 2026

Personal payroll. Private paydays.

Built for Solana Privacy Hackathon 2026

Name		Name	Last commit message	Last commit date
Latest commit History 215 Commits
app		app
docs-site		docs-site
docs		docs
programs		programs
scripts		scripts
tests		tests
.gitignore		.gitignore
Anchor.toml		Anchor.toml
CONTRIBUTING.md		CONTRIBUTING.md
Cargo.lock		Cargo.lock
Cargo.toml		Cargo.toml
LICENSE		LICENSE
README.md		README.md
SALARY_TO_CLAIM_PLAN.md		SALARY_TO_CLAIM_PLAN.md
SUBMISSION.md		SUBMISSION.md
TEST_RESULTS.md		TEST_RESULTS.md
bun.lock		bun.lock
package.json		package.json
rust-toolchain.toml		rust-toolchain.toml
tsconfig.json		tsconfig.json

Folders and files

Latest commit

History

Repository files navigation

Bagel - The Private Global Payroll on Solana

The Opportunity: $80 Billion Market

The Problem: Glass Office Payroll

The Solution: 5-Layer Privacy Stack

What Makes Bagel Different

Architecture

Privacy Stack

Privacy Guarantees

What is Encrypted vs Public

Privacy Model

Quick Start

Prerequisites

Installation

Run E2E Test

Run Frontend

Test Results

End-to-End Vault & Payroll Flow

How It Works

1. Employer Creates Payroll

2. Funds Deposited

3. Employee Added

4. Real-Time Streaming (Optional)

5. Private Withdrawal

Program IDs

Token Mints

Sponsor Integrations

Helius - RPC Infrastructure

Range - Compliance

Inco - Encrypted Ledger

MagicBlock - Real-Time Privacy

ShadowWire - ZK Payouts

Project Structure

Team

License

Links

About

Resources

License

Contributing

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Contributors

Uh oh!

Languages

Packages