Networks
Prices, data and oracles
Where the numbers in the app come from, what sets an execution price and how balances and history are read.
- Oracle needed
- No
- Stock prices
- Indicative on testnet
- Balances
- Chain plus local notes
Oracles#
Private balances, payments, payroll and proofs do not depend on a price oracle. The pool counts units of a token: if you shield 100 USDG, you hold notes worth 100 USDG, and every check inside a proof is about those token amounts. Nothing in the pool converts one asset into another or values it in dollars.
That keeps a class of failures out of the core: a stale feed, a manipulated price or an oracle outage cannot change what you own or block you from withdrawing it. A stablecoin is shown as worth one US dollar because that is what it is designed to track, not because a feed says so. If a stablecoin loses its peg, your notes still hold the same number of tokens.
Prices you see#
Some screens show a dollar figure next to a token amount, and the Markets page lists the stock tokens on Robinhood Chain testnet (TSLA, AMZN, PLTR, NFLX, AMD). Those prices are indicative: a reference figure to make the screen readable, not a quote you can trade at.
| Figure | Source | Use it for |
|---|---|---|
| Stablecoin amounts | Your notes and the token contract | Exact. This is what you hold. |
| Dollar value of stablecoins | Face value, one to one | Display only |
| Stock token prices on testnet | Reference data, may be delayed or simplified | Orientation only, never as a quote |
Testnet assets have no value
What sets an execution price#
When a swap happens, the price is set by the venue that executes it, at the moment it executes: the pool or exchange contract on the chain, given its state at that block. The indicative price on screen does not bind it. A careful flow states a minimum amount out, and the trade fails rather than fill below it.
Swapping from a private balance is the job of sealed trade, which is built but switched off. Until it is enabled, the way to trade is to unshield, trade publicly at the venue's price, and shield the result if you want it private again.
Balances and history#
Your view of your own money is assembled from two places, both under your control:
- The chain. The app reads pool events (new commitments, spent nullifiers and encrypted note data) from the network's RPC, starting at the pool's deploy block. It tries each encrypted note with your keys and keeps the ones that open.
- Your local notes. The notes you can open, and whether each is spent, are stored on your device: IndexedDB in the browser, a file when you use the SDK on a server. Your private balance is the sum of your unspent notes.
Your public wallet balance is read straight from the token contract. Your private history (who paid you, your memos, your payroll runs) exists only in your local notes. UMBR does not run a server that holds it, which is also why the key backup in Settings matters.
The first sync on a new device can take a while, because it walks the pool's history from the deploy block. Later syncs only fetch what is new.
Gas on testnet#
- Robinhood Chain testnet: gas is paid in test ETH. Shielding and any transaction you send from your own wallet need a little of it.
- Tempo Moderato: there is no gas coin. Fees are paid in a USD stablecoin such as pathUSD, so the same faucet drip covers the deposit and the fee.
- With the relayer: private sends and unshields can be submitted by the relayer, which pays the gas and takes a fee from the payment. The fee and destination are fixed inside your proof, so the relayer cannot change them.
What comes next#
- Clearer labelling of where each displayed price comes from and how old it is.
- Execution data for sealed trade, once it is switched on: expected amount, minimum out and the venue used.
- Faster first sync on new devices, without handing your keys or notes to a server.