Envelope

Envelope is on-chain payroll with a deliberately narrow privacy boundary: it publishes the totals and keeps the roster private. An employer commits to a payroll run by publishing a Merkle root and funding it with USDG. Each salary becomes a salted leaf- keccak256(runId, index, recipient, amount, salt) so the individual amounts are never written to the chain. Employees claim their own commitment with a proof. Claiming is one-time, protected by a nullifier, and bound to the recipient address, so a leaked package is useless to anyone else.

What the public can verify: the employer, the Merkle root, the total deposited, the total claimed, and the deadline — read straight from the contract, with no wallet required. What stays private: who is on the roster and what each person is paid. After the deadline the employer can reclaim whatever was never claimed.

We state the limit plainly, because blurring it would be dishonest: the contract does not cryptographically prove that the committed salaries sum to the deposited total. Preventing under-funding needs a sum proof (Pedersen commitments or ZK), which is out of scope here. In practice an employer can commit to more than they funded — and an unpaid employee can prove it, because a valid proof that reverts is public evidence of non-payment. That trade-off is documented in the repository, not hidden. One contract, four functions, no admin key, no upgrade path, no fee, and no token of our own. Settled in USDG on Arbitrum Sepolia.

Contract - PayrollRun.sol, one contract with four functions: createRun, claim, reclaim, plus public reads. No owner, no pause, no upgrade, no fee, no mint. OpenZeppelin MerkleProof and Reent rancyGuard, solc 0.8.24, events emitted before transfers.

Cryptography - a client-side Merkle builder shared by the frontend and the test suite, so there is one implementation of the tree rather than two that can drift. Salts from crypto.getRandomValues. Leaf and pair hashing bind runId and index, which kills cross-run replay and leaf malleability.

Tests - 63 passing: 32 contract, 6 Solidity<->JavaScript parity against a committed vector, 15 JavaScript, and 10 fork tests that run the complete flow against the real USDG on an Arbitrum Sepolia fork. That confirmed on day one that the token is 6-decimal, not fee-on-transfer, non-rebasing, and returns bool from transfer.

Frontend - static and backend-free: public proof, employer, and employee claim views.The public view needs no wallet at all. We also documented the settlement token's own risk: USDG is an upgradeable proxy whose issuer retains paused () and isFrozen (address). Neither is active, but the dependency is real and is asserted in the test suite rather than glossed over.

Not raising. Self-funded, built by one developer. No token, no presale, no investors.