Add Stealth Send and Stealth Swap (Houdini privacy routing)

[j0ntz]

Technical Design Document

stealth-send-swap.md

CHANGELOG

Does this branch warrant an entry to the CHANGELOG?

• Yes
• No

Dependencies

• Add core-side synthetic destination for swap-to-address edge-core-js#730 (swap-to-address toAddressInfo + EdgeSyntheticDestinationWallet)
• Add HoudiniSwap swap plugin edge-exchange-plugins#469 (HoudiniSwap plugin)

Ready for review. Two things block merge. The dependency PRs above must publish and the version pins here must bump. And STEALTH_LEARN_MORE_URI in src/constants/stealthConstants.ts is a placeholder: both Stealth toggles' "Learn more" currently opens Edge's support home rather than the Stealth Send article, which does not exist yet. It needs the real URL, which is a one-line edit at that constant. This repo runs no typecheck on pull requests (Travis is limited to develop/staging, and pr-checks.yml runs only the WIP blocker), so the branch reviews cleanly as-is; it will not compile against published edge-core-js 2.47.1, which lacks toAddressInfo and EdgeTxActionSwap.swapType. Locally it is verified against the linked dep branches: tsc clean, eslint clean, full jest suite green.

Requirements

If you have made any visual changes to the GUI. Make sure you have:

• Tested on iOS device
• Tested on Android device
• Tested on small-screen device (iPod Touch)
• Tested on large-screen device (tablet)

Description

Asana task

Send from any wallet to an address on any chain the provider serves, privately, from the ordinary send scene. Edge could previously send an asset to an address on its own chain, or swap between two wallets the user holds; paying someone whose address is on another chain took two operations and a wallet the user may not want, and every ordinary send writes a direct sender-to-recipient edge on chain. A swap provider that pays out to an arbitrary address answers both, because the provider address sits between the two parties.

The design document linked above is the full account, including the per-phase history and the decisions with their rejected alternatives. What follows is the shape of the diff.

Send (SendScene2 becomes a send-to-address swap). The feature is integrated in place rather than as a parallel scene, which is the task's UI proposal A reading and the only version that reaches the send scene's many entry points.

• A "Recipient receives" asset selector and a Stealth Send toggle appear only when the scene is an unconstrained plain send. Every constrained caller fails at least one clause of the swapSendAllowed predicate, so payment protocol, FIO requests, deep links, and any caller that pre-locks tiles or takes over broadcast keep today's behavior.
• Stealth on, or a cross-asset recipient, turns the send into a live account.fetchSwapQuotes({ toAddressInfo }) quote. Plain same-asset sends keep the existing UI and behavior, including multi-recipient UTXO sends, which gained a Total Amount row.
• Linked "You send" / "Recipient gets" rows: the edited side is the guaranteed amount and the other tracks the live quote as an estimate, each row naming its state in its own title, tinted green and warning orange. Both go through the standard flip input and open on fiat, as the Exchange scene's inputs do. Editing the receive side issues a reverse quote.
• The quote row carries the real rate, the winning provider label, the price delta reused from the swap confirmation scene through the new shared PriceImpactText, a real expiry countdown that re-quotes, and the quote's own network fee.
• A quote is retired the instant anything it was priced against moves, and the slider reads the live value through a ref rather than the one its render closed over: the PIN spending-limit check awaits, and a quote retired during that await would otherwise still be approved.
• Every send-to-address quote is Houdini-only, toggle or no toggle: send-to-any is a privacy feature and never shops the destination address to other providers. A pair Houdini cannot route errors rather than falling back, by design.
• What the provider cannot do for a pair is learned from real quote failures rather than probed. A same-asset pair with no private route turns the toggle off with a toast and degrades to the plain send it had upgraded; a missing receive-priced route falls back to a rate-seeded guaranteed send amount with a warning card that clears on edit; re-arming either on a known-unavailable pair answers pre-emptively instead of sending another doomed quote. Amounts under the applicable floor (25 USD private, 10 standard) are refused before a request goes out.
• Multi-recipient and stealth/cross-asset are mutually exclusive, gated in both directions.

Cross-chain address entry. An address the sending wallet cannot read is matched against the served destination chains rather than reported as invalid. A URI scheme names its chain outright and wins; a bare address is matched on format, and where several chains share one (the whole EVM family) the user picks from a modal rather than the app guessing and misdirecting funds. This hangs off AddressTile2.changeAddress, so Paste, Enter address, and Scan are all covered at once. A scanned QR carries a payment URI, so a new generic splitter (src/util/paymentUri.ts) reads the scheme, the EIP-681 @chainId, address candidates, the amount, and any destination memo without a chain-specific parser. The chain id is read before the scheme, since every EVM network's code writes ethereum: and only the id names the network; an id nothing serves resolves to nothing rather than falling back to Ethereum. A URI amount is what the recipient should RECEIVE, so it guarantees the receive side for a cross-asset destination; a same-asset stealth send keeps it on the send side, because the provider serves no receive-priced route when the two assets match.

Swap. A Stealth Swap toggle on the amount-entry scene restricts the request to Houdini and demands a private route, with the restriction surviving re-quotes on the confirmation scene, and the powered-by card rendering as a fixed provider through a now-optional PoweredByCard.onPress.

Transaction identity. A swap-send, a stealth send, and a stealth swap-send are titled separately in the list and details, named on the swap action's new swapType rather than inferred, because only the scene knows which shape ran. The two private flows suppress the recipient in the UI while keeping orderId and payoutAddress in storage so support can trace a stuck order, and the spend-target row is retitled "Exchange Deposit Address", which is the address the funds actually went to.

Review round (2026-08-25). The branch is rebased on current develop and re-reviewed against it. Behavior changes from that round, in order of consequence:

• The private-send redaction fails CLOSED. hidePayoutAddress read savedAction.swapType, which reaches the saved action through a best-effort saveTxAction the send deliberately swallows so a storage hiccup cannot fail a completed send. A stamp that never landed left the recipient's address on screen days later for a send the user was told was private. The test now also accepts the provider: a swap routed by the privacy provider is privacy-routed by construction, and hiding the payout address on an ordinary provider swap costs nothing, since that payout goes to the user's own wallet. The analogous fee-row case was already hardened this way; the primary row was not.
• A token source can pay out on its own chain. detectHoudiniChains dropped the source chain unconditionally, so a USDC-on-Ethereum send with a pasted 0x address offered Arbitrum, Base and every other EVM network but not Ethereum, the one the recipient actually holds. The chain is now dropped only when the source IS that chain's coin.
• The learned fixedTo route capability is keyed by privacy. Exact-out lives on fixed-rate routes, which Houdini's private routing does not serve, so a receive-priced failure learned with Stealth ON refused the editor with Stealth OFF, for a capability never tested on that route.
• Sentry names the real destination. A send-to-address error has no toWallet, and the tags fell back to the SOURCE wallet, so every stealth-send failure looked like a same-chain error in monitoring.
• The success navigation out of the slider goes through InteractionManager.runAfterInteractions, matching the plain-send path beside it; the two saveTxAction writes for a token send go out together instead of one after the other; the "require a destination wallet" guard is one helper instead of six copies in two different wordings; and the Stealth info card is one component instead of two copies.

A rebase artifact is also fixed: SafeSlider carried a duplicate testID attribute after 18 commits replayed over 155, because this branch turned the hardcoded id into a prop defaulting to the same value while upstream added the hardcoded one, and git merged both onto the element. Only tsc caught it.

The maestro suite was repaired against current develop in the same round, and two of those repairs are product fixes rather than flow edits. walletListRow ids were identical across a wallet's every enabled token, so a walk asking for "My Sonic" named seven rows at once and tapped whichever the matcher reached first; token rows now carry their currency code and the chain's own coin keeps the bare name. The picker modal reused those same ids while floating over a scene whose rows repeat the names, so a tap resolved to the COVERED row and dismissed the sheet instead of choosing a wallet; picker rows are now walletPickerRow.<name>, threaded through WalletList as a testIdPrefix. On the flow side, stealth-open-send.yaml now reaches the Send scene through Home → Send → "To Another Wallet/Exchange", since the Assets tab's wallet row no longer lands on that wallet's transaction list.

Chain metadata. src/util/houdiniChains.ts is a snapshot of Houdini's mainnet natives intersected with Edge pluginIds: 34 chains, 5 memo-required. Four of the provider's published address regexes are corrected in it with the reason inline: the Cardano pattern ends in an unanchored zero-length alternative that matches every string, the PIVX class writes A-z, which spans the punctuation between the alphabet halves, the eCash pattern spells its prefix-less form as [0-9A-Za-z]{42}, which is exactly the shape of an 0x EVM address, and Solana's floor of 32 base58 characters reaches into the 33-34 band the Bitcoin-family legacy forms occupy. Each entry also carries its EVM network id where it has one, since every EVM payment code writes the ethereum: scheme and only the EIP-681 chain id names the network.

What the recipient receives. The "Recipient receives" row and the picker that edits it now read one function. A swap-send pays out the destination chain's native asset, because the quote asks for toTokenId: null; a plain send delivers the source asset verbatim. Deciding that in two places let them disagree for a token source, where the picker offered "Tether (USDT)" and the row underneath read "Ethereum (ETH)". The row also follows the toggle rather than only the picked chain, so a plain USDT send stops claiming the recipient receives ETH. The source chain is listed once rather than twice: the duplicate quoted identically and differed only in whether turning Stealth off degrades to a plain send, which is not a distinction a user can see. RadioListModal rows gained an optional value, defaulting to the name so the other three callers are untouched, because a display name is not an identity: the POL ERC-20 on Ethereum shares its name and its currency code with the Polygon chain, which left Polygon unreachable as a destination from a POL wallet. The same opt-in shape adds the search box a 34-chain list wants, reusing the filtering ListModal already provides.

Deliberately out of scope, each with its reasoning in the design doc: token destinations, max spend in swap-send mode, multiple recipients with swap-send, and telling two EVM chains apart from a bare address.

Reading the diff. 18 commits, ordered shared primitives, then utilities, then the scenes that consume them, then the UI walks. The design document rides in the first commit and the CHANGELOG entry in the last. Each is independently lint-clean, each string lands in the commit that uses it, and each file leaves the legacy lint exclusions in the commit that brings it onto the strict ruleset.

Testing. 76 unit tests across five new files here (payment URI splitting, chain detection and table invariants, the request restriction, the error mapping, and the transaction titling), plus 14 in edge-core-js and 31 in edge-exchange-plugins. Full jest suite green: 103 suites, 804 tests, 107 snapshots. tsc and eslint clean. In-app on the iOS simulator against this branch with both dep branches linked: the Stealth Swap toggle drives on and renders its explanation, and both wallet pickers resolve through the new walletPickerRow ids. The funded swap itself did not complete: the Exchange scene wedges blank on the confirm transition in this debug build, and it does so identically with Stealth OFF on an ordinary swap, so the wedge is the build rather than this branch.

On the iOS simulator against the live provider, across the phases: five real on-chain executions including the reported cross-chain address-entry path end to end, a Stealth Send of 26 USD from Litecoin paying out Sonic on the current branch (live private quote at 1 LTC = 2036.80293985 S, through the slider to the success scene and a transaction titled "Stealth Swap & Send"), a private Stealth Send priced in fiat through to the success scene, a stamped send from a token source confirming the "Exchange Deposit Address" title over Houdini's real deposit address, a 10-case entry-path and chain matrix covering BTC, LTC, ETH, POL and SOL plus USDC and USDT token sources, the stealth auto-disable and fixed-to fallback driven live, and the plain-send and multi-recipient regressions. Screenshots are attached to this PR. maestro/14-stealth/ holds a flow per user-visible branch, with the two that move funds behind their own tag so a run of the suite cannot spend.

Warning surfaces (2026-08-27). A Houdini-routed send looks like a send and behaves like a swap, and nothing on the scene said so. Three surfaces now do, each answering a different question.

• A one-time modal on the send scene, the first time a send turns into a swap. It names the provider off account.swapConfig, and says the wallet pays the provider while the provider pays the recipient, and that the send is not complete until the provider forwards the funds. It follows the send scam warning beside it: a disklet key, runOnce, and a ConfirmContinueModal. Informational, so it never blocks the send.
• A one-time terms modal on the dedicated swap scene, in the shape every other centralized provider already gets. SwapConfirmationScene was already calling swapVerifyTerms, and Houdini was the only routed provider with no pluginData row, so it showed nothing. Its entry carries Houdini's Terms of Use, Privacy Policy and AML/KYC links, and persists through the provider's own agreedToTerms user setting.
• A warning card at the bottom of the send scene, in the existing warning cluster, for as long as the send stays a swap. A modal shown once cannot warn a user on their fortieth stealth send, and the extra wait is a property of every one of them. Private routing gets its own copy.

The send scene cannot reuse the terms modal: swapVerifyTerms runs on SwapConfirmationScene alone and a send-to-address quote never visits that scene, so one acknowledgement would have covered the dedicated swap and silently skipped every stealth send.

---

Note

High Risk
Large payment and swap-send surface (send and exchange scenes, cross-chain address resolution, Houdini-only quotes, and transaction identity) with external dependencies on edge-core-js and edge-exchange-plugins before merge.

Overview
Stealth Send turns the ordinary send scene into a live swap-to-address flow when the recipient asset differs from the source or when Stealth Send is on: linked You send / Recipient gets amounts (guaranteed vs estimated), quote expiry, Houdini-only routing, client-side minimums (25 USD private / 10 USD standard), and a Recipient receives picker before address entry. Plain same-asset sends stay as today, with Total Amount on multi-recipient UTXO sends.

Cross-chain addresses no longer fail as invalid: pasted, typed, or scanned values are matched to served chains (with an EVM disambiguation modal), and payment URIs drive the guaranteed side per the design doc.

Stealth Swap adds a matching toggle on the Exchange amount-entry scene (fixed Houdini provider on confirm). Transaction list and details use new swapType-based titles, hide the recipient on private flows, label the spend target as Exchange Deposit Address, and still surface exchange order details.

Supporting work in this diff includes Maestro flows under maestro/14-stealth/ (spend flows tagged separately), testIDs on send tiles, confirm slider, and modals for automation, unit tests for private-send transaction titling in CategoriesActions, eslint snapshot/test updates, and changelog entries.

^{Reviewed by Cursor Bugbot for commit a518c23. Bugbot is set up for automated code reviews on this repo. Configure here.}

[j0ntz]

📸 Test evidence (iOS sim, live wiring)

agent proof 1216251688512498 01 stealth send toggle

agent proof 1216251688512498 02 recipient chain picker

agent proof 1216251688512498 03 send to any quote

agent proof 1216251688512498 04 send to any success

agent proof 1216251688512498 05 stealth swap toggle

agent proof 1216251688512498 06 stealth swap houdini only

agent proof 1216251688512498 07 learn more browser

agent proof 1216251688512498 08 xrp destination tag

agent proof 1216251688512498 09 plain send regression

agent proof 1216251688512498 10 multi recipient gating

Captured by the agent's in-app test run (build-and-test).

[j0ntz]

📸 Followup test evidence: send-to-any restricted to Houdini + 1rem asset row

agent proof 1216251688512498 01 send to any houdini 1rem row

agent proof 1216251688512498 02 send to any configured

Captured by the agent's in-app test run (build-and-test).

[j0ntz]

📸 Test evidence (followup: vertical spacing fix)

agent proof 1216251688512498 03 vertical gap matched

Captured by the agent's in-app test run (build-and-test).

[j0ntz]

📸 Test evidence (followup: plain-send regression with QR amount)

qr plain send

Captured by the agent's in-app test run (build-and-test).

[j0ntz]

📸 Test evidence (followup: scanned payment QR, executed end to end)

qr crosschain live quote

qr crosschain executed

qr crosschain txdetails

qr stealth live quote

qr stealth executed

qr stealth txdetails

Captured by the agent's in-app test run (build-and-test).

[j0ntz]

📸 Test evidence (followup: cross-chain address entry across chains, tokens, and entry paths)

paste detected litecoin

paste live quote armed

paste swap executed

paste swap txdetails

type btc to eth picker

network picker

deeplink eth uri

token source usdc

token source usdt

Captured by the agent's in-app test run (build-and-test).

[j0ntz]

📸 Test evidence (followup: route availability reflected in the UI)

stealth armed

stealth autodisable toast

standard quote after fallback

preemptive tap toast

fallback swap executed

fallback swap txdetails

fixedto fallback card

fixedto preemptive tap toast

card cleared after edit

Captured by the agent's in-app test run (build-and-test).

[j0ntz]

📸 Test evidence (followup: Houdini exclusivity restored + flip-input amounts)

crossasset stealth on errorcard

yousend flipinput modal

stealth off houdini only errorcard

raw error no route

recipientgets flipinput modal

stealth on stays on errorcard

Captured by the agent's in-app test run (build-and-test).

[j0ntz]

📸 Test evidence (followup: routable Myself picker + transaction identity)

myself grouped list

myself crossasset adopted

stealth send quote

stealth send executed

tx list title

stealth details from list

Captured by the agent's in-app test run (build-and-test).

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[j0ntz]

📸🪓 Test evidence

🪓 Hack-forced evidence: pinSpendingLimitsEnabled forced true and the limit forced to $1 in SendScene2, because enabling the real setting needs the account password (settings lock) which the roster does not provide. Reverted; git status clean. Temporary uncommitted edit, reverted before commit; the marked frames prove the rendering, not the trigger.

error card provider floor

error card no route

myself picker grouped

🪓 HACK-FORCED: pin row on swap send

Captured by the agent's in-app test run (build-and-test).

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5871557. Configure here.}

[j0ntz]

📸 Test evidence: recipient asset picker, search, and a live Stealth Send

plain send names source token

picker agrees and has search

picker search matches name and code

stealth on names native payout

picker stealth on source chain once

live private quote armed

stealth send success

tx details stealth swap send

Captured by the agent's in-app test run (build-and-test).

[j0ntz]

📸 Test evidence: swap-under-the-send warnings

swap send modal

swap send card

houdini terms modal

swap confirm after terms

swap success

swap tx details

Captured by the agent's in-app test run (build-and-test).