Skip to main content
CONFIDENTIAL & PROPRIETARY © 2026 Inkwell Finance, Inc. All Rights Reserved. This document is for informational purposes only and does not constitute legal, tax, or investment advice, nor an offer to sell or a solicitation to buy any security or other financial instrument. Any examples, structures, or flows described here are design intent only and may change.
Status: pre-alpha. Dagon Payroll is not deployed and has not been externally audited. Encrypt’s pre-alpha devnet does no real encryption: ciphertext accounts hold plaintext, and the executor sees every value. Every confidentiality claim in this section holds only from Encrypt Alpha 1 (threshold FHE). Until then, treat every encrypted figure as public.Program id: F8WSqLLHKdFbyGTVoGC6MHvupgUYXt2oHTTBhDJF7oF2

​
What it is

Dagon Payroll is an Anchor program that pays salaries on Solana without publishing them. It is built on Encrypt FHE and sits beside the Dagon matching venue as a separate program. Salaries, accrued wages, bonuses, run budgets and the treasury balance are ciphertexts on-chain. The company’s multisig approves payroll policy: who is employed, the encrypted salary handles, one pay run per period with a public budget ceiling, and bonuses. Its signers never see a salary. A permissionless crank then executes every payment inside FHE.
  1. HR encrypts each salary off-chain with Encrypt CreateInput. Only a 32-byte ciphertext handle comes back.
  2. The multisig approves one proposal per period: hires (by handle) and open_pay_run(period, budget).
  3. Anyone cranks the run. Each payment is all-or-nothing inside FHE, bounded by the treasury, the run budget and the per-payment cap.
  4. Employees withdraw earned wages to an ordinary SPL token account.
  5. Employees, the authority or an auditor disclose a single figure to a named viewer, re-encrypted to that viewer’s key.

Life of a pay run

Hire, fund, approve, crank, withdraw, disclose. Six beats.

Multisig integration

Squads v4, Altitude, Clearsig, Realms. Why authority instructions need no fresh signer.

Who sees what

Per-party visibility: chain observer, signers, crank, employee, auditor, Encrypt.

Guardrails and limitations

Run budget, salary cap, flagged counter, solvency invariant, known limitations.

​
Who it’s for

Companies whose treasury is run by a multisig: Squads v4, Altitude, Clearsig, SPL Governance / Realms, or any other signer. The program checks only that the company’s authority signed. A multisig vault PDA, a plain keypair or an MPC key all qualify. See Multisig integration.

​
What is encrypted, what is public

Public by design: Ciphertext (Encrypt EUint64, readable only through grant_view): The public salary cap bounds each salary from above, and the public budget ceiling bounds the run total. Set both loosely to reveal less. Full detail in Who sees what.

​
What it is not

  • Not anonymous employment. The link between an employee wallet and the employer is public. A fresh wallet per employer is the documented mitigation.
  • Not confidential exits. Funding and withdrawals are plain SPL transfers with public amounts. Settling into Encrypt’s confidential token (pc-token) is roadmap, not shipped.
  • Not an operator-held account. No operator key controls the vault. The vault is a token account owned by the Company PDA. Only the program moves tokens out: to an employee withdrawal, or to a treasury withdrawal the multisig approved.

​
Status

  • Pre-alpha. Not deployed, not externally audited. An internal review pass found and fixed a withdrawal-freeze bug, payment front-running, company-id squatting, an unrevocable approval and a payout-lock bug. Each has a regression test.
  • Encrypt is pre-alpha. Its current devnet performs no real encryption, and data there is wiped periodically. Confidentiality starts with Encrypt Alpha 1.
  • Tested against the real Encrypt program binary with Encrypt’s mock executor, and against the Squads v4 binary dumped from mainnet.
  • Clearsig is itself pre-alpha and devnet-only. One integration question is open. See Multisig integration.
  • SDK @dagon/payroll-sdk is not published to npm. See SDK quickstart.