> ## Documentation Index
> Fetch the complete documentation index at: https://docs.inkwell.finance/llms.txt
> Use this file to discover all available pages before exploring further.

# Dagon Payroll

> Confidential payroll on Solana for companies whose treasury is run by a multisig. Salaries, balances and treasury stay Encrypt FHE ciphertexts; the multisig approves policy, a permissionless crank pays.

> **CONFIDENTIAL & PROPRIETARY © 2026 Inkwell Finance, Inc. All Rights Reserved.**
>
> This document is for informational purposes only and does not constitute legal, tax, or investment advice, nor an offer to sell or a solicitation to buy any security or other financial instrument. Any examples, structures, or flows described here are design intent only and may change.

> [!WARNING]
>
> **Status: pre-alpha.** Dagon Payroll is **not deployed** and has **not
> been externally audited**. Encrypt's pre-alpha devnet does **no real
> encryption**: ciphertext accounts hold plaintext, and the executor sees
> every value. Every confidentiality claim in this section holds only from
> **Encrypt Alpha 1** (threshold FHE). Until then, treat every encrypted
> figure as public.
>
> Program id: `F8WSqLLHKdFbyGTVoGC6MHvupgUYXt2oHTTBhDJF7oF2`

## What it is

Dagon Payroll is an Anchor program that pays salaries on Solana without
publishing them. It is built on [Encrypt](https://encrypt.xyz) FHE and
sits beside the Dagon matching venue as a separate program.

Salaries, accrued wages, bonuses, run budgets and the treasury balance are
**ciphertexts on-chain**. The company's multisig approves payroll
**policy**: who is employed, the encrypted salary handles, one pay run per
period with a public budget ceiling, and bonuses. Its signers never see a
salary. A permissionless crank then executes every payment inside FHE.

1. **HR encrypts** each salary off-chain with Encrypt `CreateInput`. Only a
   32-byte ciphertext handle comes back.
2. **The multisig approves** one proposal per period: hires (by handle)
   and `open_pay_run(period, budget)`.
3. **Anyone cranks** the run. Each payment is all-or-nothing inside FHE,
   bounded by the treasury, the run budget and the per-payment cap.
4. **Employees withdraw** earned wages to an ordinary SPL token account.
5. **Employees, the authority or an auditor disclose** a single figure to a
   named viewer, re-encrypted to that viewer's key.

> [card] [Life of a pay run](https://docs.inkwell.finance/dagon/payroll/life-of-a-pay-run.md)
>
> Hire, fund, approve, crank, withdraw, disclose. Six beats.

> [card] [Multisig integration](https://docs.inkwell.finance/dagon/payroll/multisig.md)
>
> Squads v4, Altitude, Clearsig, Realms. Why authority instructions need no fresh signer.

> [card] [Who sees what](https://docs.inkwell.finance/dagon/payroll/privacy.md)
>
> Per-party visibility: chain observer, signers, crank, employee, auditor, Encrypt.

> [card] [Guardrails and limitations](https://docs.inkwell.finance/dagon/payroll/guardrails-and-limitations.md)
>
> Run budget, salary cap, flagged counter, solvency invariant, known limitations.

## Who it's for

Companies whose treasury is run by a multisig: Squads v4, Altitude,
Clearsig, SPL Governance / Realms, or any other signer. The program checks
only that the company's `authority` signed. A multisig vault PDA, a plain
keypair or an MPC key all qualify. See [Multisig integration](https://docs.inkwell.finance/dagon/payroll/multisig.md).

## What is encrypted, what is public

Public by design:

| Datum | Why it is public |
| - | - |
| Company, authority, mint, vault, policy (auditor, operator, salary cap, paused) | Governance configuration. Employees and auditors can see the controls in force. |
| **Headcount and employee wallets** | Employee records are PDAs seeded by the employee's wallet. |
| **Funding amounts** | Funding is a plain SPL transfer into the vault. The total is visible; the per-employee split is not. |
| **Withdrawal amounts**, recipient, and whether the withdrawal paid | The exit is an ordinary SPL transfer. |
| Run period, budget ceiling, paid count, bonus count | Payroll cadence and an upper bound on total spend. |

Ciphertext (Encrypt `EUint64`, readable only through `grant_view`):

| Datum |
| - |
| Each **salary** |
| Each **bonus** |
| Each employee's **accrued balance** |
| **Treasury remaining** |
| **Run spend** (remaining budget) |
| **Flagged count** (payments the pay graph rejected) |

The public salary cap bounds each salary from above, and the public budget
ceiling bounds the run total. Set both loosely to reveal less. Full detail
in [Who sees what](https://docs.inkwell.finance/dagon/payroll/privacy.md).

## What it is not

* **Not anonymous employment.** The link between an employee wallet and the
  employer is public. A fresh wallet per employer is the documented
  mitigation.
* **Not confidential exits.** Funding and withdrawals are plain SPL
  transfers with public amounts. Settling into Encrypt's confidential token
  (`pc-token`) is roadmap, not shipped.
* **Not an operator-held account.** No operator key controls the vault. The
  vault is a token account owned by the Company PDA. Only the program moves
  tokens out: to an employee withdrawal, or to a treasury withdrawal the
  multisig approved.

## Status

* **Pre-alpha.** Not deployed, not externally audited. An internal review
  pass found and fixed a withdrawal-freeze bug, payment front-running,
  company-id squatting, an unrevocable approval and a payout-lock bug. Each
  has a regression test.
* **Encrypt is pre-alpha.** Its current devnet performs no real
  encryption, and data there is wiped periodically. Confidentiality starts
  with Encrypt Alpha 1.
* **Tested against the real Encrypt program binary** with Encrypt's mock
  executor, and against the Squads v4 binary dumped from mainnet.
* **Clearsig** is itself pre-alpha and devnet-only. One integration question
  is open. See [Multisig integration](https://docs.inkwell.finance/dagon/payroll/multisig.md#clearsig).
* **SDK** `@dagon/payroll-sdk` is not published to npm. See
  [SDK quickstart](https://docs.inkwell.finance/dagon/payroll/sdk-quickstart.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.