Validation & Limitations

What protected sending can do, and where its guarantees stop.

Current status: Cloak — including Shield — is in development and not live. No swaps run through Cloak today and no protection fee is charged.

What protected sending can do

On Solana, your transaction goes to the validators scheduled to lead the next slots. A sandwich needs someone in that path to see your swap and place trades around it. Cloak narrows that opportunity: protected submission paths instead of broad broadcast, avoiding leaders publicly flagged for sandwiching, and slippage tight enough that the attack isn't profitable.

What it cannot guarantee

Validators still see your trade. Every transaction has to reach a leader to be included. Protected sending limits who sees it and how — it does not make it invisible.
Leader reputation is imperfect. Lists of sandwiching validators are built from observed behaviour and can be incomplete or out of date. An unflagged validator can still act against you.
Not all MEV is sandwiching. Shield targets sandwiches and front-running around your swap. Other forms of value extraction are outside what it addresses.
Tighter slippage can fail. In fast-moving markets, a tight slippage limit may cause a swap to fail rather than fill at a bad price. You pay the network fee for a failed transaction, but no Cloak fee.
Infrastructure dependency. Protection depends on the RPC and sending paths Cloak uses. If they degrade, Cloak falls back to standard sending, tells you before you sign, and does not charge the protection fee (see Fee Policy).

How the protection receipt is checked

After a swap lands, Cloak inspects the transactions immediately before and after it in the same block for the pattern of a sandwich: the same actor trading the same pool on both sides of your swap. A clean receipt means no such pattern was found around your transaction — it is a detection result, not a guarantee that no value was extracted in some other way.

Contract status

Swaps execute through the aggregators' own on-chain programs (starting with Jupiter) — not a custom Cloak program. Cloak's own code (quote handling, transaction building, sending) is unaudited. Transactions are signed by your wallet and may be irreversible. Do not swap more than you can afford to have exposed to risk.

Not financial advice

Cloak does not custody assets and does not provide investment or financial advice. Token prices can be volatile.