Nero paper · v1.0 · October 2026

Solana in. Monero out.

Nero turns any Solana token into real XMR at your own Monero address, in one transaction you sign yourself, or with no wallet connection at all. It runs its own Monero node and its own solver, and its code is public. This paper says what runs, what you trust at each step, how to check each claim yourself, and where the limits are. Where this page and the chain disagree, the chain wins.

01 · Summary

• Private exit running today: the default. Send any Solana token; Nero's solver pays you real XMR from its own Monero wallet, through its own Monero node. Your Monero address is sealed in your browser and never appears on Solana.
• Standard exit running today: for amounts larger than the solver can cover. Swap any token with a route into wXMR and burn that wXMR with the bridge, addressed to your Monero wallet, all in one Solana transaction.
• Enter from Monero running today: open a deposit account on the bridge, get your own Monero subaddress, and receive wXMR on Solana for the XMR you send.
• Open source running today: the site and the solver are on GitHub. Both report the commit they run, and every order and payout comes with something you can check without us.

02 · The problem

Every balance and payment on Solana is public forever. One labelled address ties a wallet's whole history to a person. Monero was built the other way round: ring signatures hide the sender among decoys, one-time stealth addresses hide the receiver, and RingCT hides the amount, for every transaction, by default.

The gap is getting from one to the other. Privacy-coin delistings left few clean ramps, and most cross-chain routes end in a wrapped token that is just as public as what you started with. Nero's answer is narrow on purpose: one signature on Solana, real XMR at the end.

03 · Private exit running today

The standard exit names your Monero address on Solana, inside the bridge request. The private exit does not. Nero runs its own Monero node and its own solver, which pays real XMR from its own Monero wallet. The wallet reads the chain and sends payments through our node only, so no outside node sees which transactions are ours.

• The order. One transaction you sign: SOL (or a Jupiter swap into SOL) to the solver's deposit wallet, and a memo carrying your Monero address sealed in your browser with the solver's public key (X25519, NaCl box). Only the solver can open it. On Solana it is unreadable. The deposit wallet and the sealing key are pinned in the site's code, not fetched.
• The quote. Bound to your wallet, valid for 60 seconds, with the fee built in. You get exactly the quoted XMR. Each quote is cross-checked against two independent price feeds before it is offered.
• The promise. Before you sign, the solver signs a short text with the deposit wallet's own key: what you send, what you get, until when, and where a refund goes. Anyone can check that signature against the public deposit wallet. See section 07.
• Pay or refund. The solver pays from its own wallet once the deposit is final on Solana, about 15 seconds after you send. If anything does not match (late, short, unreadable address, not enough XMR on hand), your SOL is refunded automatically, minus the network fee. Each payout and refund is booked before it is sent and never retried blindly; anything unclear is held for a person.
• The proof. The Monero tx hash and tx key are shown only to the browser holding the order secret, whose hash is in the memo. With them, any Monero wallet can confirm that your address received the amount.
• Refills. The solver turns the SOL it earns back into XMR in batches through the wXMR bridge, so refills cannot be matched to any one exit.
• Without a wallet connection. The same exit with a one-time Solana deposit address per order: send SOL from any wallet or exchange. The quote is locked for 15 minutes; the fee is 0.9% for the longer lock. A Solana refund address is required, because the sender of an exchange withdrawal is not you. Short or late deposits go back to it; overpayments are paid and the extra returned.
• From another chain built, switched off: the same exit, started from Base, Ethereum, Arbitrum, Optimism, Polygon or Avalanche, or from USDC and USDT on Solana. You send to a one-time address on that chain; a cross-chain route delivers SOL to a one-time Solana address of our solver; the solver pays your XMR. The route never sees your Monero address. It opens once the private exit has run for a while.
• Limits. 0.01 XMR minimum and 0.5 XMR maximum per order to start, with a daily cap. What one order can be right now is shown live on the swap page and the status page.

04 · Standard exit running today

This is the route through the wXMR bridge. It has no size limit of ours, and it names your Monero address on Solana. Nero builds one versioned transaction with these steps, in order:

• Compute budget, then Jupiter's setup, swap and cleanup instructions, routing your token into wXMR.
• The bridge's request_withdrawal(nonce, amount, xmr_address, exact_out = false), where amount is the swap's guaranteed minimum output.

Because the withdrawal asks for the slippage floor, it can never ask for more wXMR than the swap is guaranteed to deliver. Anything above the floor stays in your wallet as wXMR. If any step fails, the whole transaction fails and nothing moves.

Before your wallet is asked to sign, the server simulates the full transaction against mainnet, and the page checks that the fee payer is your wallet, that only the expected programs appear (compute budget, system, token, associated token, Jupiter, the bridge), and that the Monero address inside the bridge instruction is the one you typed.

Limits and timing

• Minimum: 0.1 XMR, enforced by the bridge program.
• The bridge relayer marks the request as sending, pays out on Monero, then records the Monero tx hash and tx key on Solana, usually within a minute.
• Monero wallets need 10 confirmations (about 20 minutes) before received funds are spendable.
• If a request is still pending after five minutes, its owner can cancel it and the wXMR is returned. The tracking page offers this when it applies.

05 · Enter from Monero running today

Your wallet signs create_deposit_account, which costs a small amount of SOL as account rent. The bridge relayer then assigns that account a Monero subaddress. XMR sent to it (0.1 XMR minimum per deposit) is minted as wXMR to your wallet after Monero confirmations, with no bridge fee. If your wallet had no wXMR account at the time, the minted wXMR waits in the deposit's holding account until you claim it, and the page shows a button for that.

The subaddress is recorded on Solana next to your wallet. That reveals that this wallet receives from Monero, not where the XMR came from.

06 · The wXMR bridge

Nero does not run the bridge. It is wxmr.io, an independent Monero to Solana bridge with an open-source frontend. Facts read from chain:

07 · Verify it yourself

Nero is not trustless: on the private exit you trust our solver for the seconds between your deposit and its payout. What we can do is make every claim checkable, so that trust is small, short and visible. Each item below can be checked without asking us. The Verify page does most of it live, in your browser.

• The code. The site and the solver are public on GitHub. The site's footer names the commit it was built from, and the solver reports the commit it runs at /api/v2/info.
• The keys. The deposit wallet and the sealing key the site uses are written in its source (site/lib/v2.ts) and in this paper. Your browser seals your address to that key; nothing is fetched at order time that could swap it.
• Our Monero node. Its height, the hash of its top block and whether it is in sync are read live at /api/v2/node. Compare them with any public Monero explorer.
• The promise. Every order comes with a text signed by the deposit wallet's ed25519 key. The Verify page checks one in your browser; any ed25519 library can too. It names the amounts and a hash of the sealed address, never the address itself, so it is safe to show anyone.
• The payment. The tx hash and tx key of your payout prove, in any Monero wallet (check_tx_key, or Feather and Monero GUI's payment check), that your address received the amount. The proof guide walks through it.
• The Solana side. Every deposit to the solver and every refund is a public transaction to or from the deposit wallet, which anyone can list in an explorer.

What cannot be proven from outside: that the server runs exactly the published code, and how much XMR the solver holds. We publish the reserve as a number, not as a proof, on purpose: a Monero reserve proof reveals key images, which would mark our payout transactions on the Monero chain and weaken your privacy after the exit. Per-order limits keep what you trust us with small instead.

08 · Fees

09 · Privacy, precisely

The same facts route by route, the no-wallet and other-asset orders included, are on What is public.

Good practice: exit to a fresh subaddress each time, avoid round numbers and instant re-use, and once the XMR lands, send it on to another of your own addresses before using it.

10 · Who you trust

11 · Risks

• The solver's wallets are online keys on a server. If that server were compromised, its reserve and any deposit in flight could be lost. Limits per order and per day bound this.
• A private-exit refund is sent by the solver, not enforced by a program yet. If the solver were offline, a refund would wait until it is back.
• An exit from another chain passes through a third-party route first. If that route failed or was slow, your funds would be with it, not with us, and its refund goes to the address you gave on your own chain.
• Bridge failure, theft or shutdown would leave wXMR unbacked. Standard exits in flight could be lost. The bridge program can be upgraded by its operator at any time.
• Thin wXMR liquidity means price impact on large exits. The quote shows it before you sign.
• A wrong Monero address cannot be recovered. Nero validates the checksum and keys, but cannot know whether the address is yours.
• Rules on privacy coins differ by country, and some services refuse funds that touched Monero. You are responsible for what applies to you.

12 · What comes next planned

• A dedicated server. The solver, its wallets and our Monero node on their own locked-down machine, with nothing else beside them.
• A refund program on Solana. Deposits held by a program that returns them after a timeout, so a private-exit refund no longer depends on the solver.
• Reproducible deploys. A signed build record for every deploy, so the running code can be matched to a commit by more than our word.
• Higher private-exit limits as the reserve grows.

13 · Addresses

Building on Nero? The link format for a prefilled exit and the public numbers, each with an example answer, are on the page for integrators.