From local analysis tools to integrated assurance.
The pre-deployment analysis tool needs no live chain, so it ships now. Each stage adds fidelity (a real parser today, then live APS data, then proofs) and grows the same engine: the assurance layer the Arc Privacy Sector will need, extending to agent controls for agentic USDC payments and verifiable compliance.
Static confidentiality analysis for smart contracts
Client-side and instant. It models the published APS specification: exposure-surface mapping, confidential information-flow analysis, trust-domain review, commitment recognition, and the three-observer view. The engine is the @choosek/concentric library, tested to full coverage; no contract or key ever leaves the browser.
The same rules run over a whole repository: multiple files, cross-file imports, and inheritance resolved into each contract, with every finding reported at its true file and line. It emits SARIF 2.1.0 and JSON, honors inline // concentric-disable suppressions and per-rule configuration, and ships as npx @choosek/concentric check and a GitHub Action that blocks a merge on any HIGH finding.
The default engine parses with a real Solidity grammar (@solidity-parser/parser, the parser behind prettier-solidity and solhint), following dataflow through nested calls and resolving inheritance from the parse tree. A dependency-free lexical engine as an automatic fallback. It also consumes Foundry and Hardhat build output directly: --build-info links every source solc saw, so OpenZeppelin, libraries, and modifiers resolve exactly as compiled, while only your own contracts are reported by default.
Live APS data and machine-checked guarantees
When Arc's confidential environment exposes an authorized RPC, Concentric reconstructs real private-transaction traces, verifies value conservation over actual encrypted balances, and diffs intended exposure against what the deployed contract truly discloses. This is the part outside the browser: a thin authorized-RPC proxy.
From there, it encodes the APS access model as an SMT problem and proves confidentiality invariants: that no untrusted-reachable path exists to a confidential slot. This means moving from heuristic findings to formal guarantees, with a concrete counterexample when one fails.
Agent controls for agentic USDC payments
The same formal-methods core, turned on autonomous agents: spend authority expressed as attenuable, verifiable capabilities — the object-capability, macaroon, and workflow-scoped-credential model the literature converges on — carrying machine-checkable guarantees that an agent can never exceed its cap, pay outside an allowlist, be replayed, or be prompt-injected into draining.
It hardens the on-chain spend-limit and allowance mechanisms emerging in the ERC-4337 / ERC-8004 agent-wallet stack against the documented x402 attack classes (with policy granularity as the central design question) and composes with APS for confidential agent payments.
Verifiable compliance and audit console
APS selective disclosure is blunt: prove authorization and the auditor sees everything. This adds a small verified policy language whose policies compile to in-APS checks or zero-knowledge proofs, so a confidential transaction carries a proof that it satisfied a named policy (e.g., sanctions-set membership, per-transaction and rolling limits, travel-rule thresholds). Only the verdict is disclosed to the auditor, keeping the amount confidential.
"Confidential and provably compliant": a primitive others build on, paired with an auditor console offering signed, exportable attestations and live monitoring of trust-domain changes on deployed contracts.
Concentric is an independent, open assurance layer that makes the Arc Privacy Sector safer to build on, and easier to adopt. Explore the confidentiality analysis tool experiment and learn more.