Voxels

A whole world,
built around your privacy wallet.

[Voxels @Voxelsdotfun]

@anonyme1042211 checking this

[Voxels @Voxelsdotfun]

If you’d rather skip the gamified version of Voxels, we’ve built a mobile-friendly exchange so you can go straight to swapping.

https://t.co/DbDxszKrHj

[Voxels @Voxelsdotfun]

We’re integrating a reward system based on the gold in your pouch, earned through PvP and killing mobs inside the Voxels wallet.

We’ll share more updates as we go.

[Voxels @Voxelsdotfun]

Please check out our docs for a closer look at Voxels and how it all works.

https://t.co/xO5Bqh09k5

[Voxels @Voxelsdotfun]

A new integration is moving into Voxels town. The doors open soon. 👀

[Voxels @Voxelsdotfun]

The discipline underneath:

Append-only double-entry ledger in integer base units — no float ever touches a balance. Provenance-gated redeemability: only server-proven value is redeemable, and imported demo balances never become money. Payment state and delivery state are separate machines, so a settled-but-undelivered payment is a representable refund obligation rather than a lost row. A plain SOL transfer is refused by name as an x402 settlement, because exact is SPL and native SOL is a lamport balance. Provider URLs are credentials, so they never reach the bundle, a log line, or a health payload

[Voxels @Voxelsdotfun]

Voxels
A wallet you walk around in, and a payment path that refuses to leak.

[Voxels @Voxelsdotfun]

Why that combination is new:

Every payment stack built so far degrades gracefully. Privacy is best-effort: if the shielded path is unavailable, the money still moves, transparently, and nobody tells you. Authorization is a session: you approve once and the agent spends many times.

We inverted both. A payment that cannot be made privately does not get made. An authorization that does not name this exact action does not authorize it. Those are not policies layered on top — they are the only code paths that exist. Deny order is fixed and first-failure-wins, so a stable reason code means the operator console, the tests and the refusal all agree on why.

The novel primitive is a transfer with a floor under it: value crosses a public rail (Solana), terminates in a shielded pool (Orchard), and the planner treats "we couldn't do the private part" as a failure rather than a fallback. A priced quote for a shielded address is not evidence of shielded delivery, and the code says so by name.