In many traditions, the best charity is the kind nobody sees. In Islam there's a well-known teaching about giving so quietly that your left hand doesn't know what your right hand gave. The name of this project, Sitr (ستر), means covering or concealment.
I built Sitr for the iExec WTF Hackathon (Nox Protocol track). It's a treasury for Zakat and Waqf donations that keeps amounts private, while still letting the right people check that the money is being handled honestly.
You can try the live demo or read the source code.
The problem: blockchains are glass houses
A blockchain is a shared record book that anyone in the world can read. That's what makes it trustworthy: nobody can secretly change the numbers, because everyone can see them.
But that openness is a problem for charity. If you donate on a normal blockchain, anyone can see:
- how much you gave,
- how much the charity holds in total,
- and how much it paid out to each person it helped.
That can embarrass donors, expose the people receiving help, and turn giving into a display. We want the honesty of a public ledger without everyone seeing the numbers.
The idea: sealed envelopes
Imagine a charity where every donation goes into a sealed, tamper-proof envelope. Everyone can see that an envelope was dropped into the box, and everyone can count how many envelopes there are. But nobody can see what's inside, except the specific people who hold the right key.
That's what Sitr does, using a technology from iExec called Nox. It lets a smart contract (a small program that lives on the blockchain) do maths on numbers while they're still encrypted. It can add your donation to the total without anyone, including the computers doing the adding, ever seeing the actual amount.
Who sees what
Sitr has four types of visitors, and each sees a different amount:
- Donors pick a donation type and enter an amount. The amount is encrypted in their own browser before it's ever sent. Afterwards, they can unlock their own private receipt to confirm it was recorded correctly. Only they can read it.
- Auditors are trusted people who can unlock the totals: the overall balance and the total for each category, such as Zakat or Waqf. They can confirm the books add up without seeing any individual donor's gift.
- Treasury operators propose payouts, either as a single lump sum or as a steady stream over time.
- The public needs no wallet at all. They can see that the system exists and how many donations and payouts have happened, but never the amounts.
Watching the watchers
There's a subtle problem with auditors: what stops an auditor from quietly snooping?
Sitr adds a public logbook for that. Whenever someone wants to look at the private totals, they can record an on-chain note that says, in effect, "I looked at this." The numbers stay secret, but the act of looking becomes visible. Oversight itself is overseen.
Keeping the money safe
Privacy is only half of it. The money also has to be secure.
Sitr doesn't hold the funds itself. They sit in a Gnosis Safe, one of the most widely used and battle-tested "vaults" on Ethereum. A Safe can be set up so that several trusted people must all approve before any money moves. That's the same idea as a charity bank account that needs two signatures on every cheque.
Sitr wraps around that vault without modifying it. The Safe still holds the funds and approves every payout; Sitr just adds the privacy layer on top. Payouts follow a simple propose, then approve pattern: an operator suggests a payment, and the Safe's signers must approve it before anything leaves the vault.
What I took away from it
The interesting part of this project wasn't the encryption itself. It was deciding who should be able to see what, and making sure every one of those decisions was deliberate. Donors see their own gift. Auditors see the totals. The public sees that things are happening. And everyone can see when someone peeks.
For charitable giving, that balance matters. Transparency builds trust, but dignity requires privacy. With the right tools, you don't have to choose between them.