Envelope

The Problem

• Ordinary on-chain payroll publishes every salary to the world.
• Ordinary off-chain payroll asks employees to simply trust the employer.

The Solution

• The employer commits to the payroll as a Merkle root of salted salary commitments and funds the contract up front, so the root is fixed before any money moves.
• The funds sit in the contract rather than in a promise, and the contract pays exactly the committed amount to exactly the committed address.
• The employer cannot touch committed funds early, because reclaim is deadline-gated, and totalClaimed can never exceed totalDeposited.
• Salaries exist only as salted hashes with no per-leaf storage on-chain, so the roster cannot be enumerated by an outside observer.
• There is no owner, no admin, no fee recipient and no upgrade hook: the constructor takes one argument, the settlement token, and nothing else.
• A parity test pins the Solidity leaf format and the JavaScript tree builder to the same bytes, so the browser and the contract cannot drift apart.

The Result

• A complete implementation with one contract as the entire on-chain surface, plus unit, fuzz, parity and fork tests.
• A written adversarial security review recording its findings and the risks accepted.
• A fork test that exercises the full flow against the real settlement token instead of a mock.
• Not deployed, and that is a decision rather than an oversight. DEPLOY.md freezes the exact deployment parameters and names the built artifact, while stating plainly that nothing has been broadcast and no signature has been requested.

What this does not claim

• Under-funding is possible. Nothing proves that the committed salaries sum to the deposited total, so an employer can commit to more than they deposited. Preventing that needs a sum proof, which is out of scope. It cannot be hidden, though, because an unpaid recipient can demonstrate a valid Merkle proof that reverts, which is public evidence of non-payment.
• Small payrolls leak by deduction: know the total and every salary but one, and the last is determined. The aggregate is otherwise only checkable by collusion, which destroys the privacy the design exists to provide.
• Losing the salts delays employees, who can then never build a proof, though funds can still return to the employer by reclaim.
• The settlement token is not neutral infrastructure. It is an upgradeable proxy whose issuer retains pause and freeze control, so a frozen recipient cannot claim and a paused token halts every transfer. The contract cannot defend against the issuer of the money it moves, and it does not pretend to.
• This is not fully private payroll, and it does not prove that the committed salaries add up to the funded total.

Stack