anon-rpc

2 mindocs: anon-rpc

anon-rpc is an Ethereum Foundation standard. A wallet runs an anonymising network’s client as hash-pinned code in a sandbox, and the network supplies that client as a single worker bundle named on-chain by the keccak256 of its bytes. One integration on the wallet side covers every network that ships a conforming worker. The EF documents the protocol, the harness, and the capability API.

Nym ships a conforming worker that routes fetch and Ethereum RPC over the Nym mixnet, built on mix-fetch. A wallet that already supports anon-rpc needs no Nym SDK: it points the EF harness at Nym’s specifier address, and the harness fetches the bundle, checks its hash, and runs it sandboxed.

Use it

Pass Nym’s specifier address to the anon-rpc harness (the EF repo covers harness setup):

const worker = new AnonRpcWorker({
  address: '0x3aCD9742C68F6d993066Ae25533e09b9e1f60eD0', // Nym worker, Ethereum mainnet
  preExisting: { rpcProvider },
})
await worker.ready
const res = await worker.fetch(rpcUrl, { method: 'POST', body })

No config is required: the worker discovers an exit and its DNS resolvers itself.

The first response takes a few seconds while the mixnet tunnel bootstraps, and per-request latency is higher than a direct call. Build the wait into the UI.

What the harness pins

Field	Value
Specifier (Ethereum mainnet)	`0x3aCD9742C68F6d993066Ae25533e09b9e1f60eD0`
Source	github.com/nymtech/anon-rpc-worker, reproducible from the lockfile
Package	`@nymproject/anon-rpc-worker` (one of the resolvers the harness fetches from)

A harness accepts bytes only if their keccak256 equals the hash the specifier pins, so the resolver serving them is untrusted. Rebuild the source and compare the hash to audit what runs.

Trust and privacy caveats

The first read of the on-chain specifier is not anonymous.
The worker sees every request before broadcast, signed transactions included. The sandbox narrows what the worker can reach. It does not remove the trust decision.
The sandbox denies IndexedDB, so the client identity stays in memory and is new on every boot.
No wallet in the adopters list ships it yet.

Try it

Open the anon-rpc demo, pick the Nym worker (or paste the specifier address), and send a request over the mixnet.