Miden launches private, self-custodial finance with OpenZeppelin

Miden, a privacy-first blockchain spun out of Polygon Labs in 2025, takes on one of the most demanding problems in onchain finance: privacy without losing the control, recovery, and accountability organizations depend on.

Together with OpenZeppelin, Miden launched Guardian, the first non-custodial Private State Manager, allowing parties to coordinate shared private accounts without publishing account state to a public ledger or handing control to a custodian.

The Challenge

Building for privacy means a fundamentally different kind of blockchain. On Miden, an account’s state, its balances and ownership live on the user’s own device, not on a public ledger. Transactions settle via zero-knowledge proofs that confirm validity without revealing what’s inside.

That changes everything that runs on top of it. The standard tools of onchain finance such as token contracts, multisignatures and access controls, all assume account state is public. On Miden it isn’t, so they can’t be reused as-is. They have to be redesigned for a model where everything is private. This created three distinct challenges:

• Re-architecting core primitives for private, offchain state: Tokens, accounts, and access control behave differently when execution occurs offchain. Each primitive required fresh design under a model where state is never publicly readable.
• Coordinating private accounts offchain, without centralizing custody: Without a public ledger as a shared record, participants managing shared accounts cannot use the chain to sync state, gather approvals, or recover access. That coordination has to happen offchain, without any party holding the keys.
• Delivering institutional assurance prior to launch: Miden required end-to-end security reviews across the transaction kernel, contract standards, coordination layer, and asset implementations before live capital touched the network.

To build and secure these foundations, Miden needed an embedded partner prior to launch.

OpenZeppelin's Solution

A Long-Term Partnership

OpenZeppelin served as Miden's partner on the road to mainnet. It was involved from early design and development, through to securing and operating live infrastructure. Miden's standards, offchain coordination, and security foundations were co-developed by OpenZeppelin and audited before launch, going live production-ready.

Coordinating Shared Control of Private Accounts

On a conventional public chain, the parties controlling an account rely on the ledger as a common record. It is how everyone stays in sync, approves changes, and recovers access. When the account state is private, that record is no longer available, and coordination happens offchain.

Guardian, the first implementation of Miden's Private State Manager, co-designed and developed by OpenZeppelin, coordinates multi-party approvals offchain without exposing account state or taking custody of keys. OpenZeppelin became its first operator, and others can run it too. Since Guardian is open-source, a fintech or financial institution can customize its own and offer private shared-account services to clients.

The Standards for Private Value and Control

Traditional smart contract standards were built for transparent, onchain state execution, not for one where execution and state stay on the user's device. OpenZeppelin and Miden have developed the confidential stablecoin standard and compliance components so USDCx, the Circle-backed stablecoin, can be Miden’s gas token.

From developing a confidential token standard, we created accounts, access control, private swaps, and the compliance controls. Within those account modules, authentication integrates support for post-quantum Falcon-512 alongside ECDSA, ensuring network signing adapts as cryptographic standards evolve.

Securing Every Layer of Miden

Securing Miden for mainnet meant reviewing the system end-to-end. OpenZeppelin stress-tested the transaction kernel, the contracts library, and the Guardian coordination layer ahead of launch.

The Results

Institutional Self-Custody and Confidentiality

Institutions have had to choose between controlling their assets and keeping their activity private: hand funds to a custodian, or hold them onchain and expose every position and approval. Miden removes that choice. Teams can share an account, require collective sign-off before funds move, and recover access, with privacy intact and no custodian in the middle. This is delivered through:

• Private multisignature accounts
• Shared control, with collective sign-off before funds move
• Backup, recovery, and synchronization across devices and participants

Audited and Compliance-Ready Standards for Onchain Assets

Beyond shared control, institutions need the assets they hold and move to rest on foundations they can trust. Miden goes live with a complete, audited standard for confidential finance, already carrying USDCx, the network's Circle-backed gas token. With it, institutions can bring financial products onchain privately, and to the standard their business requires. This includes:

• Confidential Tokens: Fungible and non-fungible token contracts
• Compliance Controls: Pausable assets, transfer restrictions, and allow/block lists
• Private Swaps: Logic for confidential token exchanges between accounts
• Institutional Governance: Native multisignature and guarded-multisignature accounts
• Access Control: Ownership models and Role-Based Access Control (RBAC)
• Post-Quantum Authentication

A Thorough Security Record

Across eight pre-mainnet audits and penetration tests, OpenZeppelin surfaced 227 issues in total, including three critical and 12 high-severity findings. Each was raised with the Miden team and resolved before mainnet launch:

• A memory-bounds bypass in the transaction kernel, the core protocol every transaction passes through
• Two criticals in the co-designed token and swap standards, where a private swap could misroute a participant's asset
• No critical findings in the Guardian coordination layer, across audit and penetration testing

Through a close partnership, Miden and OpenZeppelin co-designed the network's standards, built its offchain coordination layer, and hardened the entire stack for mainnet. The result is configurable compliance controls, non-custodial shared account control, and post-quantum authentication: a secure foundation for institutions and fintechs building confidential applications.