Penumbra Labs
Penumbra is the first fully end-to-end encrypted blockchain in the Cosmos ecosystem. Private trading, staking, and cross-chain transfers, with zero-knowledge proofs generated locally on the user's own device.
Snapshot
- Role
- Product Designer, first in-house designer
- Team
- ~15 people across the org
- Reported to
- CEO and PM
- Products
- Veil DEX, Liquidity Tournament, Prax wallet
- Duration
- 1 year
- Collaboration
- Cross-org design system with two partner orgs
Context and Challenge
When I joined, the team had the idea for a DEX and nothing designed. A designer from Radiant, a separate organisation in the ecosystem, had been helping with other products. I came in as the first in-house designer and built the DEX from scratch.
The hard part was the privacy model itself. On Penumbra, transfers into the chain shield assets and transfers out unshield them. Everything in between is encrypted, and users can selectively disclose their own data for accounting or compliance. Two design problems followed from that:
- Shielding and unshielding had to be understandable without teaching users the underlying cryptography.
- Users needed to see their own view of a transaction alongside the public view, where nothing is visible to anyone else, without that distinction becoming a lecture on zero-knowledge proofs.
Research came through Radiant, who handled users and communications and shared their findings and reported user issues with us.
What I did
- Designed the Veil DEX trading interface from scratch, the first fully shielded DEX in Cosmos.
- Designed onboarding for two very different audiences: crypto-native users who know what a DEX is, and newcomers who need the ZK infrastructure abstracted away entirely.
- Designed the Liquidity Tournament interface, which rewards liquidity providers and delegators through voting and position rewards. Built it fast so the team could start testing the incentive mechanics as early as possible.
- Created high-fidelity wireframes for the Prax wallet native iOS app and scoped the MVP feature set with the CEO. Neobank-style UX with the Web3 layer hidden.
- Co-developed the cross-org design system shared by Penumbra Labs, Radiant, and PK Labs, who were building the blockchain explorer. Reshaped it to be easier to use while keeping consistency across the ecosystem.
Decisions and Trade-offs
Showing two views of the same transaction. The core UX problem on a privacy chain is that the user sees one thing and the public sees another. Rather than explain the cryptography, I designed the interface around what each party can see, so the privacy guarantee is something users observe instead of something they read about.
Shipping the Liquidity Tournament in two weeks. The team needed to test incentive mechanics against real liquidity as soon as possible. I delivered the complete interface in two weeks. The tournament could and should have been much more engaging, but getting it into testing fast meant accepting compromises in the first version.
Splitting a design system owned by three organisations. Every change had to work for Penumbra Labs, Radiant, and PK Labs. I split the components into two parts: a shared core that all three organisations use, and product-specific components that each organisation owns and uses only in its own products. That took load off the shared system while keeping the common style consistent.
Results
- The protocol reached $3.77M in shielded value with 100K wallets across 6 IBC chains, with Veil DEX and the Liquidity Tournament as the key surfaces driving activity.
- Delivered the complete Liquidity Tournament interface in two weeks, letting the team test incentive mechanics with real liquidity.
- Prax wallet passed 10,000 installs on the Chrome Web Store.
- One design system serving three organisations, split into a shared core and organisation-owned components. A strategic call that kept the shared system from drowning in support requests from every organisation and product.
Key Learnings
Sometimes the job is to hold the technology back.
Engineers on a protocol team want to show what the tech can do. A regular user mostly wants to know one thing: that their activity is invisible to the public. Part of my work was pushing back on surfacing more than that.
Good system decisions are not always popular.
Handing ownership of product-specific components to each organisation was not the popular option. It was still better than spending a large share of our resources syncing and coordinating every component through the shared system.
Ship rough and learn, rather than polish blind.
I asked for one more week on the Liquidity Tournament because I thought it was too raw for production. The team wanted to test as soon as possible and improve it based on the results. They were right. Shipping earlier with a rougher version is better than refining it endlessly without data.