Penumbra is a fully private proof-of-stake network and decentralized exchange for the Cosmos ecosystem. Penumbra is designed to act as a shielded zone for the entire Cosmos ecosystem, recording any kind of asset in a single shielded pool. Cross-chain IBC transfers shield value moving into the chain, and unshield value as it moves out to other transparent chains. All transactions within Penumbra are fully shielded and private-by-default, unlike other privacy-enabled chains where shielded transactions are opt-in. Of course, users retain the ability to selectively disclose their activity to third parties they authorize. Building a fully shielded proof-of-stake chain means that staking and delegation must also be private. Otherwise, holders of the staking token would be forced to choose between maintaining privacy on the one hand and network security, governance, and staking rewards on the other. But this poses a challenge: if staking delegations are private, how can the chain issue staking rewards? Penumbra solves this problem by creating a new staking design that provides accountability for validators and privacy for delegators. This design is based on delegation tokens representing a share of a validator’s shielded delegation pool. Rewards accrue to the pool, not the delegator, so there is no income to issue, and delegation tokens are completely fungible, allowing delegation privacy.