Skip to main content

Overview

The withdraw operation is the reverse of a deposit. It moves tokens from a user’s EncryptedTokenAccount (ETA) back to their AssociatedTokenAccount (ATA).
Arcium MPC verifies the withdrawal authorization. The operation follows the dual-instruction pattern — the SDK waits for both the handler and the callback transactions to confirm before returning.

Usage

Parameters

Address
required
The Solana address whose ATA will receive the withdrawn tokens. This is typically client.signer.address.
Address
required
The SPL or Token-2022 mint address. Must match a mint for which the user has an existing ETA.
bigint
required
The amount to withdraw, in the token’s native units. Must not exceed the current ETA balance.
OptionalData32
32 bytes of caller metadata stored with the withdrawal. Defaults to 32 zero bytes. Must be a pre-hashed or pre-encrypted 32-byte value — never store plaintext identifiers.
Commitment
default:"\"confirmed\""
Commitment level used for RPC account reads during withdrawal preparation.
U64
Optional Arcium computation-account PDA offset. Defaults to a fresh random U64 per call (CSPRNG).
U128
Optional MpcCallbackData PDA offset (paired with the signer in seeds). Defaults to a fresh random U128 per call.
U128
default:"0n"
Fee-vault PDA offset. The fee-vault path is currently unused for public-ATA withdrawals — leave at the default 0n (sentinel for “no fee-vault interaction”).
Address
Optional observer-CPI destination program invoked after the MPC callback. Defaults to the System Program (sentinel = “no observer CPI”).
WithdrawalHooks
Per-phase lifecycle hooks (onValidationStart, onAccountFetchComplete, queueComputation, onComplete, onError, etc.).
There are no priorityFees, awaitCallback, skipPreflight, maxRetries, or epochInfoCommitment options on the withdrawer. Priority fees are configured at factory time. Callback waiting is always-on — the result’s callback field is populated on success.

Return Value

Returns a Promise<WithdrawResult>. The shape mirrors DepositResult:
  • signatures — every transaction signature submitted by this call, in submission order.
  • queueSignature — the handler (queue computation) transaction signature.
  • callback — present once the callback round-trip completes (always awaited). "finalized" means the MPC callback landed (and exposes signature); "pruned" / "timed-out" indicate the callback did not land — recover via the staged recoverer (below).
  • rentClaim — best-effort rent reclamation outcome. The withdrawal itself still succeeded even when claimed: false.

Example

Withdrawal destination

The tokens are sent to the ATA associated with the destinationAddress for the given mint. If that ATA does not exist, the transaction will fail with an account-not-found error. Create the ATA first using standard token tooling if needed.

Callback failure recovery

If the handler succeeds but the Arcium callback never lands (network partition, compute budget, Arcium outage), the tokens stay staged in the pool ATA. Reclaim them with the recoverer factories from @umbra-privacy/sdk/account:
No MPC, no ZK proof — a synchronous recovery transaction. Use getStagedSolRecovererFunction for wSOL.

Error Handling

Withdrawal errors are typed with a stage field identifying exactly where in the pipeline the failure occurred:
See Error Handling for retry guidance and a full stage reference.

Timing

Withdrawals follow the dual-instruction pattern. The SDK submits the handler transaction, waits for Arcium to complete the MPC computation, then waits for the callback transaction to confirm. Total wall-clock time is typically a few seconds on a well-connected network.