Architecture

How the dark pool works

Hybrid threshold FHE matching with Soroban settlement — honest technical scope for institutional privacy on Stellar.

Data flow

Trader → encrypt order (Phase 3) / commit hash (Phase 1)
       → register_order on Soroban (hash + collateral lock)
       → off-chain matcher (plaintext PoC / FHE Phase 3)
       → settle_batch (matcher auth)
       → atomic USDC transfer between escrow balances

Soroban escrow

Settlement rail

SEP-41 escrow, SHA-256 order commitments, matcher-authorized settle_batch.

Off-chain matcher

Matching engine

Plaintext PoC today; TFHE-rs encrypted comparisons in Phase 3.

Threshold committee

Decryption

t-of-n selective decrypt — only netted trades revealed on ledger.

Privacy guarantees (Phase 1 PoC)

Hidden

Price and size (commitment hash only on-chain)
Matching logic (off-chain matcher)
Unmatched order details

Still visible

Depositor addresses and timing
Locked collateral amounts
Settlement counterparties
Matcher identity

Roadmap phases

Feasibility

Mapped Soroban instruction limits, FHE cost, and the hybrid escrow + off-chain matcher design.

Escrow rail

SEP-41 collateral lock, SHA-256 order commitments, and matcher-authorized settle_batch on testnet.

Matcher board

Shared off-chain order book with crossing detection and batch settlement today.

TFHE matching

Homomorphic price comparisons so the matcher never sees plaintext size or limit.

Threshold decrypt

t-of-n committee reveals only netted fills — unmatched size and intent stay dark.