NightShade Aleo testnet · ALEO / USDCx

NightShade

A native dark pool on Aleo L1.

Shield assets. Seal orders under a hash. Match at a circuit-enforced midpoint. Settle into encrypted records. No TEE. No rollup. No public book.

Leo only 4 v3 programs ZK midpoint OTC · stealth · comply Leo Wallet
01 · ProblemWhy public DEXes cannot hide a whale

Public books are an invitation to hunt

Traditional finance already moved 43–44% of U.S. equity volume into dark pools. On-chain, the same need is worse — and every transparent DEX makes it unsolvable.

Intent hits the mempool

A large buy is visible before it executes. Size, side, and pair leak.

Searchers jump the queue

Front-run: buy first, push price, sell into you. Ethereum MEV: $1.38B in 2023.

Sandwich the fill

Buy-before / sell-after brackets the trade. Uniswap v3 lost hundreds of millions this way.

The book itself signals

On dYdX / Hyperliquid, a visible limit order is a free look at your size.

This is not a smart-contract bug. It is an architectural property of transparent chains. The only fix is to hide the order until execution.

01 · ProblemLive Aleo DeFi vs the dark-pool claim

Aleo has AMMs. It does not have a dark pool.

Four names people hear. None of them is a native Aleo venue.

AlphaSwap

Live AMM

  • Hidden size
  • Hidden price
  • Private settle

Aphotic

Paper · Intel SGX

  • A live product
  • Circuit trust
  • Aleo L1

Renegade

ETH · MPC

  • Aleo native
  • ZK midpoint
  • View-key notes

Pondo / ANS

Staking · names

  • A trading venue
  • Sealed book
  • OTC / stealth

Aphotic named the product. NightShade is the product — cryptographic trust, not Intel’s enclave.

02 · ProductFrom the running v3 app — Hub through Portfolio

What NightShade is

A shielded ALEO/USDCx venue: deposit, hide, match, settle, OTC, stealth pay, prove volume. One wallet. Four programs.

Shield / unshield

Public ALEO → vault record. Public USDCx → quote record. Reverse to any address.

Dark pool DEX

Hidden limit orders. Chain sees a hash. Fill at midpoint, proven in Leo.

Sealed OTC

Code-gated tickets. No matcher. Share a secret; counterparty fills.

Stealth receive

shield_for — signer pays, ephemeral aleo1 owns the record.

Volume proofs

Eight padded amounts. Circuit asserts sum ≤ threshold. Auditor pack JSON.

Portfolio

Decrypt tickets, notes, balances. Claim, merge, cancel, unshield.

USDCx faucet

Demo quote token, 6 decimals. Mint public, then shield into the quote vault.

Leo Wallet

Connect, prove in-browser, decrypt records. No custodian.

02 · ProductSame features as the papers — stronger trust model

Same dark pool. Different physics.

Aphotic / AlphaSwap

Trust the box, or leak the pool.

Aphotic: Intel SGX + Validium + DA + attestation. AlphaSwap: public reserves in finalize. Both miss ZK-proven midpoint on L1.

NightShade v3

Trust the circuit.

Four @noupgrade programs. Vault ≠ quote. Pool only settles locked legs. Matcher never holds funds. Midpoint is a Leo assert.

01

Hidden before and during match

Commitment = BHP256(side, price, amount, pair, owner, nonce). Book mapping is a bool. Size never hits the chain.

02

Fair price is not optional

exec_price = (bid + ask) / 2. Compatibility bid ≥ ask. Matcher can censor; it cannot reprice.

03

Settlement stays a record

Buyer note in the vault. Seller note in the quote program. Claim to spend. View key audits without spend rights.

02 · ProductWhat Leo encrypts vs what mappings show

What’s private vs public

Encrypted records · owner + view key ShieldedBalance · amount, token, blinding OrderTicket / OtcTicket · full preimage SettlementNote · fill + match_id OTC secret · nonce · share code browser localStorage, never submitted as public input Public mappings · anyone can read order_book[hash] = true | false otc_book + otc_code_hash total_shielded · locked_amounts compliance_attestations[id] = true threshold + period public · trades private

Matcher sees order preimages over TLS. It cannot move locked funds without a valid match_orders proof. settle_leg asserts the caller is the registered pool.

03 · How it worksfrontend + matcher + v3 programs

How the system connects

App Matcher Aleo L1 React app Leo Wallet useNightShade useRecords TLS · no custody engine.ts prover.ts server.ts pool_v3 vault_v3 quote_v3 usdc_v3 credits.aleo

private / TLSon-chainmatcher boundary

03 · How it works/shield · vault.shield · quote.shield_quote · usdc.mint_public

How value enters the pool

Faucet ALEO faucet.aleo.org Mint USDCx cap 10_000 / call credits.aleo public account usdc_v3.account public u64 balance vault.shield blinding · 1field quote.shield_quote blinding · 2field Encrypted ShieldedBalance owner · amount · token_id · blinding final{} pulls public tokens into the program total_shielded[token] += amount unshield / unshield_quote burns via spent_serials

Serial = BHP256(owner, amount, token_id, blinding). Unshield asserts it unused, then credits.aleo::transfer_public or USDCx transfer_public.

03 · How it works/trade · place_sell / place_buy · POST /orders/submit

How a hidden order is placed

Pick record bestBalance(min) Sell or buy ALEO lock / USDCx lock BHP256 commit side price amount pair owner_hash · nonce lock_funds change record back order_book hash → true OrderTicket encrypted, cancelable Matcher TLS preimage Sell locks ALEO in vault_v3. Buy locks amount × price / 1e6 USDCx in quote_v3. Pair hardcoded 1field : 2field. Frontend then POSTs { commitment, side, price, amount, nonce, owner } to the matcher. Cancel calls unlock_funds as the ticket owner.

Two transitions, not one generic place_order — vault and quote records live in different programs. Pool register_vault binds both via set_pool.

03 · How it worksengine.findMatch · prover.generateAndSubmit · match_orders

How the matcher is allowed to exist

in-memory book buys ↓ sells ↑ Matching loop · 2000ms best bid then time best ask then time bid ≥ ask? midpoint · min(sizes) (buy + sell) / 2 quote = fill × exec / 1e6 circuit will re-check this — engine is not gospel match_orders inputs both preimages + public hashes recompute commitments assert_eq chain hashes order_book both → false

Can: see TLS orders, pick price-time, censor. Cannot: steal (pool-only settle_leg), change price (Leo assert), fake a commitment (preimage check). Book is in-memory — a production gap.

03 · How it workssettle_leg × 2 · claim_settlement · Portfolio

How a fill becomes spendable

match_id BHP256(A, B) vault.settle_leg buyer gets ALEO note clears sell lock quote.settle_leg seller gets USDCx note clears buy lock Leo decrypts requestRecords claim_settlement → ShieldedBalance Portfolio: claim · merge_balances · unshield Public ALEO does not increase until unshield. Settlement notes are not balances until claimed.

Current matcher removes both tickets on any match (full fill of the smaller side, leftover not re-posted). Partial-fill restitch is a production item.

03 · How it works/otc · create_otc_* · fill_otc_* · no matcher

How sealed OTC skips the book

Create randomField secret lock + OtcTicket code_hash on ticket otc_book = true otc_code_hash stored base64 share code this wallet only Counterparty fill proves the secret fill_otc_sell / fill_otc_buy → two SettlementNotes taker locks the other asset · otc_book set false · cancel_* refunds via unlock_funds UI lists only live otc_book == true tickets — spent drafts are pruned

Aleo records are owner-gated, so Bob cannot spend Alice’s balance. OTC is a code-gated commitment plus a private share, not a joint signature.

03 · How it works/stealth shield_for · /compliance prove_volume_bound

Stealth pay and volume attest

Stealth receive leo account new share aleo1 only address book localStorage shield_for signer pays Record owner = recipient later spends unlink from the payer Volume-bound compliance pad 8 settlement amounts zeros fill unused slots · UI blocks if sum > threshold assert sum ≤ T in the circuit attestations[id] + auditor pack JSON

Aleo has no EIP-5564 stealth addresses — ephemeral accounts are the primitive. Sanctions Merkle membership is explicitly out of scope.

04 · AleoPrimitives that make a dark pool possible

How Aleo powers NightShade

The product is these five primitives. Everything else is wiring.

record

Encrypted notes the owner (or view key) can read.

Balance · Ticket · Note

fn / final{}

Private math in the circuit. Only hashes hit the chain.

midpoint stays off-chain

BHP256

Binds side, price, size, owner into one public hash.

commit · code · serial

mapping

Live or not. Never the size.

order_book · otc_book

assert

Validators enforce bid ≥ ask and the midpoint.

matcher cannot reprice

04 · AleoWhat we actually call at runtime

Credits, keys, wallet

credits.aleo

Native ALEO in and out of the vault.

@noupgrade

All four v3 programs. No admin key.

View keys

Audit fills. Cannot spend them.

snarkVM

Proofs in Leo Wallet. Matcher uses the SDK.

Leo Wallet

Sign, prove, decrypt. AutoDecrypt on connect.

caller / signer

Only the registered pool can settle a lock.

05 · UsersWho this is for, and why a public DEX fails them

Who this is for

Size-sensitive traders

Anyone whose clip would move ALEO/USDCx on a public book. Hidden size until the midpoint fill is the product, not a setting.

OTC desks and counterparties

Bilateral clips that should never hit a matcher. Share a code, lock, settle. Cancel until fill. No RFQ tape.

Funds that need an auditor, not a spectator

View-key history plus volume-bound attestations. Prove “we stayed under T this period” without publishing each fill.

Why it is the only version that works

  • Public AMMs tax whales 2–5% before the fill
  • Address-hidden swaps still leak pool movement
  • TEE dark pools ask institutions to trust Intel
  • Stealth receive lets treasuries pay without owning the note
  • USDCx faucet + Leo Wallet makes the demo path real on testnet

Not the target

Sub-block arb shops that want exclusive order flow. NightShade is sealed limits and OTC, not a co-located matching colocation product.

06 · NextHarden the venue, then take it to mainnet

What’s next

Make fills boring. Then ship the same four programs to mainnet.

Now

Audit v3

vault · quote · pool · usdc

Harden

Matcher

Persist the book. Restitch leftover size.

Assets

Real stable

Replace demo USDCx when a path exists.

Ship

Mainnet

Same four programs. Still @noupgrade.

Grow

Desk + audit

Seed liquidity. View-key auditors. Then more pairs.

Thank you