Encrypted orders

Version 2 adds a second way to place an order. Instead of committing a hash and coming back to reveal it, you commit the hash and the order itself, encrypted so that nobody can read it before the batch closes. The keeper opens it inside the settlement transaction. You do not need to stay online, and your order never sits revealed on-chain before it is crossed.

It is the default in the app. "Reveal it myself" is still there and works exactly as in version 1.

How it works

1. Seal. The app builds your order (market, side, size, limit, a random salt), computes the same commitment hash as always, and encrypts the order with timelock encryption (tlock) to a round of the drand quicknet randomness beacon.
2. Commit. commitSealed(commitment, ciphertext) stores the hash, takes the 1 USDG bond, and publishes the ciphertext in an event. The contract cannot read it either.
3. Unlock. drand publishes a round every 3 seconds. Each round's signature is the key that decrypts everything encrypted to that round. The app aims at the round that falls at the estimated end of the batch's reveal window, counting 12 seconds per remaining Ethereum L1 block.
4. Open and settle. Once the reveal window has closed and the round is out, the keeper decrypts every encrypted order of the batch and calls settleWithReveals(batch, market, orders). For each order the contract recomputes the commitment, which includes your address, checks it matches the hash you committed, locks the size from your vault, returns your bond, adds it to the book, and then settles the market, all in one transaction.

What the contract checks

• No forgery. A preimage that does not hash to a stored commitment for that trader, batch and index is skipped. Nobody can open an order you did not commit.
• No double opening. An order opened by hand during the reveal window cannot be opened again.
• Funds at settlement. If you withdrew the size after committing, the order is consumed and its bond is forfeited, like an order never revealed.
• Book size. At most 96 orders per market per batch; extra preimages are skipped.

Who can settle, and when

The first 13 of the 26 blocks of the settle window belong to the protocol keeper. Without that, anyone could settle a market the moment the reveal window closes, before the keeper had opened the encrypted orders, and those orders would miss the batch. After those 13 blocks, anyone can call settleWithReveals with the orders they decrypted themselves: drand rounds and the ciphertexts are public. The keeper's priority gives it no access to funds.

Honest limits

• You rely on drand. If the beacon stopped, encrypted orders could not be opened: they would miss the batch and their bond would be forfeited. drand quicknet is run by the League of Entropy, a group of independent organisations, and has been live since 2023.
• The round is an estimate. The contract counts Ethereum L1 blocks, drand counts seconds. If L1 runs slower than 12 s a block, the round can come out a little before the reveal window ends; commits are closed by then, but anyone watching could read the batch's orders for those few seconds before settlement. If it runs faster, the keeper waits for the round inside the settle window.
• Everyone can decrypt at the round. Timelock encryption hides the order until the round, not from everyone forever. Between the round and the settlement transaction, the orders are readable off-chain. The price guards are what stop anyone from using that.
• If nobody settles. A batch not settled within 26 blocks is voided and every order is returned; unopened encrypted orders lose their bond.
• The ciphertext is not checked on-chain. A malformed one simply never opens. The app builds it for you.