Proof of funds in zero knowledge
This is a plan, not something you can use today. Version 2 shipped encrypted orders and a reference price first; zero-knowledge proof of funds is still ahead.
Why it is not in version 2
A shielded note tree changes where every balance lives, adds a circuit and an on-chain verifier, and would need its own audit before holding anyone's money. Encrypted orders closed the bigger leak first (the public reveal window) without touching custody. Proof of funds comes after version 2 has been audited.
The leak it closes
In version 1, vault balances are public. A trader who deposits 400,000 USDG and commits in the next batch has told the market roughly what is coming, even though the order itself is sealed.
The design
Balances move into a shielded note tree. To commit, a trader proves in zero knowledge, with a Noir circuit verified on-chain:
- that they own notes worth at least the order size, in the right asset;
- that those notes are not already committed;
- that the commitment hash is well formed for this batch.
The contract verifies the proof and stores the commitment. At settlement, fills are paid into new notes rather than public balances.
What stays the same
The price still comes from the V4 pool midpoint, and the crossing logic is unchanged. Only where the money sits and what a commitment reveals change.
Encrypted reveals
Shipped in version 2, in a simpler form than planned here: orders are encrypted to a drand round (a threshold network run by the League of Entropy) and opened inside settlement. See Encrypted orders.