Proof of funds in zero knowledge

This is the plan for version 2. None of it is in the contract you can use today.

The leak it closes

In version 1, vault balances are public. A trader who deposits 400,000 USDG and commits in the next batch has told the market roughly what is coming, even though the order itself is sealed.

The design

Balances move into a shielded note tree. To commit, a trader proves in zero knowledge, with a Noir circuit verified on-chain:

• that they own notes worth at least the order size, in the right asset;
• that those notes are not already committed;
• that the commitment hash is well formed for this batch.

The contract verifies the proof and stores the commitment. At settlement, fills are paid into new notes rather than public balances.

What stays the same

The price still comes from the V4 pool midpoint, and the crossing logic is unchanged. Only where the money sits and what a commitment reveals change.

Encrypted reveals

A second step removes the public reveal window: orders are encrypted to a threshold key held by several parties, decrypted only inside settlement. That depends on the first step and is further away.