Design
Trading and screening
A trade settles cash against loan in one step, or not at all. The buyer is screened against the borrower's DQ list, and never sees the list.
Three actions
- The seller offers. The buyer, the size, the price and the trade date go to the enclave sealed. Only the holder can offer its position.
- The buyer accepts. Only the named buyer can accept. A buyer pays test USDC into the deal first: 12,000,000.00 each for Delta and Rival in the demo.
- The agent settles. Only the agent can settle the trade.
Cash against loan, in one step
In the demo Alder sells 10,000,000.00 of its position to Delta at 99.50. When the agent settles, cash, register and both positions move in one step. Delta holds 10,000,000.00 and paid 9,950,000.00.
Interest is split on the trade date. Alder holds 40,000,000.00 with 845,000.00 of interest due at period end: 780,000.00 on what it kept, plus the 65,000.00 it earned on the part it sold, up to the trade date.
The borrower’s screen shows the trade and no price.
A list the buyer never sees
The borrower keeps the DQ list: the buyers who may not buy into the loan. It goes to the enclave sealed, so the chain carries only ciphertext.
In the demo the borrower ticks Rival. Alder offers a trade to Rival, Rival accepts, and the agent presses Settle. The answer is Not settled. Nothing moved, and the buyer is told nothing more. Rival’s screen says not settled and gives no reason. The agent’s screen says The buyer is on the DQ list. The agent sees whether a buyer passed screening, and never the DQ list itself.
A sealed box is no use to anyone but its sender
The ciphertext sits on the public chain, where anyone can copy it. If the enclave took it from any caller, Birch could send Alder’s sealed offer as its own and read the buyer, the size and the price in its own envelope. So the sealed fields name the deal, the caller and the command they are for, and the enclave refuses a box that arrives any other way. npm run e2e plays exactly that on testnet: Birch sends Alder’s box and is refused.
What the chain shows of a trade
Every action is a transaction signed by a named account. The chain shows that Alder offered a trade, that Delta accepted it and whether it settled. It does not show the size, the price or why a trade failed. A buyer’s deposit is a token transfer, so its amount is public; what the money is for is not. See Who sees what.
Tested
| Rule | Test |
|---|---|
| A trade settles cash against loan | trading test_trade_settles_delivery_versus_payment |
| Interest is split on the trade date | trading test_interest_is_split_on_the_trade_date |
| A lender that sells everything keeps the interest it earned | trading test_full_exit_keeps_earned_interest |
| A buyer on the DQ list is refused | trading test_dq_listed_buyer_is_refused |
| The borrower and the auditor see the trade but never the price | trading test_trade_privacy |
| A sealed offer copied from the chain is no use to anyone else | protocol test_a_sealed_offer_copied_from_the_chain_is_no_use_to_anyone_else |