THE PROTOCOL

How it works

A continuous lit order book for real price discovery, with a confidential position layer bolted underneath. The book is public; who you are, how big you are, how levered, and where you get liquidated are not.

Privora is not a dark pool and not a batch auction. It is a normal central limit order book: price-time priority, instant fills, a transparent mark, where privacy lives at the position layer, never the matching layer. That single choice is what makes it both a real market and a confidential one.

What is public, what is private#

Everything needed for honest price discovery is lit. Everything that's yours is shielded.

Public (the lit book)

Every resting order's price and displayed size, and the order of arrival (price-time priority).
The mark, oracle-bound and funding-adjusted, and every fill as it prints.
Per-market funding, the insurance fund, and the matching rules themselves.

Private (your position)

Your size and collateral, committed, never printed on the book.
Your leverage and margin, proven to be sound, never shown.
Your liquidation level, sealed; only a coarse bucket is revealed, and only once price reaches it.
Your identity, no account ever signs a trade, so two of your orders can't be linked.

Confidential positions#

A position on Privora is a commitment recorded on-chain, a cryptographic fingerprint of your hidden values, not the values themselves. To deposit, place, modify, or close, you produce a zero-knowledge proof that the action is valid against your hidden state, and the program verifies it before touching anything.

Proving happens locally, on every surface, browser WASM for humans, in-process for the Rust SDK and agents. The witness (your secret position) never leaves your device. There is no hosted prover and no trusted operator who can see your book.

Locked decision

A verified proof is only trusted once its public inputs are bound to live on-chain state: the tree root is recent, the nullifier is unused (then marked spent), the order/commitments are recorded, the price and size match the book. Verification without binding would be worthless, so the program never skips it.

Margin, homomorphically#

Your equity is evaluated against the public mark without ever revealing your size: the math works over commitments, and a single range proof attests that your position is healthy. Maintenance is charged on your committed entry notional, not your live notional, which is precisely what lets the liquidation seal stay fixed as funding accrues (next section).

Both margin modes are always available: isolated (per-position, set-and-forget) is the default, and cross-margin (a true portfolio seal) is opt-in per account, without ever weakening isolated positions' safety.

Liquidation#

Liquidation is the hard part of any confidential venue, and it's where Privora is most deliberate. Your liquidation level is hidden, yet liquidation must still be automatic, fair, and impossible to grief.

The level is sealed to a coarse bucket and time-locked. It is revealed only when the mark actually reaches that bucket, never before, and never the exact price.
A threshold committee attests, obliviously, that price reached the bucket. Combined with the position's own sealed proof, that authorizes the close, and a freshness check stops a stale attestation from liquidating a position whose price has since recovered.
The seal is funding-adjusted: it keys on price minus the cumulative funding index, so funding accrual never drifts it and you never have to re-arm.

Locked decision

The no-agent invariant. Solvency never depends on you, a bot, or any keeper being online. An agent can only ever buy you capital efficiency, a tighter re-arm, a faster margin reaction, never solvency. Any feature that put safety on an agent's liveness would be wrong, by construction.

Unlinkable by default#

You never sign a trade and never hold SOL. You prove an order locally, and a relayer pays the gas to submit it. Because orders are authorized by a proof and a nullifier, not an account signature, there is nothing on-chain to tie two of your trades together.

The relayer is a fee-payer, not a custodian: it carries a masked payload it can't read and can't redirect (payout destinations are bound into the proof). The only linkable points are the on-ramp (deposit) and off-ramp (withdraw), where tokens enter or leave, never a trading action.

The trust root#

Privora is clean-field and self-contained. It encrypts ordering and inputs; it never computes over ciphertext. The trust root is its own commitments plus Groth16 circuits, verified directly on Solana via the live alt_bn128 and poseidon syscalls, never the disabled native programs.

No hosted prover, every surface proves locally.
No bad debt by construction, a conservative seal plus per-bucket leverage caps, backstopped only by the residual granularity gap.
Latest Solana libraries only, no legacy verifier, no pinned-old cryptography.

Want to actually use it? Head to Trade on the app, the SDKs, or AI agents.