XMRPoolThe Monero dark pool. Swap XMR and ETH with no bridge, in sealed batches that open only when they close.
Every batch is published after it closes, and anyone can recompute the price it cleared at.
Monero side runs on monero-ts: wallet2 compiled to WebAssembly, in your browser.
Timelock to a future beacon. A new one every 3 seconds, threshold-signed by independent operators.
ETH side locks in a swap contract that only releases against the right secret, or refunds.Sealing previewROUND 33,691,012 · 11:00 UTCThis preview really encrypts with tlock-js to the round of batch 2989793. Change a field and the ciphertext changes; nobody can read it before the close.
Create or restore a wallet in the page. Monero's own wallet code runs as WebAssembly, syncs from a public node you pick, and saves its files encrypted with your passphrase in this browser's storage.
Keys never leave your device. The node sees block requests, never your view or spend key.
Your order is encrypted in your browser to the drand beacon round at the close of the batch. Our server stores a ciphertext and a hash. Every ten minutes the beacon appears, everything opens, and one price clears the batch.
Timelock encryption with tlock on drand quicknet: before the round exists, no one holds a key, us included.
Matched orders settle as atomic swaps. ETH locks in a contract, XMR locks to a shared address, and claiming the ETH reveals the key that releases the XMR. Timeouts refund both sides if anyone walks away.
Adaptor-key design with a cross-group DLEq proof between ed25519 and secp256k1.
Each closed batch is published with every ciphertext, the beacon round and the result. Press verify and your browser fetches the beacon from drand, decrypts each order, checks its commitment and reruns the clearing.
The clearing function is deterministic, so if your result matches, the operator did not bend it.
There is no visible order book and no queue to jump. Buyers and sellers meet once per batch at the price that crosses the most volume, and every fill uses it.
Matched pairs become swaps in commitment order, so the operator cannot pick who trades with whom.
Each side draws a secret below 2^252. Its ed25519 half goes into the Monero address; its secp256k1 address goes into the contract. A DLEq proof shows both come from the same secret.
The ETH holder calls newSwap with the claim and refund commitments and two timeouts. The ETH sits in the contract, released only by the right secret.
The XMR holder sends XMR to an address whose spend key is the sum of both halves. Nobody can move it alone.
The ETH holder sees the XMR confirmed with the shared view key and calls setReady. From now on the XMR holder may claim.
Claiming the ETH publishes the XMR holder's secret onchain. With it, the ETH holder now has the full Monero spend key.
The ETH holder sweeps the XMR with a + b. If anything stalls, the timeouts let the ETH holder refund, which reveals their secret so the XMR side can take the XMR back.
How an order is sealed to a drand round, what the server can and cannot see, and how a batch opens at the close.
Read