Sealed batches

Orders are encrypted in your browser to a future drand beacon. Nobody can read them until the batch closes, and then everybody can.

Schedule

A batch lasts ten minutes on the UTC clock: 14:00 to 14:10, 14:10 to 14:20, and so on. Its number is the Unix time divided by 600. Each batch is bound to the first drand quicknet round published at or after its close. Quicknet emits a round every 3 seconds, so the beacon appears within 3 seconds of the close.

Sealing an order

The order is a small JSON object with a fixed key order: version, batch, side, size, limit, ETH address, Monero address and a 16-byte random nonce. Your browser encrypts it with tlock-js to the batch round. That is identity-based encryption to the round number: the decryption key is the BLS signature the drand network produces for that round, and before the round it does not exist anywhere.

The browser sends the ciphertext and the SHA-256 of the plaintext. The server checks that the ciphertext header names the right round and refuses anything sealed to another batch. It cannot read the order. Your browser keeps the plaintext so you can follow the fill.

Opening at the close

Once the round is out, the server fetches the beacon, decrypts every ciphertext of the batch, and drops any order whose plaintext does not hash to its commitment, names another batch, or breaks the order rules. Then it clears the batch and publishes everything: ciphertexts, commitments, decrypted orders and the result. Closing happens on the next read of the batch API after the close, and on a scheduled job.

Clearing price

For each candidate price p (every limit in the batch), demand D(p) is the XMR wanted by buyers whose limit is at least p, supply S(p) the XMR offered by sellers whose limit is at most p. The batch clears at the price that maximises min(D, S). Ties go to the smallest imbalance, then to the midpoint of the tied range. Every matched order fills at that one price. The longer side is filled pro rata.

All amounts use 12-decimal fixed point, the same unit as piconero, so the result is exact and every browser computes the same bytes.

From fills to swaps

Filled buyers and sellers are sorted by commitment and paired greedily, so a large fill can be split across several swaps. The operator cannot choose who trades with whom: the order is fixed by hashes nobody controlled. Orders are capped at 5 XMR while the pool is in alpha.