Meet $GLOAM, the Gloam token.

See more
GloamDocs

How it works

Private trade

Trade one asset for another from your private balance, with your size kept private. It is built, and switched off on-chain while we build a new engine for private trading. Stock tokens can already be held and sent privately today.

Status
Built, switched off
Next
New engine underway
Live today
hold + send stock tokens
Fake fills
Never

Why it is switched off

A payment has one owner, so the owner can prove it alone. A trade is different: it mixes many people's orders against shared liquidity. That needs its own design, so we are building a new engine for private trading instead of stretching the payment one.

The first version showed why. A sealed swap spends an assetIn note and mints an assetOut note with both amounts private, but no tokens move, so the pool ends up owing assetOut it does not physically hold (audit H1). Rather than ship an insolvent swap or reveal your size to fix the accounting, the on-chain verifier is set to zero and the swap is off. Turning it on again goes through the 3-day timelock. Shield, private send and cash out are live and solvent in the meantime.

Stock tokens today

On Robinhood Chain you can already shield stock tokens (TSLA, AMZN, PLTR, NFLX and AMD on testnet), hold them privately, and send them privately. Trading them privately is the part that waits for the new engine.

How the built version works (switched off)

Private trade (sealed path)
Step 1Pick direction + vault noteBuy (ETH → stock) or sell (stock → ETH). Spend a note you already hold in the vault.
Step 2Prove the tradeBrowser builds a sealed-swap proof. Size stays private; the chain only sees a vault proof.
Step 3Settle in vaultYou receive the out asset as a new vault note, plus change. No public DEX hop.

Testnet rates use coarsened display marks (Yahoo / CoinGecko for the UI), not an on-chain oracle. If marks fail, 1:1 fallback. Dev ceremony keys only.

Size privacy (default on when enabled): the public amountOutMin is a 1-wei floor, not your real output (an earlier build leaked size by setting min-out to the exact amount; the sealed path fixes that). Rates and asset pair are public. Cash out publishes amount. See privacy model · production gate.

Vault trade adapter (fallback)

From vault (public swap step)
Step 1Cash outUnshield a vault note to your open wallet (public edge).
Step 2SwapPublic DEX swap. Size and pair are visible on the explorer.
Step 3Re-shieldProceeds go back into the vault. Hold is private again.

Useful on thin books. Not sealed trade: the swap edge still leaks size. The product shows both paths honestly.

What “sealed” means

  • Public observers do not get your exact size as a free signal (with max size privacy on)
  • Settlement still ends on-chain (we do not claim invisibility)
  • No theatrical “private success” without a real proof
  • Explorer shows sealedSwap + pair, not a Uniswap fill

What ships next

  1. A new engine for private trading, built for many people's orders, that keeps size private and the pool solvent. It is underway. Notes on the solvency side are in contracts/audit/H1-CONFIDENTIAL-SWAP-DESIGN.md.
  2. On-chain rates, replace display-mark rates with oracle-bound or pool-bound pricing (Pyth / AMM). Full write-up: Prices & oracles.
  3. Vault inventory, seed faucet stocks so cash-out after a sealed trade does not fail for empty deposited.
  4. Production ceremony keys, multi-party proving keys before any mainnet value.
  5. Ethereum expansion, same private rails where the largest onchain audience already sits.
  6. Deeper liquidity design, intent batching or vault-native pool when books are thin.

Each step keeps the same rule: no fake private fills. See Production gate.

What we will not do

  • Hide a public swap behind a “private” button
  • Claim production readiness on dev proving keys
  • Promise dark-pool guarantees on thin testnet liquidity

Repo pointers

  • Engineering design: contracts/SEALED_TRADE.md
  • Status helper: app/src/lib/sealedTrade.ts (sealedTradeReady() === true when artifacts ship; panel still checks the on-chain verifier)
  • UI: app/src/components/app/SealedTradePanel.tsx
  • Production keys gate: /docs/production

Private trade is switched off on-chain, so the trade panel shows it as disabled until the new engine is ready. Available today: the from-vault adapter (honest, not sealed), and Move to hold and send privately.