MPC Committee Architecture
GoDark uses Secure Multi-Party Computation (MPC) with a 5-party committee to provide cryptographic order privacy while maintaining sub-millisecond matching latency.
How MPC Protects Your Orders
When you submit an order to GoDark, it is never sent as plaintext to any single server. Instead:
- Secret sharing — Your order is split into 5 cryptographic shares using Shamir Secret Sharing
- Distributed computation — Each share is sent to a different, independently operated node
- Encrypted matching — The 5 nodes compute on these shares directly — matching orders, checking prices, updating positions — without ever reconstructing the original data
- Threshold output — Results are only revealed when the protocol's output step combines at least 3 shares
Any single share — or even any two shares — is mathematically indistinguishable from random noise.
The 5-Party Committee
| Property | Detail |
|---|---|
| Active committee size | 5 nodes |
| Threshold | 3-of-5 (any 3 nodes can complete a computation) |
| Operator pool | Large pool of vetted, bonded node operators |
| Operator independence | Different organizations, different countries, different legal jurisdictions |
| Fault tolerance | Any 2 nodes can crash or go offline without interrupting matching |
Why 5 Parties?
| Benefit | Explanation |
|---|---|
| Collusion resistance | An attacker must compromise 3 independent operators (across jurisdictions) to see any order |
| Fault tolerance | 2 nodes can fail simultaneously with zero downtime — superior to single-sequencer architectures |
| Performance | 5-party Shamir with preprocessing achieves sub-millisecond latency per order |
| Practical threshold | 3-of-5 balances security (majority required) with liveness (only 3 needed to operate) |
What This Means for You
- Your order is private from operators — Each node operator sees only a random-looking share of your order. They cannot determine your price, size, direction, or identity.
- Collusion-resistant — Reconstructing any order requires at least 3 of the 5 node operators to collude. The operators are independent organizations in different legal jurisdictions, and the committee membership rotates continuously.
- Cryptographic guarantee, not a policy promise — Privacy is enforced by mathematics, not by terms of service or hardware assumptions.
Offline / Online Computation Model
GoDark uses a preprocessing model to achieve low-latency matching:
| Phase | What Happens | When |
|---|---|---|
| Offline (preprocessing) | Nodes collaboratively generate cryptographic material in the background. This is computationally expensive but runs continuously ahead of time. | Always running in background |
| Online (matching) | When your order arrives, the matching engine consumes pre-generated material to execute comparisons and fills. Each operation requires only lightweight share arithmetic and a small number of communication rounds. | At order submission time |
This split is what allows GoDark to match orders in sub-millisecond latency despite running a full MPC protocol.
What Runs Inside MPC (And What Doesn't)
Not everything needs to be private. GoDark places only the privacy-sensitive operations inside the MPC boundary:
| Inside MPC (Private) | Outside MPC (Public) |
|---|---|
| Order content (price, size, direction) | Authentication |
| Order matching | Rate limiting |
| Position calculations | Input validation |
| Margin/risk checks | Settlement to Solana (see Margin & Liquidation) |
Rolling Rotation & Warm Standby
GoDark's MPC nodes are co-located (in the same datacenter) for sub-millisecond latency. To prevent this co-location from becoming a single point of failure, GoDark employs rolling rotation with warm standby across geographically distributed datacenter clusters.
Within-Cluster Rotation
| Property | Detail |
|---|---|
| Scope | 1 node replaced per rotation epoch |
| Matching downtime | Zero — share refresh (Proactive Secret Sharing) happens while matching continues |
| Effect | Breaks any forming collusion; continuously changes which operators hold active shares |
After a full rotation cycle, every committee seat has been held by a different operator than when the cycle started.
Cross-Cluster Migration
Periodically, the entire active committee migrates to a different datacenter cluster in a different geographic region:
| Property | Detail |
|---|---|
| Scope | All 5 active nodes transition to a new cluster |
| Matching downtime | Milliseconds (with warm standby) |
| Effect | System is never in one jurisdiction long enough to be a static target |
Warm Standby
To minimize disruption during cross-cluster migration, GoDark uses warm standby clusters that continuously shadow the active cluster's state. At switchover time, only a small delta needs to transfer — resulting in near-zero matching gaps that are imperceptible to traders.
Collusion Resistance
| Scenario | Difficulty |
|---|---|
| 1 operator compromised | No impact — 1 share reveals nothing |
| 2 operators colluding | No impact — 2 shares reveal nothing (3-of-5 threshold) |
| 3 operators colluding | Theoretically possible — but operators are from different jurisdictions and rotate continuously |
| All 5 operators colluding | Would break privacy — requires coordinated compromise of 5 independent organizations across multiple jurisdictions with continuous rotation |
Fault Tolerance
| Failure Scenario | Impact | Recovery |
|---|---|---|
| 1 node crashes | None — matching continues with 4 of 5 nodes | Crashed node rejoins and re-syncs |
| 2 nodes crash simultaneously | None — matching continues with 3 of 5 nodes (threshold met) | Nodes rejoin and re-sync |
| 3 nodes crash simultaneously | Brief pause — warm standby cluster takes over | Automatic failover in ~20–50ms |
| Active datacenter goes offline | ~20–50ms blip — warm standby cluster takes over | Automatic failover; no manual intervention |
| Network partition between nodes | Nodes on the majority side continue; minority side pauses | Automatic healing when partition resolves |
This is a meaningful improvement over single-sequencer architectures, where any failure of the sequencer halts the entire exchange.