Privacy & Encryption
GoDark is a perpetual futures exchange where no single party — not even the operators running the system — can see your orders, positions, or trading strategy.
Traditional exchanges (centralized or decentralized) expose order data to operators, sequencers, or validators. This creates a fundamental conflict of interest: the entity running the matching engine can front-run, sandwich, or selectively delay orders. GoDark significantly reduces this exposure using Secure Multi-Party Computation (MPC) and dark-pool execution.
The Problem: Who Can See Your Orders?
| Exchange Type | Who sees your orders | Risk |
|---|---|---|
| Centralized (Binance, Bybit) | The exchange operator | Operator can front-run, trade against you, or leak data |
| On-chain DEX (dYdX, Hyperliquid) | The sequencer / validator | Sequencer can reorder or censor transactions (MEV) |
| GoDark | No single party — order data is cryptographically split across 5 independent nodes | No single party (or any pair of colluding parties) can reconstruct your order |
How MPC Protects Your Orders
When you submit an order to GoDark, it is never sent as plaintext to any single server. Instead, your order is split into 5 cryptographic shares using a technique called Shamir Secret Sharing. Each share is sent to a different, independently operated node. Any single share — or even any two shares — is mathematically indistinguishable from random noise.
The 5 nodes then compute on these shares directly — matching orders, checking prices, updating positions — without ever reconstructing the original data. The matching engine operates on encrypted fragments, producing results that are only revealed when the protocol's output step combines the necessary shares.
What This Means for You
- Your order is private from operators — Each node operator sees only a random-looking share of your order. They cannot determine your price, size, direction, or identity.
- Collusion-resistant — Reconstructing any order requires at least 3 of the 5 node operators to collude. The operators are independent organizations in different legal jurisdictions, and the committee membership rotates continuously.
- Cryptographic guarantee, not a policy promise — Privacy is enforced by mathematics, not by terms of service or hardware assumptions.
The result: traders interact with familiar REST and WebSocket APIs. The MPC layer is transparent — you submit orders the same way you would on any exchange. The privacy happens at the infrastructure level.
For details on the committee structure, rotation model, and fault tolerance, see MPC Committee Architecture.
Order Lifecycle
Submitting an Order
- You submit an order to the nearest Edge Gateway over a TLS-encrypted connection.
- The Edge Gateway handles authentication, rate limiting, and input validation. Order payloads are encrypted in transit before MPC fanout (see Encryption & Transport for gateway trust boundaries).
- The Sequencer Gateway assigns a global sequence number, ensuring deterministic ordering, and fans the order to all 5 MPC nodes simultaneously.
- The MPC committee secret-shares your order, matches it against the secret-shared orderbook, updates positions, and runs margin checks — all without any single node seeing the data.
- You receive an acknowledgment once 3 of 5 nodes confirm the operation.
- Filled trades are batched and settled to Solana periodically.
Two-Tier Gateway Architecture
| Edge Gateways | Sequencer Gateway | |
|---|---|---|
| Location | Deployed near traders (multiple regions) | Co-located with MPC nodes |
| Scaling | Horizontal — scales to handle any number of connections | Single instance with hot standby |
| Role | TLS termination, authentication, rate limiting, WebSocket management | Sequence number assignment, parallel fanout to 5 nodes |
| Order privacy at gateway | Encrypted session framing before MPC fanout | Sequence assignment only; no MPC plaintext |
Gateway encryption protects order contents from passive observers and from logs/traces. A compromised gateway is a separate trust boundary — see Encryption & Transport.
This means a trader in Tokyo connects to a local Edge Gateway with ~2ms TLS handshake (instead of 300ms to a distant datacenter), while the Sequencer Gateway focuses purely on ordering and distribution.
Settlement
All trades matched within GoDark's MPC engine settle against private commitments in the shielded pool. Collateral remains under on-chain program controls, and GoDark's MPC committee cannot arbitrarily move user funds.
For full details, see Settlement.
Summary
| Dimension | GoDark Guarantee |
|---|---|
| Order privacy | Cryptographic — no single operator (or any two colluding operators) can see your orders |
| Matching latency | Sub-millisecond (~150–750μs per order) |
| Throughput | 10,000+ orders/second |
| Fault tolerance | Any 2 of 5 nodes can fail without downtime |
| Geographic resilience | Automatic failover across multiple global regions |
| Collusion resistance | 3-of-5 threshold with rolling rotation across independent operators in different jurisdictions |
| Settlement | On-chain (Solana) through program-controlled shielded-pool commitments |
GoDark delivers the performance traders expect from a centralized exchange, the programmatic custody controls and transparency of a decentralized exchange, and a level of order privacy that neither can offer.
Collateral privacy is handled by a separate shielded-pool layer. Deposits become private note commitments, and settlement updates those commitments without publishing a readable per-user balance ledger. See Shielded Pool for the custody and settlement privacy model.