Privacy
Private by design
Who this is for, and what it assumes
Written for someone deciding whether to put this in a server where people know each other.
- The points tier and the stakes tier have different privacy properties; both are described below.
- The on-chain privacy layer is specified and not yet deployed. Where that matters, it is said.
Why a pool can keep a secret and an order book cannot
An order book is a list of offers. To match you with somebody, it has to publish the offer: side, size, price. Anyone watching can read who is on which side and how committed they are, which is exactly what makes copy trading and front-running possible.
A pari-mutuel pool does not match anybody with anybody. Everyone stakes into one pot and the winners divide it. The only number the system needs to publish is the pot per outcome, because that number is the odds. Who contributed which part of it is not load-bearing.
What is hidden
In the design in specs/02-stub.md, a position is a note rather than an entry in a table. Spending it is a proof, not a signature. That hides who holds which position, the amount of each position, payout amounts, and the links between your deposit, your stake, your claim and your withdrawal.
Two more mechanisms stop a single stake from being readable as a jump in the totals. Stakes are accumulated and applied in batches, so observers see a batch move rather than one person moving. And balances are split into fixed denominations, so sizes inside a batch are coarse.
What is public, and has to be
The pool total on each outcome. The odds are the product; a prediction market that hides the pot has nothing to sell.
Deposits into the shielded pool: the amount, and the depositor, at the moment of deposit. This is the standard property of shielded pools — you deposit visibly once and spend privately many times.
The limits, stated plainly
Your RPC provider can see which note addresses your client asks about. Decoy reads blunt that, and a school instance should run its own indexer rather than rely on someone else’s.
A market creator cannot stake privately on their own market. That is a rule, not a gap: they have information other stakers do not.
And the important one: this layer is designed, not deployed. The on-chain hooks exist and refuse to run until the privacy program is live. Until then, the points tier gives you ephemeral confirmations in Discord — only you see them in chat — and an ordinary position on chain.
What we do not build
No live position feeds. No wallet trackers. No profit rankings. No mirror of any minor’s individual positions. These are listed as non-goals in the research that drove the design, and they stay non-goals.
Check yourself: if nobody can see your position, how does the market know what the odds are?
Because the pot per outcome is public even when the contributors are not. Your stake changes the total; it does not come with your name on it. The odds are a property of the pot, not of a list of people.