ARCLITE / CHAPTER 05

Documentation.

How the venue works, what it guarantees, and what it does not.

ArcLite engraved campaign artwork without lettering

THE ARCLITE PAPERS / 05A reference for reading the venue, not a description of it. Every figure below can be checked against Robinhood Chain.

WHAT IT IS

A private
batch auction.

ArcLite crosses tokenized real-world assets in sealed batches on Robinhood Chain. Orders are encrypted until the book closes, priced from references the contract reads itself, matched, proved, and settled on chain — with nothing per-order published.

Orders are sealed

An order is built and encrypted inside your browser and sent without a cookie or an address. What reaches the venue is a commitment and a ciphertext. Nothing in the request links it to your wallet.

The book closes before prices are read

sealWindow freezes the set of orders on chain. Only then does the price committer read each feed and publish the table the window will cross at. The ordering is the point: nobody, operator included, can see the book and then choose the reference.

III

Everyone crosses at one price

Within a window an asset has a single reference, taken from Chainlink and the issuer’s multiplier. There is no queue to be early in and no spread to be on the wrong side of. Where demand and supply do not match, fills are pro-rata.

Settlement proves the crossing

A zero-knowledge proof shows the batch was consistent — notes existed, nothing was spent twice, value was conserved at the committed reference, no guarded asset crossed — without revealing a single order. The contract verifies it before anything moves.

THE GUARANTEE THAT MATTERS

You can always leave.

ArcLite engraved artwork in navy, pink and cyan

THE GUARANTEE THAT MATTERSWithdrawal carries no pause, no role and no window check. The pool accepts a valid proof from anyone, so a holder can exit while the venue is stopped, the asset is delisted, and the operator is gone.

The proof is generated in your browser, from keys that never leave it. A server that could prove your withdrawal could also spend your note — which is why no server has one.

WHAT IS PRIVATE

Private is not
a synonym for hidden.

Full zero-knowledge does not make a venue unaccountable, and it does not hide everything from everyone. This is who sees what, stated plainly, including the parts that are less private than the word suggests.

The public sees commitments

On chain: note commitments, nullifiers, Merkle roots, and the fact that a window settled. No asset, no size, no side, no counterparty, no address.

Deposits are visible, and always were

Shielding is an ordinary token transfer from a known address, so the link between a wallet and having deposited is public in every shielded pool including this one. What stays private is everything after: which notes are whose, what they traded, and who crossed with whom.

The matcher sees one window

Orders are decrypted to be matched, so the venue sees that window’s book in plaintext. It cannot see it before the book closes, and it cannot link your orders across windows — the account handle is salted per window by construction. Removing the single-window view entirely needs threshold decryption, which is not built.

Your own history needs your keys

Because orders are unlinkable across windows, there is no query for “this person’s trades”. Only the holder of the keys can assemble it — which is also why the vault can rebuild itself from the chain and a signature alone, on any browser.

WHAT THE CHAIN ENFORCES

Checks, not promises.

SOLVENCY

Repeatable by anyone

Crossing moves no tokens — every unit a buyer receives comes from a seller in the same window — so the pool’s obligations change only on deposit and withdrawal. Solvency reduces to comparing its token balance against what it owes, per asset, directly on chain.

GUARDS

Read, not set

An asset is deferred when its reference is stale, its oracle is paused, or a corporate action is in progress. The contract derives that itself from the feeds and the token, and a deferred asset rests while every other asset keeps crossing.

EXIT

Unconditional

Withdrawal is the one path with no pause, no role and no window check. It is also the smallest circuit in the system, deliberately, so that proving it stays something a laptop can do in seconds.

REFERENCE

Where to
check it.

The venue runs on Robinhood Chain, an Arbitrum Orbit L2. These are the contracts the dashboard reads, published so the solvency figures can be verified against the chain rather than taken from this page.

Network: Robinhood Chain · 4663
Quote asset: USDG · 6 decimals
Eligible universe: Tokenized equities with a Chainlink feed
Window length: 5 minutes
Pool: 0x3435494d626091642e170AD1B0f48c9eD8c899aa
Asset registry: 0x9c4004d59f97b7993D621D867262f91745C594C7
Price committer: 0xcB0165Ac908B4758C2790BC2DeB59ECa20b432F6
Quote token: 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168

Every contract is source-verified. The dashboard’s solvency record reads these live and links each address to the explorer.

LIMITS

What this is
not.

Unaudited

The contracts and circuits have not been through an external audit. They are source-verified and tested, which is not the same thing.

A thin anonymity set

Privacy comes from the crowd you hide in. Early on that crowd is small, and timing alone can correlate a deposit with a withdrawal. This improves only with use.

Issuer powers remain

The tokens are issued by a third party who can pause transfers globally, blocklist an address, or restate a multiplier. No venue can hold these assets and remove that.

Proved consistent, not optimal

The settlement proof shows a crossing was valid at the committed reference. It does not prove the matcher found the best possible crossing, and this page will not pretend otherwise.

References come from Chainlink feeds, which update on a deviation threshold rather than continuously, so a window can legitimately cross slightly away from the live mid. An asset whose reference has gone stale is deferred rather than crossed on an old price. Access is subject to asset availability, screening and jurisdiction eligibility.

CONTINUE THE EXPERIENCE / 06Open the dashboard.