How it works
Sealed trade
Swapping from a private balance without broadcasting what you hold. The sealed path is built but switched off; this page explains why and what works today.
- Sealed path
- Built, switched off
- Markets view
- Robinhood Chain testnet
- Tokens
- 5 test stock tokens
Why it is switched off#
The code that swaps from a private balance exists, and it is turned off in the app. We would rather ship nothing than ship a "private" trade that is not. Three things hold it back:
- Liquidity. A swap has to meet a public market. On testnet those markets are thin, so prices move a lot on small orders and results would be misleading.
- Price leakage. The swap step is public. Amount, direction and timing show up on the explorer. With few users, a sealed trade is easy to tie back to the deposit that funded it.
- Review. The adapter contract handles pooled funds on behalf of private notes. It needs an external review before it handles anything of value.
| Feature | Status |
|---|---|
| Stock token list and reference prices | Testnet |
| Sealed swap from a private balance | Switched off |
| Batched sealed swaps | Planned |
Stock tokens on testnet#
Robinhood Chain testnet has test tokens that track stocks: TSLA, AMZN, PLTR, NFLX, AMD. They are test assets with no value and no claim on any share. Markets lists them with reference prices so you can see how the trade screen will behave.
Markets is a view, not a private trading desk. Any swap you make with these tokens from a normal wallet is a public transaction, the same as on any other app. Tempo Moderato has no stock tokens.
How the sealed path works#
Spend a private note
Your device proves ownership of USDG notes and names the vault adapter as the destination, with the asset you want out and a minimum amount bound into the proof.Adapter receives funds
The pool releases the input amount to the adapter contract, not to any wallet of yours.Public swap
The adapter swaps on a public market. This is the one step that shows an amount and direction.Re-shield
The adapter deposits the output back into the pool as a new note for you, encrypted to your key.Or revert
If the output is below your minimum, the whole transaction reverts and your note stays unspent.
The vault adapter#
The adapter is a small contract that sits between the pool and a market. It only acts inside a transaction the pool started, it holds funds only for the length of that transaction, and it can only send the output back into the pool. It never sees your keys.
What the public swap step reveals:
- The input asset and amount, the output asset and amount, and the time.
- That the trade came from the UMBR pool, through the adapter.
What it does not reveal:
- Which notes paid for it, your wallet, or your remaining balance.
- Where the output note goes next.
With a large, busy pool, that is meaningful cover. With a small testnet pool, the swap amount alone may be enough to link the trade to a deposit. That is the price leakage problem above.
What sealed means#
In UMBR, sealed means the trade cannot be tied to your wallet or your private balance. It does not mean the trade is invisible. Someone watching the market sees that a swap of a given size happened. It also does not protect against front-running of that public step; your minimum output is the guard against a bad fill.
What ships next#
- Batching: combine many sealed swaps into one public swap, so no single trade size is exposed.
- An external review of the adapter and the circuits it relies on.
- Turning the path on for small amounts on testnet, with clear warnings, once batching works.
Track it on product status.
What we will not do#
- Call a trade sealed when its swap step can be linked back to you.
- Turn sealed trade on for real funds before review.
- Imply that test stock tokens represent shares or carry value.
- Route your order through a market maker or private desk that sees who you are.
Testnet assets