status: the helius ring integration is not wired yet. the app runs in DRY_RUN on devnet, every listing and bid returns a simulated result and nothing is submitted on-chain.
what is public vs private, per step
| step | on-chain / explorer | desk board | counterparty | darkblock operator |
|---|---|---|---|---|
| deposit into ring | your wallet, the amount and the ring address are visible. this is the one public link. | nothing | nothing | nothing beyond the chain |
| list a block | nothing | token, size as % of supply, floor vs market, end time, vesting options | same as board | same as board |
| place a bid | nothing | bid count only | nothing until close | a commitment hash, not the bid |
| settle | one relayer-submitted ring transaction. parties, token and amounts are not readable. | block marked closed | your side of the deal, via viewing key | that a block settled |
| withdraw from ring | the receiving wallet and amount are visible | nothing | nothing | nothing beyond the chain |
nothing = not visible to that party.
privacy model
a privacy ring is a shared pool of balances. inside it, transfers between members are not readable on the explorer. a relayer submits transactions, so the wallets that trade never sign a visible transaction.
darkblock adds a desk on top: a board of sealed listings, encrypted bids, and atomic settlement. listings are visible to desk users at a coarse level (share of supply, discount band) so buyers can decide whether to bid.
private by default does not mean invisible. it means the default path leaks as little as we can manage, and the places it does leak are listed below.
blind auctions
each bid is encrypted in your browser before it leaves. the desk stores a commitment (a hash) so the bid can't be changed later, but can't read it.
when the auction ends, bids are opened for the seller and checked against the floor. the best valid bid wins. losing bids are discarded and never shown to anyone.
if no bid clears the floor, the block closes unfilled. there is no guaranteed buyer.
private vesting
a seller can allow buyers to take the block locked. the tokens go into a private escrow inside the ring and unlock linearly over 7 or 30 days.
locked tokens can't be sold until they unlock. buyers usually ask for a deeper discount in exchange for that risk.
no-trace funding
the cleanest path is to fund a bid from a balance already in the ring. a fresh deposit right before a trade, of roughly the trade size, is the easiest way to link yourself to a deal.
whenever an action would require a public deposit, the app warns you before you sign. you can still go ahead, it's your call.
honest limits
- deposits and withdrawals are public. if you deposit 1,000,000 of a token and withdraw it a day later, timing and amount can link the two.
- small rings leak more. with few members, an observer can narrow down who traded.
- the relayer sees submission metadata (timing, and network data unless you use your own protection).
- your wallet app, rpc provider and browser extensions may see what you sign.
- compliance screening runs inside the ring. if a wallet is flagged, it is blocked.
- this is software. it can have bugs. use amounts you can afford to lose while it's young.
keys and viewing keys
darkblock never asks for a private key or seed phrase. anyone who does is not us.
your viewing key is derived from a wallet signature over a fixed message. it lives in memory in this tab. closing the tab drops it.
api keys (helius, jupiter) stay on the server. the browser talks to /api routes, never to providers with our keys.
fees
desk fee and holder share are set in config and shown on the site. until they are final they show as –.
holder share is paid from one public wallet. every distribution tx is linked on the home page.