capacity privacy
Hide the intent. Never the venue.
Commit your size before anyone sees it, mint from a one-shot wallet, or fund through a shielded pool. The swap itself stays public — that is where the reject path lives.
Private cadence intent
Commit H = hash(size, epoch, salt). Size lands public only at reveal-on-consume — not a dark AMM.
0x2b03bb93…073c00epoch —
salt · generated fresh at commit · revealed at consume
ask — not written · total —
commitments
No commitments yet. Commit-mint and only H appears in the Graph feed — size reveals at consume.
Mint from a one-shot wallet
A fresh ephemeral key pays for the slot — your main wallet stays out of the mint.
Generate a one-shot wallet locally. Nothing touches your main wallet — the ephemeral key commits, reveals, and pays, then sweeps what's left.
Shield the funding, not the swap
Aztec / Railgun path: private balance in, cadence slot out, public swap.
1 · shield
Shield funds into your Railgun/Aztec private balance.
2 · fund
Unshield to the ephemeral wallet that pays for the slot.
3 · commit
commitMint(H) from the ephemeral wallet — size hidden.
Checking adapter configuration…
Shields funds, not the swap. The beforeSwap gate and reject paths stay public — that is the mechanism.
What is private — and what is not
Commitment, not darkness
H = hash(size, epochId, salt) goes onchain; the size reveals at fill — not private forever.
Upper bound, disclosed
The escrow shows an upper bound on size. Exact size stays hidden until reveal.
Payer privacy
A one-shot wallet separates your identity from the purchase.
Venue stays lit
Rejects, fills and capacity supply remain fully public.