You can prove it works, or you can keep it secret.
Not both. Until now.
A quant with a genuine edge has no way to sell it. Publish the strategy and it stops working the day it is copied. Keep it private and every claim about it is unfalsifiable — a screenshot, a spreadsheet, a story. Sealed removes the choice.
Five parameters, sealed at registration.
The ring is all anyone can ever read of them.
This is a strategy.
Five parameters, sealed inside a trusted execution environment the moment it was registered. The values on the right are not hidden behind a login, and they are not redacted for the demo.
They are handles: 32-byte pointers to ciphertext held inside the enclave. Reading one needs an ACL grant that nobody on this page has, and the contracts that trade on them cannot read them either.
Hover any row for what a handle is — and what it is not.
Lisbon MomentumThis is all anyone can ever see. A handle is a 32-byte pointer to a ciphertext held inside the TEE — not the value, and not an encrypted form of it you could attack offline. Reading it needs an ACL grant that nobody here has.
0x0000aa36a723013e1968087f0566628c25cdfc39c4da1d3265610c2eee3bce7f
This is all anyone can ever see. A handle is a 32-byte pointer to a ciphertext held inside the TEE — not the value, and not an encrypted form of it you could attack offline. Reading it needs an ACL grant that nobody here has.
0x0000aa36a743018d043cacea3a2702f8e3a863d0b7a7b782c17d6f939ba981f1
This is all anyone can ever see. A handle is a 32-byte pointer to a ciphertext held inside the TEE — not the value, and not an encrypted form of it you could attack offline. Reading it needs an ACL grant that nobody here has.
0x0000aa36a743017d30cd15431a83935e7271537caa9c912a5d3becef567af754
This is all anyone can ever see. A handle is a 32-byte pointer to a ciphertext held inside the TEE — not the value, and not an encrypted form of it you could attack offline. Reading it needs an ACL grant that nobody here has.
0x0000aa36a7230101857da8da44e91f378d12cd070b60b1c15e36fd7d7edce99e
This is all anyone can ever see. A handle is a 32-byte pointer to a ciphertext held inside the TEE — not the value, and not an encrypted form of it you could attack offline. Reading it needs an ACL grant that nobody here has.
0x0000aa36a74301151faa9d2e2ce7f0d0113f6e48df3c010862c7bd3f17f990c2
Nobody has ever seen those five numbers — not the allocators, not us, not whoever runs the keeper. There is no updateParams function on any contract in this system, and a test enumerates every compiled ABI to prove it.
And this is what it did.
Real capital, real Uniswap v3, recorded on chain against the commitment those parameters were sealed under. Not a backtest. Not a selected sample.
How the trade stays private after it happens
Sealing the parameters is not enough on its own. A swap on Uniswap has a publicly visible size, and a strategy whose every trade is visible is one you can reverse-engineer without ever reading a parameter.
So opposing intents are summed in encrypted space and only the residual reaches the market. One strategy wants to buy, another wants to sell, and the two fill against each other inside the pool at a single clearing price. An observer sees one small swap and cannot recover either side from it.
That boundary is exactly one contract, it is named CrossingRouter, and a test asserts nothing else in the repository can cross it. Watch an epoch cross →
Shape taken from the reference run. On the live deployment each strategy’s intent exists only as a handle, and drawing a guess at one here would be the single dishonest picture on this site.
And it is asynchronous, which the interface never hides
A TEE computation is not a function call. The transaction returns before the value exists, and every screen in this app says so rather than pretending otherwise.
The part everyone else gets wrong
“Unfakeable” holds for a single record and falls apart across a set.
That is the split-mailing scam with better cryptography, and any design that only makes individual records unfakeable is wide open to it. Sealed binds every strategy to its author at registration and exposes strategiesOf(author) — every strategy they ever registered, active, abandoned, retired and losing. There is no deregistration path anywhere in the ABI.
Three alive, forty-seven dead. A strategy from an author with 47 dead siblings is labelled as such, automatically, next to its curve. Performance and selection are both unfakeable.
What this does not hide
Every confidentiality claim on this site has an edge. Here is exactly where it is.
- Strategy parameters
- Per-strategy direction and size within an epoch
- Per-allocator deposits and positions
- Which strategies traded at all, and how many
- The aggregate residual swap on Uniswap
- Each strategy’s NAV history, quantized to 25 bps and lagged one epoch
- Who registered what, and when
- Every performance fee, before you commit capital
The NAV series is quantized and lagged because an exact one would give the whole thing back: NAV against a public price series solves for inventory, and inventory differences are the trades. Rounding is deterministic and on chain, so a third party still reproduces the record exactly. That tension is real, and this is the honest engineering answer to it — not a claim that it does not exist.
Try it with an empty wallet
One click for test USDC, one to deposit, one to watch an epoch cross. Or read the whole thing without connecting anything at all.