Moby Market is the open-source Solana infrastructure for executing nine and ten-figure orders without front-running, slippage, or strategy leakage. OTC matching, TWAP/VWAP execution, zero-knowledge privacy pools, and intent-based solvers — all in audit-ready Rust.
// 100M SOL unwind, 48h window, anti-detection on let order = TWAPOrder { trader, token_in: SOL, token_out: USDC, total_amount: 100_000_000, time_window: 48 * 3600, num_splits: 288, randomness_factor: 42, price_deviation_limit: 25, min_output_per_interval: _, }; submit_intent(order).await?; // → 0.08% realised slippage // → routed across 12 venues // → zero observable pattern
Every feature exists because retail-grade DeFi loses money for whales. Each one is a real Rust crate in the workspace, not a marketing bullet.
On-chain escrow accounts let two desks settle nine-figure trades atomically without trusting a centralised matcher and without surrendering custody the way a CEX OTC desk demands. Partial fills, dark-pool mode, and RFQ flows are all native primitives — not bolt-ons. This is how a tokenized-RWA issuer or institution moves a block without printing it to the public price.
Execution algorithms slice parent orders into hundreds of randomised child orders timed against natural market volume. A tunable randomness factor (0–100) defeats pattern detection by adversarial bots.
Pedersen-committed amounts, stealth addresses, and a choice of Groth16, PLONK, STARKs, or Bulletproofs. Strategy stays private from competitors while compliance stays provable to auditors via selective disclosure — the exact combination a tokenized-RWA issuer or regulated fund needs to trade on-chain without doxxing positions.
Post a constrained trading intent — say what you want, not how to route it — and a network of solvers competes via commit-reveal to execute it. On-chain reputation rewards solvers who fill at the tightest price with the least leakage. This is the intent-native, atomically-composable execution model institutional flow is converging on in 2026.
Liquidity is aggregated across Serum, Raydium, Orca, Phoenix, Lifinity, and custom AMMs. Up to four-hop routes and dynamic split execution adapt mid-flight to liquidity shifts.
CrossChainOrder primitives integrate Wormhole and LayerZero so a single order can settle across Solana, Ethereum, Arbitrum, and Base with target sub-five-minute finality. Today the bridge primitives live inside moby-trading; they graduate to their own crate before mainnet.
Anchor 0.29 on solana-program 1.16, with release builds enforcing overflow checks, LTO, and single-codegen-unit determinism. Critical paths target formal verification rather than bug bounties alone.
The Cargo workspace is intentionally small. Each crate owns one concern; the controller orchestrates.
Shared structs — TradingIntent, OTCEscrow, TWAPOrder, VWAPOrder, PrivateTransaction.
Fixed-point arithmetic, big-int helpers, Pedersen commitments. Built on rust_decimal and num-bigint.
Pyth / Switchboard / Chainlink aggregation with TWAP staleness checks.
TWAP, VWAP, intent processing, smart routing across Serum, Raydium, Orca, Phoenix, Lifinity. Hosts the cross-chain primitives (Wormhole, LayerZero) until they break out into their own crate.
Groth16 / PLONK / STARKs / Bulletproofs verification, Pedersen commitments, stealth addresses, and confidential-transfer plumbing.
Honest summaries of the venues whales already use. Each card links to a detailed comparison.
Hashflow streams bilateral quotes from market makers to retail and pro traders across EVM chains. It is the closest analogue to Moby Market on the RFQ axis but stops short of native algos, privacy pools, and Solana settlement.
CoW pioneered the solver-competition model on Ethereum. Moby Market shares that DNA and extends it to Solana with privacy pools, explicit RFQ, and execution-algorithm intent types beyond best-of-N pricing.
Paradex is a Starknet-native perpetuals venue with a privacy story. Moby Market focuses on spot and cross-asset OTC for whale unwinds, with execution algos rather than a fully matched orderbook.
Renegade uses multi-party computation to hide orders pre-trade. Moby Market trades MPC for zero-knowledge proofs, runs on Solana, and adds RFQ, TWAP/VWAP, and cross-chain settlement as first-class features.
Jupiter is the dominant Solana swap aggregator for retail flow. Moby Market complements Jupiter at sub-million sizes but is built for orders where slippage, MEV, and strategy leakage make naive aggregation unusable.
Long-form pieces written by the team and the contributor network.
Three years after the institutional-DeFi narrative started, what actually got built, what stalled, and where the surviving infrastructure is converging. An industry view from the people writing the Rust.
Walk through a realistic large-position unwind on Solana from intake to settlement — RFQ check, TWAP scheduling, privacy mode, route splitting, and post-trade reporting — using the actual primitives in the moby-market workspace.
Both protocols offer request-for-quote at institutional sizes — but only one is built around RFQ alone. A look at where the EVM-first quote-streaming model wins, and where a Solana-native execution stack with privacy and algos pulls ahead.
If yours isn't here, open an issue or reach out — answers get folded back into the docs.
Yes. The full Rust workspace — including the OTC, execution, privacy, oracle, and trading crates — is MIT-licensed and lives at github.com/cryptuon/mobymarket. The on-chain programs and the off-chain Rust services are both auditable.
The reference implementation targets Solana via Anchor 0.29 and solana-program 1.16. Cross-chain order primitives (CrossChainOrder) integrate Wormhole and LayerZero so settlement can extend to Ethereum, Arbitrum, and Base.
Three mechanisms. TWAP/VWAP shred the parent order into hundreds of timing-randomised children. Smart routing splits across Serum, Raydium, Orca, Phoenix, and Lifinity. The OTC marketplace lets the entire block clear bilaterally without ever touching a public pool.
Solver submissions use a commit-reveal scheme, intent payloads can be routed through private mempools, and stealth-mode orders are mixed with other traders so that observers see noise rather than a coherent strategy.
Amounts are hidden by Pedersen commitments. Sender and receiver addresses are masked by stealth addresses on both sides. Privacy pools enforce a minimum anonymity set (default 100) and a configurable withdrawal delay so timing analysis fails.
Yes. The compliance module supports selective disclosure: a trader can prove accreditation, jurisdiction, or KYC status without revealing identity or strategy. Auditors get a verifiable trail; competitors get nothing.
The protocol is free to use at the smart-contract level. The Rust workspace is MIT-licensed, so self-hosted deployments cost only Solana network fees. There is no protocol fee captured by the project itself; market makers and solvers price their own spread directly into RFQ and intent fills.
Solvers stake collateral, build on-chain reputation across executed intents, and compete in commit-reveal auctions. Poor performance and griefing burn reputation; the design intentionally rewards correctness, not scale.
Tokenizing an asset — a treasury bill, a credit tranche, a balance-sheet position — is now well-understood. The unsolved problem is trading in and out of those positions at size without market impact or information leakage. A public AMM broadcasts every order and moves the reference price; a CEX OTC desk reintroduces custody and counterparty trust. Moby Market is the execution leg in between: OTC block clearing and TWAP/VWAP shredding keep size off the public price, while ZK privacy keeps the rebalance confidential and selective disclosure keeps it auditable.
A CEX OTC desk solves market impact by taking the other side off-book, but you settle by trusting their custody, their solvency, and their discretion with your flow. Moby Market keeps the same impact protection — bilateral, block-sized clearing — but settlement is atomic and on-chain through trustless OTCEscrow accounts. You never surrender custody, and amounts and counterparties stay private via Pedersen commitments and stealth addresses rather than a desk that has seen your book.
The market is converging on intents: a trader declares what they want — size, tokens, constraints, privacy — and a competitive solver network figures out how to fill it. Moby Market is intent-native. A TradingIntent is a first-class on-chain object; solvers compete via commit-reveal with on-chain reputation, and OTC, TWAP, VWAP, and cross-chain settlement are all fill strategies a solver can reach for. That aligns the stack with intent-based, atomically-composable execution rather than fixed routing.
Not yet at real size — Moby Market is pre-mainnet. The design targets exactly this use case: selective disclosure lets a fund prove accreditation, jurisdiction, and KYC status to an auditor without revealing identity or strategy to competitors. Before real institutional or RWA flow settles on it, the production-viability gates in the roadmap must be met: independent security audits, liquidity and venue partnerships, ZK-proof performance inside Solana compute limits, solver reliability, compliance-control review with a regulated design partner, and production-grade monitoring.
The full picture lives across a handful of focused pages. Start wherever your question is.
The seven primitives in detail — OTC, TWAP/VWAP, ZK privacy, solvers, routing, cross-chain, and audit-ready Rust.
The architecture: a controller program plus five Rust crates, and the intent → route → solve → settle flow.
Treasury unwinds, OTC desks, privacy-sensitive funds, and cross-chain arbitrage — who Moby Market is built for.
Honest head-to-head breakdowns against Hashflow, CoW Protocol, Paradex, Renegade, and Jupiter.
Open source, which chain, beating slippage, MEV resistance, privacy, compliance, and cost — answered plainly.
Long-form engineering notes on whale execution, ZK privacy pools, TWAP/VWAP, and protocol comparisons.
The mission, the design principles, and the team behind the Rust workspace.
Read the Rust workspace, run it against devnet, and bring your size on-chain. The whole stack is MIT-licensed — pay zero to use it, pay only if you want our team in the room.