A controller program plus five specialised crates.
The Cargo workspace is intentionally small. Each crate owns exactly one concern; the controller orchestrates them into a single execution surface for orders too large for retail-grade tooling.
A trader posts a constrained TradingIntent — size, tokens, time window, price-deviation limit, privacy and randomness settings.
The controller either matches the block bilaterally through on-chain OTCEscrow, or slices it into randomised TWAP/VWAP children routed across Solana DEXs.
Where an intent is open, solvers compete via commit-reveal; on-chain reputation rewards the tightest, lowest-leakage fill.
Amounts are Pedersen-committed and counterparties masked by stealth addresses; a selective-disclosure proof keeps compliance provable.
CrossChainOrder settles across Solana, Ethereum, Arbitrum, and Base via Wormhole / LayerZero when the order spans chains.
The crates
Shared structs — TradingIntent, OTCEscrow, TWAPOrder, VWAPOrder, PrivateTransaction. The vocabulary every other crate speaks.
Fixed-point arithmetic, big-int helpers, and Pedersen commitments. Built on rust_decimal and num-bigint for deterministic pricing math.
Pyth / Switchboard / Chainlink aggregation with TWAP staleness checks, so routing and settlement price against fresh, cross-checked marks.
TWAP, VWAP, intent processing, and smart routing across Serum, Raydium, Orca, Phoenix, and Lifinity. Hosts the cross-chain primitives (Wormhole, LayerZero) until they break out into their own crate.
Groth16 / PLONK / STARKs / Bulletproofs verification, Pedersen commitments, stealth addresses, and confidential-transfer plumbing.
Everything ships as Anchor 0.29 on solana-program 1.16, with release builds enforcing overflow checks, LTO, and single-codegen-unit determinism. Critical paths target formal verification rather than relying on bug bounties alone.
Read the workspace.
The whole stack is MIT-licensed. Clone it, run it against devnet, and bring your size on-chain.