Know the price. Not the size.

DarkBook is a central limit order book for perpetual futures on Solana in which the quantity on an order is never published before it trades. An order carries the trader pubkey, the side, the price in ticks, the leverage, one of five declared size bands, and a SHA-256 commitment to the exact lot count. Anyone reading the book learns where you want to trade and a ceiling on how much. The quantity itself arrives at settlement, and the program checks it against the commitment that was published when the order was placed.

Matching does not run on the Solana base layer. The OrderBook account is delegated to a MagicBlock Ephemeral Rollup, where a permissionless crank calls match_orders against a price-time priority book and writes a Fill for each crossing pair. The rollup commits that state back to Solana. Settlement is a separate instruction, claim_fill: a settler supplies the salt, size and leverage for both legs, the program rehashes each one, compares it to that leg's commitment, bounds each revealed size by that leg's own declared ceiling, and opens a long position for the taker and a short for the maker.

The privacy is narrow and it has a price. Side, price, leverage, band and trader pubkey stay public for the whole life of the order, both legs' bands are published on every fill, and the position that opens at settlement carries the exact size. A simulation of 56 configurations put a number on what the hiding costs: a maker breaks even at a 1.991 bps half-spread on the live five-band schedule against 1.790 bps on a transparent book. The maker is calibrated to zero expected profit on both sides of that comparison, so the difference is paid by the taker crossing the spread.

Start here

Read in order if you want the mechanism before the economics. Jump straight to the cost page if you want the number that decides whether any of this is worth it.

The commitment

One hash carries the whole privacy claim. It is computed off-chain by the trader, published on the order, and recomputed by the program at cancel and at settlement.

// programs/darkbook/src/ix/orders.rs, compute_commitment
commitment = SHA-256(
    salt              // 32 bytes, held by the trader
 || size_lots         // u64, little endian, the sealed value
 || leverage_bps      // u16, little endian
 || trader_pubkey     // 32 bytes
)

Leverage sits both in the clear on the order and inside the hash, so a trader cannot swap leverage at reveal time. The band is not inside the hash. It does not need to be: the band lives on the fill, and the ceiling is checked against the revealed size at settlement.

Where the numbers come from

Every figure on these pages was read from one of these files. Where a page states a number it names the file inline, so a claim can be checked without trusting the page it appears on.

These pages are written in MDX. Correcting a sentence means editing the prose in src/app/docs, not rebuilding a component.