Private positions on a real prediction market โ the official Gnosis Conditional Tokens market, byte-for-byte, with a confidential participation layer welded on by iExec Nox.
A transparent market can only price the truth people are willing to sign their name to. Everyone else self-censors โ and the market loses exactly the information it exists to collect.
A policy analyst is certain the consensus is wrong. A $10k on-chain bet against her employer's public position is a firing offense the second anyone links her wallet. So the market never learns what she knows.
| Wallet | Side | Size | Seen by |
|---|---|---|---|
| 0x71abโฆ9c | YES | $4,000 | everyone |
| 0x44deโฆ13 | YES | $6,000 | everyone |
| 0xa1c6โฆdana | NO | $10,000 | her boss, too |
| 0x9f3cโฆ22 | YES | $7,000 | everyone |
Prior privacy attempts rebuild the whole market from scratch โ and die without liquidity. Nobody trades where nobody trades.
Keep the real market untouched. Add a confidential layer: every bet is committed as two encrypted amounts โ a YES-stake and a NO-stake, one of them an encrypted zero. Direction never exists in plaintext, anywhere.
Bet what you know, not who you are.
The market knows the information โ someone dissented with size โ but not the informant. Aggregates decrypt. Individuals never do.
4 bettors, each two sealed handles. k = 4. Direction never plaintext.
Only sums decrypt: YES 1,700 / NO 500, routed through the real FPMM in one batch. NO resolves.
Dana's sealed NO 500 pays exactly the pot โ 1,626.1277 cUSD. Even her win stays hers to disclose.
| Nox primitive | What it does here | Without it you needโฆ |
|---|---|---|
| aggregation-only allowPublicDecryption | reveals epoch sums only (I2) | a threshold-decryption committee |
| dual encryptInput + fromExternal | direction-free (amtYes, amtNo) | โฆor a side-bit leaks in calldata |
| per-user ACL (allowThis / addViewer) | decrypt-your-own-position forever | a custodial account database |
| IERC-7984 pooled custody + operator-pull | nothing position-shaped in wallets | positions in wallets = the linkage |
| 2-step unwrap โ finalizeUnwrap | plaintext exits ONLY at the FPMM | a trust-me bridge |
| Nox.mul / div (ร public scalar) | public-rate confidential claims | leaked stakes at claim time |
| NoxOraclePool novel ยท source-verified โ | 0xfFba9520โฆ83d4a2E |
| ConditionalTokens 1.0.3 unmodified ยท bytecode hash โ | 0xCd316D06โฆ62eA734a5 |
| FPMM 1.8.1 instance unmodified ยท real market | 0xBf4900dfโฆBEEf4cc3 |
| cUSD wrapper ERC-7984 confidential USD | 0x82C281D7โฆ7468991 |
Privacy-market rivals rebuild the exchange and starve for liquidity. We add confidentiality to the official Gnosis CTF + FPMM, byte-for-byte โ the liquidity is already there.
Direction and size stay hidden through and after resolution โ not just until the reveal. Membership is public; what you believed and how much never is.
First Sepolia run reverted in executeEpoch (NotAllowed 0xb87a12a9): the token re-enters TDX under its own identity, so the pool must allowTransient the burn. A permissive mock hid it. Fixed, redeployed, re-ran green โ logged in feedback.md #16.