Architecture

Four parts: the fund program, the share mint, the Arcium circuits, and the web relay. Only the first two hold value.

flowchart LR
  H[Holder wallet] -- deposit USDC --> P[Fund program]
  P -- mint shares, then confidential Deposit --> M[Share mint, Token-2022]
  K[Anyone] -- request_decision --> P
  P -- queue decide with sealed rules --> A[Arcium cluster]
  A -- decide_callback, BLS signed --> P
  K -- execute with an Orca or Jupiter route --> P
  P -- swap sell vault to buy vault --> R[Orca or Jupiter]
  H -- withdraw from confidential, then redeem --> P
  P -- same fraction of every vault --> H

The fund program

An Anchor program. Its accounts and seeds:

Seeds pin one of each: one fund, one vault per asset, one order. initialize_fund requires the program's upgrade authority.

The callback from Arcium runs as a CPI at stack height 2, so a swap inside it could hit Solana's call depth limit. The callback therefore never trades: it writes the order, and a separate top-level execute, callable by anyone, carries it out under the bands. Band enforcement never depends on Arcium; a bad order is simply never executed.

The share mint

A fresh Token-2022 mint with only the confidential transfer extension: auto-approve on, no auditor key, no authority, so nobody can ever add an auditor. Decimals 6. deposit mints shares and moves them into the depositor's pending confidential balance in the same instruction. A transfer between holders is a standard confidential transfer done by the holder's wallet; the program never touches a proof.

The Arcium circuits

Arcium is a multi-party computation network on Solana. Two Arcis circuits:

• set_rules: the author submits target weights and a band encrypted with a key shared with the cluster; the nodes re-encrypt it for the cluster only and the callback stores it in PendingRules.
• decide: reads the sealed rules straight from the Rules account plus the eight public vault values, and reveals only the order: which asset to sell, which to buy, the gap in basis points, and whether the band was crossed.

Mainnet today (read from chain on 2026-10-29): cluster offset 10000 with three nodes, permissioned by its cluster authority. The protocol is dishonest-majority with abort, so the rules stay sealed as long as one node is honest, and a faulty node aborts the computation rather than producing a wrong order. Computation fees are paid in SOL.

Blackthorn, Arcium's encrypted AI inference, is not open yet. Until it is, the manager is the encrypted rule set above: weights and thresholds hidden, logic public.

Prices

The program values USDC, SOL, cbBTC and JitoSOL with Pyth push feeds through the Pyth receiver, checking the account address, owner, feed id and full verification, a maximum age of 120 s and a maximum confidence of 1%.

NVDAx, SPYx, TSLAx and XAUt0 are valued with Kamino Scope, the price account Kamino's lending markets read: one slot each (332, 344, 338 and 167), the same slot Kamino's own reserve for that token uses. The program checks the account address, owner, slot and age (120 s). Scope's xStock prices are per token unit as held, so dividends, which xStocks pay by raising a balance multiplier, are already in the price.

The web relay

/api/prices relays Jupiter's price API (falling back to CoinGecko, then to the last good reading) for the landing page; the program never uses it. /api/rpc relays Solana JSON-RPC for the app. Neither signs anything.