On Privacy-Native Prediction Markets: Architecture Notes

Price Discovery Demands Two Kinds of Light

Prediction markets live at the intersection of two incompatible instincts. Transparency — open ledgers yield accountability. Tactical opacity — price discovery is adversarial and information has half-life. Traders who reveal intent too early donate alpha to the fastest copycat in the room.

VEIL's thesis: privacy during formation, transparency at resolution. The engineering question is whether you can deliver that as a chain property — not duct-taped at the app edge — without denting liveness, fairness, or cost.

Why a Custom VM

A prediction market needs three levers under its own control: mempool semantics (sealed vs. cleartext, ordering, admission), execution semantics (batch cadence, clearing rules, market maker invariants), and economic routing (how fees feed depth, security, operations and privacy). A dedicated Avalanche L1 with HyperSDK gives all three.

Sealed Order Flow

Local gossip is VTG2: Shamir-split data keys, X25519-wrapped shares, t=2 of n=3 on the current node. One committee key cannot decrypt the wire. Order bodies are VEILENC1. A solo node still accepts plaintext SubmitTx from the order-router. Production 13-of-20 is not this network.

Batch Auctions

Continuous matching rewards latency. Batch auctions flip the bias: trade in sealed windows, clear once at a uniform price. Path dependence disappears; speed is less valuable; correct sizing and pricing wins.

Shielded Ledger

Gossip hides pending tx bytes from a single key. The groth16 statement binds commitment, nullifier, and state-root slots as public digest fields. That is not yet a note ledger with in-circuit inclusion proofs or viewing keys.

Chain-Owned Liquidity as Native Mixer

Protocol-owned liquidity adds a third privacy layer by mixing value flows at the liquidity layer. Because the protocol itself owns and operates core liquidity conduits, every epoch routes many independent streams through a pooled balance sheet, creating plausible unlinkability even when some interactions touch public rails.

Current Status

These are design principles plus a local runtime: proof-gated clears, VTG2 2-of-3 gossip, native VAI/AMM/COL, companion intent rails on anvil. Feb “GO FOR PRODUCTION” is not current launch authority. Local ≠ Fuji ≠ mainnet.