● Deployed · devnet
Dark Percolator
Sealed intents, batch-crossed at the mark inside a Private Ephemeral Rollup. Hedge hints for Phoenix come out the other side.
The deploy · 2026-11-11
Written to devnet,
verified byte by byte.
One of the first private perps engines built on a Solana Private Ephemeral Rollup. It's an upgradeable program on the BPF loader, not finalized, so it can still evolve.
ELF sha256
fd973918ee9dbd57ab428d5bd1d4b9c6a76f6add191a69df28cf9fae1fa3627a
ELF size
549,320 bytes · BPF upgradeable loader
Deployed at slot
521,233,282
Upgrade authority
ProgramData
Cluster
https://api.devnet.solana.com
55 / 55TypeScript tests pass, plus cargo tests and typecheck
32 bytesProgram id found raw inside the ELF before deploy
1 id
declare_id!, IDL address and TS ABI all match the keypairno --finalPlaceholder build rejected and the program left upgradeable
The engine
Public aggregates.
Private everything else.
Per-trader positions, collateral and intents live in a Private Ephemeral Rollup. Only the trader, the market keeper and up to two auditors the trader names can read them. A no_std Rust risk core (hybrid fee, EWMA mark, mark envelope, margin, liquidation, sealed batch cross) is mirrored bit-for-bit in TypeScript.
Base layer · Solana
Markets, vaults, deposits and delegation.
initMarketfundopenPortfoliodepositwithdrawdelegateMarketdelegatePortfolioPrivate rollup · Intel TDX
Privacy, marks, intents, crossing and commits.
initPermissionsetPrivacypushMarksubmitIntentcancelIntentcrossBatchliquidatecommitMarketundelegatePortfolioundelegateMarketBase
init_market creates the market, a lamport vault and a hedge ticket. Traders open a portfolio, deposit and delegate it to the market's TEE validator.
Rollup
set_privacy seals the portfolio. Trader, keeper and named auditors are the only readers.
Rollup
The oracle pushes the mark. When the Pyth legs go stale, an EWMA drifts toward the indicative price and the fee charges for the drift.
Rollup
submit_intent is refused unless the portfolio is private. It stores the intent and its SHA-256 commitment.
Rollup
cross_batch fills up to 16 portfolios at the mark. Buys cross sells, the pool absorbs the imbalance up to its cap and the heavy side fills pro rata. Margin is checked before any intent enters.
Rollup → Base
commit_market schedules record_hedge, which writes pool inventory to the hedge ticket. An operator reads it and places the offsetting Phoenix order.
The dark suite
One is live.
The rest are still in the dark.
Dark Percolator is the only piece deployed. Dark x402, Dark Swaps, Dark Pools and Dark Perps are concepts on the roadmap. Nothing about them is built or deployed yet.
Concept · roadmap
Dark x402
HTTP 402 payments for agents, where the payer, the amount and the endpoint stay sealed and only settlement comes back out.
Concept · roadmap
Dark Swaps
Swap intents matched inside the enclave, so the order isn't visible to anyone before it fills.
Concept · roadmap
Dark Pools
Deep, still liquidity where size rests without being seen, crossed at the mark in batches.
Concept · roadmap
Dark Perps
The Dark Percolator core grown into a full venue with more markets, LP shares for the pool and keepers that can be swapped out.
Honest edges
What it is not, yet.
UnauditedExperimental code. Don't treat it as safe for real funds.
Devnet onlyNo mainnet deploy. Devnet SOL only, with no returns of any kind.
Trusted oracleThe mark is pushed by an oracle key inside the rollup and bounded per slot. It is not a direct Pyth read.
Phoenix is publicHedge orders, fills and vault balances on Phoenix stay visible on-chain.
TEE trustPrivacy rests on Intel TDX operated by MagicBlock, including its ingress checks.
One keeperA single keeper runs batches, liquidations and commits, so a stalled keeper stalls the market.
Status
Program live. First market not created yet.
Next: authenticate to MagicBlock's devnet PER, measure real rollup slot timing, then call init_market with timing parameters based on that measurement.