Privacy claims are cheap. This page lists, per party, what kn:ll reveals and when. If you find a bit missing from the list, that is a bug, and we would like to know.
| PARTY | LEARNS | NEVER LEARNS |
|---|---|---|
| chain observer | a commitment hash exists; a fill of size S at price P happened in round R (one round late) | who committed, which commitments filled, side of any order, size of any unfilled order |
| your counterparty | they were filled S at P | who you are, your total size, your band |
| committee member (one) | an encrypted share of each reveal | any order's contents, alone |
| committee (quorum) | the set of revealed orders for one round, inside the enclave-less MPC | nothing after the round; unfilled orders are discarded, never output |
| kn:ll (the venue) | the same as a chain observer | everything else — there is no privileged view |
| reference price source | nothing about the pool | — |
| MOMENT | PUBLIC | SEALED |
|---|---|---|
| you commit | a hash, your escrow amount (upper bound on size) | side, size, band, salt |
| round closes | reference mid for the round | all orders |
| cross computed | proof of correct cross, list of fill amounts | which commitment each fill belongs to (revealed only to the filled party) |
| settlement | escrow movements, aggregated | per-order mapping |
| one round later | the toll: each fill's size and price | unfilled orders — forever |
Escrow amount. To commit you escrow funds; the escrow is an upper bound on your size and is visible. Mitigation: over-escrow, or commit from a pooled contract. We are working on shielded escrow.
Timing. A commitment's block time is public. Batching rounds blunts this; it does not erase it.
Fill inference. If a round tolls exactly one fill and you were the only new commitment, an observer can guess. Rounds with fewer than a minimum number of commitments do not cross.
Your own RPC. The node you submit through sees your address and your commitment together. Use a relayer.