This page separates what the Blacksite contract enforces from what it does not. If something is not on the first list, do not assume it.
Guaranteed by the code
- Sealed during commit. While a batch takes orders, the chain holds only your commitment hash and a fixed 1 USDG bond. Market, side, size and limit are not on-chain.
- One price per batch. Every crossed order in a batch fills at the same midpoint, read from the market's Uniswap V4 pool in the settlement block.
- Your limit holds. A buy never fills above its limit, a sell never below.
- No fill at a moved price. If the settlement midpoint is further from the batch's sampled average than the market's guard, the batch is voided and every order is returned.
- No fill at a stale price. A batch not settled within 26 blocks of its reveal window is voided.
- Unfilled size comes back. Whatever does not cross is returned to your free vault balance in the settlement call.
- Free balance is withdrawable. No phase, pause or owner action can stop the withdrawal of a balance not locked in an open order.
- Solvency. Settlement rounds every division toward the venue and asserts that it pays out no more than it takes in.
- Fee ceiling and delay. The fee can never exceed 0.50 %, and a change waits 48 hours.
Not guaranteed
- Privacy after reveal. A revealed order is public for up to 5 blocks of the reveal window plus the time until settlement.
- Privacy of balances. Deposits and withdrawals are ordinary token transfers. Someone who watches your vault balance can guess at your intent.
- That you are trading. A commitment is visible, so the fact that an address is about to trade is public.
- A fill. Blacksite has no liquidity of its own. Size only crosses if the other side is in the same batch.
- The listing venue price. Fills are at the on-chain pool midpoint, which can differ from Nasdaq or NYSE.
- The stock tokens themselves. Their issuer can pause them or block an address. See Risks.
