Your tokenized stock positions
are public. All of them.
Confide lets you hold them on Solana without publishing what you hold —
and still prove what you must, to whom you choose, when you choose.
The chain readings on this page are live, made in your browser. The mint list and the
proof transactions are files served with the page; everything they are used to ask is asked of
mainnet and devnet now.
GitHub ·
Apache-2.0 · nothing here needs a wallet or an API key
Walkthrough — click the frame, or
watch on YouTube
(youtu.be/KQsRwP8HTs0). Every terminal pane in it is the stdout of a command run
moments before the recording; two of them reach mainnet and devnet.
The privacy is already shipped. Nobody can use it.
All 1,869 tokenized stocks on Solana run on Token-2022 with confidential transfers
switched on. Every one of them leaves the auditor key empty — because the only key
on offer reads everyone's everything, forever, and no setting of that is correct for a regulated
issuer.
Read from mainnet, just now, by your browser. NVDAx and TSLAx are
Backed's; NVDA.US and AAPL.US are Backpack Securities'. Two issuers, arriving
independently at the same empty slot — that is the finding, and all 1,869 mints check the same
way (scripts/slot-scan.sh).
Meanwhile, anyone can read anyone.
Wallets that touched NVDAx in the last few transactions, and what they held
when it settled. These are the balances the transaction itself published, not a lookup of what
they hold now — which is the point: the number was public the moment it landed.
Try any address — yours, or one you know. The page reads its recent transactions.
Paste an address above.
The same position, under Confide.
A live account on devnet. The chain shows nothing. The position is there.
Its mint gates new accounts exactly as NVDAx does —
autoApproveNewAccounts: false — so the issuer had to sign before
this account could hold anything. On a real mint that signature is a conversation, not a
transaction, which is the one thing here that cannot be done without them.
A lender can check your collateral without seeing it.
A lender needs one bit: does the collateral cover the loan? Two proofs
answer it over the account's own on-chain ciphertext — equality binds a commitment we can open
to the account, then the range proof runs on the surplus. Press the button and Solana's ZK
program will check them, right now, from your browser.
And a lender can now take it. The three proofs a seizure needs are built
while the borrower cooperates, parked on chain under an authority they cannot close, and fired
later by a program that owns the escrow — no key reconstructed, no committee asked, the amount
never revealed. It runs on devnet: the
loan
account still reads seized.
The proofs were generated by scripts/prove-collateral.sh
over the account above; the verification you just triggered is live.
Last quarter's number cannot be tidied.
An LP is owed a position report every quarter. Today that number is written
afterwards, and nothing binds it to what was actually held on the reporting date. Confide seals
the position that day — over the account's own ciphertext above — and anchors a
32-byte commitment on chain. Forty-five days later a committee opens it. The holder is not
one of them, and a figure restated in the meantime does not open the commitment.
reading devnet…
Written by scripts/anchor-receipt.sh, opened by
scripts/committee.sh — five separate processes, and the holder's
exited in September. Nothing about the position is on chain: a hash and two dates.