Signed and encrypted locally
EIP-712 orders bound to one chain, one contract and one epoch. Timelock encryption to the drand threshold network, which publishes a key every 3 seconds. The scheme is pluggable; Shutter was evaluated.
Confidential execution for onchain markets
Encrypt intent.
Verify execution.
Your order stays unreadable to everyone, Kasumi included, until its batch closes. Then it clears at one price that anyone can check.
Scroll to walk into the slab霞 kasumi, haze
This is your order, sealed.
Side, size, price and wallet are unreadable to everyone, the relay included, until its epoch closes.
One epoch, five states
- 01 / 05
Sealed
Your browser signs the order and encrypts it. The relay receives a ciphertext, its hash and a salted commitment.
Public: nothing about the order
Illustration: A blank white slab tied with an orange ribbon, floating in violet fog above the sea - 02 / 05
Committed
The epoch closes. The relay fixes the batch as a Merkle root before any key exists, so no order can be added later.
Public: order count and root
Illustration: A round vault door shut in a violet cliff, mist at its base - 03 / 05
Decrypted
The drand network publishes the round signature that opens every ciphertext in the batch at once.
Public: all orders in the batch
Illustration: A key made of white light cutting through fog over a canyon - 04 / 05
Matched
A deterministic auction finds the single price that trades the most volume, closest to the oracle.
Public: clearing price and result hash
Illustration: Brass scales standing level on a snowy plateau, a glowing cube in each pan - 05 / 05
Settled
The settlement contract re-checks every signature, limit and nonce, then moves tokens atomically.
Public: every transfer
Illustration: A sunlit plaza where rows of white slabs stand open like doors and two figures exchange a parcel
What Kasumi hides, and what it does not
Kasumi protects intent before the trade. It is not a mixer, a privacy coin or an anonymity tool, and it does not hide what settles.
Hidden until the epoch closes
- Buy or sell
- Which asset
- Size
- Limit price
- The wallet that signed
Hidden from the relay too. Encryption happens in your browser.
Not hidden
- Token transfers at settlement
- Every order in the batch, once the epoch is decrypted
- Wallet balances and history
- That an address uses Kasumi
Settlement is transparent on purpose. That is what makes execution verifiable.
How it is built
Four parts, each checkable without trusting the one before it.
Accountable, not trusted
Every accepted ciphertext gets a signed inclusion receipt. If the published root leaves your order out, the receipt is proof of censorship.
One price, no queue
A uniform-price batch auction in integer arithmetic. The Rust matcher and an independent TypeScript reference produce identical result hashes for every fixture.
The contract enforces
The matcher only proposes a price and fills. Signatures, limits, minimum fills, nonces, oracle bounds and batch membership are verified again onchain.
const client = new KasumiClient({ relayUrl });
const { markets } = await client.config();
const order = await client.buildOrder({
owner: account.address,
market: markets[0],
side: SIDE_BUY,
baseAmount: 120n * 10n ** 18n,
limitPrice: toProtocolPrice("332.60", 18, 6),
});
// Signed, then encrypted, in this process.
const sealed = await client.signAndSeal(order, (typedData) =>
account.signTypedData(typedData),
);
const receipt = await client.submit(sealed.envelope);
// After the epoch closes.
const check = await client.verifyInclusion(receipt);{
"protocolVersion": 1,
"scheme": 1,
"epochId": 48392,
"ciphertext": "0x2d2d2d2d2d424547…",
"ciphertextHash": "0x9f3a…c21e",
"orderCommitment": "0x5be1…90d7"
}No ticker, side, size, price or wallet. The relay rejects any envelope that carries an extra field.
Where it stands
- Terminal
- Signing, encryption, commitments, receipts and matching are the real protocol in every mode. The terminal states at the top whether it is settling paper balances or real tokens.
- Prices
- Chainlink reference prices for Stock Tokens, read from Robinhood Chain.
- Contracts
- Tested, including fuzz tests, and reviewed internally. Not audited by a third party. Read the security review before relying on them.
