AZENYX

ARCHITECTURE

How AZENYX Works

Components and data flow

  1. Client: note selection, encrypted order payload, zero-knowledge eligibility proof
  2. ↓ Matcher intake: proof + public inputs + opaque encrypted payload
  3. ↓ Chain snapshot: all admission reads pinned to one block, then canonicality check
  4. ↓ Durable admission + prover outbox record (single atomic database commit)
  5. ↓ Private prover hand-off (private network only)
  6. ↓ Private opening boundary: exact-epoch key, integrity checks, OPENED
  7. ↓ Settlement lifecycle on-chain

Custody and notes

Funds deposited into the pool become shielded notes. A note is represented on-chain only by a commitment in an append-only Merkle tree; spending a note publishes a nullifier that prevents it from being spent twice. Opening an order moves a note into escrow, and every escrow ends in exactly one terminal path: settlement, cancel-reclaim, expiry-reclaim or emergency exit.

What the matcher handles

  • The eligibility proof and its public inputs, which include the public matching terms of the order (market, side, size, limit price, minimum fill, expiry) and the order tag.
  • An opaque encrypted payload that it cannot decrypt and forwards unchanged.
  • Admission metadata and delivery status.

The matcher does not receive the decrypted private section of an order, epoch secret keys or private witnesses. Decryption of the protected section happens only inside the private prover boundary.

Durable admission and prover hand-off

  • Admission and the prover hand-off record are written in one atomic commit: either both exist or neither does.
  • The stable identity of an admitted order is its orderTag; a repeated submission of the same order is rejected as a duplicate.
  • Delivery to the prover is at-least-once with retry: transient failures (prover or network unavailable, lost responses) keep the admission and retry with the same orderTag.
  • Deterministic prover rejections (for example a missing epoch key or a key mismatch) are terminal and are not retried.
  • A successful opening moves the hand-off to OPENED.

Delivery is not exactly-once at the network level; correctness relies on the stable order identity and idempotent handling, not on the network.