A sealed-bid OTC block-trading desk, native on Canton. A rival dealer never receives your quote — the ledger doesn't transmit it. Losing bids are archived, never revealed. Settlement is atomic Vickrey delivery-versus-payment. Privacy is the ledger model, not cryptography bolted on.
Dealer A's ask sits in Dealer A's session. Dealer B has the same request open and an empty price column — not hidden by the interface, never delivered to its node. There is nothing there to decrypt, and nothing to leak.
On Canton, "dealer B cannot see dealer A's quote" is not a cryptographic achievement — it is a signatory/observer declaration. No ZK, no FHE, no TEE.
Buyer invites a dealer panel. The market never sees the RFQ; it carries no price.
Each dealer answers with a sealed quote and locks the asset in escrow. Rivals never receive it — physically, not by policy.
Cheapest ask wins, paid the second-cheapest price. Cash→dealer and asset→buyer settle in one atomic DvP transaction.
A regulator observes executed trades — and only executed trades. The pre-trade flow stays dark.
Counted off the ledger, not off a deck. The desk you can open reads the same validator live, so these move when the ledger does.
The cash leg moves through registries this desk neither controls nor can mint into — Canton Coin through the DSO-run registry, CBTC through BitSafe's. cETH is the same code path with one field changed. The trading history was seeded by me to exercise the flows; it is not customer volume, and the page will not pretend otherwise.
I build this alone. It took third place at HackCanton Season 2, and what it needs next is not another feature — it is one desk willing to put real enquiries through it and tell me where it breaks.
If you already run a Canton validator, joining is a party allocation and a DAR vetting. No vendor onboarding, no procurement queue, nothing leaving your node, and nothing anywhere near mainnet.
Your axe invisible to competing dealers. Escrow on quote, so nobody is left carrying a counterparty who changed their mind. Atomic delivery-versus-payment against a real registry asset instead of transfer-then-hope. And a second-price rail where quoting honestly is the move that wins.
A short review, and permission to be told this is wrong. The kill criteria are written down in advance — the numbers at which I stop rather than talk myself into another quarter.
A request opened, a dealer's sealed quote, the rival's own session without it, then the privacy verifier and the settlement rails. Screen recording against a live ledger, narrated.
Prefer the longer walkthrough? The four-minute demo covers the same flow at a slower pace.
A Quote has no other observers, so competing dealers and the regulator never receive it. Verified live: a dealer's own node only ever holds its own quote.
The winner is paid the runner-up's price, so dealers quote their true reserve without shading. On a transparent chain this needs ZK or FHE — here it is ~40 lines of Daml.
Cash to the dealer and the escrowed asset to the buyer move in one transaction; any failure rolls the whole exercise back. No half-settled trade.
The asset is locked in escrow the moment a dealer quotes and can't be pulled back mid-auction. Issuer binding rejects counterfeit legs.
A "Verify privacy" view counts what each party's node actually holds — each dealer sees only its own quote, the regulator nothing pre-trade. Not UI filtering; the ledger never transmits it.
Reveal one sealed quote to a named auditor on demand — for a best-execution audit or a dispute — without ever making it public or telling rivals. Canton's real superpower.
No public order book, yet the regulator proves it: from the sealed asks the counterparties disclose to it, the desk confirms the buyer beat every competitor. 16 green attestations live on Devnet, across all three rails.
Run a competitive second-price auction, hit one dealer directly at its ask, or fill part of a lot — all on the same sealed, atomic-DvP rails.
Multi-instrument baskets settle every leg atomically. Treasuries, Gilts, Bunds, OATs, JGBs, corporates and EM sovereigns — real assets, real settlement.
The same sealed-bid OTC thesis costs a different amount of cryptography depending on where you build it. This is what a confidential RFQ desk has to bolt on, chain by chain.
A rival dealer's quote is not hidden from the screen. Its participant node never received the contract, so there is nothing to decrypt and nothing to leak — and no proving system to audit, benchmark or keep up to date.