Your order rests where nobody can read it.
Not other traders, not solvers, not us. Orders are sealed to an enclave, and even a compromised one can't fill you worse than the limit you signed.
Live on NEAR mainnet · batch 2 crossed at mid 3.73253 · both legs in 1 txMeasured Nov 9 on the live 1Click route · selling 150k NEAR: 102 bps · 200k NEAR: no liquidity
How a block crosses
Four steps, once per batch. No server ever holds your order, your keys or your funds: the pool contract stores ciphertext, the enclave matches, and the NEAR Intents verifier settles.
- 1
Seal
Split the block into lots and sign each one at your limit. The order is encrypted to the enclave's key and padded to a fixed size, so a 10 NEAR order and a 50k one look the same.
- 2
Batch
Anyone can crank
run_batch(). The pool hands every sealed order to the matcher inside an Intel TDX enclave, in one request. - 3
Cross at the mid
The enclave checks two 1Click quotes signed with ed25519 and takes their midpoint. Every compatible lot crosses at that one price, for both sides alike.
- 4
Settle
Both legs settle in one
execute_intentscall. The gap between each limit and the mid, less the venue fee, goes back to both sides in that same call.
Prices in the scenes are from batch 2 on NEAR mainnet, Nov 11. Tile positions are illustrative.
Worst case: your own limit.
Each lot is signed at its limit, and the verifier applies signed amounts exactly. Whatever the matcher does, no lot can settle at a worse price than the one you signed.
The route vs the book
On Nov 9, selling 150k NEAR through the public NEAR Intents route cost 102 bps, about $5.4k. At 200k the route answered “No liquidity available”. Blindbook crosses at the mid, within 5 bps, when the other side is in the batch.
| Side | Size (NEAR) | Cost (bps) | Cost (USD) |
|---|---|---|---|
| sell | 10 | 31.09 | 0.11 |
| sell | 100 | 25.96 | 0.92 |
| sell | 1,000 | 20.13 | 7.13 |
| sell | 10,000 | 31.22 | 110.64 |
| sell | 50,000 | 49.31 | 873.71 |
| sell | 100,000 | 76.39 | 2707.07 |
| sell | 150,000 | 101.76 | 5409.18 |
| sell | 200,000 | No liquidity available | |
| sell | 250,000 | No liquidity available | |
| sell | 500,000 | No liquidity available | |
| buy | 10 | 40.94 | 0.15 |
| buy | 100 | 50.74 | 1.80 |
| buy | 1,000 | 37.45 | 13.27 |
| buy | 10,000 | 66.41 | 235.34 |
| buy | 50,000 | 78.80 | 1396.24 |
| buy | 100,000 | 100.78 | 3571.39 |
| buy | 150,000 | No liquidity available | |
| buy | 200,000 | No liquidity available | |
| buy | 250,000 | No liquidity available | |
| buy | 500,000 | No liquidity available | |
| either, on Blindbook | any, when the other side is in the batch | at most 5 from the mid |
Measured Nov 9, 1Click dry quotes (14:33 UTC, wNEAR/USDC, exact input, against a mid of 3.543747). Source: blindbook/results/baseline-2026-11-09.json. Blindbook's row is the mainnet fill in batch 2: mid − 5 bps for the seller, mid + 5 bps for the buyer.
Check it yourself
Batch 2 settled on NEAR mainnet on Nov 11. house.blindbook.near sold one 0.1 NEAR lot to demo.blindbook.near, and both legs settled in one call on intents.near. Every step left something you can open.
execute_intents call. Prices in USDC per NEAR, one 0.1 NEAR lot a side. The venue kept 0.000372 USDC.pnpm verify:batch 2 --tx 5HgpGzUbGPENVWwcf5kQNgWX2hMCTJSMqrjhGky4UFiZ --sender demo.blindbook.near --mainnetSeven checks, and every one should read PASS: the result signature, both legs in execute_intents, the signed 1Click quotes, the TDX attestation, the pinned build, the exact input and the venue key. It reads only public endpoints.
1Click quote signatures
The enclave fetched a bid and an ask quote, verified 1Click's ed25519 signatures, and wrote both digests into its signed result.
See them in the txGjzg5S…AbfD8ZwxNW…HPLZTDX attestation
OutLayer publishes the Intel TDX quote for every run, bound to the matcher's wasm hash and to the batch's input and output.
Open the attestationrequest 2983wasm 435b7863…7bc9Result signature, checked on chain
Before acting, the pool verified the matcher's signature against its pinned key with
env::ed25519_verify.
Seeresult 7bb20121…f0f0on_resultexecute_intentson the verifierThe sell, the buy and the venue's closure settled together on
intents.near. One call, all or nothing, improvement paid back inside it.
Open on nearblocks5HgpGz…UFiZSelf-cancel ticket
Sign the same nonce with no intents and send it to the verifier yourself. The venue isn't asked. Nobody cancelled in batch 2.
Read the ticket format"intents": []
Also on NEAR testnet: batch 9
Two lots a side of 1 NEAR each crossed at mid 3.61498 on Nov 9. The seller got 3.6132 against a limit of 3.5977. The buyer paid 3.6168 against 3.6339.
The free demo runs on testnet. The same code runs on mainnet, batch 2.
pnpm verify:batch 9 --tx 8Qa2X8buwY86ztwXvrSk6rBNRNV2hReQzEHe82MPgMUa --sender blindbook-crank-e4c061.testnet- Pool contracts
pool.blindbook.nearbatch 2 crossed one lot a sidepool.blindbook-dev.testnet23 batches run, 18 lots crossed- Matcher wasm, sha256
435b786312128aefc2a0a60ffa4d0232a22cfcf0ad31e492075519b909467bc9mainnet build · testnet a352985a…a980- Tests
- core 60, matcher 94, pool 46, SDK 11
- Engine fuzz
- 5,000 random books, 0 invariant violations
For agents and treasuries
Give your agent a mandate and seven tools. It prices the block against the public route, seals lots at its limit, watches them fill, and cancels without asking anyone.
blindbook_marketsMarkets, lot sizes and the contracts it settles throughno keyblindbook_route_costWhat the block would cost on the public route right nowno keyblindbook_batchesRecent batches: matched lots, volumes, the mid, settlementno keyblindbook_balanceYour balances inside the NEAR Intents verifierblindbook_place_orderSigns lots at your limit, seals them locally, submitsblindbook_order_statusLots still open versus filled or cancelledblindbook_cancel_orderCancel tickets straight to the verifier
{
"mcpServers": {
"blindbook": {
"command": "node",
"args": ["blindbook/packages/mcp/dist/index.js"],
"env": {
"BLINDBOOK_NETWORK": "testnet",
"BLINDBOOK_SECRET_KEY": "ed25519:…",
"BLINDBOOK_MAX_LOTS": "10"
}
}
}
}- Read-only tools work with no key at all.
- The agent's key never leaves this process. Orders are sealed locally before they're submitted.
BLINDBOOK_MAX_LOTSis a hard cap on every order.
Honest limits
What Blindbook doesn't hide, and who you still trust.
Settlement is public.
After a cross, both legs settle on intents.near, where anyone can read them. Before the cross nothing is public: resting orders, their sizes and their limits never leave the enclave.
Early liquidity is our own market maker.
Until outside flow arrives, a house market maker quotes the other side. It trades from a labelled house account, so you can see when you crossed with it.
You trust TDX hardware and OutLayer's operator.
A compromised enclave could leak what your order says. It still couldn't fill you worse than the limit you signed.
Live on mainnet, in small lots.
Mainnet lots are 0.1 NEAR. The first mainnet batch crossed one lot a side, with the house account on the other side. The free demo runs on testnet. The same code runs on mainnet, batch 2.