Private Ephemeral Rollup · Intel TDX

The dark pool
that lives onchain.

Limit orders encrypted inside a TDX enclave. Matched in TEE. Settled atomically on Solana.
Anti-MEV by construction.

Launch app How it works

SOL/USD—loading

Open0hidden orders

Vol 24h$00 fills

Latency<50msTEE settlement

Why Shadow Book

A trading venue built on what other DEXes leak.

Privacy

TDX-secured order book

Bids and asks live inside an Intel TDX enclave. Even the validator host can't read them. Only the match engine + owner can.

Performance

Sub-50ms execution

Match engine ticks every 500ms inside the PER. Settlement is atomic via SPL Token CPI. No batched epochs.

Fairness

Anti-MEV by construction

Searchers can't sandwich what they can't see. No public mempool, no resting book leak, no front-running surface.

Compliance

Onchain attestable

TEE produces TDX quotes you can verify. Permission Program enforces account-level ACLs. Range AML built in.

Composable

Settles to Solana

Fills commit back to L1. Public sees a swap. Other Solana apps can compose against the result, not the book.

Open

Built on MagicBlock PER

Uses the published Private Ephemeral Rollups SDK + Permission + Delegation programs. Source on GitHub.

Market

SOL/USDC

—

Last—

24h High—USD

24h Low—USD

24h Vol—USD

24h Range →

Market Cap—

ATH—

Network

—

Cluster—

Solana core—

Slot—

Block height—

RPC RTT—

TEE health—

TEE ValidatorMTEW…3xzo

Permission ProgramACLs…XQnp1

Delegation ProgramDELe…SaeSh

What leaks · what doesn't

live · last 6

Raydium · public

Sig + size + side + maker + timing — every datapoint indexed forever.

Shadow Book · TEE

Encrypted at rest in TDX. Only the engine + owner read price/size.

Architecture

How a hidden order becomes a public fill.

Three-stage pipeline. Solana for settlement. TEE for everything else.

STEP 01Solana → PER

Place

Wallet signs a TDX-attested challenge. Order serialized into a delegated account. Onlookers see a delegate ix — never price or size.

STEP 02Inside TEE

Match

Engine signer (only ENGINE_AUTHORITY) crosses opposing orders by price-time priority. FillEvent emits. Host machine cannot peek.

STEP 03PER → Solana

Settle

Filled portion commits back to L1 via SPL Token CPI. Public sees a swap. Resting book stays dark.

  Trader A                   Solana L1                  PER (Intel TDX)               Trader B
     │                          │                              │                          │
     │── sign TDX challenge ─→  │                              │                          │
     │← bearer token ──────────                                │                          │
     │                          │                              │                          │
     │── place_order(buy 99) ─────────────────────────────────→│ ←── place_order(sell 98) ─┤
     │                          │                              │ [encrypted in vault]      │
     │                          │                              │                          │
     │                          │                       ┌──────┴──────┐                  │
     │                          │                       │ match_tick  │ engine: MTEW…    │
     │                          │                       │ cross @ 98.5│                  │
     │                          │                       └──────┬──────┘                  │
     │                          │                              │                          │
     │                          │ ←── commit fill ─────────────│                          │
     │                          │ ←── settle via SPL ──────────│                          │
     │                          │                              │                          │
     │← fill notification ──────│                              │── fill notification ────→│

  Public sees:    "swap 100 USDC ↔ 1 SOL"
  Public misses:   resting book · order sizes · timing · counterparties