GHOSTRAIL

Earn the same yield as public lending venues,
and keep your position private.

A confidential lending layer on Circle's Arc

● Live on Arc testnet Real USDC Real CCTP Zero admin keys
ghostrail.xyzgithub.com/Himess/ghostrail
The problem

Someone is reading your position right now.

Not hacking. Just looking. A public vault publishes its depositor table — and it's free to read.

Public USDC vault · depositors ● ANYONE CAN WATCH
0x66Bf…C45816,941,00367.40%
0xB81a…5bfD8,002,23231.84%
0xbd35…03B8187,2100.74%
0x1eb3…4e9B1,000<0.01%
no login · no permission · no traceFULLY EXPOSED
What anyone learns
for free, in one call
One wallet holds two thirds of the vault.
Their size, to the dollar.
When they entered — and the moment they leave.
Enough to trade against them.
This is the default on every public lending venue.
Our thesis

We're a layer.
Not another venue.

Added by GhostRailConfidential side
GHOSTRAIL — Confidential Lending Layer
Shield Pool & net View keys Zero admin

Supply into any public venue with your amount, your share and your entry sealed in the enclave. Deposits pool and net at the boundary — only the batch net ever touches the public side.

same chain · same liquidity · same yield — not a separate venue
Morpho · Aave · any Arc-native venue Liquidity we inherit

Where the depositors, curators, borrowers and yield already are. The router takes an adapter, so we're not bound to two names. From the venue's side, GhostRail is one ordinary address.

Arc — Circle's L1 · public EVM + APS The rails

USDC is the native gas token — nobody holds ETH. APS seals state in a hardware enclave, so confidentiality is plain Solidity: no ciphertexts, no circuits. shield / unshield is the only boundary — atomic, same-block — which is exactly where we net.

Provided by ArcBase layer
Why APS

Confidentiality as a
substrate primitive.

Arc's Privacy Sector is a TEE-backed private EVM sitting beside Arc's public one. It's not why the idea works — it's why the code is small.

Public EVM
Morpho
Aave
USDC
everything readable
SHIELD / UNSHIELD
atomic
same-block
APS · enclave
_shares[you]
_costBasis[you]
_balance[you]
sealed in hardware
plain Solidity · no ciphertexts, no circuits
Trade-off

You trust hardware attestation, not cryptography alone. We say that plainly.

Atomic same-block composability

A confidential contract calls a public venue and settles in one transaction. No bridge — and a bridge would leak the very timing netting exists to hide.

Generic over any Arc ERC-20

Not a USDC special case. That's why 5 markets are the same two contracts with a different underlying.

Disclosure is native

View keys are the substrate's own model — we don't bolt compliance on, we inherit it.

What we built

Three pillars

Two contracts. Everything below falls out of them.

01

Confidential position

You deposit cUSDC — never USDC — and get confidential shares. Amount, share and cost basis stay sealed in the enclave, readable only by you.

ConfidentialToken · any ERC-20
02

GhostGate netting

Deposits and withdrawals cancel inside the confidential zone. Only the net of each batch crosses to the venue — one movement, one address.

O(1) execution · permissionless
03

Selective disclosure

Appoint an observer and they read your position exactly as you do. Invisible to the market, legible to your auditor. No global backdoor.

per-account · revocable · read-only

Across 5 asset markets — USDC · ETH · BTC · EURC · tokenized treasury — each the same architecture with a different underlying.

How it works

Many depositors in.
One anonymous position out.

Public · USDC
0xA1c4…250,000
0xB2f9…1,200,000
0xC3d1…50,000
0xD4e7…10,000
amounts visible
↓ shield
Confidential · cUSDC
👻
Confidential pool
per-user shares
sealed in the enclave
GhostGate · batch nets
+1,510,000
deposits − withdrawals
Public venue · USDC
Any public venue
existing liquidity & yield
Sees ONE depositor:
the router. Not you.
↑ unshield the net
one movement per batch
The signature move

GhostGate: only the difference
ever crosses.

// one batch, one crossing
net = deposits − withdrawals
net > 0 → unshield(net); venue.deposit(net)
net < 0 → venue.withdraw(−net); shield(−net)
net = 0nothing crosses at all

Withdrawals are funded from deposits already sitting in the router. Hundreds of traceable transfers collapse into one ordinary supply from one address.

Execution is O(1)

It loops over nothing: snapshot the clearing price, adjust aggregates, cross once, advance. Users then pull their own share.

Permissionless

Anyone can call executeBatch(). There's no keeper to trust, no operator to bribe, no liveness dependency on us.

Why pull, not push

An earlier design looped over participants. Our own review found a griefer could queue 1-wei deposits until execution exceeded the gas limit — bricking the router permanently, with no admin to rescue it. Pull-based removed the loop, so the attack has nothing to grow.

The honest boundary

We state it instead
of hiding it.

Private
Your confidential balance
Your shares, cost basis and earnings
Who deposited how much, and when
Your per-batch entry
Public
Shield / unshield amounts
Aggregates — total shielded, total shares
The per-batch net
The solvency invariant
previewRedeem(totalShares) ≤ totalAssets()

Privacy that hides insolvency is a scam waiting to happen. Anyone can verify we're fully backed — without seeing a single position. Proven as a fuzz invariant over 128,000 calls.

Design rationale

Why these choices

Most of the work wasn't writing contracts — it was deciding what not to build.

Layer, not venue

Our own pool means bootstrapping liquidity from zero — the two-sided cold-start trap that kills lending launches. We inherit what took years to build.

Pooling is the mechanism, not a preference

A position in a public contract has a public amount. Hide the owner, or hide the breakdown — only the second gives amount privacy. Splitting one depositor across proxies is structuring.

Operational privacy, not a mixer

Same address in, same address out. We hide sizes, not identity. Institutions aren't asking to disappear — they're asking not to be front-run while staying auditable.

Zero admin keys

Immutable. No owner, no pause, no upgrade, no privileged fund path. We can't touch the pool because there is no operator role. The auditor can only read.

Circle integration

USDC isn't a checkbox.
It's the product.

USDC ● Live

The flagship market wraps real Arc testnet USDC (0x3600…0000). Every confidential dollar is backed 1:1 by it, provably.

On Arc it's also the gas token — users transact without ever holding ETH.

CCTP ● Live

Cross-chain onboarding through Circle's own Bridge Kit: burn on Base / Ethereum / Arbitrum, Circle attestation, native mint on Arc.

This answers the hardest question the design has: how does liquidity get to Arc at all.

EURC — the Euro market, same architecture Market
Gateway · Paymaster — roadmap, not claimed Planned
Arc Testnet · chainId 5042002 · 10 markets deployed (1 live · 9 simulated) · verifiable on testnet.arcscan.app
Honest status

What's real, and what isn't — yet.

Not yet real

Privacy is notional today

APS is not live. On Arc testnet the confidential values sit in ordinary storage and the gating isn't enforced against a spoofed eth_call. The privacy is architectural, not cryptographic.

Every divergence point is marked // APS-SWAP in the source. Venues are mocked — Morpho and Aave aren't on Arc yet; Aave V4 is in Arc governance.

Real, right now

Deployed and running

Protocol logic live on Arc testnet — 10 markets
Real Circle USDC · real CCTP bridge
56 tests · 4 fuzz invariants · 128k calls
Zero admin keys — immutable, no privileged path
The claim, precisely

Protocol live on Arc testnet, USDC-integrated, architected for APS — confidentiality activates when APS ships. An independent audit completes before mainnet real funds, not after.

Roadmap

Live now. Audited next.
Honest about the rest.

v1 ● Live

Confidential deposit & yield

Generic token + router. 5 asset markets, GhostGate netting, view keys, public solvency invariant. On Arc testnet with real USDC and CCTP.

v2 Audit-gated

Real venues, leverage, compliance

Adapters — Morpho / Aave the day they're on Arc. Aave V4 is in Arc governance (USDC/EURC/cirBTC).

Same-asset leverage — no cross-asset gap; the clean, low-tail-risk way to add leverage.

Compliance tier — auditor tooling. The revenue layer.

v3 Research-gated

Deferred, and why

Cross-asset borrow — pooled collateral carries irreducible tail risk: a fast gap liquidates the aggregate and safe users share the loss.

Yield aggregator — fights the privacy model. Fragmented liquidity means thinner anonymity sets.

Venue policy: Aave-style pools first (permissionless) · Morpho markets direct second (permissionless + immutable) · curated vaults only where gates are abdicated.

GHOSTRAIL

Your yield is public information.
It doesn't have to be.

The confidential lending layer for Circle's Arc — built on Circle's own rails, and honest about exactly where it stands.

● Live on Arc testnet USDC + CCTP integrated Open source · MIT
ghostrail.xyz github.com/Himess/ghostrail testnet.arcscan.app
Title 1 / 12
S
Speaker notes