Nyx · Confidential Prefunding

Private credit for public rails.

Nyx lets a Stellar anchor borrow short-term stablecoin liquidity against confidential tokenized collateral — without revealing reserve size, draw amount, repayment amount, or credit capacity to the public.

“The public sees that a compliant credit position exists — but amounts stay hidden. Then an authorized auditor loads a credential and decrypts the full trail.”

The demo in one sentence.

01 — The problem

Prefunding is dead capital with bad options

Cross-border anchors must prefund corridors before a payout completes. Today every option leaks something:

Idle USDC in corridors

capital-inefficient — money waits instead of working

External borrowing

exposes treasury stress and reserve size to lenders

Public collateral moves

leaks corridor strategy to competitors on-chain

Off-chain trust

lenders and auditors settle for PDFs and delayed reconciliation

The institutional requirement isn't just “borrow against collateral.” It is: prove sufficiency without disclosing the amount, release liquidity privately, keep a public audit trail, let an authorized auditor decrypt everything, and let a counterparty verify selected facts without seeing the whole book.

02 — How it works

Eleven steps, end to end

1

SEP-31 payout arrives

Anchor Platform creates or ingests the payout transaction that needs prefunded liquidity.

2

KYB syncs on-chain

Alpha's accepted KYB status is written to ParticipantPolicy — approval becomes an on-chain authorization condition, not UI state.

3

Live quote

The backend quotes prefunding from real contract state: participant approval, collateral policy, haircut, tenor, and a fresh oracle price.

4

Collateral sufficiency proof

Alpha generates a Noir proof that its encrypted cTBill balance covers the draw after haircut — without revealing the balance.

5

On-chain verification

PrefundingCreditLine.open_credit verifies the UltraHonk proof on Soroban, checks every policy, and locks the collateral commitment.

6

Confidential draw

The facility releases cUSDC through an OpenZeppelin confidential transfer — the ledger records an encrypted commitment, not an amount.

7

Public lifecycle, private numbers

Anyone can see an active position with a verified proof. Nobody can read reserve size, draw amount, or fee.

8

Auditor visibility

Every confidential transfer emits a second ciphertext encrypted to the auditor key — decryptable evidence, live.

9

Repayment

Alpha repays; the credit line closes, the collateral lock releases, and the SEP-31 payout completes.

10

Repayment history proof

A second circuit proves a threshold statement — e.g. ≥2 of 3 repayments on time — without exposing which one was late.

11

Scoped disclosure

A regulator receives one encrypted fact via an expiring, revocable grant. The server never sees the plaintext.

03 — Architecture

Five layers, one boundary rule

The backend coordinates; it is never the privacy source of truth. That role belongs to the confidential token ciphertexts and verifier-checked proofs.

Anchor / SEP layer

Stellar Anchor Platform + business callback server. Owns SEP-31 payout state and SEP-12 KYB status.

Anchor PlatformBusiness serverSEP-31SEP-12

Coordination backend

Fastify API with SQLite state, a Soroban event watcher, a quote engine reading live contract state, and a proof job queue.

Fastify APIQuote engineProver workerEvent watcherAuditor / disclosure APIs

Soroban contracts

Nine contracts enforce participation, collateral policy, oracle freshness, locking, credit lifecycle, history, and disclosure grants.

ParticipantPolicyCollateralPolicyRegistryOracleAdapterCollateralLockRegistryPrefundingCreditLineRepaymentHistoryRegistryDisclosureGrantRegistry2× UltraHonk verifiers

Confidential token layer

OpenZeppelin Confidential Tokens are the privacy source of truth: encrypted balances, encrypted transfer amounts, auditor ciphertexts, compliance hooks.

cUSDCcTBillConfidentialAuditorConfidentialVerifier

Frontend personas

One design system, three credentials: the anchor operator runs the flow, the public observer verifies it, the auditor decrypts it.

Anchor operatorPublic observerAuthorized auditorRegulator (scoped link)

04 — State machines

Two lifecycles, deliberately separate

pending_stellar means the payout is waiting on settlement. credit_drawn means the private prefunding leg released liquidity. Related — but not the same machine, and Nyx never conflates them.

SEP-31 payout status

pending_senderpending_stellarcompleted

Nyx product status

prefunding_requiredcredit_quote_readyproof_pendingproof_verifiedcredit_drawnrepaidclosed

05 — Contracts

What enforces what

ParticipantPolicyOn-chain allowlist — records whether a participant is approved to use the credit system. Synced from Anchor Platform KYB.
CollateralPolicyRegistryCollateral eligibility, haircut basis points, max tenor, and oracle configuration per asset.
OracleAdapterPrice and freshness checks — Reflector-backed where configured. Stale prices reject the open.
CollateralLockRegistryPrevents a collateral commitment from being reused; releases the lock after repayment.
PrefundingCreditLineThe core: verifies the proof, checks every policy, opens credit, records draw and repayment, emits lifecycle events.
RepaymentHistoryRegistryStores private repayment leaves and roots; verifies threshold statements via the second circuit.
DisclosureGrantRegistryThin grant registry — scope hash, viewer hash, expiry, revocation. Stores no plaintext, ever.

Plus the OpenZeppelin confidential token contracts (cUSDC, cTBill, ConfidentialAuditor, ConfidentialVerifier) and two UltraHonk verifier contracts — one per circuit.

06 — Proof system

Two circuits, one honesty rule

Collateral sufficiency

Proves the private collateral balance covers the requested draw after haircut. The public inputs bind the oracle price, haircut, tenor, lock key, and a position nullifier — so the proof can't be replayed or repriced.

NoirUltraHonkverified on Sorobannullifier replay-blocked

Repayment history

Proves a threshold statement over private repayment leaves — e.g. at least 2 of 3 repayments on time — without exposing amounts, dates, counterparties, or which record was late. This is the portable private credit record.

Second circuitprivate leaves + rootthreshold statement

Honesty note:demo proving runs in an Alpha-controlled prover worker, and auditor decryption runs through co-hosted auditor tooling. In production, proving moves into the anchor's own infrastructure (or browser WASM) and decryption runs on auditor-controlled machines. Nyx never claims the backend can't see witness values while that boundary is co-hosted.