Nyx · Confidential Prefunding
Nyx lets a Stellar anchor borrow short-term stablecoin liquidity against confidential tokenized collateral — without revealing reserve size, draw amount, repayment amount, or credit capacity to the public.
“The public sees that a compliant credit position exists — but amounts stay hidden. Then an authorized auditor loads a credential and decrypts the full trail.”
The demo in one sentence.
01 — The problem
Cross-border anchors must prefund corridors before a payout completes. Today every option leaks something:
Idle USDC in corridors
capital-inefficient — money waits instead of working
External borrowing
exposes treasury stress and reserve size to lenders
Public collateral moves
leaks corridor strategy to competitors on-chain
Off-chain trust
lenders and auditors settle for PDFs and delayed reconciliation
The institutional requirement isn't just “borrow against collateral.” It is: prove sufficiency without disclosing the amount, release liquidity privately, keep a public audit trail, let an authorized auditor decrypt everything, and let a counterparty verify selected facts without seeing the whole book.
02 — How it works
SEP-31 payout arrives
Anchor Platform creates or ingests the payout transaction that needs prefunded liquidity.
KYB syncs on-chain
Alpha's accepted KYB status is written to ParticipantPolicy — approval becomes an on-chain authorization condition, not UI state.
Live quote
The backend quotes prefunding from real contract state: participant approval, collateral policy, haircut, tenor, and a fresh oracle price.
Collateral sufficiency proof
Alpha generates a Noir proof that its encrypted cTBill balance covers the draw after haircut — without revealing the balance.
On-chain verification
PrefundingCreditLine.open_credit verifies the UltraHonk proof on Soroban, checks every policy, and locks the collateral commitment.
Confidential draw
The facility releases cUSDC through an OpenZeppelin confidential transfer — the ledger records an encrypted commitment, not an amount.
Public lifecycle, private numbers
Anyone can see an active position with a verified proof. Nobody can read reserve size, draw amount, or fee.
Auditor visibility
Every confidential transfer emits a second ciphertext encrypted to the auditor key — decryptable evidence, live.
Repayment
Alpha repays; the credit line closes, the collateral lock releases, and the SEP-31 payout completes.
Repayment history proof
A second circuit proves a threshold statement — e.g. ≥2 of 3 repayments on time — without exposing which one was late.
Scoped disclosure
A regulator receives one encrypted fact via an expiring, revocable grant. The server never sees the plaintext.
03 — Architecture
The backend coordinates; it is never the privacy source of truth. That role belongs to the confidential token ciphertexts and verifier-checked proofs.
Anchor / SEP layer
Stellar Anchor Platform + business callback server. Owns SEP-31 payout state and SEP-12 KYB status.
Coordination backend
Fastify API with SQLite state, a Soroban event watcher, a quote engine reading live contract state, and a proof job queue.
Soroban contracts
Nine contracts enforce participation, collateral policy, oracle freshness, locking, credit lifecycle, history, and disclosure grants.
Confidential token layer
OpenZeppelin Confidential Tokens are the privacy source of truth: encrypted balances, encrypted transfer amounts, auditor ciphertexts, compliance hooks.
Frontend personas
One design system, three credentials: the anchor operator runs the flow, the public observer verifies it, the auditor decrypts it.
04 — State machines
pending_stellar means the payout is waiting on settlement. credit_drawn means the private prefunding leg released liquidity. Related — but not the same machine, and Nyx never conflates them.
SEP-31 payout status
Nyx product status
05 — Contracts
Plus the OpenZeppelin confidential token contracts (cUSDC, cTBill, ConfidentialAuditor, ConfidentialVerifier) and two UltraHonk verifier contracts — one per circuit.
06 — Proof system
Collateral sufficiency
Proves the private collateral balance covers the requested draw after haircut. The public inputs bind the oracle price, haircut, tenor, lock key, and a position nullifier — so the proof can't be replayed or repriced.
Repayment history
Proves a threshold statement over private repayment leaves — e.g. at least 2 of 3 repayments on time — without exposing amounts, dates, counterparties, or which record was late. This is the portable private credit record.
Honesty note:demo proving runs in an Alpha-controlled prover worker, and auditor decryption runs through co-hosted auditor tooling. In production, proving moves into the anchor's own infrastructure (or browser WASM) and decryption runs on auditor-controlled machines. Nyx never claims the backend can't see witness values while that boundary is co-hosted.