Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.inkwell.finance/llms.txt

Use this file to discover all available pages before exploring further.

CONFIDENTIAL & PROPRIETARY © 2026 Inkwell Finance, Inc. All Rights Reserved. This document is for informational purposes only and does not constitute legal, tax, or investment advice, nor an offer to sell or a solicitation to buy any security or other financial instrument. Any examples, structures, or flows described here are design intent only and may change.
Pre-alpha vs production. Pages that describe “the operator holds the session-to-ephemeral-key mapping” describe today’s single-operator implementation. Production Dagon will distribute this custody across an Ika 2PC-MPC dWallet network — no single “operator” entity will hold the mapping, and no unilateral disclosure (lawful or otherwise) will be possible without the network agreeing. The two-party composition described here is strengthened, not weakened, by the migration. See Design Philosophy for the full decentralization roadmap.
“Operator” pre-alpha vs production. Pages that describe a single “operator” cranking batches, holding liveness, or acting as a single point of failure describe today’s pre-alpha implementation. In production, operator duties are performed by the decentralized FHE cluster (Encrypt REFHE threshold network) — any quorum can crank, no single entity can stall the venue, and liveness is shared across independent nodes. “Operator” survives as a conceptual role, not a single entity.
FHE and ZK + MPC are adjacent, not substitutes. Different parts of the confidential-matching problem have different cost structures; different primitives are optimal for different parts.

​
What FHE is good for

Homomorphic computation on ciphertexts. The operator can run the matching algorithm (bisection, tâtonnement, curve evaluation) without decrypting any inputs. The algorithm is stateful and iterative; FHE handles this natively. Dagon’s matching is a composition of SIMD-parallel additions and comparisons over encrypted vectors. This is FHE’s sweet spot: no committee threshold assumption, no liveness dependency on N-of-M peers, no secret-share refresh.

​
What MPC is good for

Distributed computation over private inputs from multiple parties. A committee of compute nodes each holds a share of each input; the computation is evaluated across shares; any single node sees only a share. MPC has shipped production systems for longer than FHE. Arcium’s substrate is MPC. The tradeoff is committee liveness (M-of-N nodes must stay honest and online) and share refresh overhead.

​
What ZK is good for

Proving statements about private witnesses without revealing the witness. Credential validity, range proofs, knowledge-of-preimage — all natively handled by SNARKs/STARKs. Dagon uses ZK-style credentials — BBS+ or Coconut blind signatures, both selective-disclosure-friendly — for identity-side primitives:
  • Proving credential validity without revealing the credential (zkKYC: the issuer verifies identity once, the user presents a ZK proof of eligibility to Dagon).
  • Proving session-key authorization without revealing the credential binding.
  • Per-batch credential rotation so multi-schedule submission doesn’t leak lane multiplicity.
ZK is not a good fit for the matching itself. Matching is an iterative state computation; ZK proves statements about a fixed witness.

​
Why FHE for matching specifically

Matching is computationally expensive per-batch but does not require proving anything to a verifier — the operator does not need to convince anyone that the match is correct beyond cryptographic integrity, and that is handled by the FHE circuit’s own soundness. An MPC alternative would require a committee to maintain secret shares of every submitted curve for the life of a batch, coordinate to execute the matching circuit, and refresh shares for settlement. The committee becomes the trust surface. With FHE, the matching is a pure function of the ciphertext inputs. No committee holds state for matching; the threshold committee only enters the picture for decryption. The operator runs the function; in production, the decryption keys are split across the threshold-FHE committee, not held by the operator. The separation is cleaner. Where TEE / SEV-SNP attestation fits: as defense in depth, not as the trust root. We rejected TEE-as-vault after 14 confidentiality- breaking CVEs against Intel SGX/TDX and AMD SEV since 2018. TEE attestation locks the execution environment; it does not guarantee confidentiality alone.

​
Why not pure ZK?

ZK-based dark pools (Renegade, historical attempts) have used SNARKs to prove settlement correctness against private order books held off-chain. This works but moves the trust surface to whoever runs the off-chain matching — they see the orders. You’ve re-introduced a centralized matcher; ZK is just attesting to the settlement. Dagon’s design moves the matching itself into encryption, not just the settlement attestation. The operator is the matcher and structurally cannot see orders. That’s what FHE enables and ZK alone does not.

​
The honest tradeoff

FHE is computationally expensive per-operation. The Encrypt REFHE network has not shipped production FHE yet; Dagon’s mainnet is gated on that timeline. If Encrypt slips past end-of-2026, Dagon’s stack would pivot (likely to gMPC — generalized MPC with committee refresh). We’re transparent about this dependency; see dagon.so/compare for the cost structure of the alternative.

​
Further reading