Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.inkwell.finance/llms.txt

Use this file to discover all available pages before exploring further.

CONFIDENTIAL & PROPRIETARY © 2026 Inkwell Finance, Inc. All Rights Reserved. This document is for informational purposes only and does not constitute legal, tax, or investment advice, nor an offer to sell or a solicitation to buy any security or other financial instrument. Any examples, structures, or flows described here are design intent only and may change.
“Operator” pre-alpha vs production. Pages that describe a single “operator” cranking batches, holding liveness, or acting as a single point of failure describe today’s pre-alpha implementation. In production, operator duties are performed by the decentralized FHE cluster (Encrypt REFHE threshold network) — any quorum can crank, no single entity can stall the venue, and liveness is shared across independent nodes. “Operator” survives as a conceptual role, not a single entity.
Reading Dagon through the wrong frame misses what it does. Here are the frames it is commonly confused with, and where they diverge.

​
Not a mixer

Mixers (Tornado, Samourai, Wasabi-style CoinJoin) create anonymity by pooling many users into a single state and severing the link between deposit and withdrawal. The privacy property is set-based: you hide among N others who look exactly like you. Dagon does not pool. Identity is split across two independent parties, each holding half of what’s needed to name a trader. The privacy property is composition-based: no single party can de-anonymize, not even the operator. Compelled process requires coordinated cooperation of both parties, which is the positive compliance claim — not an accidental escape hatch. Consequences:
  • A breach of one party yields zero identity information.
  • Sanctions-screening obligations live at the credential issuer, not in an unscoped mixer set.
  • There is no “tainted” UTXO problem because there is no mixing.
See: Is this a mixer?

​
Not an AMM

AMMs (Uniswap, Raydium, Orca) price every trade against an on-chain bonding curve. Liquidity lives as reserves in a pool; market makers are passive until reserves reprice them. Dagon’s market makers publish encrypted six-parameter schedules — structured curves describing how much they will take at each price. The schedules are evaluated homomorphically, together, in one batch. There is no bonding curve, no LP token, no constant-product invariant. The clearing price emerges from the intersection of encrypted demand and encrypted supply, not from a formula applied to public reserves.

​
Not a CLOB

Central limit order books match orders continuously in arrival order. First-movers get price priority; latency creates edge. Dagon batches. Inside a batch, no order is “first.” A single clearing price serves every fill on both sides. Latency-based edges — sub-cent pickoff, last-look, maker-taker asymmetry — are structurally absent, not policy-disabled.

​
Not HFT infrastructure

Dagon’s batch cadence is measured in seconds, not microseconds. It is not a venue for latency-sensitive market making. It is a venue where impact exceeds latency — block execution, large-notional flow, trades that would move the tape in public. If you’re already slicing a parent order over twenty minutes of TWAP to avoid impact, a Dagon epoch is free. If your alpha lives inside a ten millisecond window, Dagon is the wrong venue.

​
Not TradFi Canton

Canton (Digital Asset’s privacy-preserving DLT) is the current institutional answer for confidential matching at TradFi scale — Broadridge, DTCC, HSBC Orion. Canton is a permissioned network with participant-controlled data residency. Dagon runs on Solana with a permissionless settlement layer and a permissioned operator/issuer composition. It is closer to JPM’s Prime Match in product shape than to Uniswap. It is not a Canton replacement at Tier-1 bank scale, and it does not try to be. Its wedge is DeFi-native institutions (prop shops, OTC desks, crypto funds) whose compliance model is “respond to lawful process,” not “prevent all disclosure.”

​
Not decentralized the way an AMM is decentralized

“Decentralized” is a gradient. Dagon is:
  • Non-custodial. Users hold their own keys. No operator-held vault.
  • On-chain settled. Balance updates are Solana transactions.
  • Permissionless to use. Anyone with a credential can deposit and submit.
  • Operator-mediated in matching (pre-alpha). One operator runs the FHE executor and cranks the batch today. It cannot see orders, but it can refuse to serve. The design supports a decentralized threshold-FHE committee end-state — a quorum of independent parties each holding key shares, no single party able to decrypt — gated on Encrypt REFHE shipping production threshold decryption.
  • Issuer-mediated in identity. A credential issuer attests that a given participant is allowed to submit. The issuer is not the operator, by design. A federation of jurisdictionally-separated issuers is the target.
Calling Dagon a “DEX” imports AMM assumptions (permissionless listing, no operator, MEV surface) that do not apply. Calling it a centralized venue ignores the non-custodial settlement and the operator’s cryptographic blindness. The honest shape is in the middle. See: Decentralized or not?