ShadowPerp Documentation

Overview

ShadowPerp enables private perpetual futures trading on Solana. Trade size, direction, leverage, and margin are encrypted before they reach the on chain program. Sensitive calculations run through Arcium's MPC network rather than being exposed in plaintext on the ledger.

Only the minimum public state required for settlement is written on chain. The protocol is designed to prevent position data from becoming exploitable public information.

ShadowPerp supports 6 trading pairs: SOL-USD, BTC-USD, ETH-USD, JUP-USD, PYTH-USD, and ORCA-USD. Each pair routes to its own on-chain market PDA, while delegated sessions and shared collateral keep execution reusable across supported markets. The selected pair persists across page refreshes.

How It Works

Each trade follows the same core path:

1. Encrypt | Your browser encrypts sensitive trade inputs including size, price, leverage, direction, and margin before submission.
2. Queue | The encrypted payload is submitted to the Solana program, which queues an Arcium MPC computation.
3. Compute | Arcium's MPC network evaluates trade logic, margin checks, PnL, and liquidation conditions without exposing raw inputs to any single node.
4. Callback | Arcium returns a verified, replay hardened result to the Solana program.
5. Settle | ShadowPerp updates the margin account and position state from the verified output.

After your session is approved, the relay submits trades on your behalf. You sign once for the session instead of approving a wallet prompt for every action.

Session Trading

ShadowPerp uses a delegated session model to keep the trading experience seamless. Here is what happens when you start a session:

1. You sign a CreateTradeSessionV2 transaction by default. This creates a wallet scoped session PDA tied to your wallet and the relay, and reusable across supported markets.
2. You sign a short authorization message. This is not a transaction. It simply proves that the relay can act for you during the session window.
3. For the rest of that session, the relay can submit trades and delegated collateral actions without opening a wallet popup each time.

Session Limits

Revoking a Session

You can revoke your active session at any time from the Settings panel. Open Settings, go to the Trading tab, and click Revoke Session. This submits a transaction that invalidates the session on chain immediately. The relay will reject all further requests from that session the moment the transaction confirms.

Privacy Model

ShadowPerp relies on Arcium as the privacy layer behind trading. Here is the practical boundary between what stays private and what remains visible:

What is private

• Position size
• Entry price
• Leverage
• Direction
• Margin amount
• Unrealized PnL

What is public

• Your wallet address, which is used for the margin account and session
• Token transfers to and from the vault (Solana constraint)
• The fact that a trade was queued, but not the details
• Session creation and revocation

What is becoming private (shielded collateral)

• Internal collateral ownership and allocation
• Margin lock and release transitions
• Per-user balance within the protocol

Margin and Leverage

ShadowPerp supports two margin modes and leverage up to 50x.

The current devnet namespace now uses a migration-backed shared collateral model for adopted markets. After your wallet is migrated from any legacy per-market margin accounts, one owner scoped collateral balance can back positions across supported pairs instead of requiring a separate funding bucket per market.

Cross Margin

Your full margin balance is shared across all cross margin positions. If one position loses, the rest of the balance absorbs it, which can reduce liquidation risk on a single position but exposes more of your account to aggregate losses.

Isolated Margin

A fixed amount of margin is assigned to one position. If that position is liquidated, only that isolated margin is at risk and the rest of your balance stays untouched.

Leverage

Leverage increases both upside and downside relative to your margin. Available range: 1x to 50x.

Order Types

Market Order

A market order executes against the current oracle price. The position is queued for MPC computation and opens once the Arcium callback returns successfully.

Limit Order

A limit order is queued in the browser and triggered when the market price crosses your chosen level. When that happens, the relay submits the order for you.

Take Profit / Stop Loss

Each open position can have optional TP and SL rules. These are stored locally and monitored by the client.

• Take Profit (TP) | closes the position when price reaches your target.
• Stop Loss (SL) | closes the position when price reaches your protection level.

You can set TP and SL in the trading panel before opening a position, or edit them later from the position row. Use the Save action to keep the rule.

Validation Rules

• For long positions, TP must be above entry and SL must be below entry.
• For short positions, TP must be below entry and SL must be above entry.
• TP and SL must be at least 0.10% away from entry price.

Liquidation

A position is liquidated when its health ratio falls below the maintenance threshold. The health ratio is calculated as:

Health = (Equity / Maintenance Margin) x 100%

• Liquidation threshold: set per market in basis points, enforced by the on-chain program
• Liquidation penalty: 5% to the liquidator, with the remainder returned to the trader

In cross margin mode, your full balance acts as equity. In isolated mode, only the position's allocated margin counts.

Shielded Collateral

ShadowPerp already has the base shielded collateral flow deployed on devnet. Deposits, private withdrawal requests, proof verification callbacks, and delayed finalization are live. The remaining work is private margin lock and private position settlement through Arcium MPC.

How it works

1. Deposit | You deposit USDC to the vault. The token transfer is public (Solana constraint), but the protocol creates a private commitment in a Merkle tree instead of updating a plaintext balance.
2. Trade | Margin lock and release transitions happen through Arcium MPC, consuming and producing commitments without revealing your internal balance.
3. Withdraw | You first create a pending withdrawal, then queue an Arcium MPC proof check, and only finalize after the callback marks that withdrawal as verified and the delay window has passed.

What stays private

• Your internal balance within the protocol
• How much margin is allocated to each position
• The connection between deposits and trading activity

What remains public

• USDC transfers to and from the vault (Solana L1 constraint)
• The fact that a deposit or withdrawal happened
• Timestamps of transactions

FAQ

Do I need to keep the browser open?

For market orders, the relay and callback path continue after submission, so you do not need to keep the tab open just to keep the request alive. For limit orders and TP and SL automation, yes. Those flows still run in the browser and need the tab to stay open.

How do I deposit collateral?

Click Collateral in the trading panel, or use the deposit button in the portfolio summary. You must deposit USDC before you can open a position. For devnet testing, use a devnet USDC faucet to fund your wallet with the correct test mint.

Why does my position show "Queued" or "Finalizing"?

Those states mean the trade was submitted successfully and is moving through the protected callback path. Queued means Shadow is still waiting for the Arcium MPC callback to return. Finalizing means the callback completed and the remaining on-chain settlement steps are finishing. On devnet this typically takes 30 to 120 seconds depending on cluster load. If it takes longer, the cluster may be temporarily delayed, but your collateral remains safe and the position will either resolve once settlement completes or fail into a terminal state if the callback aborts on chain.

Is my data stored anywhere?

Trading preferences, session info, automation rules, cached activity, layout preferences, and RPC settings are stored in your browser's localStorage. Actual on chain position state is still read from Solana, but the app also keeps a few local convenience snapshots so the interface can restore faster. Server-backed features such as the relay and history routes may receive your public wallet address and encrypted trade inputs when needed to fulfill the request.

Can I use ShadowPerp on mainnet?

Not yet. ShadowPerp is currently devnet only. Mainnet deployment depends on a fully verified open and close flow, production operational confidence, and a comprehensive audit.