Overview
UNLIT is an asset manager with no people, on Solana. One program holds a pool of eight assets: USDC, SOL, cbBTC and JitoSOL, three tokenized stocks (NVDAx, SPYx and TSLAx, the NVIDIA, S&P 500 and Tesla xStocks) and tokenized gold (XAUt0). A rule set that nobody outside Arcium's encrypted network can read decides how the pool is rebalanced. The people who own the pool hold shares whose running balances only they can read. Everything that binds the manager is public and enforced by the program.
The arrangement being inverted is the US qualified blind trust, set out in the Office of Government Ethics rules (5 CFR part 2634, subpart D). There, an official hands assets to an independent trustee and is no longer told what the trustee holds. The blindness protects the public from the official. Here it points the other way: everyone can see what the manager did, and nobody can read the manager's rules or a holder's balance.
What is public
| Field | Where it lives | Who can read it |
|---|---|---|
| Value per share and the pool's value | The Fund account, the eight vault token accounts, Pyth and Kamino Scope prices | Anyone |
| Every deposit: USDC in and shares minted | The deposit instruction and its Deposited event | Anyone |
| Every order the cluster revealed | The Order account and the OrderDecided event | Anyone |
| Every executed trade | An Orca or Jupiter swap signed by the vault authority, plus TradeExecuted | Anyone |
| Every redemption: shares burned and what was paid out | The redeem instruction and Redeemed | Anyone |
| The parameters: routes, turnover cap, slippage band, fees, delays | The Fund account | Anyone |
| Total share supply | The share mint | Anyone |
What is sealed
| Field | How it is sealed | Who can read it |
|---|---|---|
| The rule set (target weights and the band) | Encrypted for Arcium's cluster (Enc<Mxe>) and stored that way in the Rules account | Nobody from the chain. Whoever wrote it knows what they submitted |
| A holder's running share balance | Token-2022 confidential transfer extension, twisted ElGamal ciphertext | The holder, with their ElGamal key |
| Share transfers between holders | Confidential transfer with zero-knowledge proofs | The two parties |
What is not hidden, said plainly
- The deposit is public: the USDC amount and the number of shares minted both sit in the deposit instruction. The shares then move into the holder's confidential balance, and the public balance reads zero. From then on, transfers and the running balance are sealed.
- The redemption is public: the holder first moves shares out of the confidential balance with a standard withdraw, then
redeemburns them and pays out in the open. - Executed trades are public, so part of any strategy shows through its trades. That is true of every fund.
- Whoever authors a rule set knows it. A new rule set waits seven days in public (
RulesScheduled) before it can be activated.
The walls
- No instruction moves pool assets to an arbitrary address. Assets leave only through
redeem(pro-rata, to the holder) or throughexecute(a checked trade from one vault into another). - Only an order the Arcium cluster signed can trade, and the program checks the cluster's BLS signature on chain.
- A trade must deliver at least 99.5% of its input value at the fund's oracle prices, and the day's trades stay under 20% of the pool's value at the start of the day.
- Redemption works while the fund is paused and uses no prices.
Tests
The program runs against copies of mainnet Token-2022, Orca, Pyth and Kamino Scope in 38 engine tests, and the whole user path runs on an Arcium cluster: a deposit sealed in a confidential balance, a decision from the cluster, an Orca trade inside both bands, and a redemption paid in kind.