Skip to main content
Shield Swap uses Aleo private inputs and encrypted records to keep participant ownership information out of ordinary public AMM state. Record contents, private inputs, and direct wallet attribution are confidential. Public market parameters and finalization state remain visible.

​
Private proof inputs

The core program declares the following private inputs: A private input is not the same as an encrypted record. The value participates in proof construction, while a record is a persistent unit of encrypted Aleo state that can later be consumed.

​
PositionNFT records

PositionNFT contains:
  • Owner
  • Immutable withdrawal address
  • Token ID
  • Token program identifiers
  • Pool
  • Lower and upper ticks
All declared record fields use Leo’s default visibility and are encrypted for the owner. The owner can decrypt the record and use it to authorize position operations. PositionNFT is the confidential ownership capability for public position state. Current liquidity and owed amounts remain in the public positions mapping. Mint creates the first PositionNFT. Increase, decrease, and collect consume it and return an updated record with the same identifying fields. Burn consumes the final record and returns no replacement.

​
Token records

Dynamic token records fund and settle the confidential path.

​
Funding records

Mint and increase consume two token records. Swap consumes one token record. The token program moves the requested amount into the AMM’s public balance and returns an encrypted change record for any unspent balance. The exact record schema and authorization rules belong to the dynamically selected token program. The AMM depends on a compatible IARC20 implementation. Asset onboarding must confirm that the production token program enforces the intended ownership, amount, freeze, and transfer rules.

​
Payout records

Collect converts public AMM balances into token records owned by the immutable PositionNFT.withdrawal address. Swap claims convert the output and any original-input refund into token records owned by self.signer. The owner of a token record is confidential from ordinary public state. The amount transferred by the AMM is still public because collect and claim amounts are public arguments and because pending swap amounts are stored publicly before claim.

​
Compliance records

The program defines three encrypted compliance record types:
  • MintComplianceRecord
  • SwapComplianceRecord
  • MultiHopSwapComplianceRecord
Each record is owned by SWAP_INVESTIGATOR_KEY, not by the participant. The record contents are confidential from the public and available to the corresponding investigator-key holder. All three records include self.signer and self.caller. This preserves both the top-level account and the immediate integration path when a call is routed through another program. See Compliance records and Caller and signer.

​
What each record owner can see

​
Position recipient

The mint recipient can decrypt the PositionNFT. If the recipient differs from the signer, the signer should not be assumed to own or decrypt that position record.

​
Token-record owner

The owner of a token change, output, refund, or collect record can decrypt its token and amount fields according to the token program’s schema.

​
Investigator

The investigator can decrypt compliance records addressed to SWAP_INVESTIGATOR_KEY. The investigator does not gain general authority over participant PositionNFTs or token records from this AMM contract.

​
Administrator

The admin has no special decryption function in shield_swap.aleo. The program initially assigns the deployer and investigator roles to the same address, so one key holder may control both capabilities. An admin transfer does not move the investigator role.

​
Mint confidentiality differs from swap confidentiality

Mint does not accept a blinded_address. Its token ID is computed as:
The request is public, while the recipient and nonce are private. Their hash produces the public token ID used to index position accounting. Swaps use a public confidential address derived from the signer and a private blinding factor. Claims prove the same relation and direct records to the signer. Mint derives a token ID from private inputs. Swaps derive a signer-bound public pseudonym. The two mechanisms have different lifecycle and recovery requirements.

​
Information not covered by encrypted records

The confidential path does not hide:
  • Swap amount or direction
  • Minimum output or price limit
  • Pool or multi-hop route
  • Position range
  • Desired or minimum mint amounts
  • Position token ID
  • Liquidity and owed balances
  • Claim amount or timing
  • Administrative control activity
The public and confidential layers must be evaluated together. See Public data.

​
Lifecycle coverage

The initial mint compliance record links signer, caller, owner recipient, immutable withdrawal address, nonce, and token ID. An investigator can use that token ID to follow later public position-accounting changes. The contract does not issue new compliance records for:
  • Increase liquidity
  • Decrease liquidity
  • Collect
  • Burn
  • Claims
  • Freeze or unfreeze
Later operations do not create new compliance records. However, every collect pays the withdrawal address that the investigator can read from the original mint record.