> ## Documentation Index
> Fetch the complete documentation index at: https://shield.fi/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Confidential data

> The Aleo private inputs and encrypted records used for participant ownership, funding, payouts, and selective disclosure.

Shield Swap uses Aleo private inputs and encrypted records to keep participant ownership information out of ordinary public AMM state. Record contents, private inputs, and direct wallet attribution are confidential. Public market parameters and finalization state remain visible.

## Private proof inputs

The core program declares the following private inputs:

| Transition          | Private input                          | Purpose                                                                                 |
| ------------------- | -------------------------------------- | --------------------------------------------------------------------------------------- |
| `mint`              | `nonce`                                | Adds confidential entropy to the public token ID                                        |
| `mint`              | `recipient`                            | Selects the owner of the returned PositionNFT                                           |
| `mint`              | `withdrawal`                           | Binds the immutable owner of later payout records                                       |
| `mint`              | freezelist proofs                      | Proves signer, owner recipient, and withdrawal non-inclusion                            |
| `swap`              | `blinding_factor`                      | Binds the signer to a public one-use confidential address without publishing the factor |
| `swap_multi_hop`    | `blinding_factor`                      | Applies the same address construction to a routed swap                                  |
| `claim_swap_output` | `blinding_factor`, freezelist proofs   | Authorizes single-hop or routed output settlement                                       |
| `collect`           | owner and withdrawal freezelist proofs | Validates both NFT authority and immutable payout address                               |

A private input is not the same as an encrypted record. The value participates in proof construction, while a record is a persistent unit of encrypted Aleo state that can later be consumed.

## PositionNFT records

`PositionNFT` contains:

* Owner
* Immutable withdrawal address
* Token ID
* Token program identifiers
* Pool
* Lower and upper ticks

All declared record fields use Leo's default visibility and are encrypted for the owner. The owner can decrypt the record and use it to authorize position operations.

`PositionNFT` is the confidential ownership capability for public position state. Current liquidity and owed amounts remain in the public `positions` mapping.

Mint creates the first PositionNFT. Increase, decrease, and collect consume it and return an updated record with the same identifying fields. Burn consumes the final record and returns no replacement.

## Token records

Dynamic token records fund and settle the confidential path.

### Funding records

Mint and increase consume two token records. Swap consumes one token record. The token program moves the requested amount into the AMM's public balance and returns an encrypted change record for any unspent balance.

The exact record schema and authorization rules belong to the dynamically selected token program. The AMM depends on a compatible `IARC20` implementation. Asset onboarding must confirm that the production token program enforces the intended ownership, amount, freeze, and transfer rules.

### Payout records

Collect converts public AMM balances into token records owned by the immutable `PositionNFT.withdrawal` address. Swap claims convert the output and any original-input refund into token records owned by `self.signer`.

The owner of a token record is confidential from ordinary public state. The amount transferred by the AMM is still public because collect and claim amounts are public arguments and because pending swap amounts are stored publicly before claim.

## Compliance records

The program defines three encrypted compliance record types:

* `MintComplianceRecord`
* `SwapComplianceRecord`
* `MultiHopSwapComplianceRecord`

Each record is owned by `SWAP_INVESTIGATOR_KEY`, not by the participant. The record contents are confidential from the public and available to the corresponding investigator-key holder.

All three records include `self.signer` and `self.caller`. This preserves both the top-level account and the immediate integration path when a call is routed through another program.

See [Compliance records](./compliance-records) and [Caller and signer](./caller-and-signer).

## What each record owner can see

### Position recipient

The mint recipient can decrypt the PositionNFT. If the recipient differs from the signer, the signer should not be assumed to own or decrypt that position record.

### Token-record owner

The owner of a token change, output, refund, or collect record can decrypt its token and amount fields according to the token program's schema.

### Investigator

The investigator can decrypt compliance records addressed to `SWAP_INVESTIGATOR_KEY`. The investigator does not gain general authority over participant PositionNFTs or token records from this AMM contract.

### Administrator

The admin has no special decryption function in `shield_swap.aleo`. The program initially assigns the deployer and investigator roles to the same address, so one key holder may control both capabilities. An admin transfer does not move the investigator role.

## Mint confidentiality differs from swap confidentiality

Mint does not accept a `blinded_address`. Its token ID is computed as:

```text theme={"languages":{"custom":["/languages/leo.tmLanguage.json"]}}
hash(MintPositionRequest, recipient, nonce)
```

The request is public, while the recipient and nonce are private. Their hash produces the public token ID used to index position accounting.

Swaps use a public confidential address derived from the signer and a private blinding factor. Claims prove the same relation and direct records to the signer.

Mint derives a token ID from private inputs. Swaps derive a signer-bound public pseudonym. The two mechanisms have different lifecycle and recovery requirements.

## Information not covered by encrypted records

The confidential path does not hide:

* Swap amount or direction
* Minimum output or price limit
* Pool or multi-hop route
* Position range
* Desired or minimum mint amounts
* Position token ID
* Liquidity and owed balances
* Claim amount or timing
* Administrative control activity

The public and confidential layers must be evaluated together. See [Public data](./public-data).

## Lifecycle coverage

The initial mint compliance record links signer, caller, owner recipient, immutable withdrawal address, nonce, and token ID. An investigator can use that token ID to follow later public position-accounting changes.

The contract does not issue new compliance records for:

* Increase liquidity
* Decrease liquidity
* Collect
* Burn
* Claims
* Freeze or unfreeze

Later operations do not create new compliance records. However, every collect pays the withdrawal address that the investigator can read from the original mint record.

## Related pages

* [Confidentiality model](./model)
* [Public data](./public-data)
* [Trust and key boundaries](../security/trust-and-key-boundaries)