Skip to main content
Shield Swap combines public market state, confidential ownership records, encrypted attribution records, and administrative intervention controls. Each layer provides different capabilities and requires different operating safeguards. Compliance depends on off-chain identity, eligibility, disclosure, governance, and jurisdiction-specific controls in addition to the contract features described here.

​
Operating responsibilities

Operators must define and maintain:
  • Deployed program ID, edition, checksum, and release
  • Admin address and governance process
  • Investigator address and key custody
  • Token admission and wrapper behavior
  • Public and confidential data inventory
  • Compliance-record schemas and coverage
  • Disclosure authorization and evidence handling
  • Pause and position-freeze procedures
  • Monitoring and incident response
  • Identity binding outside the chain
  • Jurisdiction-specific obligations
Publish deployment-specific addresses, custodians, approved assets, and operating jurisdiction separately from the protocol documentation.

​
Confidentiality summary

The public can observe:
  • Pool, tick, and position accounting
  • Swap amounts and directions
  • Multi-hop routes
  • Limits, deadlines, and token identifiers
  • Public confidential addresses
  • Position token IDs
  • Claim amounts and timing
  • Administrative state changes
The intended confidential path omits the following from public AMM fields:
  • PositionNFT owner
  • Token-record owner
  • Mint recipient
  • Immutable collect withdrawal address
  • Swap blinding factor
  • Signer and immediate caller stored inside encrypted compliance records
The last item is selectively disclosed to the hardcoded investigator account.

​
Attribution capability

The encrypted compliance records give the investigator both:
  • signer: top-level account authorizing the transaction
  • caller: direct account or program invoking the AMM
signer preserves top-level account attribution when caller is an intermediary. Linking that address to a natural person or legal entity requires an external identity registry. Mint records additionally disclose the private position owner and immutable withdrawal address. Swap records disclose the public confidential address. Each record includes the identifiers and request data needed for correlation.

​
Coverage limits

Compliance records exist only for initial mint and swaps. They do not cover:
  • Position increases
  • Position decreases
  • Collections
  • Burns
  • Claims
  • Freeze or unfreeze
  • Pool creation
  • Protocol-fee collection
The initial mint token ID permits later public position tracking. The same encrypted mint record contains the immutable address used by every later collect.

​
Investigator governance

The investigator address is hardcoded. The source defines it as the same address as the initial deployer. Operators must define:
  1. Who controls the account view key?
  2. Is the account private key also retained?
  3. Which personnel and systems can request decryption?
  4. Which can perform decryption?
  5. Are record-specific view keys used for limited disclosure?
  6. How are accesses logged and reviewed?
  7. How is key recovery tested?
  8. What happens after compromise or loss?
  9. How will future records be redirected if the key must change?
  10. How are historical records handled after a rotation?
The contract has no investigator-key rotation transition. Admin transfer does not change the investigator.

​
Administrative intervention

​
Pause controls

The admin can:
  • Disable one pool
  • Pause one token across pools
  • Pause all fee tiers of a token pair
  • Pause the venue globally
These controls block pool creation where applicable, new mints, liquidity increases, and trading. They do not pause decreases, collections, burns, or output claims. Pause does not gate these exit paths. Record ownership, balances, token transfers, and other operation-specific assertions still apply.

​
Position freeze

The admin can freeze a public position token ID. Freeze removes its active liquidity, settles principal and fees into owed balances, and blocks increase, decrease, collect, and burn until unfreeze. Freeze does not transfer value to the admin. It immobilizes the position and removes its market depth. Unfreeze removes the freeze entry and unlocks collection. It does not restore liquidity. The mapping’s block-height value is present only while the freeze is active. Historical freeze evidence requires transaction indexing because unfreeze removes the current mapping entry.

​
Missing intervention controls

The core program does not provide:
  • User or wallet allowlist
  • User or wallet freezelist
  • Address-specific swap block
  • Pending-output freeze
  • Compliance pre-approval hook
  • Risk-score input
  • Automatic sanctions screening
  • Administrative seizure
An existing swap output remains claimable during pause states if the claimant satisfies the normal proof and amount checks.

​
Token eligibility

The token allowlist controls which token programs can be used to create pools. It does not screen participants and does not prove that a token preserves issuer controls. The included wrapper targets a test stablecoin, and its internal ARC-20 transfers do not consult the underlying stablecoin freezelist on every transfer. Verify how issuer controls behave after wrapping and during AMM transfers before enabling a production market. Asset onboarding must cover:
  • Exact token program and edition
  • Issuer freezelist behavior
  • Private transfer requirements
  • Wrapper reserve and redemption controls
  • Upgrade authority
  • Decimal registration
  • Record schema
  • Failure behavior during pause or freeze
  • Whether AMM custody changes the applicable control path

​
Control matrix

​
Claims and limitations

Acceptable technical claims include:
  • Confidential participant identity with public market state
  • Encrypted compliance records for selective disclosure
  • Publicly verifiable concentrated-liquidity accounting
  • Compliance-supporting pause, token eligibility, and position-freeze controls
  • Signer attribution retained across routed program calls
Claims requiring separate legal and operational evidence include:
  • The venue is compliant
  • The venue satisfies a named regulation
  • All participants are screened
  • All position payouts are attributable
  • The system is anonymous or untraceable
  • USDCx issuer restrictions are preserved end to end
  • A freeze creates a permanent in-contract audit record

​
Required operating records

Maintain:
  • Deployed program registry
  • Admin and investigator custody policies
  • Compliance-record parser tests, including routed caller != signer
  • A typed MintComplianceRecord implementation
  • Disclosure runbook and sample redacted evidence package
  • Access-log review procedure
  • Key-loss and compromise exercise results
  • Pause and freeze exercise results
  • Historical state index design
  • Token and wrapper due-diligence reports
  • Identity-binding procedure
  • Data-retention schedule
  • Incident and regulator-notification process