ShadowPerp Documentation

Overview

ShadowPerp lets you trade perpetual futures on Solana without broadcasting most position details to the world. Trade size, leverage, and margin are encrypted before they reach the on chain program. Direction is encrypted for the MPC path, then revealed at open for routing and liquidation bookkeeping. Sensitive calculations run through Arcium's MPC network rather than being exposed in plaintext on the ledger.

Only the minimum public state required for settlement is written on chain. The protocol is designed so that position data does not become exploitable public information.

ShadowPerp supports 6 trading pairs: SOL/USD, BTC/USD, ETH/USD, JUP/USD, PYTH/USD, and ORCA/USD. Each pair routes to its own on chain market account. Shared collateral keeps account usage reusable across supported markets, and your selected pair persists across page refreshes.

Devnet Namespace

The current devnet rollout uses a fresh ShadowPerp program and market namespace. These addresses are useful when checking transactions in Solana Explorer or comparing app configuration against on chain state.

How It Works

Each trade follows the same core path:

1. Encrypt — Your browser encrypts sensitive trade inputs including size, price, leverage, and margin before submission. Direction is encrypted for the MPC path and revealed when the position opens.
2. Queue — The encrypted payload is submitted to the Solana program, which queues an Arcium MPC computation.
3. Compute — Arcium's MPC network evaluates trade logic, margin checks, PnL, and liquidation conditions without exposing raw inputs to any single node.
4. Callback — Arcium returns a verified, replay hardened result to the Solana program.
5. Settle — ShadowPerp updates the margin account and position state from the verified output.

Shadow signs directly with your connected Solana wallet. That includes Privy embedded wallets for email users and external Solana wallets connected through Privy.

Wallet Connection

ShadowPerp now uses a direct wallet model. Every trade and collateral action is signed by the connected Solana wallet that is active in the app.

1. You can log in with email through Privy, which creates or reuses an embedded Solana wallet for you.
2. You can also connect an external Solana wallet such as Phantom or Solflare through Privy.
3. Trading and collateral actions are signed directly from that wallet instead of being routed through a separate session layer.

What this means in practice

Privacy Model

ShadowPerp relies on Arcium as the privacy layer behind every trade. Here is the practical boundary between what stays private and what remains visible on chain:

What is private

• Position size
• Entry price
• Leverage
• Margin amount
• Unrealized PnL

What is public

• Your wallet address, used for the margin account and wallet connection
• Token transfers to and from the vault (a Solana constraint)
• Direction after a position opens, used for routing and liquidation bookkeeping
• The fact that a trade was queued, but none of the details

What is becoming private through shielded collateral

• Internal collateral ownership and allocation
• Margin lock and release transitions
• Per user balance within the protocol

Margin and Leverage

ShadowPerp supports two margin modes and leverage up to 50x.

The devnet namespace uses a shared collateral model for adopted markets. Once your wallet is migrated from any legacy per-market margin accounts, a single owner scoped collateral balance can back positions across supported pairs instead of requiring a separate funding bucket per market.

Cross Margin

Your full margin balance is shared across all open positions in cross margin mode. If one position loses, the rest of the balance absorbs it. This can reduce the chance of a single position getting liquidated in isolation, but it also means aggregate losses can draw down the full account.

Isolated Margin

A fixed amount of margin is assigned to one position. If that position is liquidated, only that isolated amount is at risk. The rest of your balance stays untouched.

Leverage

Leverage amplifies both upside and downside relative to your margin. Available range is 1x to 50x. Higher leverage means a smaller adverse move can trigger liquidation.

Order Types

Market Order

A market order executes against the current oracle price. The position is queued for MPC computation and opens once the Arcium callback returns successfully.

Limit Order

A limit order is queued in the browser and triggered when the market price crosses your chosen level. When that happens, the app submits the order from your connected wallet.

Take Profit and Stop Loss

Each open position can carry optional take profit and stop loss rules. These are stored locally and monitored by the client.

• Take Profit closes the position when price reaches your upside target.
• Stop Loss closes the position when price hits your downside protection level.

You can set take profit and stop loss in the trading panel before opening a position, or edit them later from the position row. Use the Save action to confirm the rule.

Validation Rules

• For long positions, take profit must be above entry and stop loss must be below entry.
• For short positions, take profit must be below entry and stop loss must be above entry.
• Both levels must be at least 0.10% away from entry price.

Liquidation

A position is liquidated when its health ratio falls below the maintenance threshold. The health ratio is calculated as:

Health = (Equity / Maintenance Margin) x 100%

• Liquidation threshold is set per market in basis points and enforced by the on chain program.
• Liquidation penalty is 5% to the liquidator with the remainder returned to the trader.

In cross margin mode, your full balance acts as equity. In isolated mode, only the allocated margin for that position counts.

Shielded Collateral

ShadowPerp has the base shielded collateral flow deployed on devnet. Deposits, private withdrawal requests, proof verification callbacks, and delayed finalization are all live. The remaining work is private margin lock and private position settlement through Arcium MPC.

How it works

1. Deposit — You deposit collateral to the vault. The token transfer is public because that is a Solana constraint, but the protocol records a private commitment in a Merkle tree instead of updating a plaintext balance.
2. Trade — Margin lock and release transitions happen through Arcium MPC, consuming and producing commitments without revealing your internal balance to anyone.
3. Withdraw — You first create a pending withdrawal, then queue an Arcium MPC proof check. Finalization only happens after the callback marks the withdrawal as verified and the delay window has passed.

What stays private

• Your internal balance within the protocol
• How much margin is allocated to each position
• The connection between deposits and trading activity

What remains public

• Token transfers to and from the vault (a Solana L1 constraint)
• The fact that a deposit or withdrawal happened
• Transaction timestamps

FAQ

Do I need to keep the browser open?

For market orders, the callback path continues after submission, so you do not need to keep the tab open just to keep the request alive. For limit orders, take profit, and stop loss automation, yes. Those flows still run in the browser and need the tab to stay open.

How do I deposit collateral?

Click Collateral in the trading panel, or use the deposit button in the portfolio summary. You need to deposit collateral before opening a position. On devnet, you can claim test mUSDC from the onboarding flow when you first connect your wallet. It goes straight into your Shadow margin account.

Why does the app sometimes say price unavailable?

ShadowPerp now blocks market-order submission when it does not have a trusted live or cached reference price. It does this on purpose instead of silently falling back to mock pair pricing in the trade path.

Why does my position show Queued or Finalizing?

Both states mean the trade was submitted successfully and is moving through the protected callback path. Queued means Shadow is waiting for the Arcium MPC callback to return. Finalizing means the callback completed and the remaining on chain settlement steps are finishing. On devnet this typically takes 30 to 120 seconds depending on cluster load. If it takes longer, the cluster may be temporarily delayed. Your collateral stays safe and the position will either resolve once settlement completes or move to a terminal state if the callback aborts on chain.

Is my data stored anywhere?

Trading preferences, automation rules, cached activity, layout preferences, and RPC settings are stored in your browser's localStorage. On chain position state is always read directly from Solana, but the app keeps a few local convenience snapshots so the interface can restore faster. Server-backed features like history routes and market data helpers may receive your public wallet address when needed to fulfill a request.

Is position history a full ledger yet?

Position history is reconstructed from closed and liquidated position accounts, then labeled that way in the UI. It gives you useful review context without pretending to be a full accounting export.

Can I use ShadowPerp on mainnet?

ShadowPerp is presented as a devnet experience today. Treat it as a place to learn the flow, test wallet behavior, and explore the privacy model with test funds.