Private OTC desk · XRP ↔ FXRP · Flare Confidential Compute
Move size in a whisper. Settle it on-chain.
A dark OTC desk for institutional XRP↔FXRP block trades. Quotes are sealed inside a Trusted Execution Environment, so no one front-runs your order — and settlement is delivery-versus-payment: the escrow releases FXRP only against a Flare Data Connector proof of the exact XRPL payment.
The problem, and the fix
Public DEX or a trust-me OTC chat, versus a sealed desk with proof.
Without WhisperDesk
- Order visible before it fills — anyone watching the mempool can front-run you.
- Price moves against you — thin FXRP liquidity means real slippage on size.
- OTC has no settlement guarantee — you send first and hope they pay.
Outcome: leaked intent, worse fills, counterparty risk.
With WhisperDesk
- Quotes sealed in a TEE — side, size, and counterparty never exposed.
- Fair price enforced on-chain — within ±1% of the live FTSOv2 mid, or the contract reverts.
- Settlement proven, not trusted — FXRP releases only against an FDC proof of payment; default slashes the maker's 1% bond to you.
Outcome: private execution, guaranteed delivery-vs-payment.
How a trade settles
Watch the money move.
Three parties. Nothing leaks. Nobody gets stiffed. Follow the trade from a sealed order to money in hand — and see exactly what happens if the buyer never pays.
Taker
You
Escrow
WhisperDesk Vault
Maker
Counterparty
You place a private order
Your side and size are encrypted before they ever leave your browser — the market can't see what you're about to do.
5,000 FXRP · encrypted
The safety net: if the buyer never pays before the deadline, the vault refunds you automatically — and the deposit they staked is yours.
The trust model
Trust the enclave for secrecy. Trust the chain for the rules.
Private · enclave
Trusted for secrecy
The sealed order book, the matching engine, and the TEE signing key live here. This layer authorizes matches — it never holds funds.
- Sealed RFQ book
- In-band matching
- TEE signing key
On-chain · Coston2
Enforces every rule
DvPEscrow and BondLedger verify the enclave's signature, re-check the FTSOv2 band, consume the FDC proof, and run the deadline + slashing logic.
- Verify enclave signature
- Re-check FTSO band
- Consume FDC proof · slash on default
Worst case
Bounded, not catastrophic
A fully-compromised enclave can at most fill at the edge of the ±1% band — a quantified 1% loss, never theft. The enclave never custodies funds.
- Max loss ±1% of mid
- Funds never pass through the TEE
- No key custody, no theft path
The receipts
Not a mockup — it settled on-chain.
enclave-signed lock() — nothing self-signed
ecrecover == live enclave 0x5656…c18B
tx 0x58ec…d1db
enclave loop · release() → maker got FXRP
sealed RFQ → TEE match → FDC proof → settled ✓
tx 0xb6b0…dfad
XRPL payment
tesSUCCESS
tx 097B23FD…BAA6
FDC proof
XRPPayment · status 0 · bound to escrow
release() → maker received FXRP
settled ✓
tx 0x2c16…202f
default path · refund() → taker
principal + 1% slashed bond · settled ✓
tx 0x1605…feed