Architecture

Matching pipeline

Shade splits the stack into three planes: a signing client, an off-chain matcher, and an on-chain Uniswap v4 hook. Only the last plane touches Robinhood Chain. The other two never reveal unmatched flow.

1. Client

The dApp at /app constructs typed data, displays the mid, and asks the wallet for an EIP-712 signature. The client never submits a swap transaction. Cancel is another signature over the same nonce.

2. Matcher

Intents are stored in an encrypted book keyed by pool id. The matcher pairs complementary sizes when both mids agree within the signed bound. Partial fills are allowed only when the remaining size stays above the pool’s minimum lot.

• No public gossip of price or size.
• Matches are deterministic given the same book snapshot.
• Expired or cancelled nonces are dropped before pairing.

3. Settlement hook

A solver posts settle(intentA, intentB) to the Shade hook. The hook:

1. Recovers both signers and checks nonces against the on-chain bitmap.
2. Reads the Uniswap v4 pool mid and confirms it sits inside both bounds.
3. Moves tokens atomically and writes fill receipts.

If the mid has moved, the call reverts. Nothing is leaked; the intents remain valid until their deadline.

Trust model

The matcher cannot steal funds: it cannot settle without valid signatures and a passing mid check. At worst it can delay a match. Traders may cancel at any time by invalidating the nonce.