AngelSwap

An order on a public chain is public before it executes. Anyone watching can see the intent and act on it first. Existing privacy tools solve this by moving liquidity into a separate shielded pool, which protects the trade and splits the market in half.

The question worth answering was whether a trade could be private without its liquidity being private too.

The first generation established the exchange itself, in Solidity on an EVM chain: the native token, a template for issuing others, a liquidity pool and its factory, an order book with real limit orders, a faucet, and the interfaces between them.

The second generation is where the zero knowledge work happened. Three Noir circuits, for deposit, swap, and withdraw, each with its own tests and each generating a Solidity verifier that is then exercised from a separate test harness, so the circuit and the contract that checks it are proven to agree.

Around them, the privacy contracts, the three off chain services, and a trading interface across landing, trading, liquidity, portfolio, and staking.

Three layers cooperate on every trade.

In the browser, a private trade generates its proof locally in a web worker. Nothing that identifies the trader leaves the machine, and the proof is handed to a relayer for submission, or sent directly on chain if no relayer will take it.

Off chain, a matcher maintains a price and time priority order book rebuilt from on chain events rather than persisted, so it holds no state anyone has to trust. A keeper scans the book and submits matched batches with validity proofs. A relayer submits shielded transactions on behalf of people who should not have to reveal an address to trade. Keepers and relayers stake the native token and are slashable, so the roles are open to anyone and still accountable.

On chain, an adapter verifies the proof, checks and marks the nullifier, and forwards the call into the public pool. That last step is the design decision the whole thing turns on: a shielded trade routes into the same liquidity every public trade uses, so privacy does not fragment the market.

Protocol architect and lead developer across both generations. The contracts, the circuits, the off chain services, and the trading interface.

The zero knowledge layer took the longest by a distance, and it was worth it.

The Merkle helper the circuits would naturally have used was removed from the language in its first stable release, so the tree, thirty two levels deep, is built by hand from a Poseidon hash of pairs. Getting that right means getting it right identically in three places: the circuit, the contract, and the browser, since a root computed even slightly differently is a proof that verifies against nothing.

Double spending is prevented by a nullifier derived from the secret rather than from the note, so a spent note cannot be re-presented under a different disguise.

Proving in the browser at all. A proof that takes too long is a trade the user abandons, which puts a hard ceiling on how much the circuit is allowed to do.

The first generation worked and was not private. The second is the one worth showing, and the gap between them was mostly spent learning to think in constraints rather than in statements. Nothing about that transfers from writing Solidity.