Private OTC settlement · XRP ↔ FXRP · proven live on Coston2
Move size in a whisper. Settle it on-chain.
Institutional XRP↔FXRP block trades, settled across two chains with no trusted middleman. Quotes are sealed inside a TEE, so nothing can be front-run in flight — and FXRP is released only against an FDC-proven XRPL payment. Proven end to end on Flare testnet.
- 2 ledgers
- settled against one proof
- Sealed
- size never leaves the enclave
- 1% bond
- slashed if the maker defaults
Sealed RFQ · WD-LIVE-1
Your view · Maker
You quote blind. This is not a redacted view — the enclave never disclosed those fields. The band is public on purpose: the escrow re-checks it on-chain.
The problem, and the fix
Public DEX or a trust-me OTC chat, versus a sealed desk with proof.
Without WhisperDesk
- Order visible before it fills — anyone watching the mempool can front-run you.
- Price moves against you — thin FXRP liquidity means real slippage on size.
- OTC has no settlement guarantee — you send first and hope they pay.
Outcome: leaked intent, worse fills, counterparty risk.
With WhisperDesk
- Quotes sealed in a TEE — side, size, and counterparty never exposed.
- Fair price enforced on-chain — within ±1% of the live FTSOv2 mid, or the contract reverts.
- Settlement proven, not trusted — FXRP releases only against an FDC proof of payment; default slashes the maker's 1% bond to you.
Outcome: private execution, guaranteed delivery-vs-payment.
How a trade settles
Watch the money move.
Three parties. Nothing leaks. Nobody gets stiffed. Follow the trade from a sealed order to money in hand — and see exactly what happens if the buyer never pays.
On size:this walkthrough is production-sized — 5,000 FXRP, WhisperDesk's real minimum block. The live demo below settles 1 FXRP for 1 XRP per run, since testnet XRPL faucets can't fund a 5,000-XRP counter-payment — the receipts further down are those 1-FXRP settlements.
Taker
You
Escrow
WhisperDesk Vault
Maker
Counterparty
You place a private order
Your side and size are encrypted before they ever leave your browser — the market can't see what you're about to do.
5,000 FXRP · encrypted
The safety net: if the buyer never pays before the deadline, the vault refunds you automatically — and the deposit they staked is yours.
The trust model
Trust the enclave for secrecy. Trust the chain for the rules.
Private · enclave
Trusted for secrecy
The sealed order book, the matching engine, and the TEE signing key live here. This layer authorizes matches — it never holds funds.
- Sealed RFQ book
- In-band matching
- TEE signing key
On-chain · Coston2
Enforces every rule
DvPEscrow and BondLedger verify the enclave's signature, re-check the FTSOv2 band, consume the FDC proof, and run the deadline + slashing logic.
- Verify enclave signature
- Re-check FTSO band
- Consume FDC proof · slash on default
Worst case
Bounded, not catastrophic
A fully-compromised enclave can at most fill at the edge of the ±1% band — a quantified 1% loss, never theft. The enclave never custodies funds.
- Max loss ±1% of mid
- Funds never pass through the TEE
- No key custody, no theft path
What we prove, live
Not a mockup — it settled on-chain.
Four guarantees, each backed by a transaction you can open. Signed by the live enclave, verified by the real Flare Data Connector, settled on real Coston2 and XRPL testnet.
P1 · No self-signing
Nothing here is signed by us
The instruction that moved the funds was signed inside the enclave with its own key, and the escrow recovered that signature on-chain before touching anything. The desk cannot forge a match for itself.
P2 · Cross-chain DvP
Delivery only against proven payment
FXRP is released when — and only when — the Flare Data Connector proves the exact XRPL payment landed before the deadline. The two legs live on chains that cannot see each other, so the proof is the only bridge between them.
P3 · Default path
A no-show costs the maker, not the taker
If the XRP never arrives, the taker gets their principal back plus the maker's slashed 1% bond. The failure path is a designed outcome that settles — not an error that strands funds.
P4 · Real asset
The desk settles genuine FXRP
Every seat in the live demo settles FAssets-minted FXRP — no mock, no stand-in. The first supply came from XRP we sent into the Core Vault ourselves; visitors get theirs from Flare's own faucet, which is what let the placeholder go entirely.