Reference
Contracts and security
What each contract does, what is public, and what the admin can do.
Nightshade's rules live in its contracts, and Midnight enforces them. This page says what those rules guarantee, what stays private, and what Nightshade's admin keys can still do.
What the contracts do
Midnight checks every transaction against the contract's rules, through the proof the sender's wallet makes. Nobody can skip a rule, Nightshade included.
The order book holds every public market, pool, queued swap, stop and trade, and the tokens in them.
- A pool's tokens leave it only through a trade at its price, or to its own makers when they withdraw.
- A trade can't fill past the taker's limit, and pays what the price says, rounded in the makers' favour.
- A new order or pool can't list at or through the other side of the book.
- Pool shares are minted and burned exactly, with rounding against whoever joins or leaves, so nobody can take value from other makers by joining and leaving.
- A batch checks every swap's share of the trade and of the proceeds, and its fee and limit, so whoever sends it can't change anyone's price.
- Amounts are capped at 2^120 units, so the arithmetic can't overflow.
The Shield holds the public tokens behind every private twin, one for one, and runs the Private Book with the same rules over twins. It never keeps a private coin: it burns what comes in and mints what goes out.
The sale has two parts. On Cardano, one escrow script holds every NIGHT payment until the close: then at most the cap goes to Nightshade's treasury, and the rest goes back to the addresses that paid. On Midnight, the sale contract mints SHADE's supply once and pays each buyer's share after the close.
What is public and what is private
| Public | Private | |
|---|---|---|
| Public Book | Markets, prices, pools and amounts, every trade, and the addresses tokens move to and from | Your orders and pool shares are kept under a key from your wallet's secret, not your address |
| Shield | Each shield and unshield: address and amount | Holding and sending twins |
| Private Book | Markets, prices, pools and amounts, every trade | Who traded and who owns which pool |
| Dark Pool | Each day's total volume per market | Tokens, amounts and parties. Nightshade's operator sees each order's terms |
What the admin can do
On the order book, Nightshade's admin key can:
- Set the taker fee, up to 1%.
- Withdraw collected fees, to any address it names (Fees).
- Repair a market: reset a pair opened with an unusable minimum, or a token listed with the wrong decimals. The book starts empty, and every old pool can still be withdrawn in full.
- Correct a token's listing: re-list its name, symbol, decimals and image, and set its website and social links.
On the Shield, its admin key can pause new shielding (unshielding always works), list and repair Private Book markets, set the Private Book's fee up to 1%, and collect its fees.
On the sale, its admin can call the sale off, which returns every deposit in full. That's how the sale's floor is kept: the escrow enforces the cap and the refunds, and if less than the floor comes in, the admin calls the sale off (Nightshade's settlement tooling refuses to settle under it). After the sale closes, the admin collects what it raised and any unsold SHADE.
No admin can move anyone's tokens out of an order, a pool, a stop or the Shield, and none can lock them, except by replacing a contract (see the next section). Nightshade's own liquidity isn't locked either.
Contract upgrades
Midnight contracts have a maintenance key that can replace a contract's circuits. While Nightshade is on the Preview testnet, Nightshade keeps that key so fixes can ship, and new versions are often deployed fresh, without carrying balances over. How the key is held for mainnet will be published here before mainnet opens.
The Dark Pool operator
The Dark Pool's keeper runs on Nightshade's servers with its own wallet. It can't change an order's amounts or take anything its maker didn't offer, because the maker's wallet proved the order. It does see every order's terms, and it decides whether and when to fill within the public rule. Orders expire, and makers can cancel at any time.
Contract source
The contracts' source isn't published.