PROTOCOL DOCUMENTATION
VELUM ARCHITECTURE
Velum is a sealed-bid block-trade protocol. Takers post large orders; LPs quote privately inside an Intel TDX enclave. Best price wins and settles via Jupiter. A cryptographic receipt proves fairness on-chain.
PROTOCOL FLOW
01
Taker posts RFQ
Specifies sell token, amount, max slippage, and auction duration. A reference price from Jupiter Price V3 is shown pre-submission. On-chain create_rfq embeds a per_session_id that links the Solana account to the coordinator's auction state.
02
LPs receive RFQ inside TDX enclave
Whitelisted LPs connect to the coordinator WebSocket. When a new RFQ arrives, each LP calls Jupiter Swap V2 /order to price their quote. The output amount becomes their bid. They submit a hash commitment on-chain (spam prevention) then reveal their price after the auction window closes.
03
Coordinator picks best price
After the reveal window, the coordinator selects the LP offering the highest output amount for the taker. All losing quotes remain sealed — no LP learns a competitor's price. The comparison runs inside the TEE, not in public state.
04
Settlement via MagicBlock PER + Jupiter
The coordinator calls MagicBlock's private transfer API. The winning LP signs the settlement transaction. Funds move from the LP's ephemeral TEE balance to the taker's wallet via Jupiter Swap V2 /execute — MEV-protected managed execution.
05
Attestation issued on-chain
An Intel TDX attestation is recorded in the RFQResult account. It proves: (a) the coordinator ran the audited build, (b) all LP quotes were sealed during the auction, (c) the winning price is correct. Takers download this receipt for compliance.
JUPITER INTEGRATION
Price V3
GET /price/v3
Reference rate shown to taker before posting RFQ. Confidence interval surfaced to set slippage expectations before committing.
Token V2
GET /tokens/v2/search
Mint resolution for the pair selector. Only verified tokens with organic_score > 0.5 are offered — scam filter at API level.
Swap V2 /order
GET /swap/v2/order
LPs price their sealed quote. The requestId is cached and used for instant execution at auction close — no re-quoting race condition.
Swap V2 /execute
POST /swap/v2/execute
MEV-protected settlement. outputAmountResult goes on-chain in RFQResult as immutable proof of execution at quoted price.
Trigger V2
POST /trigger/v2/orders/price
Winning LP immediately hedges inventory with a limit order. OCO type sets take-profit and stop-loss in one call.
TX Submit
POST /tx/v1/submit
Fallback submission path for coordinator finalize_rfq when standard RPC is congested.
KEY DESIGN INSIGHT
The requestId pattern unlocks async RFQ settlement
Jupiter Swap V2's /order → requestId → /execute split was the architectural key for Velum. An LP prices their quote during the auction window and caches the requestId. When they win, they sign and call /execute instantly — no re-fetching, no price staleness, no latency race.
Combined with Jupiter's managed landing (MEV protection built in), the LP's fill is guaranteed at the quoted price. The outputAmountResult from the /execute response is recorded in the on-chain RFQResult account — cryptographic proof that the taker received exactly what was quoted.
ON-CHAIN PROGRAM
PROGRAM ID2QNpH2FgW91EybZjaNpaeWvtW49Sr8ZS9ZLgV1eDHmNU
NETWORKSolana Devnet
FRAMEWORKAnchor 0.30.1
TEEIntel TDX via MagicBlock Private Ephemeral Rollup
SETTLEMENTJupiter Swap V2 + MagicBlock PER private transfer
ATTESTATIONTDX quote stored in RFQResult.attestation_blob
JUPITER DX FEEDBACK
✓
requestId flowExceptional for async RFQ protocols. Caching quotes and executing instantly at auction close is exactly the right pattern.
✓
Managed landing / MEV protectionNon-negotiable for block trades. Not having to implement Jito tip logic ourselves saved days.
✓
Price V3 confidence intervalsUsed to warn takers when pricing is uncertain. Thoughtful addition.
✓
Token V2 organic_scoreScam-filter at the API level. Gating RFQ pairs to verified + high organic_score is a trust signal for institutional traders.
△
V6 sunset migrationNo deprecation header on v6 responses caused ~2 hours of debugging. A 410 Gone pointing to v2 would fix this.
△
requestId TTLLPs need to know when to re-price. Adding requestIdExpiresAt to the /order response would eliminate guesswork.
△
Price impact curve endpointFor block trades, impact across a size range (100K–1M) matters. A single multi-amount impact endpoint would be powerful.