Umbra is a request-for-quote venue for institutional block trades. Competing dealers price the same trade and stay mutually blind, and every settlement is atomic — asset and cash move together or not at all. Guaranteed by the ledger, not by trust.
| Dealer | Instrument | Qty | Price |
|---|---|---|---|
| You · D1 | cBTC / cETH | 0.1 | 34.71 |
| Dealer 2 | cBTC / cETH | 0.1 | |
| Dealer 3 | cBTC / cETH | 0.1 |
Multi-dealer RFQ already works — but it runs on infrastructure where someone always sees everything. On a public chain, every quote sits in a shared mempool for rivals to read and front-run. On a centralized venue, the operator is a trusted party who could peek, leak, or be compelled to. The privacy is a promise. Umbra makes it a property of the ledger.
Every dealer's quote is visible to the venue operator, and on a public chain, to anyone watching the mempool. You trust the operator not to leak or front-run. At settlement there's a window where one leg has moved and the other hasn't.
Canton has no public mempool and enforces visibility per contract: a dealer is a stakeholder only on its own quote, so rival quotes are never disclosed to it. Settlement is one indivisible transaction — both legs move, or neither does. No trusted operator in the loop.
Not claims on a slide. Each is reproducible against the live ledger on Canton DevNet — the kind of thing you can run in front of a skeptic.
Invite two dealers to the same RFQ; both quote. Query the ledger as each: Dealer 1 sees one quote, Dealer 2 sees one, the requester sees both. The contrast is enforced by Canton signatory rules — not by application code filtering results.
Awarding a quote allocates both real legs; settlement swaps one asset for the other — real cBTC, cETH or Canton Coin — in a single transaction. There is no moment where one side holds both. Underfund it and the whole trade is rejected, with nothing stranded.
The same trade lifecycle runs two ways. The toggle isn't a setting; it's the whole argument about what a private venue should require of its participants.
Fast path: the operator holds the rights to submit on each party's behalf. Convenient for onboarding and demos — but the operator is technically able to act as any participant.
Each party is an external Canton party holding its own signing key. Every quote, acceptance, and settlement is signed client-side. The operator relays transactions but cannot forge, impersonate, or act for any participant — it never holds the keys.
No bolted-on privacy layer, no mixers, no zero-knowledge overhead. The guarantees fall out of how Canton works.
Signatory and observer rules decide who sees a contract. A dealer is a stakeholder only on its own quote — rivals are structurally excluded.
One Daml transaction archives the cash and creates the instrument holding together. Indivisible by construction.
Participants onboard as external parties whose identity is their own keypair, signing via Canton's interactive submission.
Settles real BitSafe cBTC, onRails cETH and DSO Canton Coin atomically across issuers on Canton DevNet — via the CIP-56 token standard, not stand-in tokens.
Open the live terminal, run a two-dealer RFQ, and watch each dealer's view withhold what the protocol never disclosed.