PinTool MM

Demo

About

PinTool Market Making removes the trust barrier between strategy creators and capital owners on 1inch Aqua. A Strategy Provider publishes a market-making strategy while keeping its activation rules, thresholds and sizing logic private. A Maker picks a strategy and sets private risk limits: total budget, maximum inventory share, per-fill caps and authorization lifetime. Neither side ever sees the other's inputs. A Chainlink Confidential Workflow intersects both policies inside a TEE (handlerInTee). Provider policies are Vault DON secrets; Maker limits are sealed in the browser and opened only inside the enclave. The workflow publishes only the minimal authorization the chain needs, a Guard report with allowed directions, per-swap caps, inventory caps and expiry, and it can only make the Maker's limits stricter, never looser. PinTool Guard sits behind SwapVM's Extruction instruction and checks every Aqua fill against that authorization, reverting anything outside it, so a strategy halts the moment the workflow stops renewing it. Funds never leave the Maker's wallet; one balance can back several strategies with at most one active at a time. Strategies are published under ENSv2 names on Sepolia so Makers pin a verified, immutable release. Everything runs end to end on Ethereum Sepolia with canonical WETH and Circle USDC: a public run of 40 transactions shows guarded swaps on two strategies plus an expected on-chain rejection, and the mandate service independently verifies every Guard report and Aqua receipt before the app shows it.

How it's made

Confidential workflow (workflow/, TypeScript, Bun, @chainlink/cre-sdk): a cron- or HTTP-triggered handlerInTee callback fetches the Provider strategy and the Maker limits with getSecrets(), reads live ETH/USDC market data from Kraken, runs a pure intersection function (the stricter side wins on every cap; inventory caps are derived from budget × share at the mid price; paused reports zero every cap), ABI-encodes the Guard report and crosses back with usingTheDons() so the DON signs it and the forwarder delivers it to PinTool Guard's onReport(bytes,bytes). The encoding is golden-tested byte for byte against the fixture the Solidity side decodes, and a leak-check script diffs every secret value against the simulation output. Local CRE CLI simulation broadcasts real reports through Chainlink's Sepolia simulation forwarder. Contracts (contracts/aqua-executor/, Solidity, Foundry): the official 1inch Aqua and SwapVM sources are built unmodified at pinned commits. PinTool Guard implements the Extruction interface and is the terminal instruction of every Maker-approved program, so each fill is validated before any token moves. It enforces direction, per-swap amount, post-swap inventory and expiry per (maker, strategyHash), with strictly increasing nonces and standing authorizations the Maker can revoke. Official Aqua deployments require a KycNFT, so we redeployed Aqua and the SwapVM router on Ethereum Sepolia. Mandate service (orchestrator/, Node, Railway): validates requests, signs CRE HTTP-trigger calls, runs the confidential runner and independently verifies every Guard report and Aqua receipt from Sepolia RPC before the web app shows it, with a durable event outbox, serialized deliveries and restart recovery. Web app (frontend/, Next.js 15, React 19, Privy, viem, static export): marketplace, Provider Studio with an AI-assisted strategy builder (Vercel AI SDK + OpenAI), a Maker mandate flow that seals limits in the browser with noble ciphers, an activity monitor, and ENSv2 strategy names on Sepolia (namespace registrar, delegated version pointer, Maker-pinned releases). Hard parts: EVMClient has no TeeRuntime overload, so on-chain writes must cross out of the enclave; SwapVM's Extruction has no try/catch, so a veto must revert; the SDK's opcode table lagged the contract; and Extruction args are capped at 235 bytes, so the Guard report lives in PinTool Guard's storage and only a public envelope goes into the bytecode. Codex and Claude Code were used heavily across contracts, workflow and frontend, with the team owning product, privacy model and verification (see AI_USAGE.md).