Uniform Batch Auctions
for Onchain Markets

Orders should compete on price and size, not network position.

Nightshift is a proposed decentralized exchange architecture that clears limit orders in discrete epochs. Traders commit hidden order intent, reveal valid orders after the collection window, and settle eligible trades at a single deterministic price. The design aims to reduce information leakage during order collection and soften the advantage of transaction ordering within an epoch.

The protocol does not eliminate market risk, adverse selection or extractable value. It narrows one part of the execution surface by replacing continuous first-come execution with published batch rules.

Continuous execution turns latency into an economic input.

Pending orders can reveal direction, size and price before settlement. Searchers may react to visible intent, reorder transactions or trade around a user. Faster inclusion can become more valuable than better price formation.

A three-state epoch.

Orders that fail to reveal expire. Production parameters must define penalties, refunds and timing bounds before deployment.

Maximize volume. Minimize imbalance. Resolve ties deterministically.

demand(p) = Σ buy.amount where buy.limit ≥ p
supply(p) = Σ sell.amount where sell.limit ≤ p
volume(p) = min(demand(p), supply(p))

Select p* by:
1. maximum volume(p)
2. minimum |demand(p) - supply(p)|
3. minimum distance to the epoch reference
4. lower price as the final tie-break

Buy orders at or above p* and sell orders at or below p* are eligible. If one side exceeds matched volume, fills are allocated pro rata by order size. Every eligible fill settles at p*.

Net flows, explicit accounting.

A SettlementVault escrows order assets during the epoch. After clearing, it computes each account’s input consumed, output owed, fee charged and refund. Transfers can be netted per token to reduce overhead.

Integer token units require a public rounding policy. Residual dust must follow a deterministic rule and never be assignable by the transaction sender.

Commit–reveal changes the attack surface; it does not erase it.

• Withholding: a trader can refuse to reveal after observing external markets.
• Capital lock: escrowed assets remain unavailable through the epoch.
• Griefing: excessive commitments can raise verification and settlement cost.
• Reference manipulation: the tie-break reference must be narrowly scoped.
• Contract risk: vault and accounting logic require independent audits.

Network Alpha carries no audit claim. Production deployment requires public contracts, reproducible builds, a bug bounty and constrained emergency controls.

Parameters should move slowly and visibly.

Governance may control epoch duration, approved quote assets, minimum order size, commitment bond and protocol fee. Changes should be timelocked and bounded by immutable limits.

No NIGHT token allocation, sale, supply or governance rights are defined in version 0.1.

From deterministic prototype to permissionless settlement.

1. Phase A — Specification. Freeze clearing rules, rounding and adversarial test vectors.
2. Phase B — Public testnet. Deploy escrow, epoch manager and permissionless clearing.
3. Phase C — Audit campaign. Independent review, invariant testing and open bug bounty.
4. Phase D — Mainnet candidate. Publish verified source, production addresses and governance controls.