Architecture

Nautilius separates public coordination from confidential price discovery.

The diagram uses SilentLotInstructionSender because that is the immutable name of the verified v0.1 Coston2 artifact.

seller wallet
  ├─ register salted evidence commitments ────────────────→ LandDeal
  ├─ bind auction before encryption ─────────────────────→ SilentLotInstructionSender
  │                                                        └─ FlareTeeManager selects TEE
  └─ sign + ECIES-encrypt CREATE to bound TEE key ────────→ TeeExtensionRegistry

bidder wallet
  └─ EIP-712 sign + ECIES-encrypt offer ─→ server relay ─→ TeeExtensionRegistry
                                                          └─ same selected TEE
                                                              └─ /decrypt
                                                                  └─ TypeScript matcher

TEE/proxy ─ signed ActionResult ─→ browser/Go verifier ─→ LandDeal.consumeClearing
                                                        ├─ verify chain/domain/action/status
                                                        ├─ verify selected TEE signer and replay
                                                        └─ decode fixed clearing payload

selected buyer ─ FTestXRP approve/deposit ─→ LandDeal escrow
seller ─ consent + registry commitments ───→ pull credit ─→ seller
expired/failed completion ─────────────────→ pull refund ─→ buyer

Components

web/ hashes user-selected title evidence locally with 32 bytes of fresh salt, verifies deployment code and live state, binds the TEE before encryption, creates EIP-712 authorizations, encrypts with Go-Ethereum-compatible ECIES, submits transactions, polls signed FCC results and shows explorer receipts. SILENTLOT_RELAYER_PRIVATE_KEY is server-only; it is never included in the browser bundle. contracts/InstructionSender.sol contains the v0.1 registered FCC instruction entry point. The parcel seller first calls bindAuctionTee; all CREATE/BID/CLEAR actions for that auction then use the same machine. Returned registry action IDs are recorded once and cannot overwrite existing bindings. typescript/ is the only Nautilius extension implementation. Ciphertext is passed to the TEE node /decrypt endpoint, then the plaintext is strictly decoded and validated. State is currently process-local: a TEE restart loses open auctions, so the present design needs operational continuity or a future sealed persistence mechanism. contracts/LandDeal.sol stores commitments and lifecycle state, verifies the exact signed FCC result, and holds exact-transfer FTestXRP. It uses pull credits for seller settlement and buyer refunds. tools/ contains generated ABI bindings and Coston2 deployment/verification CLIs. It is not an alternate extension implementation.

Fixed clearing schema

The extension ABI-encodes:

(bytes32 schema, bytes32 auctionId, bytes32 parcelCommitment,
 address seller, address selectedBuyer, uint256 clearingAmount,
 uint32 bidCount, uint64 closesAt, uint64 resultExpiresAt,
 bytes32 receiptCommitment)

LandDeal accepts it only when the schema, parcel, seller, close, action mapping, CLEAR command, expiry, selected TEE signature and replay guards all match.

Failure behavior

Missing deployment, extension, proxy or relay configuration disables the affected path; no fake success is shown.
A rejected wallet request, reverted transaction or failed TEE result remains an explicit error.
An unfunded clearing can be expired after its deadline.
A funded deal that misses consent/completion deadline can expose a buyer pull refund.
Failed outgoing token transfers preserve the corresponding credit because the transaction reverts atomically.

Continue with the privacy and threat model or inspect the clearing-result schema.

Start here

Understand Nautilius

Build and verify

Protocol reference

Components

Fixed clearing schema

Failure behavior

​Components

​Fixed clearing schema

​Failure behavior

Components

Fixed clearing schema

Failure behavior