Skip to main content
Nautilius protects offer contents before they enter the public FCC instruction. It does not make the entire transaction private.

​
Data boundary

Encrypted before submission

Seller reserve and configuration; bidder wallet; offer amount; expiry; nonce; and signed authorization.

Public by design

Ciphertext length and timing; fees; auction and parcel commitments; selected TEE; action ID; transaction sender; selected buyer; clearing amount; and settlement state.
Losing offer plaintext exists in the selected TEE process memory while the round is open. The extension does not return losing bidder identities, amounts, nonces, or expiry values in clearing results or state reports. Open-auction state is process-local, so a TEE restart currently loses the round.

​
Relay boundary

The optional funded server relay submits bid ciphertext so the bidder wallet is not the public transaction sender. The relay can observe IP and timing metadata, censor a request, or become unavailable. It cannot forge the bidder’s EIP-712 authorization or decrypt ECIES ciphertext. If the relay is unavailable, the live interface fails closed. It does not present direct bidder submission as private.

​
Cryptographic boundary

  • ECIES uses the Go-Ethereum scheme expected by tee-node: secp256k1, SHA-256 concat-KDF, AES-128-CTR, and HMAC-SHA-256.
  • A browser/Go fixed vector pins the wire format.
  • Seller and bidder EIP-712 messages bind Coston2 chain 114, the sender, LandDeal, extension, selected TEE, auction, parcel, nonce, and expiry.
  • The verified v0.1 sender requires the historical EIP-712 domain name SilentLot. Nautilius preserves this exact compatibility value until redeployment.
  • FCC result verification reconstructs the official TEE_ACTION_RESULT chain-domain payload and EIP-191 signer recovery.
  • Result actions and hashes are single-use. The selected TEE, CLEAR command, auction fields, status, and expiry must match.
Cryptographic checks do not prove that confidential-compute hardware, Google PKI, the proxy transport, or the build supply chain is flawless. A production claim requires current registry membership, key, code hash, platform, and fresh attestation verification.

​
Contract and token risks

LandDeal rejects zero values, duplicate parcel commitments, replayed results, high-s or malformed signatures, fee-on-transfer behavior, and balance-delta mismatches. Reentrancy guards protect token-transfer paths. Deadlines create cancellation and refund exits. The contracts are unaudited hackathon software. The escrow assumes FTestXRP behaves as a conventional exact-transfer ERC-20. Nautilius has no dispute adjudication, upgrade path, or emergency governance. Continue with evidence and legal boundaries or verify production attestation.