Solana × Ika × Oro/GRAIL × Encrypt FHE·2026

Borrow against
gold, BTC,
anything.

Veil is the first lending protocol on Solana where you can borrow against native Bitcoin, physical gold, or any on-chain asset — with an optional privacy layer. No bridges, no wrapping.

Launch appSee the 60-second walk-through
Devnet live · mainnet on roadmap·Non-custodial·Source-available · BSL 1.1
VAULT · VLT_0x3F…A91 · SOLANA
LIVE
Native Bitcoin vault
btc::1P…qL9x·signed by Ika dWallet · MPC 2-of-3
COLLATERAL
◉◉◉.◉◉◉◉ BTC
ct: 7fA9·12Ce·88aD
BORROWED
$◉◉,◉◉◉ USDC
ct: E4b2·9C01·F7dd
HEALTH
◉.◉◉×
ct: A1b3·44Cc·ZzQ9
FHE ORACLE STREAM
slot 287,394,112
  • FHEhealth rebasenow
  • PYTHBTC $63,4101s
  • RATEkink tick 6.2%5s
  • dWALLET2-of-3 co-sign9s
Solvency proof verified·REFHE
Two structural gaps

Solana is the best venue for onchain capital — until you ask why billions still sit still.

Every position, balance, and liquidation price is published to the world, and any non-Solana asset — including BTC, ETH, and physical gold — has to trust a bridge or custodian to get on-chain. That's a non-starter for funds, market makers, and institutions. Veil closes both gaps with a single protocol.

Gap 01L I Q U I D I T Y

The collateral is on the wrong chain.

The world's BTC, ETH, and physical gold can't be pledged on Solana without a bridge or a custodian. Bridges introduce custody risk and trusted third-parties — so institutions keep trillions in capital idle instead of pledging it.

bridge.risk.stack×
warn custodian_multisig ⟶ 3-of-5 external signers
warn wrapped_supply ≠ native_supply
warn smart_contract_risk on two chains
warn bridge_halt_incident ×14 last 3y
Gap 02T R A N S P A R E N C Y

Your position is a spreadsheet for your competition.

Collateral ratio, liquidation price, strategy — all visible to anyone with an RPC call. That's why a meaningful share of sophisticated capital still stays off-chain.

rpc getAccountInfo(VLT_0x3F…A91)200
{
  collateral_btc:  1.8421,
  debt_usdc:       84,203,
  health_factor:   1.184,
  liq_price_btc:   46,218,
  owner:           GJf…Nq
}

Veil closes both at once — native BTC/ETH via Ika dWallet, physical gold via Oro/GRAIL, encrypted state via Encrypt FHE, all coordinated by a Pinocchio program on Solana.

See how the protocol works
How it works

Five moves, one protocol.

Solana coordinates capital from every chain — native BTC, native ETH, and physical gold. Privacy is a toggle, not an L2 detour.

  1. 01
    Pledge collateral

    Lock BTC, ETH, or physical gold — on its own chain.

    BTC and ETH stay in an Ika dWallet, jointly controlled by you and Ika's MPC network — no bridge, no custodian. Physical gold is pledged via Oro's GRAIL platform, which handles custody and compliance so you don't have to.

    Native BTCNative ETHPhysical Gold via OroMPC 2-of-3
  2. 02
    Coordinate on Solana

    A Pinocchio program tracks collateral, debt and rates.

    Zero-dep, zero-copy. The lending program enforces pool invariants, a kink-curve interest rate, and a health factor engine with compute units that scale with liquidation load.

    PinocchioKink IRMPool invariantsPyth oracle
  3. 03
    Borrow in private

    Flip the privacy toggle. Balances become ciphertext.

    Encrypt's REFHE stores amounts and debt as ciphertext on-chain. Health factor and solvency are computed over encrypted data — observers see nothing, the protocol verifies everything.

    FHE / REFHEEncrypted balancesEncrypted HFPublic invariants
  4. 04
    Flash loans

    Borrow without collateral — atomically, in one transaction.

    Take any amount from the pool with no collateral required. Return it with a 0.09 % fee in the same transaction or it reverts. Useful for arbitrage, on-chain liquidation bots, and collateral swaps. 90 % of fees go to LPs.

    No collateralAtomic repayment0.09 % fee90 % to LPs
  5. 05
    Liquidate cross-chain

    When health breaks, the dWallet signs settlement natively.

    An unhealthy position triggers an on-chain instruction that asks the dWallet's MPC network to co-sign a transaction on the asset's native chain. No wrapped IOU, no bridge round-trip.

    Cross-chain settlementMPC co-signOn-native liquidationNo wrapped IOU
Architecture

Solana becomes the coordination layer for capital from every chain.

Native collateral stays on its origin chain. Physical gold stays in Oro custody. The Solana program governs all invariants, and Encrypt's FHE layer keeps every amount as ciphertext.

Origin chainika::dWallet
Bitcoin
Native UTXO held by dWallet
MPC 2-of-3co-sign ready online
Origin chainika::dWallet
Ethereum
Native account held by dWallet
MPC 2-of-3co-sign ready online
Physical assetoro::grail
Gold · XAU
Custody via Oro/GRAIL
Oro/GRAIL custodyregulatory compliant verified
Solana · Pinocchio ProgramVLT_core_v0.3
Pool invariants
utilization-capped liquidity
Kink IRM
dynamic borrow rate
Health engine
solvency over ciphertext
Liquidation router
dispatches dWallet sigs
instructionsix 4 / CU ~2.1k
ix deposit_native(vault, proof_of_lock)
ix deposit_gold(oro_attestation)
ix borrow_encrypted(amount_ct, max_slip)
ix liquidate(unhealthy_vault) ⟶ dWallet::sign
Pyth oracle
sub-second price feeds
BTC $63,410 · XAU $2,940
Privacy layerencrypt::refhe
Encrypt · FHE
REFHE computes over ciphertext
ct collateral_enc = enc(1.8421 BTC)
ct gold_enc = enc(42.5 oz XAU)
ct debt_enc = enc(84,203 USDC)
fn health(ct_c, ct_d, px) ≥ 1.0
// observer sees: ct bytes only
Public invariants
  • Solvency enforced onchain
  • Utilization < cap
  • Rate curve monotonic
  • Liquidation atomic w/ dWallet
  • Gold custody verified by Oro
Protocol layers
Ika Layer
Cross-chain · MPC
dWallet Registry
per-asset dWallet map
Collateral Vault
BTC · ETH · XAU (Gold)
Signing Policy
liquidation-triggered sign
MPC Network
2-of-3 co-signer
BTC / ETH / Gold
native assets
Core Lending
Pinocchio · Solana
Liquidity Pool
deposits · supply · borrows
Kink IRM
utilization rate curve
lTokens
receipt mint
UserPosition
collateral + debt PDA
Health Engine
solvency over ciphertext
Liquidation Router
dispatches dWallet sigs
Pyth Oracle
price feeds
Encrypt Layer
FHE · REFHE
Enc. Position
FHE ciphertext balances
FHE Compute
encrypted health factor
Plaintext Path
privacy-off fallback
FHE Keys
Encrypt service
Ika dWallet flowEncrypt FHE flowLiquidation cross-layerPyth price feedOro/GRAIL gold custody
Privacy, per position

One toggle. Every number becomes ciphertext.

With Encrypt's REFHE scheme, your collateral, debt and health factor are stored on-chain as ciphertext. The lending program proves solvency without ever decrypting — observers see bytes, not dollars.

  • No visible collateral ratio — no liquidation targeting
  • No visible borrow amount — no strategy leakage
  • No visible liq price — no front-running your unwind
  • Invariants like health ≥ 1 still hold, verifiably
PrivacyON
POSITION · VLT_0x3F…A91
encrypted
Collateral
◉◉◉.◉◉◉◉ BTC
Borrowed
$◉◉,◉◉◉ USDC
Liq. price
$◉◉,◉◉◉
Health factor
◉.◉◉×
Utilization
◉◉.◉%
getAccount() → ct: 7fA9·E4b2·88aD
Zero-dep · Zero-copy

Built on Pinocchio. Lower CU, deeper headroom.

The core lending program — pool, kink IRM, health engine, liquidations — is written from scratch on Pinocchio, Solana's zero-dependency, zero-copy framework. That leaves compute units for the things that actually matter at scale: repeated health checks and liquidations under load.

~3×
lower CU / instruction vs Anchor-equivalent
0
external crate deps in the hot path
O(1)
per-position health check
veil::healthno_std · zero-copy
pub fn health_factor(
  c_ct: &Ct, d_ct: &Ct, px: &Price,
) -> FheBool {
  // compute over ciphertext
  let c_usd = fhe_mul(c_ct, px.collat);
  let d_usd = fhe_mul(d_ct, px.debt);
  fhe_ge(c_usd, fhe_mul(d_usd, LLTV))
}
COMPUTE UNITS · PER IX
Anchor baseline Pinocchio
  • borrow
    38,400 CU→12,100 CU
  • repay
    29,800 CU→9,400 CU
  • health_check
    14,200 CU→3,900 CU
  • liquidate
    51,200 CU→17,400 CU

Indicative figures for planning. Final numbers pending mainnet benchmark.

Who it's for

Built for capital that can't be seen moving.

Portfolio managers, market makers, DAO treasuries, and gold holders each get the same primitives — native collateral, encrypted state, cross-chain settlement — with different use cases.

Alex
Portfolio Manager
"I'm not pledging native BTC to anything I can't walk away from."
Cares about
CustodyPrivacyLiquiditySimplicity
Win with Veil · Native BTC / ETH as collateral without adding a trust layer, positions encrypted end-to-end.
Bob
Market Maker
"Visible inventory is a subsidy I'm paying my competitors."
Cares about
Execution speedStrategy hidingLow feesThroughput
Win with Veil · Borrow on demand, deploy into MM / arb, repay fast — with inventory hidden from mempool watchers.
Charlie
DAO Treasury Manager
"We need yield without forcing the DAO to vote on a bridge."
Cares about
Governance-friendlyConservative riskAuditable invariantsNo contentious bridges
Win with Veil · Unlock treasury BTC / ETH for yield while keeping positions and strategy off the public feed.
Diana
Family Office · Gold Holder
"My gold has sat in custody for a decade earning nothing. That has to change."
Cares about
Gold productivityTradFi-grade custodyNo counterparty riskSimple integration
Win with Veil · Pledge physical gold via Oro/GRAIL as DeFi collateral — the first time gold has ever been productive on-chain.
The stack

Built on primitives designed to upgrade in place.

Veil works today as a full lending protocol, and upgrades without migration as Ika and Encrypt reach mainnet. Oro/GRAIL makes physical gold live from day one.

L1
Solana
Settlement + coordination

Sub-second finality, global liquidity, the only L1 with the throughput profile Veil's compute model is designed for.

Runtime
Pinocchio
Zero-copy program framework

Veil's lending core is built from scratch on Pinocchio — fewer deps, lower CU, more headroom for encrypted health checks at scale.

Cross-chain
Ika · dWallet
Cross-chain MPC signing

Programmable dWallets govern native BTC / ETH. Solana logic requests a co-signed settlement — no bridge, no wrap.

Gold
Oro · GRAIL
Physical gold infrastructure

Oro's GRAIL platform handles gold custody, regulatory compliance, KYC, and on-chain settlement — so users can pledge physical gold as DeFi collateral for the first time.

Privacy
Encrypt · REFHE
FHE privacy layer

Balances and debt stored as ciphertext; health factor computed homomorphically. Invariants are provable without decryption.

Oracle
Pyth
Price oracle

Sub-second, first-party prices for BTC, ETH, XAU, and quote assets. Fuels the kink rate curve and liquidation thresholds.

Econ
Kink IRM
Interest rate model

Utilization-driven rate curve with a kink — cheap under the target, sharply punitive above it to protect lenders.

DeFi
Flash Loans
Uncollateralized atomic lending

Borrow any amount, execute your strategy, repay in one transaction. Atomic enforcement at the program level — no collateral, no credit risk. 0.09 % fee split 90 / 10 between LPs and protocol.

Security model

Private is only useful if solvent.

Veil treats privacy and solvency as a joint property. Ciphertext hides amounts; the program proves the pool is always backed.

Current status
  • Core protocol design frozen
  • Architecture + invariants documented
  • Pinocchio implementation underway
  • FHE layer implemented — EncryptedPosition, 5 private instructions, graph definitions
  • Ika integration scaffolded; Encrypt CPI activates when SDK reaches pinocchio 0.11
  • Not audited — experimental; do not deploy mainnet capital without review.
Custody
Non-custodial by construction

Your BTC / ETH stay in an Ika dWallet — jointly signed by you and the MPC network. No protocol admin key ever holds your collateral.

Privacy
Privacy without opt-out invariants

The protocol still enforces solvency, health factor and utilization caps over ciphertext. Privacy never weakens public guarantees.

Risk
Oracle-first risk

Pyth feeds drive the kink curve and liquidation thresholds. Rate limits and circuit-breakers protect against stale or anomalous prints.

Liquidation
Atomic cross-chain settlement

Liquidation is a single Solana ix that dispatches a dWallet signature on the origin chain. Either the native transfer settles or the debt remains.

FAQ

The honest questions.

How does physical gold work as collateral?
Veil integrates Oro's GRAIL platform, which is digital gold infrastructure for modern finance. Oro handles the hard parts — physical custody, regulatory compliance, KYC, and on-chain settlement. Users pledge gold-backed assets through Oro's self-custody model; Veil's Solana program tracks the position and enforces collateral logic. This makes Veil the first DeFi lending protocol where physical gold works as productive collateral alongside native crypto.
What are flash loans and how do they work on Veil?
A flash loan lets you borrow any amount from a Veil pool within a single Solana transaction — no collateral required. The catch: you must return the borrowed amount plus a 0.09 % fee in the same transaction. If the repayment instruction is missing or falls short, the entire transaction reverts atomically and no funds move. This makes flash loans safe for the protocol while unlocking capital-efficient strategies like arbitrage, liquidation bots, and collateral swaps. 90 % of the fee goes to liquidity providers; 10 % to the protocol.
How does Veil hold native BTC without bridging?
Veil uses an Ika dWallet — a programmable wallet jointly controlled by you and Ika's MPC network. Your Bitcoin stays on Bitcoin as native UTXOs. A Solana program sends signing instructions; the dWallet co-signs. No wrapped token, no custodian.
What does "encrypted position" actually mean?
When you call EnablePrivacy, Veil creates an EncryptedPosition account that holds two on-chain ciphertext handles — one for your deposit balance, one for your debt — managed by the Encrypt program. Every subsequent deposit, borrow, repay, or withdraw submits an FHE computation graph (add_deposit, sub_debt, etc.) to the Encrypt program via CPI. An off-chain executor evaluates the graph using actual FHE and commits updated ciphertext. An RPC observer sees 32-byte opaque handles, not values. Solvency is enforced in plaintext by the standard UserPosition; the encrypted mirror provides observer confidentiality.
If positions are encrypted, how does liquidation work?
Liquidation is triggered by a homomorphic comparison of your encrypted health factor against 1. When the check fails, a Solana instruction dispatches a dWallet signature on the asset's origin chain — settling against native BTC or ETH. No IOU, no wrapped round-trip.
Is privacy optional?
Yes. Privacy is a per-position toggle. You can hold a transparent position alongside encrypted ones — useful for demo, or for addresses you want to keep discoverable.
Why Pinocchio instead of Anchor?
Pinocchio is Solana's zero-dependency, zero-copy program framework. For a lending protocol that does a lot of repeated math (health checks, rate updates, liquidations), a meaningfully lower compute-unit footprint per instruction means more throughput and more headroom under stress.
Is the protocol live on mainnet?
Veil is experimental. The core protocol design is frozen, the Pinocchio implementation is in progress, and Ika and Encrypt are themselves evolving toward mainnet. Veil is built to upgrade in place as those primitives land.
The veil is up

Be on-chain. Stay off-stage.

Pledge native BTC, physical gold, or any on-chain asset. Borrow in private. Keep every balance encrypted. Solana coordinates — your capital stays where it belongs.

Launch appRead the whitepaper
ENCRYPTED · VAULT SNAPSHOT
collateral_ct7fA9·12Ce·88aD
debt_ctE4b2·9C01·F7dd
health_ctA1b3·44Cc·ZzQ9
dwallet_sigok · 2-of-3