Ghost Finance

GHOST is a dark pool lending protocol that brings institutional-grade price discovery to DeFi through sealed-bid batch auctions and tranched risk structures. The core insight is that continuous on-chain orderbooks are fundamentally broken for lending. They leak information, enable MEV extraction, and force participants to constantly adjust positions. We borrowed the batch auction mechanism from traditional Treasury bill markets and combined it with structured credit tranching from CLOs. The result is a lending primitive where price discovery happens in discrete settlement windows, eliminating front-running entirely. Every five minutes, our clearing engine runs a sealed-bid uniform price auction. Lenders submit encrypted intents specifying minimum acceptable rates and tranche preference. Borrowers submit maximum rates they'll pay. At epoch boundary, we construct supply and demand curves, find the intersection point, and settle all willing participants at the single clearing rate. This is the same mechanism the U.S. Treasury uses to issue $20+ trillion in government debt. It's mathematically proven to incentivize truthful bidding. The tranching system implements a proper waterfall structure. Each loan partitions into 70% senior and 30% junior. Senior capital has payment priority and earns the clearing rate. Junior capital is subordinated but earns a spread premium. On default, we seize collateral and distribute through the waterfall: senior gets made whole first, junior absorbs first-loss. This creates genuine risk stratification. A pension fund can take senior exposure at 5% with near-zero default risk while a hedge fund takes junior at 9% with leveraged upside. We built an on-chain reputation system called Haunt Score that actually unlocks capital efficiency. Most DeFi reputation is cosmetic. Ours directly reduces collateral requirements from 150% down to 110% as users build history. The tiers follow ghost lore: Whisper, Shade, Specter, Phantom, Poltergeist. A Poltergeist borrower accessing $1M needs $400K less collateral than a new user. At protocol scale, this represents billions in freed capital. The entire system runs on USDC, eliminating oracle dependencies. Circle CCTP and Circle Gateway enable seamless cross-chain participation. Users on any supported chain can access GHOST liquidity without wrapped token risk or bridge exploits.

We architected GHOST as a three-layer system separating settlement, computation, and coordination concerns. This lets us achieve the security of fully on-chain custody with the efficiency of off-chain computation. The settlement layer is two contracts on Arc. GhostPool.sol implements the core accounting engine using a double-entry bookkeeping pattern. Every state transition maintains the invariant that total lender balances plus total collateral plus active loan principal equals contract USDC balance. The waterfall distribution function implements proper structured finance math: we calculate accrued interest for each tranche using continuous compounding approximation, determine payment priority, then distribute pro-rata within each tranche. CreditRegistry.sol stores Haunt Scores and implements the collateral curve as a piecewise linear function with configurable inflection points. The computation layer is where things get interesting. We built a custom clearing engine that implements the McAfee mechanism for double auctions. Intents come in as signed EIP-712 typed data with domain separation to prevent cross-chain replay. We store them in SQLite with WAL mode for concurrent read performance during settlement. When the epoch closes, we construct order books, run the intersection algorithm to find the clearing rate, then solve a matching problem to pair lenders with borrowers while respecting tranche ratios. The matching uses a greedy fill algorithm with pro-rata allocation when demand exceeds supply in a tranche. Circle Gateway handles our cross-chain UX. Users on Arbitrum, Base, or Ethereum interact with GHOST through Gateway's smart routing. They approve USDC, Gateway burns through CCTP, Circle's attestation service validates the burn, and we receive native USDC on Arc. No wrapped tokens, no liquidity pool slippage, no bridge risk. Gateway also handles gas abstraction so users don't need Arc's native token. From their perspective, they're using a single unified lending market regardless of which chain their USDC lives on. The coordination layer is a bare-metal runner on DigitalOcean hitting our settlement endpoints every 300 seconds. We considered running this as a Gelato task or Chainlink Automation job but wanted tighter control over the execution window during the hackathon. One architectural decision worth noting: the intent server has zero fund access. It holds a hot wallet with gas tokens but can only call two contract functions: executeLoan() and liquidate(). Both functions exclusively shuffle balances already held by the contract. We implemented this as an explicit onlyServer modifier rather than a role-based system to minimize attack surface. If the server gets compromised, the attacker can grief matching but cannot extract funds. Users retain the ability to withdraw their deposits directly from the contract at any time. This is the same trust model as a centralized exchange's matching engine, except we don't custody funds. The waterfall math was surprisingly tricky to get right. We had to handle partial fills, rounding errors in pro-rata distributions, and the edge case where recovered collateral exactly equals senior owed (junior gets zero but shouldn't revert). We ended up implementing it as a two-pass algorithm: first pass calculates theoretical payouts, second pass adjusts for rounding and ensures conservation. For the reputation system, we store raw scores on-chain but compute the collateral curve off-chain during intent validation. This keeps gas costs minimal while still enforcing requirements at execution time.