Enclave - A Private Prop AMM on Solana

A proprietary decentralized exchange where swap logic executes inside a MagicBlock TEE enclave, meaning trade amounts, pricing, and execution are fully private until settlement. The Pinocchio program acts as a lean, zero-copy settlement layer that only sees enclave-signed results, never raw swap data. LP positions and trade intents stay encrypted end-to-end.

The result is a prop AMM where nobody, not validators, not MEV bots, can see what you're swapping or for how much until it's already settled on-chain.

Pricing Strategy — Avellaneda-Stoikov

This system uses the Avellaneda-Stoikov (2008) model to dynamically adjust quotes based on current inventory and market volatility, rather than quoting a fixed spread around the oracle mid.

---

Core Equations

1. Reservation Price

$$r = s - q \cdot \gamma \cdot \sigma^2 \cdot (T - t)$$

This is the system's true center price — not the oracle mid, but adjusted for inventory risk.

Symbol	Meaning
s	Oracle mid price
q	Current inventory (signed: +100 = holding 100 SOL)
γ	Risk aversion (how urgently to reduce inventory)
σ²	Baseline price variance (fixed constant)
T - t	Trading window (fixed constant 1.0)

2. Optimal Spread

$$\delta = \gamma \cdot \sigma^2 \cdot (T - t) + \frac{2}{\gamma} \cdot \ln\left(1 + \frac{\gamma}{k}\right)$$

Symbol	Meaning
k	Order arrival rate — fixed constant 1.5
First term	Inventory risk component — widens when volatile
Second term	Execution risk component — widens when flow is thin

k is set as a constant 1.5 since live order flow data is unavailable. This is acceptable because the spread is relatively insensitive to k — varying it across a wide range produces less than 10% change in spread width:

k = 0.5  → spread = $1.324
k = 1.0  → spread = $1.308
k = 1.5  → spread = $1.295  ← used
k = 2.0  → spread = $1.285
k = 5.0  → spread = $1.255

3. Final Quotes

bid = r - δ/2
ask = r + δ/2

---

How Inventory Shifts Quotes

With oracle mid at $310.00, γ=0.1, σ²=0.04:

Inventory      Reservation     Bid        Ask
─────────────────────────────────────────────
q = -100 SOL   r = $310.40   $309.75   $311.05  ← quotes skew up (want to buy)
q =    0 SOL   r = $310.00   $309.35   $310.65  ← neutral
q =  +50 SOL   r = $309.80   $309.15   $310.45  ← quotes skew down (want to sell)
q = +100 SOL   r = $309.60   $308.95   $310.25  ← aggressive sell skew

When holding long inventory in a declining market, both bid and ask shift down — the system prices more aggressively to offload without a hardcoded rule.

---

Execution Decision

reservation_price = oracle_mid - q * gamma * sigma2 * time_horizon
half_spread       = delta / 2

adjusted_ask = reservation_price + half_spread
adjusted_bid = reservation_price - half_spread

if user_sell_price >= adjusted_ask:
    execute()   # trade is fairly priced given current inventory

The threshold is not fixed — it emerges from inventory and risk aversion at the time of the quote.

---

Parameters

Fixed Constants

Stored in a state account, updatable by program authority via update_params instruction.

γ    = 0.1    # Risk aversion. Higher = more aggressive inventory skew.
σ²   = 0.04   # Baseline SOL volatility. Fixed — on-chain program cannot compute rolling variance.
k    = 1.5    # Order arrival rate. Spread is insensitive to this value.
T-t  = 1.0    # Normalized time horizon.

Live Inputs

Updated every instruction.

s    # Oracle mid price — fetched from oracle account each instruction.
q    # Current inventory — updated on every executed trade.

Since the system runs fully on-chain on Solana with no off-chain backend, real-time variance computation is not feasible. All constants are configurable via an update_params instruction restricted to the program authority, allowing manual updates when market conditions shift significantly.

---

Reference

Avellaneda, M. & Stoikov, S. (2008). High-frequency trading in a limit order book. Quantitative Finance, 8(3), 217–224.