How Confidential Are Orion's Vaults?

Orion's privacy model lets a manager choose between a transparent vault and a private one. In a private vault the intent weights and the holdings are stored as HPKE ciphertexts, while performance stays verifiable onchain. The design goal is to protect manager alpha without giving up verifiable results.

This piece asks a specific, quantitative question: if performance is public and verifiable, what can an observer reconstruct about a private vault's weights, and how fast?

Credits to ethprivacy.tools research series.

Sealed Fields and Public Series

For an encrypted vault, the sealed fields are the target allocation (the intent) and the per-asset holdings. Three series remain public in every epoch:

The three public series are not independent of the two sealed fields: a vault's share-price return in an epoch is the weighted sum of the asset returns it holds. The net trade of an asset is the sum, across all vaults, of what each vault must buy or sell to return to its intent after prices move.

Matrix Versus Vector Confidentiality

Many confidential designs protect the amount of a single token. The hidden state there is a vector, one number per account, and every public aggregate is one linear equation on that vector. Equations and unknowns then grow at the same rate, and a modest number of observations can pin the vector down.

Orion's hidden state is a matrix: V vaults, each with N weights. Public data still arrive at a rate of order V + N per epoch, while the unknowns number V × N. The gap widens with every vault and every asset, and each vault sits inside a batch that combines it with all the others. That difference is key to understanding why hiding a strategy across assets is not the same problem as hiding a balance in one token.

Single-Epoch Reconstruction

Take one epoch and the whole batch. The confidential state is the full V × N matrix of vault positions, and the observer reconstructs all of it from the public series at once.

Unresolved count. The public data give a number of equations that grows like V + N, while the hidden weights number V × N. The equations are not all independent, but what matters is the scaling: the unknowns outgrow the equations with every vault and every asset, so the part of the matrix the public data cannot resolve grows with the size of the system.

The figure expresses the unresolved count as a share of all V × N hidden weights. With one vault, the net trade vector is that vault's trades. As vaults are added, the unresolved count grows roughly with the product of vaults and assets, while the public data pin down only a number of directions that grows linearly.

Reconstruction error. The analysis takes the least-informed estimate consistent with the equations: the solution closest to a flat portfolio, with every vault's size left free, read as long-only weights.

Batch Size and Reconstruction Error

The unresolved count keeps growing, but the error measured against what an observer would guess anyway levels off: most of the hiding is already in place after a handful of vaults.

Three patterns stand out.

The jump is immediate. Going from one vault to two moves the error from zero (the baseline where holdings are known) to a large fraction of its maximum. A second vault is enough to hide most of what the net trade vector would otherwise reveal about the first, and a handful of vaults hides nearly all of it.

The error saturates quickly. As the vault count grows, each further vault adds about N unknowns but only about one equation, so the unresolved fraction approaches a ceiling set by the universe size and the error stays at its plateau within one epoch.

The universe size sets the ceiling, not the speed. In a small universe the error levels off well below its maximum; in a large one it approaches it. More assets raise how much remains hidden once the plateau is reached.

Identification Over Many Epochs

So far the observer saw one epoch. Now suppose a vault's intent stays unchanged while the observer keeps watching. The unknowns stay fixed and every epoch adds a fresh set of equations over them, so the unresolved set shrinks until it collapses to a point.

Start with one vault and only its share price. Each epoch adds one independent equation over that vault's N weights. The weights sum to one, so N − 1 epochs are enough.

The number of free dimensions falls by one per epoch and reaches zero after N − 1 epochs. The identification time grows linearly with the universe size, and it does not depend on how many other vaults exist: this channel is per-vault.

The batched trades add a second channel, and this is where vault count enters. It assumes the observer knows each vault's current holdings, either because they are public or because they can be derived from prior observations; without that, the net trade vector alone cannot identify target holdings and only the share-price channel applies. For any one asset, the net trade is one equation per epoch over that asset's weights across all V vaults. To separate V unknowns, the observer needs about V epochs.

Identification time is the number of epochs until a vault's weights are exactly determined. For the share-price channel alone it is N − 1. Adding the batched trades, and assuming holdings are known as above, it is about V epochs, up to that same N − 1 ceiling: a single vault is identified after one epoch, and each additional vault adds about one more. If holdings are not known, the horizon is the share-price bound of N − 1 epochs.

Two limits follow.

Vault count buys time, one epoch per vault. With a single encrypted vault whose holdings are known, one epoch identifies it, and each additional vault adds about one epoch. This is the multi-epoch counterpart of the single-epoch result: a few vaults hide almost everything in one epoch, and the hidden part can only be recovered gradually, one epoch of public data at a time.

The horizon has a ceiling set by the universe. Once the vault count reaches the universe size, the share-price bound takes over and identification time stops growing at N − 1 epochs. The plateau starts roughly when V reaches N and stays flat however many vaults are added: beyond that point, the universe size, not the vault count, sets the horizon.

Before identification the batched channel also helps only partially, and only while vaults are few relative to epochs. At an intermediate epoch the feasible interval of each weight is narrower with the batched trades than with share price alone, and it closes completely once the epochs observed reach about the vault count.

These horizons assume unchanged intents. They are a reference under that assumption, not a forecast for strategies that rotate faster than the horizon.

Universe Size and Privacy Horizon

A larger system hides more in a single epoch, and it lengthens the horizon over many epochs. The two dimensions play different roles.

• More vaults: within one epoch, the first few vaults do almost all the work and the error saturates. Over many epochs, each extra vault delays identification by about one epoch, until the vault count reaches the universe size. Against a vault's own share price they do nothing.
• More assets: a larger universe raises the single-epoch error ceiling and the number of weights left unresolved. Over time it raises the identification ceiling by one epoch per additional asset, and it is the binding constraint once there are enough vaults.

Programmable Privacy: Choosing Where to Be Private

Because privacy in Orion is programmatic, a system can decide where to impose it. Intents and holdings are sealed, while share price, oracle prices, and batched net trades stay public. That split is a design choice, and it is what keeps results verifiable while the alpha stays protected.

This mirrors the argument in Permissionless Consensus for Robust Institutional Onchain Finance. There, compliance controls such as whitelisting and access gating belong at the application layer, so the consensus layer keeps the security of open participation. Privacy follows the same logic. Sealing everything would break verifiability, and sealing nothing would expose the strategy. Placing confidentiality at the layer where it protects the manager, and leaving the rest open, preserves the guarantees of the base layer while still meeting managers' requirements.

References

• Orion Finance Research. Verifiable Rebalancing at Scale: Trustless Order Generation Without Onchain Cost.
• Orion Protocol.
• ethprivacy.tools research series: ethprivacy.tools/research.