VeilRisk

Inspiration

Portfolio compliance usually forces an uncomfortable choice: disclose the holdings so someone can verify the rules, or keep the holdings private and ask others to trust the result. Even allocation percentages can reveal strategy, risk appetite, and concentrated positions.

VeilRisk explores a better boundary. The risk policy is public and independently inspectable, while the portfolio remains private. Midnight makes it possible to prove that the rules were satisfied without publishing the underlying allocations.

What it does

VeilRisk lets a portfolio owner evaluate four private allocation buckets—cash, bonds, equities, and speculative assets—against a public Conservative mandate.

The policy requires:

• Allocations to total 100%
• Speculative exposure of no more than 20%
• Combined equities and speculative exposure of no more than 70%
• No individual allocation above 60%

A risky portfolio fails immediately in the browser and creates no attestation, wallet-signature request, or transaction. A compliant portfolio can continue through proof generation, Lace approval, submission, and finalization on Midnight Preprod.

The public result reveals the policy, network, contract address, transaction identifier, and compliance outcome. It never reveals the four allocation values.

How we built it

The application uses React and TypeScript, with private allocation values held only in non-persistent browser state. A deterministic TypeScript policy engine provides immediate feedback and blocks invalid portfolios before any wallet or network interaction can occur.

A matching Compact contract receives the allocations as private circuit inputs and enforces the same public limits. Both implementations share boundary tests so that values exactly at each cap pass while values one basis point above fail consistently.

The Midnight integration uses Lace's delegated providers to generate the proof, request approval, submit the transaction, and wait for Preprod finalization. The integration is isolated behind an adapter, allowing the complete lifecycle to be tested deterministically without relying on live services during routine testing.

We deployed the Conservative policy contract to Midnight Preprod and finalized a real browser-generated compliance proof through Lace. The indexed public state confirmed the successful proof without exposing portfolio allocations.

Challenges we faced

The hardest challenge was protecting privacy across the entire product, not only inside the circuit. Private values also had to remain absent from logs, URLs, browser storage, error messages, transaction metadata, receipts, analytics, and public interface elements.

The Midnight transaction lifecycle introduced another challenge. Wallet discovery, proof generation, approval, submission, and indexer finalization can each fail independently. The interface therefore needed accurate, recoverable states without exposing sensitive SDK diagnostics.

We also had to keep the TypeScript policy engine and Compact circuit behaviorally identical, including exact basis-point boundary behavior.

Accomplishments we're proud of

• Finalized a real browser-generated compliance proof on Midnight Preprod
• Kept private allocations out of public state and transaction inspection
• Blocked invalid portfolios before wallet approval or network submission
• Matched TypeScript and Compact behavior at every policy boundary
• Clearly separated private local previews from finalized public attestations
• Tested privacy, failures, retries, keyboard use, mobile use, and fresh sessions

What we learned

Privacy is a system property. A private circuit is insufficient if its inputs later appear in telemetry, errors, storage, transaction metadata, or product copy. Defining forbidden side effects first made the integration safer and the tests more meaningful.

We also learned that local checks and on-chain proofs serve different purposes. The local engine provides fast, private feedback without publishing failed attempts. The Compact circuit creates the publicly verifiable success claim. Communicating that distinction clearly is essential.

What's next

VeilRisk is currently a focused hackathon demonstration, not an audited production financial product. Future work could add blinded portfolio-version commitments, expiring attestations, multiple named policies, and downloadable verification receipts while preserving the same principle: private holdings never become public application or transaction data.

Built With

• cloudflare
• compact
• lace
• midnight
• midnight.js
• node.js
• playwright
• react
• typescript
• vinext
• wallet