Oblio: privacy primitives for Solana, starting with confidential liquid staking

Oblio is an ecosystem of privacy and confidentiality primitives for Solana. Each product serves a specific need, and all of them share the same foundations so they compose with each other. We start with the piece every other primitive can build on: a confidential liquid staking token, obSOL. This is the pitch we are bringing to the Colosseum hackathon.

1. The vision

Solana has the speed, the cost and the liquidity to run serious finance. What it lacks is a privacy layer that serious participants can actually use. Our goal is to build that layer as a set of focused products rather than one monolith: each one solves a real problem for a specific audience, and each one is designed to plug into the others.

We also want the ecosystem around us to grow. Few teams are building real privacy products on Solana today, so we will integrate with as many as we can, encourage new ones, and publish the standards and patterns we develop so others can build on top of them without starting from zero.

2. The problem

Everything on a public chain is visible by default: balances, transfers, stake accounts and the timing of every move. For a retail user that is a footnote. For a fund, a treasury, a market maker or a company tokenizing real-world assets, it is a risk.

• Treasury size and liquidity are readable by anyone with an explorer.
• Large moves can be anticipated and traded against.
• Wallet history links positions across protocols and over time.
• Company strategy leaks through on-chain activity.

More real-world assets are moving on chain, and the institutions with the most capital are the ones least willing to give up privacy to get there. Today they face a bad choice: stay off chain, or accept full exposure. Existing liquid staking tokens do not help, because they are fully transparent SPL tokens.

3. Why now

Three things have lined up. Tokenization of real-world assets is accelerating and bringing in players who need confidentiality as a condition of entry. Token-2022 now ships confidential transfers and the ScaledUiAmount extension, so a yield-bearing token can keep a fixed encrypted balance while its displayed value grows. And the Core-BPF stake program and the current Anchor toolchain let a program drive native Solana staking entirely on chain, with no off-chain custodian.

Privacy with compliance has not had a better moment to find its market than this one. Participants want the benefits of Solana without exposing their strategy, while still operating within the rules that apply to them.

4. Why start with a liquid staking token

Staking is where the most SOL sits, and a liquid token is where it becomes useful. A confidential LST is therefore a natural first point of entry into on-chain privacy for both audiences: consumers who want a private position that still earns yield, and institutions that want to hold and move SOL exposure without publishing their treasury. It is also the right foundation, because every other primitive we build needs a deep, liquid, private asset to work with.

5. The product: obSOL

You deposit SOL into a pool and receive obSOL, a Token-2022 mint with the ConfidentialTransfer and ScaledUiAmount extensions enabled from day one. The pool delegates in aggregate to validators through native Solana staking. Rewards raise the share price, so there is nothing to claim.

• Stake SOL directly, or deposit an existing native stake account and receive obSOL for it.
• Optionally mint straight into the confidential balance, so shares never exist as a public balance.
• Exit instantly through a reserve with a transparent fee curve, or through a fee-free first-in-first-out ticket.
• Everything is enforced by the program: no operator holds funds or decides who gets paid.

6. Privacy with compliance

Privacy for institutions only works if it can coexist with oversight. Token-2022 confidential transfers support an optional auditor key on the mint: a designated party can be given the ability to view amounts, while everyone else cannot. Oblio exposes this through a timelocked admin action, so an auditor can be configured for institutional deployments without changing the token.

We want to be precise about what is private. obSOL balances and transfer amounts can be encrypted. The SOL you deposit is a normal, visible transfer into the pool when you enter, and the pool is a public account. After that, because the pool delegates in aggregate, no stake account maps to your wallet, and your obSOL holdings and movements can be hidden.

Confidential mode is implemented in the program: deposits accept a Public or Confidential mint mode. The current website uses public mode, and exposing the confidential flow in the interface is the next step on our roadmap. An auditor key is optional, and it supports compliance workflows but is not a legal guarantee.

7. How it works

• Deposit: SOL goes to the gateway account. Shares are minted at the vested share price, with a virtual offset against inflation attacks.
• Delegate: a permissionless crank moves idle SOL into validator buckets, using transient stake accounts for top-ups.
• Sync: once per epoch, anyone can sync the rate. It reads real lamports from every stake account, vests new rewards linearly and updates the display multiplier.
• Exit: instant unstake pays from a reserve; standard unstake burns shares for a ticket funded by permissionless deactivate and withdraw cranks.

8. What is already built

• A complete Anchor program: initialization, governance, validator buckets, deposits, both exit paths, rate sync, reward injection and fee claims.
• A black-box integration suite that runs the compiled program against the real Token-2022 and Core-BPF stake programs.
• A stateful fuzzer that checks solvency, value reconciliation, price monotonicity, atomic failure and queue accounting after every instruction.
• This website, running on devnet: stake, instant and standard unstake, and ticket claiming.

9. Safety model

Governance changes sit behind a timelock with a hard minimum delay. A guardian can pause and can drain a bucket instantly, but cannot unpause or re-weight. Users are never trapped: ticket orders and claims keep working during a guardian pause. A circuit breaker freezes price-dependent paths if the real value of the pool drops beyond tolerance.

Oblio is a devnet beta and has not been audited. No mainnet funds until an independent review is complete.

10. Beyond obSOL: the ecosystem

obSOL is the first primitive and the base layer for the rest. Because it is a standard Token-2022 asset with confidential balances, other privacy products can accept it as collateral, settle in it or route yield through it. Each future product will have its own audience and its own problem to solve, and each will reuse the same foundations. We will announce them as they are built, and we will open-source the patterns that other teams can reuse.

11. Roadmap

• Confidential mint mode in the website, with token account setup handled in one flow.
• Independent security audit of the program.
• Auditor key setup for institutional deployments.
• More validator buckets and a published delegation policy.
• Mainnet beta with a conservative TVL cap.
• Second privacy primitive built on top of obSOL, and integrations with other privacy-focused projects on Solana.

12. The ask

We are looking for feedback from builders and judges working on private finance, introductions to institutions and RWA issuers who need confidential on-chain exposure, other teams building privacy products who want to integrate, and a path to a funded audit. The technical articles explain the details behind each claim, and the program source is linked in the site footer.