ZKward Whitepaper

Abstract

ZKward is a live USDC vault on SUI mainnet. Seven agents read Polymarket, BlueFin funding, and mid-cap price momentum; allocate across BTC / ETH / SUI; hedge on BlueFin perps; and commit a zero-knowledge STARK proof of each hedge decision on-chain. The pool is capped at $10K by the Move contract during the operational-proof phase — this is not a scaling claim, it is a discipline. Cap-lifting is a governance action, not a code change.

Prediction-market volume reached $20B/month in early 2026 (Polymarket) and the sector grew to $63.5B in 2025 (CertiK). The signal is liquid enough to trade at retail size. What has been missing is verifiable execution: most AI-agent products are black boxes. ZKward publishes the signal weights, the sizing math, and a post-quantum STARK proof for every decision that moves capital.

Two revenue paths run today. On-chain: 50 bps annual management + 10 % performance, routed through a MSafe-held FeeManagerCap distinct from the operational AdminCap. Off-chain: tiered subscriptions for private hedges and the private portfolio creator. The consumer flow proves the ZK rails; the subscription flow prices them.

Live: package 0x107292…7b726 (v0.2.0), pool state 0xe814…fb3a, eight autonomy defense gates, and bun jest test/integration/pool-drawdown-defense.test.ts gating every merge.

Why prediction-market alpha needs infrastructure

Three barriers stop retail from harvesting the signal.

• Operational cost. Riding prediction-market alpha continuously needs bots, monitoring, and 24/7 attention. Fine for a fund. Impossible for a solo depositor.
• Missing risk management. A directional signal without sizing, stops, and a hedge leg is a way to get liquidated by the same move you predicted.
• Unverifiable AI. "Our model is great" is the industry claim. Every AI-agent crypto product ships a black box; users are asked to trust a team.

The convergence that makes 2026 the moment: Polymarket has real liquidity, ZK-STARKs finally verify in sub-second on commodity hardware, and consumer on-chain UX (smart accounts, sponsored gas, one-click deposits) closes the last-mile gap. Bittensor, ASI Alliance, Fetch, and MyShell all crossed $1B market cap — the market has decided AI-managed workflows are the frontier. The open question is trust.

What we do differently: predictive, not reactive

Traditional risk management reacts. The pattern is well-documented: an event fires, an alert lands, a human reviews, a decision is made, orders go in, settlement clears. The median time between event and settlement in a serious drawdown is 60–90 minutes. In four of the last five major crypto crashes, the majority of the drawdown was already visible in prediction markets 30–120 minutes before the price move.

ZKward inverts the loop. A 5-minute cron reads the aggregator, sizes the hedge, opens on BlueFin, verifies the fill via getPositions() delta, and commits a STARK proof. The decision path is 30 seconds end-to-end on a hit, and it fires on the signal — not on the price.

Architecture, without the diagram

Four layers. Every capital-touching action passes through all four. Diagnostics can short-circuit at any layer.

1. UI. Next.js 16 App Router, React 19, Tailwind, 12-locale i18n. No wallet SDK on marketing pages (that bundle is lazy-loaded on /dashboard). PWA-registered.
2. Agent orchestration. Seven typed agents behind SafeExecutionGuard: single-trade cap $10M, daily cap $100M (UTC reset), 30 bps slippage ceiling, 4× leverage ceiling, 2-of-3 consensus threshold above $100K, 5-second cooldown, ZK proof hash stored for every execution above $1M.
3. Data + integration. Polymarket, Delphi, Manifold, Crypto.com prices, Pyth oracles, BlueFin (perps + funding), Kalshi (ATM strike), Deribit (implied vol), Binance and Bybit (funding + long/short + OI). 20-second TTL in a shared aggregator. Bakchodi PostgreSQL 18 for off-chain state.
4. Blockchain. SUI mainnet Move contracts (pool + hedge executor + STARK verifier + proxy vault) as the lead chain. Hedera testnet, Sepolia, Cronos EVM, Oasis Sapphire, Arbitrum Sepolia as multichain reference deployments.

The seven agents

Lead (intent parse), Risk (VaR + Sharpe + drawdown), Hedging (fused-signal hedge ratio), Settlement (sponsored-gas 2-step), Reporting (proof-optional summaries), Price Monitor (cross-source sanity), and SUI Pool (signal reasoning for the community pool cron). Cron routes generally bypass agents for latency, with the SUI cron lazily instantiating getSuiPoolAgent().

Live contracts (SUI mainnet, v0.2.0)

• Package: 0x107292a69eea2f6eaf4a4e4727ee25d747b04c1985441b138933f0ef33f7b726
• Pool state: 0xe814e0948e29d9c10b73a0e6fb23c9997ccc373bed223657ab65ff544742fb3a
• Capabilities: AdminCap (currently hot, migrating to MSafe via the OracleCap split in v0.4.0), FeeManagerCap (MSafe), OracleCap (planned split; hot key attests NAV without touching pool authority).
• TVL cap: $10,000, enforced by the Move contract. Governance action required to lift.

Prior deployment (v0.1.0 at 0x9ccb…c88) is dormant. The withdrawal-underpayment bug that motivated the v0.2.0 redeploy is fixed on-chain; reproduce via bun run scripts/analyze-pool-pnl.ts.

Zero-knowledge, without hand-waving

The STARK backend is transparent. No trusted setup, no elliptic curves, no discrete-log assumptions.

• Field. Goldilocks prime p = 2^64 − 2^32 + 1 = 18446744069414584321 (same field as Polygon zkEVM and Plonky2), primitive root g = 7. Native 64-bit arithmetic; fast NTT.
• Soundness. Per FRI Theorem 1.2 (Ben-Sasson–Bentov–Horesh–Riabzev, ePrint 2018/828), ε ≤ ρ^q. We configure ρ = 1/4 and q = 80, giving ε = 2^(−160). Add 20 bits of proof-of-work grinding: 2^(−180) total, 52 bits above NIST Post-Quantum Level 1. Hedge proofs use 24-bit grinding and 16× blowup for a bit more headroom.
• Non-interactivity. Fiat–Shamir over SHA-256 in the random-oracle model.
• CUDA prover for self-hosted operators. GPU-optimised NTT via CuPy/Numba, probe-verified on import. Vercel deployment has no GPU, so production runs the CPU-only prover.

Enforced end-to-end at every FRI layer: value + sibling Merkle binding; folding-consistency f_{L+1}(x²) = (v+s)/2 + α·(v−s)/(2x) over the multiplicative coset; Fiat–Shamir challenges bound to sha256(root_L); final-polynomial degree bound.

What a hedge proof commits

Commitment hash — 146-byte SHA-256 preimage, fixed binary layout
  version_u32BE                      (4)
  portfolioId_u32BE                  (4)
  timestampMs_u64BE                  (8)
  asset_code_u8                      (1)   BTC=1, ETH=2, SUI=3
  side_code_u8                       (1)   LONG=0, SHORT=1
  leverageX_u32BE                    (4)
  leverageCap_u32BE                  (4)
  entryPriceUsdcCents_u64BE          (8)
  sizeUnits_u64BE                    (8)   per-asset step units
  notionalValueUsdcCents_u128BE      (16)
  notionalCapUsdcCents_u128BE        (16)
  salt_32B                           (32)
  inputsHash_32B                     (32)  SHA-256 of canonical JSON

On-chain verification: zk_verifier::verify_hedge_stark_proof_entry → grinding PoW check (≥ 20 bits, 24 for hedge) → FRI (Merkle + folding-consistency + Fiat–Shamir) → composition polynomial identity for asset / side / leverage → replay protection via used_proofs.

The whole binding path is SHA-256. No elliptic curves, no pairings — Shor's algorithm is a non-threat. The legacy ed25519 fast path can be disabled by an admin via admin_set_stark_only_mode(true), forcing every verify through the post-quantum STARK path.

What's checked, and what isn't

Honest scope note. Empirical soundness harness (python zkp/tests/empirical_soundness_harness.py) confirms round-trip success and tamper-vector rejection on the inputs we tried. That is a necessary signal, not a machine-checked formal proof. A full Coq / Lean encoding of the STARK protocol is out of scope for this repo. External audit (SUI Foundation grant milestone T4-C) is where the formal review lives.

Autonomy defense (v0.3.0 — 8 gates)

Between June and July 2026 the pool took a 30 % drawdown. Root cause was subtle: existing autonomy layers were prescriptive — they gated future rebalances but never reshaped existing holdings. When a signal flipped, the trader stopped opening new positions but the old ones sat. v0.3.0 closes those gaps.

Every destructive action is env-gated. Rollout is deliberately staged: log-only first, flip execution one gate at a time (PORTFOLIO_DRIVER_EXECUTE → STALE_HEDGE_AUTO_CLOSE → ALERT_RESPONSE_EXECUTE → ALERT_RESPONSE_EXECUTE_HALT) after 24 hours of clean logs. bun jest test/integration/pool-drawdown-defense.test.ts stays green through every merge — that test is the operational contract.

Signal fusion

Ten sources feed the aggregator, each with a fixed weight and a 20-second TTL. Weights are per-asset; the table below is BTC.

Hedge ratio is 50 % of exposure (100 % for pools under $1K), scaled by a confidence multiplier 1 + (probability − 0.5) × 0.5, then clamped by on-chain max_hedge_ratio_bps. Example: a 73 % probability signal → 1.23× multiplier → 50 % × 1.23 = 61.5 % exposure hedged.

The small-NAV asymmetry

BlueFin's per-symbol minimum size creates a hedgeability gap at small NAV: BTC-PERP min 0.001 (~$73), ETH $30, SUI $4. When allocation × NAV < floor, the perp leg is skipped — leaving spot naked-long even under a BEARISH signal. Gate 3 in the defense table redirects that allocation to USDC; PortfolioDriver actively unwinds the pre-existing spot instead of documenting the exposure.

Multi-chain

SUI is the lead chain by design. Other chains are proven at testnet level so pool logic can migrate when demand justifies it. The multi-chain surface is a capability, not a scattered focus.

Security

Contracts. OpenZeppelin where EVM applies; Move code uses sui:: with explicit entry boundaries. 15 internal audit phases completed (2026-06-04 through 2026-06-12); external audit is a SUI Foundation grant deliverable (T4-C).

Cryptographic. 180-bit effective STARK soundness (80 FRI queries × 20-bit grinding). SHA-256 Merkle trees, 10-layer FRI hierarchy. Goldilocks field. ECDH stealth addresses for private hedges. admin_set_stark_only_mode(true) forces post-quantum-only verification.

Operational. Non-custodial — the pool holds capital under Move object custody, not admin authority. Every cron uses verifyCronRequest + tryClaimCronRun (idempotency) + setCronState (heartbeat). Missing heartbeats trip alerts within one interval. Every capital-moving action fires a Discord alert and appends to alert-log:ring-buffer. Reconcilers cross-check on-chain Move ↔ BlueFin (hourly) and BlueFin ↔ DB (every 15 min). Pre-push hook runs the security scan on every push.

Kill switches. SUI_AUTO_HEDGE_DISABLE=1 (halt), HEDGE_MIN_NAV_USD (default 20; hedge blocked below), NAV_SAFETY_CEILING_USDC (default 10B; halts writes above ceiling; Move u128 redeploy required before scaling past it).

Economics

Revenue on-chain. 50 bps annual management + 10 % performance on realised profits. Routed through FeeManagerCap (MSafe multisig). AdminCap (currently hot, migrating to MSafe via OracleCap split) is a separate object — the fee path cannot be sacrificed to an admin key compromise.

Revenue off-chain. Subscription access to private hedges and the private portfolio creator. Consumer flow proves the ZK rails; subscription flow prices them.

Capital state. $10K contract-enforced TVL cap. Cap-lifting is a governance action (sui-set-tvl-cap, CRON_SECRET-gated), not a code change. NAV_SAFETY_CEILING_USDC default 10B halts writes above ceiling; scaling past requires the Move u128 redeploy.

Cost. Vercel sin1 (Bangalore) for API + crons; pay-per-request, dominated by cron cadence and function memory. Bakchodi self-hosted PostgreSQL 18 via PgBouncer. Self-hosted job scheduler (jobs.zkward.com) — we moved off Upstash QStash 2026-09-19 for cost and latency.

Growth projections are omitted deliberately. The whitepaper describes what runs today, not a forecast.

Roadmap

Conclusion

ZKward is a live vault, not a pitch deck. Prediction-market alpha, seven typed agents, an eight-gate defense system, a $10K contract-enforced cap during the operational-proof phase, and a STARK proof for every hedge decision. Cap-lifting is a governance action, not a code change. Ship what runs today.

References

1. Ben-Sasson, E., Bentov, I., Horesh, Y., & Riabzev, M. Scalable, transparent, and post-quantum secure computational integrity. IACR ePrint 2018/046. https://eprint.iacr.org/2018/046
2. Ben-Sasson, E., Bentov, I., Horesh, Y., & Riabzev, M. Fast Reed-Solomon Interactive Oracle Proofs of Proximity. ICALP 2018. IACR ePrint 2018/828. https://eprint.iacr.org/2018/828
3. StarkWare Industries. ethSTARK Documentation v1.2. IACR ePrint 2021/582.
4. Polygon zkEVM. Goldilocks Prime Field: efficient 64-bit field arithmetic for zkVMs.
5. EIP-3009. Transfer With Authorization. 2020.
6. Boston Consulting Group. Relevance of on-chain asset tokenization. BCG Global, 2024.
7. CertiK. Prediction Market Sector Report 2025.
8. Polymarket. Prediction Market Accuracy Analysis.
9. Sui Foundation. Move on SUI — Framework and Object Model.
10. BlueFin Exchange. Perpetual Futures API Reference.