Swap privately

A shielded swap trades one token for another inside the pool, so your holdings and the trade stay private.

Steps

1. Open Trade, choose the token to sell and the token to buy, enter an amount and slippage (pick a preset or type a custom value).
2. Review the confirmation — "You are about to swap X → ~Y, min received Z" — then confirm.
3. Your device proves the swap and it runs as one atomic Jito bundle (all three transactions land together or none do). With the relayer on, the relayer submits and pays gas; with the relayer off, you sign and submit it yourself. You receive a new private note in the bought token.

How it works

A swap is a 3-step flow on-chain:

1. Release — escrow the sold token from the pool and record the deal (this is the only step with a ZK proof).
2. Route — the escrowed token is swapped via a DEX (Jupiter on mainnet; a mock filler on localnet), with the pool's own program authority signing.
3. Settle — the bought token is checked to be at least your minimum-out, then minted to you as a new private note; leftovers return to the pool.

If a swap can't fill, the escrow is returned to you via a reclaim path — you get your input back as a fresh note, never a partial loss. If a self-executed swap ever releases but doesn't settle (e.g. its bundle never landed), a Reclaim button appears on the Balances page to recover those funds in one tap.

Slippage, pricing & privacy

You set a slippage tolerance; the swap guarantees you receive at least the minimum-out or it doesn't settle. The "you receive" estimate and the minimum-out come from a live Jupiter quote fetched through the relayer's proxy (so your IP is never exposed to Jupiter, and the relayer already handles the swap). A private swap is quoted with the same direct-route constraint it executes under, so the number you see matches what you get.

Good to know

• Both SPL Token and Token-2022 mints can be swapped. Transfer-fee / transfer-hook tokens can't enter the private pool (they'd under-back your note) but trade fine in public mode.
• A SOL→token private swap uses two of your private SOL notes (one to swap, one for the fee lane); if you only have one, Murk transparently splits it first.
• Swaps land as a Jito bundle, which needs a competitive tip to be included — set the Jito tip in Settings (there is no non-atomic fallback, so too-low a tip means the swap fails rather than half-completing).

ℹ️ Note: On mainnet, swaps route through Jupiter; on the devnet/localnet preview they use a built-in mock filler for USDC↔JUP.