Note: This article is adapted from the official Phala blog post, How iExec Uses dstack For OnChain Finance. Full credit for the original reporting and technical details goes to the Phala team.
See it here: https://phala.com/posts/iexec-dstack-nox-chain-of-trust
Confidential DeFi has a problem that doesn’t get talked about enough. You can encrypt data on chain all day, but eventually that data has to be processed somewhere off chain, and someone has to trust that the processing actually happened the way it was supposed to. iExec is addressing this with Nox, its confidential compute protocol for DeFi and RWA applications, and they’re using Phala’s dstack to handle the trust part of that equation.
What iExec and Nox Do
iExec builds infrastructure for confidential computing in on-chain finance. Nox is their programmable confidentiality protocol, and it lets DeFi and RWA applications work with sensitive financial data without exposing it publicly on chain. Builders can add confidential execution, selective disclosure, and verifiable computation to existing EVM applications without rebuilding everything from scratch. The first product direction for Nox is confidential token infrastructure, which matters most in situations where users want privacy, protocols need to confirm correctness, and institutions need a reviewable path for permissions.
How dstack Fits In
Nox handles the on-chain side with encrypted handles and smart contracts, but the actual computation still happens off chain, and that’s where dstack comes in. dstack runs the Nox workload inside a measured environment on real hardware. It boots the system, captures evidence of exactly what code is running and what state it’s in, and generates a quote that can be tied to a specific request, deployment, or transaction. A verifier checks that evidence before anything sensitive happens, like releasing keys or accepting a result. In practice, a runner processes encrypted financial data, produces proof of its own environment through a lightweight service called dstack-quote-service, and only after that proof checks out does it get access to the next step. Most of that complexity sits behind simple APIs, so builders don’t need to become experts in trusted execution environments just to use it.
Why This Matters
DeFi and RWA applications sit on a real tension. Users want their data private. Protocols and institutions still need a way to verify things are correct and compliant. This setup gives both sides what they need. Sensitive data stays encrypted, computation happens in a verifiable environment, and there’s an audit trail available when it’s needed, without ever exposing the raw data itself.
For anyone building in confidential DeFi or RWAs, this is a practical example of what privacy infrastructure looks like when it’s built to actually be verified, not just taken on trust.
Top comments (0)