Private Pricing With CAPS: What It Is and Why It Matters

CAPS, the Canton Access and Privacy Standard, is an open-source pricing standard that RedStone is building for Canton, a blockchain network for financial institutions, with a grant from the Canton Development Fund. It is designed to let every party in a deal settle against the same price while keeping who used that price, and how, private, including from the oracle that published it.

Why Institutions Trade Out of View

“Never let them know your next move.” Sensible advice that holds up everywhere, from the basketball court to the crowded trading floors of Wall Street. A founder or a fund selling a large block of shares, for example, wants the sale done before the market finds out. If buyers know a big seller is coming, they wait, short the stock or cut their bids, and the seller gets a worse price.

Anyone who can see what an institution holds, and when or how much it trades, can use that knowledge to trade ahead of it, at the institution’s expense.

Being seen costs large investors money. A study of 385 forced sales by investment funds between 1999 and 2014 found that the brokers handling those orders passed the information to their best clients, who traded ahead and earned about 32 basis points over ten days. The selling funds’ liquidation costs rose by about half. The leak came through the party handling the order.

It still happens. In January 2024, the SEC charged one of Wall Street’s largest banks with fraud after its block trading desk tipped select investors about upcoming share sales between 2018 and 2021, despite the sellers asking for confidentiality. Those investors shorted the stock ahead of each sale. The bank agreed to pay more than $249 million to settle.

So institutions keep their trading quiet. In 2025, more than half of US equity volume traded away from public exchanges for the first time, up 3.6 percentage points in a single year. Most of it went through dealers, and the rest through private venues often called dark pools.

That secrecy sits awkwardly with how public blockchains were designed. They emerged as open, immutable ledgers where anyone can check every transaction, removing the need for blind trust and the chance to misuse it.

That means wallet addresses and their balances are public, and so are trades waiting to be processed. Cointelegraph Research, using data from the analytics firm EigenPhi, counted more than 95,000 sandwich attacks on Ethereum in the year to October 2025, where a bot spots a pending trade and buys just ahead of it. An institution won’t put real size on a ledger that shows its book to everyone.

Price Feeds: Where Privacy Breaks

Smart contracts are deterministic by nature. Every node in the network runs the same code and has to reach the same result, or the network can’t agree on which transactions are valid. That means a contract can only use information that every node already has. If each node fetched a price from an outside website on its own, they would get slightly different answers and never agree.

That’s where an oracle steps in. It collects prices from outside sources, signs them and brings them onchain, where smart contracts use them to value collateral, trigger margin calls, settle trades or price a fund’s shares. Oracles are the layer that connects onchain applications to the wider world.

Once a price is onchain, it sits on the same shared ledger as everything else. On a public blockchain like Ethereum, anyone can read it, along with every wallet’s balance and every contract that uses the price. Multiply the two and you have the value of a position. Because Ethereum wallets are pseudonymous, that exposure mostly points at a faceless string of numbers and letters, not a name.

Institutions don’t get that cover. Compliance requires them to operate under known identities, so on a network built for them, any visible information or movement is attached to a named bank or fund. Canton is that network. There, contracts are only visible to their parties, so a repo trade between two banks is seen by those two banks and nobody else. Digital Asset, which develops Canton, says it works with more than 600 ecosystem participants.

Most institutional use of shared ledgers is still bookkeeping. RWA.xyz, which tracks tokenized assets, counts $408.71 billion in tokenized assets recorded onchain for reconciliation but not transferable, against $39.34 billion that can move between wallets (as of 3 November 2026). Trading on those ledgers needs a price every party accepts at the same moment.

Oracles deliver prices in one of two ways, the push model or the pull model, and on Canton each one breaks something. A push price feed writes one price into a shared contract that everyone reads. All parties get the same number, but the provider sits in that contract and can see who reads which price and when. Over enough reads, that adds up to a map of an institution’s positions. Institutions on a private network can assume their activity is private while the party delivering their prices still has a view of it.

A pull price feed lets each party fetch a signed price when it needs one, which takes the provider out of the shared contract. But it also means two counterparties who ask four seconds apart can get different answers. When they come to settle, each holds a valid, signed price for the same deal, and nothing says which one counts.

How CAPS Works: Root Capsules and Derived Capsules

CAPS, the Canton Access and Privacy Standard, is an open standard for delivering prices on Canton. RedStone, which has delivered data on Canton since December 2025, designed it and is now building it with a grant from the Canton Development Fund.

The idea is to split a price into two layers. The root capsule is the official price, and every authorized party can see it. A derived capsule is a private copy of that price, and only the parties to one deal can see it. The oracle publishes the root and never sees the copies.

Take two banks making an overnight loan backed by tokenized US Treasuries. The oracle publishes the Treasury price: $100. The banks make a private copy, agree to value the collateral at $98, and settle. Both started from the same price, so there’s nothing to argue about later, and the oracle only ever sees the $100.

“Institutions move trillions through dealers and venues built to keep their orders quiet, and they will never accept less onchain. CAPS gives every party one verifiable price to settle against, while the oracle never sees the deals built on it. That is what it takes to bring real institutional positions to Canton.” Matt Gurbiel, VP of Business Development, RedStone.

Where CAPS Stands

CAPS is in development as a standard for the whole Canton network. On 16 September 2026, the Canton Development Fund approved RedStone’s CAPS proposal, and the grant funds the work as shared infrastructure for Canton. That means it won’t be limited to RedStone. Once it’s ready, any oracle or data provider will be able to use it to deliver prices privately, and any project on Canton will be able to choose which prices are published openly and which are read privately inside a deal. The first implementations are in development with Zenith and Memora.

CAPS is designed as a set of application-layer packages in Daml, the smart contract language Canton uses, so it runs on top of Canton as the network works today. Everything delivered under the grant will be released as open source under the Apache License 2.0.

The first step is a Canton Improvement Proposal (CIP), which sets CAPS as a shared standard for the network, and goes to Canton’s governance later this year. Canton already keeps every contract private, and CAPS is designed to close the remaining gap at the price feed. What that makes possible, from licensed market data to private collateral and margin, is the subject of the next pieces in this series. Data providers and institutions interested in building on CAPS can apply to become design partners.

About RedStone

RedStone is the data layer for institutional DeFi, delivering secure, low-latency price feeds for digital assets, RWAs, stablecoins, LSTs, LRTs, and Bitcoin LSTs across 110+ chains. Trusted by 200+ clients, including Securitize, Morpho, Pendle, Spark, Ether.fi, Ethena, Lombard, Venus, and Compound, RedStone powers lending, stablecoins, perpetuals, and tokenized asset markets with custom pricing infrastructure built for complex onchain systems. RedStone provides data for tokenized products including BlackRock’s BUIDL, Apollo ACRED, and Hamilton Lane SCOPE. Zero mispricing events. 100% uptime. Learn more at redstone.finance.

Frequently Asked Questions

What is CAPS?

CAPS, the Canton Access and Privacy Standard, is an open-source standard for delivering price data on Canton. It’s built to publish one official reference price and let institutions make private copies of it for specific deals, visible only to the parties involved.

What is the difference between a push oracle and a pull oracle?

A push oracle writes prices onchain on a schedule into a contract that everyone reads. A pull oracle delivers a signed price only when someone requests it. Push gives every party the same number. Pull lets each party fetch its own, which can leave two counterparties holding different prices for the same trade.

Can an oracle see who uses its prices?

With a push oracle on a privacy network, the provider can see who reads its prices and when, which can reveal positions over time. Under CAPS, the oracle is a party only to the official root price, so it has no view of the private copies institutions use for their deals.

What are root capsules and derived capsules?

A root capsule is the official, signed price for a given moment, visible to every authorized party on the feed. A derived capsule is a private copy of that price for one deal or group of parties. Access can only narrow from the root down.

Is CAPS open source?

Yes. RedStone will release all software, Daml contracts, indexers and documentation built under the grant under the Apache License 2.0. Any oracle or data provider will be able to implement CAPS with no dependency on RedStone’s services.

Is CAPS live?

No. CAPS is approved and in development, and its first Canton Improvement Proposal goes to Canton’s governance later this year.