Built for markets that keep score in microseconds and audits

1. 01

   The order book lives in the execution layer

   A central-limit order book as a native, deterministic matching engine — not a program fighting per-transaction compute limits, which is how on-chain books die. Integer ticks only, price-time priority stated formally, self-trade prevention named per market. And because the matcher joins the state transition itself, the proof system covers it: a matching step can be disputed and verified on Solana like any other instruction. The engine's core exists — price-time priority with an explicit admission tiebreak, good-till-cancel, immediate-or-cancel and fill-or-kill, post-only, both self-trade policies, a canonical versioned fingerprint — as a tested library. It is not yet wired to the node.

2. 02

   Signed receipts make ordering accountable

   Every accepted order returns a signed receipt: order hash, market, batch, position, slot. Two receipts for one position — or a published batch contradicting a receipt you hold — is slashable equivocation anyone can prove. A soft confirmation stops being the operator's word and becomes an enforceable promise. The receipt mechanism is live in the node today, per transaction; the slashing that turns a proven equivocation into a penalty is not built.

3. 03

   The ordering rule is published and checkable

   Per market, one of two rules: frequent batch auctions (uniform-price clearing per slot — ends the latency race and sandwiching by construction) or first-come-first-served with cancel priority, the market-maker protection real venues use. Either way the rule is a deterministic function of published data, so a broken promise is provable, not alleged. The node's rule today is first-come, first-served by admission; the auction variant is design.

4. 04

   Cancels are priced for quoting

   Real quoting means ten to a hundred cancels per fill. Cancels carry a near-zero fee with anti-spam bounds, and place-and-cancel within one batch can net to almost nothing in data costs — as a per-market choice, because netting erases the audit tape that regulated markets keep.

5. 05

   Every market is its own parallel domain

   One hot order book serialises everything that touches it. State is laid out so each market owns its own write-lock domain — parallelism across markets is structural, not aspirational.

6. 06

   Latency claims come with percentiles

   Receipt latency is published as p50 and p99 alongside ingress locations and a fair-access policy. No microseconds marketing — the audience this page is for reads that as a warning sign, and they are right to.

• State growth is HFT-multiplied. Order books churn state faster than any other workload. State expiry and archival stop being a later-stage nicety and become a prerequisite for opening these markets at all.
• Benchmarks replay real flow. Performance for this page is measured by replaying real, anonymized exchange order flow — cancel-heavy, contention-swept, reported as a curve. Synthetic transfer benchmarks describe nothing about running a market.

How performance gets reported →