Trading venue market structure

A Trading Venue market is defined by a set of composable structures. Order reservation backs every resting order with a reserved balance in the trader's own wallet, and trading authorization lets settlement pull tokens only under the trader's standing consent. On top of that base, a trading calendar sequences the market's sessions, and a call auction opens them at one clearing price. Price bands and thresholds gate what intake accepts, a stop book holds dormant intents, and a participant list can make a market private. A compensating reversal lets the operator bust an erroneous trade without breaking settlement finality. This page explains each structure and how they compose.

The short version

A market lists any two distinct platform tokens as base and quote inside one deployment. Every participant is registered in the deployment's identity registry, and every fill settles through the tokens' own compliance path. The structures below exist so that the book can rest orders with certainty, open and close on schedule, and settle, without the venue ever holding funds.

Order reservation

When the venue accepts an order, it reserves the committed quantity in the trader's own wallet as a reserved balance: the base token for a sell, the quote token plus the maximum applicable fee for a buy. The reservation is a partial freeze on the wallet's balance. The tokens never move, the venue pools nothing, and the wallet cannot spend the reserved amount elsewhere while the order works.

The reservation gives the book escrow-grade certainty without escrow. A resting order is always backed: the quantity it promises cannot be transferred away between placement and fill. That is why an order only becomes matchable, and only appears in aggregated depth, after its reservation confirms on-chain.

Reservation accounting is cumulative per wallet and token across all markets and orders. Each partial fill reduces the reservation atomically with its settlement. Cancellation, expiry, pruning, or a remainder below the market minimum releases it.

One structure deliberately breaks the reserve-then-rest rule: a dormant stop order holds no reservation at all. The venue reserves at the moment the stop triggers, which is why a stop can be rejected at trigger time. See Stop orders.

Trading authorization

Before a trader's first order, the trader establishes a trading authorization to the venue's settlement contract. The authorization is the trader's standing consent that lets settlement pull the reserved tokens at fill time, through the token's normal transfer path, with every identity and compliance check running.

Intake rejects any order whose authorization is below the reserved amount plus the maximum applicable fee, so an accepted order is always executable. For institutional desks, trading authorizations and desk limits pass maker-checker approval through a persisted approval store: a proposer submits them, a distinct approver confirms them, and the venue reads the approved limits at order intake. Approval governs funding and limits, never individual fills, so the book stays live.

Price protection band

Each market carries an operator-set price protection band. A market order executes as a marketable limit bounded by that band: the band is anchored to an independent reference price from the platform's feed infrastructure when the market has one, else to the last trade. Quantity that would next fill outside the band is refused, not filled at any price. Quantity already filled inside the band stands. A triggered stop order converts under the same band, so a stop can never chase a dislocated print without limit.

The band anchors only to sources independent of the venue. Prices the venue itself publishes back to the feed infrastructure are excluded from band anchoring, so a thin book cannot widen its own band.

Price bands and order thresholds

Beyond the protection band, which bounds execution, the operator can configure two rejection bands and two size thresholds per market. All four are enforced at order intake, and each rejection names its reason:

Bands reject orders; they are not circuit breakers. A breach never halts the market, and halting stays a decision the operator makes by hand. Resting orders are never revalidated against a moving band: banding applies at intake, and again at execution through the protection band, following the execution-time model exchanges use for price banding.

Tightening a band or threshold leaves resting orders untouched. The operator surface previews how many resting orders fall outside a candidate setting and offers an explicit prune, a mass cancel that releases the affected reservations, as a separate step. Nothing is cancelled implicitly.

Trading calendar and sessions

A market can trade continuously, or follow an operator-configured trading calendar: an IANA timezone, a weekly session template with one preopen, open, and close time per traded weekday, and dated exceptions for holidays and half-days. A market without a calendar is always open for continuous trading.

The calendar drives automatic session transitions. Wall-clock times are preserved in the market's timezone across daylight-saving changes, expanded ahead of time into exact UTC instants, and applied by the platform without operator intervention:

Session transitions inherit halt semantics: they stop matching and new order acceptance, cancel nothing, and let already-staged settlement batches complete. A good-till-cancelled order resting at Friday's close rests at its original price-time priority when the market next opens; an order's own expiry governs it regardless of the calendar.

The operator can override the calendar at any time: delay an open, extend a session, or close early. Overrides are calendar edits effective from now, and manual halt and resume work within any session state as an orthogonal flag.

The opening call auction

A market with a calendar opens through a call auction. During preopen, orders collect without matching, and the engine continuously derives the indicative equilibrium price and matchable quantity over the self-trade-excluded book, so the published indicative price is always achievable. At the open, the book uncrosses once: every crossing fill executes at one uniform clearing price, settles through the batch settlement path, and the unmatched remainder carries into continuous trading at its original price-time priority.

The clearing price is selected deterministically: maximize executable volume, then minimize the residual imbalance, then take the price closest to the reference (the feed reference, else the last trade), then the lower tick. The clearing price is hard-bounded by the static band; an uncross that would clear outside it is refused and escalated to the operator instead of printing a dislocated open. The settlement contract validates the uniform clearing price on-chain: every auction fill must clear between its own buy and sell limits.

The exact uncross moment is randomized. The platform publishes the scheduled open and the width of the uncross window; the drawn instant inside that window stays server-side by design, so last-instant order gaming has no deterministic target.

An auction-only market runs this cycle without a continuous phase: a collection window in which orders are placeable and cancellable, then one uncross at the clearing price. Unfilled remainders carry to the next auction or cancel, per a market configuration fixed at creation.

Official closing price

At session close, each market computes an official closing price by operator-configured methodology: the last settlement-confirmed trade of the session, or a volume-weighted average price over a configured window before the close. Busted trades are excluded from both. The official close is published to the platform's price-feed infrastructure as a new observation marked as the official close, and it anchors the next session's static band. A session without trades publishes no close, and the previous anchor stands. Private markets publish their closes exactly like public markets.

Stop orders

A stop order is a signed intent that arms dormant with a trigger price and reserves nothing while dormant, so the trader's capital stays free. The venue monitors settlement-confirmed prints only: a print that fails settlement, or is later busted, can never fire a stop. A sell stop triggers when a confirmed print is at or below the trigger; a buy stop when it is at or above.

On trigger, the venue reserves and the order enters normal intake as a marketable limit bounded by the trader's signed price and the protection band. If the trigger-time reservation fails, because the funds moved or authorization lapsed, the stop is rejected, not retried, and the rejection reason is recorded on the order.

Good-till-date is a first-class time in force beside good-till-cancelled and immediate-or-cancel: a signed expiry the platform enforces at intake, at match, and on-chain at execution.

Private markets

A market can be created auction-only and private. A private market carries an operator-administered list of approved participant wallets: only listed wallets may place orders, and the token's own compliance check remains the final judge at fill time.

Visibility is enforced at one choke point on every application surface. To a caller with no approved wallet, the market does not exist: the markets list omits it, and direct reads of the book, trades, candles, ticker, calendar, and stream answer not-found, never forbidden. Watchlist reads silently drop a market that becomes invisible. Removing a participant prunes that wallet's resting orders and dormant stops and releases its reservations.

The market's on-chain footprint is intentionally public. Creation events, reservation events, fills, and published feed prices are readable by anyone with chain access, because the feed prices drive bands, valuations, and mark prices platform-wide. Privacy is application-surface access control, not chain-level secrecy; the compliance page states this boundary for reviewers.

A market's trading mode (continuous or auction-only) and visibility (public or private) are immutable after listing. Changing either means delisting and listing a new market.

Trade busting

The operator can bust an erroneous trade inside an operator-configured window without touching settlement finality. The original settlement stays final and irrevocable on-chain; the bust is a second, fully audited transaction: a compensating reversal that returns both legs through the tokens' compliance path and refunds the fee from the operator fee account.

The bust flow is defensive by construction:

1. Only trades whose two orders are both fully closed (filled, cancelled, or expired) and whose fill is chain-confirmed are eligible.
2. A pre-check runs at proposal time: eligibility, window, counterparty balances, and compliance-path viability. A failing pre-check refuses the proposal with the reason and creates no approval.
3. A distinct approver decides the proposal; the proposer can never approve their own bust. The full pre-check re-runs at approval, because balances and eligibility can move between the two.
4. The reversal executes through an operator-held custodian identity, never through the venue contract, which keeps zero forced-transfer surface. The reversal and the fee refund complete atomically or not at all; a failed reversal leaves no one-legged state and the trade can be proposed again.

A busted trade stays in trade history flagged as busted, and both counterparties see the flag in their own trade blotter. Candles, the ticker, and the trade tape recompute excluding it, and the published feed price is corrected by a new, marked observation, because feed submissions cannot be retracted. Stop triggers and band evaluations that already fired on the busted print are not reversed. If the busted trade set the official close, the close recomputes and republishes.

Listing ceremony

A market exists only after an explicit ceremony with named preconditions. The operator creates the market with its pair, tick and lot sizes, bands, fee schedule, trading mode, and visibility. Then, before the market can go live:

1. The issuer of each listed token grants the venue the token's custodian role. The grant is the issuer's real decision: the custodian role carries the token's full custodial powers, and a declined grant leaves the market unlistable, shown as a blocked ceremony rather than an error.
2. The venue verifies its feed-writer registration for the market so it can publish traded prices.
3. The operator fee account is identity-registered and stays monitored. A fee account that loses eligibility halts the affected markets.

Delisting mirrors the ceremony: the venue cancels all resting orders and dormant stops, releases the reservations, and permanently closes the market. The venue's custodian role on a token is revoked only when no other live market lists that token.

How the structures compose

The reservation makes the book trustworthy, the authorization makes settlement executable, and the bands make execution safe. The calendar makes the market predictable, the auction makes its opens fair, and the official close gives the next session an anchor. The stop book gives traders protection without idle capital, the participant list makes restricted distribution possible on the same engine, and the bust gives the operator an error remedy that never weakens finality. Remove any one and the model changes character. Without reservation the book can rest orders it cannot honor, and without the randomized uncross the open is gameable. Without the compensating-reversal model, an error correction would need a venue that can force transfers.

When to read the detailed pages