Decisions and open work
This record describes the current build. Proposed features must not be described as completed behavior.
Current decisions
| Decision | Reason and consequence |
|---|---|
| Separate ETH and MON markets | Collateral and risk stay isolated |
| On-chain matching | Contracts enforce price and time priority and margin |
| Parametric maker ladders | One quote call moves all maker levels of a market. This keeps the operator loop cheap on Monad, which charges for the gas limit. Makers accept that the quoter sets the center. |
| Sorted order lists with a price bitmap | Real resting orders keep price and time priority. The book holds at most 128 real resting orders, and an order has at most 32 match attempts. |
| Signed test observations on the quote | The observation and the new quote arrive in one transaction. There are no separate price transactions. |
| Indexed funding with delayed activation | Observations avoid account scans. A new fill does not receive the payment of the prior interval. |
| Time limits from the observation interval | The gap limit is three intervals and the mark age limit is two intervals, so one contract serves 10-second, 60-second, and 300-second markets |
| wagmi with MetaMask | The current browser flow. Dynamic is deferred. |
| Scoped session keys | Orders can be signed without a MetaMask prompt for each order |
| Separate relayer gas account | Browser session orders can be submitted without gas from the main wallet |
| TestOracle and TestUSDC | Controlled test scenarios. No external price verification and no real collateral value. |
| REST polling and SSE notices | The current transport. The WebSocket design stays planned. |
| Atomic JSON event state | Supports the demo. A production database stays planned. |
| Different local and testnet scripts | Anvil time controls and public test keys must not be used on testnet |
| Browser LP model | The LP position of the demo is a calculation. A token-backed pool stays open work. |
See Target architecture for the decisions of the target design.
Verification record
The following checks passed during implementation, before the contract got maker ladders and before this documentation site. They are a record of that run. They are not a claim that the tests ran again.
| Check | Recorded scope |
|---|---|
| Foundry | 35 tests, including accounting, matching, sessions, risk, and a fuzz test |
| Python | 54 research and reference tests |
| Service unit tests | 4 tests for validation, typed signatures, and index recovery |
| ABI tests | 4 comparisons against compiled Solidity |
| UI calculation tests | 2 tests for the LP model |
| TypeScript | Workspace and script type checks |
| Web production build | Passed after the MetaMask connector change |
| Testnet deployment | Addresses in the deployment record |
The Foundry suite is larger now. The directory contracts/test/ has five test files with 84 test functions, which include ladder, queue, and gas tests. Run pnpm contracts:test for the current result.
The coding sandbox of that run blocked local listeners and testnet DNS. Full browser-to-chain checks were not completed there. The wallet extension interaction, the deployed shock flow, the long-running keeper behavior, and a complete public testnet hedge demo still need recorded live results.
Open work
| Item | Necessary outcome |
|---|---|
| Live demo verification | Record deposits, session authorization, order fills, shocks, and the final funding close |
| Token-backed LP pool | Implement reserves and share accounting, test it, deploy it, and connect its measured state |
| Dynamic | Add only after the current MetaMask flow is accepted |
| Oracle source and sampling | Verify source data, selection, intervals, and omission behavior separately for each asset |
| Retained funding claims | Resolve their valuation and margin treatment under stressed conditions |
| Frozen mark recovery | Define a robust price rule after depth loss or a jump |
| Bad debt | Define and test loss allocation when liquidation cannot cover the deficit |
| Public services | Add hosting, persistence, monitoring, and an access policy for the funded relayer |
| Security and parameters | Independent review, asset-specific calibration, and workload measurements |
The economic review in simulation/MODEL_REVIEW.md lists the unresolved model issues. Passing accounting tests do not establish economic safety.
Documentation updates
For each future change, record the behavior, the affected source, the reason, and the checks. Update deployment evidence only from receipts or clearly attributed reports. Keep keys and authenticated endpoints out of the docs.