Perps on Canton — Leveraging Temple's Virtual Orderbook
Time saved using Temple as the matching + settlement foundation vs. only referencing open-source perp DEXes. Temple claims inferred from public material; order-of-magnitude. 2026-06-19.
Open-source reference
design only
AGPLv3 blocks code reuse · nothing runs on Canton
Temple as build stack
saves ~6–10 mo
Removes matching engine + Canton settlement transport
Net production build
~18–24 → 12–16 mo
If Temple exposes engine + extends settlement to positions
Where each component acts across the trade process →
reuse (Temple / Interstice)
partial adapt
new build
· a filled cell = the component is live at that stage · hover any cell for the full description
| Component ↓ / Stage → | Onboard | Order | Match | Settle | Hold | Funding | Default |
|---|---|---|---|---|---|---|---|
| KYC / eligibility gate | gateOnboarding gate — verify the party is KYC'd and whitelisted before it can trade or provide liquidity. | open chkAuthoritative on-chain check at position open — the party must be attested/whitelisted for the settlement to commit. | |||||
| Matching engine | bookAccepts and maintains resting orders in the limit order book. | crossCrosses bids and asks by price-time priority to produce fills. | |||||
| Banding | reject farPre-trade price band — rejects orders priced too far from the oracle mark (blocks fat-fingers and manipulation). | fill capCaps how far from the oracle mark a liquidation may fill, preventing ruinous liquidation prices. | |||||
| Oracle | band refSupplies the reference price the order band is measured against. | markSupplies the mark price used to value positions and compute PnL / margin each tick. | indexSupplies the index price the funding rate is computed against. | liq priceSupplies the price that decides liquidatability and the liquidation fill band. | |||
| Risk engine | margin chkPre-trade margin check — rejects orders that would breach initial-margin requirements. | mark-to-marginContinuously revalues account equity against maintenance margin using the latest mark. | liquidateDetects a margin breach and fires the liquidation to close the position. | ||||
| Settlement transport | DvPCommits the matched trade on-chain atomically via CIP-0056 delivery-versus-payment. | settleSettles netted funding payments on-chain. | settleSettles the liquidation / close transfers on-chain atomically. | ||||
| Fills → positions | open posTransforms a settled fill into a leveraged position record — not a spot asset delivery. | ||||||
| Position & margin state | openCreates the position — collateral, entry price, margin tier. | carryCarries the open position — collateral, initial/maintenance margin, running PnL. | applyApplies funding debits / credits to the position's collateral. | closeCloses / settles the position and releases or seizes collateral. | |||
| Funding management | chargeComputes the funding rate (premium + interest, capped) and charges longs / shorts. | ||||||
| Backstop (insurance·ADL·pool) | absorbInsurance fund / ADL / pool absorbs positions liquidation can't fill — the last line against bad debt. |
Read across a row = that component's footprint in time. Spanning rows (Oracle, Risk engine, Position state) are always-on and carry the most risk; single-cell rows act at one point. Reused (green) clusters at the front; new build (red) dominates from Settle onward.
Work remaining
| Component | Source | Work left | Effort | Note |
|---|---|---|---|---|
| Matching engine | reuse | none | — | Temple's CLOB is directly a perp book (~10ms, 100k/s). |
| Order mgmt / connectivity / recovery | reuse | none | — | Production-grade; hard to replicate to the same quality. |
| KYC / eligibility gate | reuse | ~none | ~0.5 p-mo | Interstice's on-chain whitelist + attestation. Wire to perp positions. |
| Canton settlement transport | partial | low–med | 1–2 p-mo | Redirect CIP-0056 settlement from asset delivery to position effects. |
| Oracle | partial | med–high | 2–4 p-mo | Kaiko hourly reference exists — fine for funding, not liquidation marks. |
| Fills → positions | new | med | 1–2 p-mo | New position / collateral / PnL contracts. |
| Position & margin state | new | high | 3–5 p-mo | Subaccounts, cross/isolated, IM/MM, on-chain margin gate. |
| Risk engine | new | highest | 4–8 p-mo | Off-chain detect → on-chain liquidation. The Canton solvency-window problem. |
| Banding | new | low–med | 1–2 p-mo | Order/match price protection + liquidation fill-price cap. |
| Funding management | new | med | 2–3 p-mo | Rate compute + netted/batched settlement to fit Canton TPS. |
| Backstop | new | med | 2–4 p-mo | Insurance fund, ADL, pool-as-counterparty. |
| Total (these components) | ~17–31 p-mo | Excludes cross-cutting integration, audits, frontend, ops. |
Effort = person-months for one skilled Daml + trading-systems engineer (person-time, not calendar), for the work that remains after Temple + Interstice reuse. Calendar depends on team size + the critical path (Oracle → Risk engine → liquidation); the risk engine is the long pole and resists parallelizing.
Read: reused components (Temple book + rails, Interstice gate) act at the front of the trade process; everything from Settle onward is new build — the bulk and the real schedule risk, regardless of where the book comes from.
Revenue opportunities — fee · yield · interest
Three independent engines: Fee = volume × a rate you set · Yield = pool AUM × return (at-risk) · I/R = balances × rate-spread (net interest margin). Note: funding itself is trader↔trader — it only becomes revenue through the pool.
| Line | How it's derived | Driver / note |
|---|---|---|
| FEE — throughput × a rate you control (predictable, scales with volume) | ||
| Taker trading fee | Σ(taker notional) × taker bps (~2–10 bps) | The reliable base; compresses for ECP institutions but volume is large. |
| Maker rebate (cost) | Σ(maker notional) × rebate bps (0 to −x) | Incentive to attract liquidity; nets against fee income. |
| Liquidation penalty | Σ(liquidated notional) × penalty% × protocol share (~1–1.5%) | Counter-cyclical — spikes exactly in volatile stress. |
| Listing / issuance | flat fee × new markets or asset issuances | Lumpy; fits Canton's RWA / tokenization. |
| Market data | subscription tier × seats | Steady, high-margin; institutions genuinely pay for depth + history. |
| YIELD — the pool as residual counterparty (high upside, at-risk, regulated fund) | ||
| Pool trading P&L | bid-ask spread + net funding collected + liquidation flow on warehoused net OI | This is where "perp funding" becomes revenue — via the pool. Pool bears directional risk. |
| Protocol fee on pool | AUM × mgmt% p.a. + perf% × pool profit | Earns off AUM without owning all the pool's risk — the cleaner line. |
| I/R — net interest margin (most stable; often the largest at institutional balances) | ||
| Collateral float income | avg idle collateral × (reinvest yield − user pass-through) | Reinvest float into tokenized T-bills / MMF (~4–5%); native on Canton. The underrated #1. |
| Margin / borrow interest | avg borrowed × (borrow APR − cost of funds) × utilization | NIM on leverage lent; ties to the lending-market layer. |
How each is derived, in one line: Fee = throughput × a rate you control — predictable, volume-driven. Yield = the pool earning spread + the funding it collects for warehousing net open-interest imbalance + liquidation flow, plus a mgmt/perf fee skimmed on AUM — high upside but directional risk + fund regulation. I/R = reinvest idle collateral (float) into tokenized T-bills and keep the spread over pass-through, and lend margin above cost of funds. At institutional scale, I/R is usually the largest and most stable line; fees are the reliable base; pool yield is the upside.
P&L opportunities — agency vs principal
Agency = a toll on activity (capital-light, low regulatory weight — your floor). Principal = you take risk/inventory for edge (needs balance sheet + risk mgmt + usually fund/derivatives authorisation — your upside).
| Opportunity | Edge — where the P&L comes from | Risk / gate |
|---|---|---|
| AGENCY — toll on activity (capital-light, reliable) | ||
| Trading fees | bps on every taker fill | Fee compression for ECPs; pure volume game. |
| Listing & issuance | per-market listing fee + asset-issuance fee + recurring market-maintenance fee | Has a cost side: each market = an oracle feed + risk params + liquidity bootstrap + settlement overhead — price the fee to cover it. |
| Market data | Subscription / per-seat for depth + history | Low; high-margin. |
| Liquidation penalty (protocol share) | Fixed % of liquidated notional routed to protocol | Counter-cyclical, lumpy. |
| PRINCIPAL — take risk for edge (higher expectancy, capital + regulation) | ||
| Pool market-making | Adverse-selection-adjusted bid-ask spread on flow the pool faces | Inventory / directional risk; regulated fund (LP eligibility). |
| Funding / basis carry | Pool collects funding while staying delta-neutral — hedge the spot leg on Temple / CEX (cash-and-carry) | Basis + execution + counterparty risk. |
| Liquidation backstop | Acquire liquidated positions at a discount to mark, unwind at mark | Gap risk / unfillable book in fast moves. |
| Insurance / backstop underwriting | Counterparty of last resort: collect liquidation penalties + (optional) insurance premium; profit when payouts < premiums. Can be opened to third-party insurance counterparties who post backstop capital for the penalty yield — protocol takes a fee | Tail / bad-debt risk — loss-bearer in extreme events; capital-adequacy + (if external capital) fund regulation. |
| Internalisation spread (PMM) | Capture bid-ask by internalising flow then hedging out | Inventory risk; PFOF / best-execution regulatory sensitivity. |
| Treasury NIM (float + insurance fund) | Reinvest collateral & fund balance into tokenized T-bills/MMF above pass-through | Rate / duration / credit risk; collateral-segregation rules. |
Read: agency lines are your dependable floor — capital-light tolls. principal lines are the upside but cost you a balance sheet, a risk desk, and usually authorisation. On Canton the biggest stable principal edge is treasury NIM on tokenized RWA; the biggest variable edge is the pool (spread + basis carry + liquidation). Pool and insurance are different risk layers — the pool earns on ordinary flow, the insurance fund earns premium for tail/bad-debt; keep them as one vault (HLP-style) or separate the insurance layer and finance it with third-party underwriters. Listing is agency revenue with a real cost tail — every new market adds an oracle feed, risk parameters, and liquidity to seed, so it's only net-positive once the market trades.