Perps on Canton — Leveraging Temple's Virtual Orderbook
Time saved using Temple as the matching + settlement foundation vs. only referencing open-source perp DEXes. Temple claims inferred from public material; order-of-magnitude. 2026-06-19.
Open-source reference
design only
AGPLv3 blocks code reuse · nothing runs on Canton
Temple as build stack
saves ~6–10 mo
Removes matching engine + Canton settlement transport
Net production build
~18–24 → 12–16 mo
If Temple exposes engine + extends settlement to positions
Where each component acts across the trade process →
reuse (Temple / Interstice)
partial adapt
new build
· a filled cell = the component is live at that stage · hover any cell for the full description
| Component ↓ / Stage → | Onboard | Order | Match | Settle | Hold | Funding | Default |
|---|---|---|---|---|---|---|---|
| KYC / eligibility gate | gateOnboarding gate — verify the party is KYC'd and whitelisted before it can trade or provide liquidity. | open chkAuthoritative on-chain check at position open — the party must be attested/whitelisted for the settlement to commit. | |||||
| Matching engine | bookAccepts and maintains resting orders in the limit order book. | crossCrosses bids and asks by price-time priority to produce fills. | |||||
| Banding | reject farPre-trade price band — rejects orders priced too far from the oracle mark (blocks fat-fingers and manipulation). | fill capCaps how far from the oracle mark a liquidation may fill, preventing ruinous liquidation prices. | |||||
| Oracle | band refSupplies the reference price the order band is measured against. | markSupplies the mark price used to value positions and compute PnL / margin each tick. | indexSupplies the index price the funding rate is computed against. | liq priceSupplies the price that decides liquidatability and the liquidation fill band. | |||
| Risk engine | margin chkPre-trade margin check — rejects orders that would breach initial-margin requirements. | mark-to-marginContinuously revalues account equity against maintenance margin using the latest mark. | liquidateDetects a margin breach and fires the liquidation to close the position. | ||||
| Settlement transport | DvPCommits the matched trade on-chain atomically via CIP-0056 delivery-versus-payment. | settleSettles netted funding payments on-chain. | settleSettles the liquidation / close transfers on-chain atomically. | ||||
| Fills → positions | open posTransforms a settled fill into a leveraged position record — not a spot asset delivery. | ||||||
| Position & margin state | openCreates the position — collateral, entry price, margin tier. | carryCarries the open position — collateral, initial/maintenance margin, running PnL. | applyApplies funding debits / credits to the position's collateral. | closeCloses / settles the position and releases or seizes collateral. | |||
| Funding management | chargeComputes the funding rate (premium + interest, capped) and charges longs / shorts. | ||||||
| Backstop (insurance·ADL·pool) | absorbInsurance fund / ADL / pool absorbs positions liquidation can't fill — the last line against bad debt. |
Read across a row = that component's footprint in time. Spanning rows (Oracle, Risk engine, Position state) are always-on and carry the most risk; single-cell rows act at one point. Reused (green) clusters at the front; new build (red) dominates from Settle onward.
Work remaining
| Component | Source | Effort · solo | AI × | AI-assisted | Note |
|---|---|---|---|---|---|
| Matching engine | reuse | — | — | — | Temple's CLOB is directly a perp book. |
| Order mgmt / connectivity / recovery | reuse | — | — | — | Production-grade reuse. |
| KYC / eligibility gate | reuse | ~0.5 | 3× | ~0.2 | Interstice whitelist — wiring only. |
| Canton settlement transport | partial | 1–2 | 2.5× | ~0.5–1 | Redirect CIP-0056 to position effects. |
| Oracle | partial | 2–4 | 1.5× | ~1.5–3 | Daemon + design; Kaiko ref ≠ liq marks. |
| Fills → positions | new | 1–2 | 2× | ~0.5–1 | New position / PnL contracts. |
| Position & margin state | new | 3–5 | 2× | ~1.5–2.5 | Subaccounts, IM/MM, margin gate. |
| Risk engine | new | 4–8 | 1.3× | ~3–6 | Least compressible · most needs verification. |
| Banding | new | 1–2 | 2.5× | ~0.5–1 | Price protection + liq fill cap. |
| Funding management | new | 2–3 | 2.5× | ~1–1.5 | Rate calc + batched settle. |
| Backstop | new | 2–4 | 2.5× | ~1–2 | Insurance, ADL, pool. |
| Total (these components) | ~17–31 | ~1.7× | ~10–18 | p-mo. Excludes cross-cutting, audits, frontend. |
Effort = person-months for one skilled Daml + trading engineer, work-left after Temple + Interstice reuse. AI-assisted = differentiated multiplier: ~3–5× boilerplate/glue · ~2× bounded Daml · ~1.3× the novel risk engine · ~1× audits/regulatory (not shown). Net ~1.7–2× overall — Amdahl: the risk engine + audits barely compress, so they become almost the whole critical path. Calendar: production ~18–24 → ~11–15 mo; lean pool-perp MVP eng ~3–5 → ~2–3 mo. Discipline: vibecode the periphery; hand-craft + adversarially verify the solvency-critical core. Bonus: AI lets one engineer span TS + Daml + Go, lowering the team-size floor.
Read: reused components (Temple book + rails, Interstice gate) act at the front of the trade process; everything from Settle onward is new build — the bulk and the real schedule risk, regardless of where the book comes from.
Revenue opportunities — fee · yield · interest
Three independent engines: Fee = volume × a rate you set · Yield = pool AUM × return (at-risk) · I/R = balances × rate-spread (net interest margin). Note: funding itself is trader↔trader — it only becomes revenue through the pool.
| Line | How it's derived | Driver / note |
|---|---|---|
| FEE — throughput × a rate you control (predictable, scales with volume) | ||
| Taker trading fee | Σ(taker notional) × taker bps (~2–10 bps) | The reliable base; compresses for ECP institutions but volume is large. |
| Maker rebate (cost) | Σ(maker notional) × rebate bps (0 to −x) | Incentive to attract liquidity; nets against fee income. |
| Liquidation penalty | Σ(liquidated notional) × penalty% × protocol share (~1–1.5%) | Counter-cyclical — spikes exactly in volatile stress. |
| Listing / issuance | flat fee × new markets or asset issuances | Lumpy; fits Canton's RWA / tokenization. |
| Market data | subscription tier × seats | Steady, high-margin; institutions genuinely pay for depth + history. |
| YIELD — the pool as residual counterparty (high upside, at-risk, regulated fund) | ||
| Pool trading P&L | bid-ask spread + net funding collected + liquidation flow on warehoused net OI | This is where "perp funding" becomes revenue — via the pool. Pool bears directional risk. |
| Protocol fee on pool | AUM × mgmt% p.a. + perf% × pool profit | Earns off AUM without owning all the pool's risk — the cleaner line. |
| I/R — net interest margin (most stable; often the largest at institutional balances) | ||
| Collateral float income | avg idle collateral × (reinvest yield − user pass-through) | Reinvest float into tokenized T-bills / MMF (~4–5%); native on Canton. The underrated #1. |
| Margin / borrow interest | avg borrowed × (borrow APR − cost of funds) × utilization | NIM on leverage lent; ties to the lending-market layer. |
How each is derived, in one line: Fee = throughput × a rate you control — predictable, volume-driven. Yield = the pool earning spread + the funding it collects for warehousing net open-interest imbalance + liquidation flow, plus a mgmt/perf fee skimmed on AUM — high upside but directional risk + fund regulation. I/R = reinvest idle collateral (float) into tokenized T-bills and keep the spread over pass-through, and lend margin above cost of funds. At institutional scale, I/R is usually the largest and most stable line; fees are the reliable base; pool yield is the upside.
P&L opportunities — agency vs principal
Agency = a toll on activity (capital-light, low regulatory weight — your floor). Principal = you take risk/inventory for edge (needs balance sheet + risk mgmt + usually fund/derivatives authorisation — your upside).
| Opportunity | Edge — where the P&L comes from | Risk / gate |
|---|---|---|
| AGENCY — toll on activity (capital-light, reliable) | ||
| Trading fees | bps on every taker fill | Fee compression for ECPs; pure volume game. |
| Listing & issuance | per-market listing fee + asset-issuance fee + recurring market-maintenance fee | Has a cost side: each market = an oracle feed + risk params + liquidity bootstrap + settlement overhead — price the fee to cover it. |
| Market data | Subscription / per-seat for depth + history | Low; high-margin. |
| Liquidation penalty (protocol share) | Fixed % of liquidated notional routed to protocol | Counter-cyclical, lumpy. |
| PRINCIPAL — take risk for edge (higher expectancy, capital + regulation) | ||
| Pool market-making | Adverse-selection-adjusted bid-ask spread on flow the pool faces | Inventory / directional risk; regulated fund (LP eligibility). |
| Funding / basis carry | Pool collects funding while staying delta-neutral — hedge the spot leg on Temple / CEX (cash-and-carry) | Basis + execution + counterparty risk. |
| Liquidation backstop | Acquire liquidated positions at a discount to mark, unwind at mark | Gap risk / unfillable book in fast moves. |
| Insurance / backstop underwriting | Counterparty of last resort: collect liquidation penalties + (optional) insurance premium; profit when payouts < premiums. Can be opened to third-party insurance counterparties who post backstop capital for the penalty yield — protocol takes a fee | Tail / bad-debt risk — loss-bearer in extreme events; capital-adequacy + (if external capital) fund regulation. |
| Internalisation spread (PMM) | Capture bid-ask by internalising flow then hedging out | Inventory risk; PFOF / best-execution regulatory sensitivity. |
| Treasury NIM (float + insurance fund) | Reinvest collateral & fund balance into tokenized T-bills/MMF above pass-through | Rate / duration / credit risk; collateral-segregation rules. |
Read: agency lines are your dependable floor — capital-light tolls. principal lines are the upside but cost you a balance sheet, a risk desk, and usually authorisation. On Canton the biggest stable principal edge is treasury NIM on tokenized RWA; the biggest variable edge is the pool (spread + basis carry + liquidation). Pool and insurance are different risk layers — the pool earns on ordinary flow, the insurance fund earns premium for tail/bad-debt; keep them as one vault (HLP-style) or separate the insurance layer and finance it with third-party underwriters. Listing is agency revenue with a real cost tail — every new market adds an oracle feed, risk parameters, and liquidity to seed, so it's only net-positive once the market trades.
Worked model — illustrative annual P&L
Illustrative only — not a forecast. A ramping institutional venue. Every line uses the derivation formulas above; the model is ~linear in its drivers.
| Input assumption | Value |
|---|---|
| Avg daily volume (ADV) | $200M/day → $73B/yr (24/7) |
| Taker / maker fee · split | 3.0 / −0.75 bps · 50/50 |
| Avg collateral on platform | $500M |
| Reinvest yield − pass-through (NIM) | 4.5% − 1.5% = 3.0% |
| Pool AUM / net return / fee | $100M / 8% / (2% mgmt + 20% perf) |
| Liquidated notional / penalty | 1.0% of volume / 1.0% (30% protocol · 70% insurance) |
| Insurance fund / calm-yr payouts | $50M balance / $1.0M |
| Listing & issuance / market data | $1.0M / $1.0M |
| Line | Calc | Annual |
|---|---|---|
| AGENCY — reliable toll | ||
| Net trading fees | $36.5B×3bps − $36.5B×0.75bps | $8.2M |
| Liquidation penalty (protocol 30%) | $730M liq × 1% × 30% | $2.2M |
| Listing & issuance | bundle | $1.0M |
| Market data | ~20 seats | $1.0M |
| Agency subtotal | $12.4M | |
| PRINCIPAL — risk-taking edge | ||
| Treasury NIM (float) | $500M × 3.0% ← largest single line | $15.0M |
| Pool (protocol fee) | 2%×$100M + 20%×$8M | $3.6M |
| Insurance underwriting (self) | $5.1M penalties + $2.25M fund-NIM − $1.0M payouts | $6.4M |
| Principal subtotal (self-underwritten) | $25.0M | |
| TOTAL — self-underwritten insurance | bears the tail | $37.4M |
| TOTAL — third-party insurance | insurance → ~$1.3M fee, tail offloaded | $32.3M |
Read the model: total ~$32–37M/yr on these assumptions. Treasury NIM ($15M) is the single biggest line — larger than all net trading fees — confirming I/R dominance at institutional scale. Agency ($12.4M) is the dependable floor; principal ($20–25M) is the upside but carries risk. Insurance two ways: self-underwriting adds ~$6.4M expected but turns negative in a stress year; third-party financing trades ~$5M of expected upside for tail protection. Biggest levers: ADV (fees + pool/liquidation flow) and collateral balance (NIM) — the model scales ~linearly in both.