System architecture

In one paragraph. Trion V2 is a hybrid exchange: an off-chain, single-writer matching engine decides order (who traded with whom, in what sequence), and a set of non-upgradeable contracts decide money (custody, margin, funding, liquidation). Nothing the matcher says becomes true until a signed batch is accepted by the PerpetualV2 contract on chain. Prices come from a separate oracle path that the matcher cannot override.

The six moving parts

Life of an order

1. Sign. The browser builds a 14-field Order, signs it under the TrionOrders v2 EIP-712 domain bound to the market's OrdersV2 address, and POSTs {order, signature} to the matcher. See Signed orders.
2. Admit. EngineV2.submitOrder recovers the signer off the hot thread, refreshes the trader's on-chain AccountView/RiskView, and checks collateral reservations. A failure returns a structured Fault (BAD_SIGNATURE, MARGIN, …), never a silently reordered acceptance.
3. Persist, then match. The order is written to the WAL (SUBMIT frame) and only then matched. GTC remainders rest; IOC remainders are dropped; FOK is all-or-nothing.
4. Propose. Fills accumulate into a packed batch (target 50, cap 100, 100 ms flush timer) that the matcher key signs under the TrionPerpetual domain. The batch is itself a WAL frame (BATCH_PROPOSED).
5. Settle. The relay simulates, submits PerpetualV2.settleBatch(packed, matcherSig) and waits for the receipt. The contract re-validates every signature, epoch, tick, price band, fee cap and margin rule; it also pins the batch to the latest accepted oracle priceSequence.
6. Confirm. Only receipt-confirmed fills become the tape (L) and are pushed to WebSocket subscribers. Until then the API reports the order as matched, never confirmed.

Deposits, withdrawals, hard revocation (OrdersV2.advanceAccountEpoch) and direct OrdersV2.cancel go straight from the wallet to the chain; the matcher learns about them by polling PerpetualV2 events (ChainIngester, 500 ms) and re-checking account state on every submission.

Price path

The design separates four prices: I (independent index), M (bounded mark, ±0.5 % of I), E (actual fill) and L (last confirmed fill). Risk uses M; funding notional uses I; the tape uses L. The matcher samples its own book into an EMA mark (mark-sampler.ts) and serves an authenticated snapshot of its depth to the oracle (/v2/mark-evidence), but it cannot push a price on chain: only a payload two of the three committee signers independently reproduced and signed is accepted. Details and current limits are in Data & methodology.

What is implemented versus what is designed

The normative design is docs/spec/V2_ARCHITECTURE.md. The code above implements its main shapes (single-writer engine, binary WAL, packed settleBatch, threshold verifier, epoch revocation, independent signer services). It is deployed and verified on Robinhood Chain (4663) with USDG collateral: the shared stack (MarketRegistryV2, TrionPriceVerifierV2, FundingEpochsV2, RiskV2, FixingCouncilV2) and the perp modules are in overdrive/deployments/v2/4663.json / 4663.perps.json; the CMPT option stack has been live since the time listed on the status page and is recorded in the verified 4663.options.json written by the finalizer. The live product is CMPT capped options. The CMPT-USD perpetual (PerpetualV2 0x44bb9EB22B9f00C9830cdDEBC3C98f71F376AF87, OrdersV2 0xc80e131148C68AFDFC3AF999DE9C3B32310C936F, CloseoutRouterV2 0x13A053245d5152E52FF7DB35459835226621Fd99) is in open beta: it is served by a separate perp matcher at https://api.trion.market/perp, marks to the ten-venue CMPT-USD perp index (trion-cmpt-v2-linked, published to TrionPriceVerifierV2 about once a minute) and is operator-cleared, with no ADL queue, backstop vault or slow-mode endpoint deployed (zero addresses); the original CMPT perp module set in the same manifest was never listed. AI access to that beta goes through the MCP endpoint https://api.trion.market/mcp (OAuth 2.1, open to any wallet since 2026-09-26) and the desk's Trion AI chat; see Connect an AI assistant (MCP). GRID, DRAM, NAND, HASH and DPIN have no contracts on 4663, and TOKN derivatives are disabled by construction in the deploy scripts. The 4663.*.dryrun.json files are pre-cutover simulations kept as history; they are not consumed by any loader. Local development uses a throwaway chain 31337 with a valueless test token (see Local development).

Guards that the code now enforces

• Canonical deployment only. loadV2DeploymentsFromDisk (core/src/deployments.ts) accepts a manifest only when deploymentStatus is verified and it carries verifiedChainId, verifiedGenesisHash, verifiedAtBlock and verifiedBlockHash. Those fields are written solely by the read-only finalizers (core/scripts/finalize-perps-v2.ts, finalize-options-v2.ts) after a fresh RPC check; the deploy scripts themselves write *.pending.json. The matcher (config.ts validateV2Bindings) and the oracle (v2-runtime.ts) re-verify genesis and anchor block against the RPC at startup, so a manifest cannot be pointed at a different chain or fork.
• Registry-gated matching. Every EngineV2 is constructed with a marketStateLoader (main.ts) that re-reads MarketRegistryV2.getMarket at the latest block, recomputes the market id from the registered identity and re-checks the block hash. Admission, policy triggers and batch proposal refresh that state; if the market is disabled, unavailable or mismatched, the affected unproposed intents are durably cancelled and no batch is emitted. Cancellation, account intake, receipts, reorgs and recovery are never gated.
• No silent chain fallback in the browser. getV2PerpsDeployment(chainId) and getV2OptionsDeployment(chainId) in overdrive/exchange/web/src/v2-config.ts accept only 31337 (local) and 4663, and on 4663 they throw unless both the perps and options manifests carry deploymentStatus: "verified". Before signing or sending any V2 transaction, wallet.ts also re-reads the matcher's configured chain, the wallet's account state and a fresh eth_chainId, and refuses on mismatch rather than switching networks for you.
• No placeholder prices. /v1/markets, /v1/account and the ticker stream serve only the snapshot accepted by TrionPriceVerifierV2 and answer 503/UNAVAILABLE when it is missing, expired or malformed. There is no seed, store or V1 substitute on the V2 path (see API).
• Soft cancel reaches the V2 book. DELETE /v1/orders/:hash authenticates against the resting order's actual trader and removes it with EngineV2.cancelOrder. It is local only; hard revocation on chain remains the authoritative exit.
• No self-refreshed prices. The matcher never re-signs an ageing V2 snapshot. Snapshots come only from the oracle publisher's 2-of-3 signer committee; when the last accepted snapshot expires the API reports the price as unavailable until a new signed snapshot lands.
• Options wired to series. The Options and Liquidity pages read OptionEngineV2, OptionDlmmV2 and WriterSleeveV2 through the V2 ABIs, resolve a series by seriesId from the options manifest and the matcher config, and verify pool/token/sleeve bindings on chain before acting. The live series list is whatever the verified 4663.options.json records; an empty manifest yields an empty list, never invented instruments.
• Options V3 is a separate exchange. OptionsExchangeV3 (overdrive/src/v3/OptionsExchangeV3.sol, interface overdrive/shared/v3/IOptionsExchangeV3.sol) holds trader cash, positions and per-series collateral locks and settles operator-matched fills (settleFills) against EIP-712 orders under the domain TrionOptions v3. The book service (overdrive/exchange/options-book) matches in a single-writer engine, simulates each batch with eth_call, relays at most 40 fills per transaction, and keeps orders, fills and batches in SQLite; the desk, the market maker and the service all compute payoff, fee, fill projection and reservations from overdrive/exchange/core/src/v3.ts, never from private copies. It loads only a verified overdrive/deployments/v3/<chain>.options-v3.json, and it settles against the same TrionPriceVerifierV2 fixing as V2; the oracle publisher adds V3 expiries to the CMPT fixing schedule from that manifest (oracle/src/v2-runtime.ts). See Options and the Options order-book API.
• Public API host. One public host, https://api.trion.market, fronts the services: the options-era matcher under /v1 (which also proxies the index oracle read-only under /v1/oracle/*), the CMPT-USD perp matcher under /perp (/perp/v1/..., WebSocket /perp/v1/ws), the Options V3 book under /v3/options, and the MCP server under /mcp (see API).

Known limits at launch

• Perp funding view. The matcher reports perp funding fields as UNAVAILABLE; it does not read FundingEpochsV2. Options pay no funding, and funding is switched off in the CMPT-USD open beta (mark = index), so this is not user-visible today.
• Mark equals index. Accepted snapshots carry the index as their mark (M = I): the CMPT options index for the options market, and the CMPT-USD perp index for the perp beta. Option premiums are quoted from the options mark.
• Operator-cleared perp beta. For CMPT-USD, Trion's matcher settles trades and Trion's keeper runs liquidations (full close into Trion accounts). With no ADL, backstop or slow-mode contracts deployed there is no independent forced-exit path; cancel and hard revocation remain available on chain. A flat account with negative trading cash cannot withdraw, even with positive free cash; additional deposits increase free cash but do not repay negative trading cash. Accounts with an open position also need sufficient margin after withdrawal and a fresh NORMAL market.
• Governance and council. Governance is a single address and all five fixing-council seats are Trion-held at launch; see Risks and security.
• No independent audit. The internal review register in docs/RELEASE_V2.md §6 has no third-pass closure review.

Source trail: docs/spec/V2_ARCHITECTURE.md §§1, 3.5, 4; overdrive/deployments/v2/4663.json, 4663.perps.json; overdrive/deployments/v2/reviewed/4663.cmpt-options-approval.md (markSource: "index"); overdrive/exchange/matcher/src/main.ts (marketStateLoader), server.ts (/v2/mark-evidence, /v1/oracle/*), config.ts, canonical-prices.ts, index-feed.ts, mark-evidence.ts; overdrive/exchange/core/src/deployments.ts (parseVerification, loadV2DeploymentsFromDisk), v2-bindings.ts; overdrive/exchange/core/scripts/finalize-perps-v2.ts, finalize-options-v2.ts; overdrive/exchange/oracle/src/publisher.ts, signer.ts, v2-runtime.ts; overdrive/exchange/web/src/v2-config.ts, wallet.ts, pages/options.ts, pages/liquidity.ts; overdrive/deployments/v2/README.md.

Repository-owned documentation · October 2026 · Educational material, not investment advice and not an audit.