Contracts and deployments

In one paragraph. Trion V2 is a set of small, non-upgradeable Solidity contracts wired together at deployment time. Four are shared across markets (registry, price verifier, funding, risk) plus the fixing council, eight are deployed per market (perpetual, orders, strategy policy, closeout router, backstop vault, ADL queue, slow-mode endpoint, writer sleeve), and the options stack adds an engine, pricer, ERC-1155 option token, DLMM resolver and one secondary pool per series. The production deployment is on Robinhood Chain (4663) with USDG collateral: the shared stack and the CMPT perp modules are verified in overdrive/deployments/v2/4663.json, and the CMPT option stack opens at the time on the status page. Only CMPT is deployed; the CMPT perpetual is not listed. A deployment becomes loadable by the matcher, oracle and desk only after a read-only finalizer has verified it against the chain and written the canonical manifest.

Which manifest is which

Only CMPT is populated in the 4663 V2 manifest. main.ts refuses to boot a listed market whose perpetual, orders, verifier or registry address is missing, and re-reads the market's registry identity on every operation (marketStateLoader).

Pending, verified and canonical

flowchart LR
  R[Reviewed config JSON\nhash committed] --> D[forge script Deploy*/Seed*\nwrites *.pending.json]
  D --> F[finalize-*-v2.ts\nread-only RPC checks]
  F -- "genesis + block anchors\ndeploymentStatus: verified" --> C[<chain>.perps.json / .options.json / .json]
  C --> M[matcher config.ts]
  C --> O[oracle v2-runtime.ts]
  C --> W[web v2-config.ts]

• Deploy writes pending only. DeployV2.s.sol refuses to run if a canonical <chain>.perps.json already exists and writes <chain>.perps.pending.json; DeployOptionsV2.s.sol and SeedOptionsV2.s.sol do the same for options. Outside 31337 the scripts require a reviewed configuration file whose keccak hash is passed as PERPS_CONFIG_HASH / OPTIONS_CONFIG_HASH / SERIES_INPUT_HASH, separate private (non-Anvil) identities for governance, matcher and each signer, a six-decimal collateral token, and on 4663 the hard-coded USDG address.
• Finalize verifies, never broadcasts. core/scripts/finalize-perps-v2.ts and finalize-options-v2.ts read the pending file, re-check every identity, bytecode, registry binding, signer set, activation delay (at least one hour outside 31337: MIN_PRODUCTION_ACTIVATION_DELAY_SEC in core/src/v2-bindings.ts, which the runtime bindings also enforce) and reviewed config hash against a fresh RPC read pinned to one block, then write the canonical files with deploymentStatus: "verified", verifiedChainId, verifiedGenesisHash, verifiedAtBlock and verifiedBlockHash. Existing canonical identities are retained, never replaced or removed ("Refusing to remove canonical perps market"), and the publication is atomic under a cooperative lock.
• Loaders demand the anchors. loadV2DeploymentsFromDisk (core/src/deployments.ts) rejects any manifest without those fields, and beginV2Verification/finishV2Verification (core/src/v2-bindings.ts) compare the RPC's genesis hash and anchor block hash to them at startup and around every pinned read. There is no fallback to an older manifest shape, a different chain or a local default.
• TOKN is zero-exposure by construction. The perps deploy requires TOKN to have zero risk limits, zero source configuration and no funding origin; the options deploy and seed scripts require its issuance config disabled and refuse TOKN series; the options finalizer fails if TOKN is enabled in the registry.

Module responsibilities

Shared (one per chain):

Per market:

The full interface set with struct definitions is overdrive/shared/v2/IV2.sol; TypeScript mirrors are generated into overdrive/exchange/core/src/v2-abi/ and exported as v2Abi from @trion/exchange-core/v2-abi.

Deployment shape

overdrive/perps/script/DeployV2.s.sol deploys the shared contracts, then for each selected market computes the market id, schedules it in the registry, precomputes the per-market addresses from the deployer nonce (vm.computeCreateAddress) so constructors can bind immutable peers, and deploys them in that fixed order. Inputs are environment variables: MARKETS, QUOTE, GOVERNANCE, MATCHER, SIGNER0..2, ACTIVATE (local only), and outside 31337 ACTIVATION_DELAY (seconds, at least one hour) and PERPS_CONFIG_FILE/PERPS_CONFIG_HASH. DeployOptionsV2.s.sol (in overdrive/script/) adds the option engine, pricer, token, DLMM resolver and one writer sleeve per market from the reviewed OPTIONS_CONFIG_FILE; SeedOptionsV2.s.sol creates series and their CREATE2 pools from SERIES_INPUT_FILE.

On chain 4663 the script hard-codes CHAIN_4663_QUOTE = 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168 as the USDG address and requires it to report six decimals; the verified manifest records that same address as quote. The live registry's activation delay on 4663 is 3 hours (10800 s) and is immutable; the CMPT option market's activationAt is 1790147015 (2026-09-23 07:03:35 UTC, 02:03:35 CDT). Options trading opens on 23 September by 08:00 CDT once the option stack is deployed and seeded after activation; the status page is the single source for that.

The launch registry was redeployed with a 3-hour delay so that options could open on 23 September at 08:00 CDT; the first deployment (48 h delay) is retired, never enabled and never funded. It used the same contract code, governance, matcher, signer committee, council seats, bonds and reviewed configuration (reviewedConfigHash 0xd288d961e68c9623d569784f4a314dad863191f7c73ad86f0216c04fb7933ceb in both manifests); only the registry's constructor delay differs.

Options integration status

• Series-scoped UI. In V2 mode config.ts publishes options.markets from the options manifest's series array (TOKN excluded); each entry carries seriesId, pool, sleeve, terms and a tradingEnabled flag derived from the registry. pages/options.ts and pages/liquidity.ts look a series up by seriesId, read getSeries, the pool's seriesId/engine/optionToken/quoteToken and the sleeve's bindings through the V2 ABIs, and refuse to act on any mismatch. claim is called with the series id and the user's chosen quantity.
• Live series. The 4663 options manifest carries the two first-series entries (CMPT call and put, expiry 2026-10-30 08:00 UTC) once seeded and finalized; their seriesId, pool and sleeve are read from that file and shown on the desk's Transparency page.
• Acceptance script. core/scripts/e2e-v2.ts exercises a writer-sleeve deposit only; it labels that step accordingly ("Issuance, DLMM trading, settlement and buyer claims are not exercised by this step"). The full lifecycle (issuance, DLMM swap, fixing, settle, claim, settleDlmmInventory) is exercised in Foundry tests under overdrive/test/v2/.
• Perp protocol fees: PerpetualV2.feeCash accumulates taker fee minus maker rebate and has no withdrawal or recipient function; whatever the protocol would earn is stranded in the contract. There is no fee distributor, staking or emission contract anywhere in V2.

EIP-712 domains

All bind chainId and verifyingContract, so a signature for one chain or deployment is useless on any other chain or address.

Status and risk

• No independent security audit of these contracts exists. The internal review register (docs/RELEASE_V2.md §6, REG-01…REG-14) records remediation code against many findings and no third-pass closure review for any of them.
• Governance on 4663 is a single address (0xc37e…e17c), distinct from the matcher and from each of the three oracle signers as the deploy and finalize scripts require, but not a multisig or timelock. All five fixing-council seats are Trion-held at launch.
• Perp market configs for every market other than the CMPT option launch remain at their CANDIDATE_MARKETS defaults (enabled = false, T = 0, zero caps, riskApprovalHash = keccak("UNAPPROVED")); no perpetual is listed.
• Only what the verified manifests record exists. Any other address claiming to be Trion V2 is not.

Source trail: overdrive/deployments/v2/README.md; overdrive/deployments/v2/4663.json, 4663.perps.json; overdrive/deployments/v2/reviewed/{4663.options-config.json,4663.options-series.json,4663.options-launch.json,4663.cmpt-options-approval.md}; overdrive/perps/script/DeployV2.s.sol (CHAIN_4663_QUOTE); overdrive/script/DeployOptionsV2.s.sol, SeedOptionsV2.s.sol; overdrive/exchange/core/scripts/finalize-perps-v2.ts, finalize-options-v2.ts, v2-publication.ts; overdrive/exchange/core/src/deployments.ts (parseVerification, loadV2DeploymentsFromDisk), v2-bindings.ts, v2.ts (CANDIDATE_MARKETS); overdrive/shared/v2/IV2.sol; overdrive/src/v2/options/{OptionEngineV2,OptionTokenV2,WriterSleeveV2}.sol; overdrive/src/v2/dlmm/{OptionDlmmV2,FeeMath}.sol; overdrive/perps/src/v2/{PerpetualV2,BackstopVaultV2}.sol; overdrive/exchange/matcher/src/{main,config}.ts; overdrive/exchange/web/src/{v2-config,wallet}.ts, pages/{options,liquidity,transparency}.ts.

Repository-owned documentation · September 2026 · Educational material, not investment advice and not an audit.