01 · Determinism
Deterministic matching you can replay.
Orders and fills are WAL-durable (fsync). State is replayed, not recomputed — bit-identical rebuild on recovery.
Mechanism: WAL fsync + deterministic replay from genesis.
THE ENGINE
A core most exchanges only talk about.
A memory-safe Rust matching engine. A WAL-durable, deterministic replay. A double-entry ledger with conservation gate-checked on every batch. A blake3 audit chain that breaks visibly when tampered.
MECHANISMS
Six claims.
Six mechanisms.
Every claim below maps to a shipped mechanism. No adjectives without proof — the credibility of the engine is the credibility of the exchange.
02 · Conservation
Every balance change is conserved.
TigerBeetle double-entry transfers. Conservation is gate-checked (cache ↔ ledger lockstep). 0 drift, by construction.
Mechanism: Double-entry ledger + conservation gates.
03 · Tamper-evidence
Tamper-evident by construction.
Append-only blake3 hash-chain. Least-privilege DB roles. Off-box hash-tip export keeps the chain externally verifiable.
Mechanism: Append-only blake3 + role-segregated audit DB.
04 · Memory safety
No GC pauses on the hot path.
Engine in Rust. Single-threaded low-latency matching actor. No managed-runtime stop-the-world surprises.
Mechanism: Rust + single-threaded match core.
05 · Risk engineering
Real risk, explained.
Cross-margin unified account. Worst-first partial liquidation. Maintenance model + insurance fund + ADL waterfall — explained, not hidden.
Mechanism: Unified margin + worst-first partial liq.
06 · Capability auth
Your data is yours.
Capability-model authenticated RPC. No client can read another account. Fees stamped on ingress and conservation-locked through the ledger.
Mechanism: Account-scoped capability tokens.
MEASURED
Numbers,
and how they were measured.
All values measured on canary hardware under synthetic sustained load. Methodology is published next to every figure — that's the entire point.
Order-ack p50 / p99
5 / 9 µs
Single-instrument canary · representative load · 30-min run · 2026-06
Sustained throughput
1.1M ops / s
synthetic load · single instrument · sustained 30 min
Deterministic recovery
2.9s
WAL replay from genesis · 4 GB log · bit-identical state
Ledger conservation
0 drift · gate-enforced
A property, not a benchmark — enforced by the conservation gate on every batch.
DETAILS
Questions, answered straight.
Why determinism matters, what WAL-before-ack buys, how 0 drift is enforced, and where the numbers come from.
Why build the engine deterministic?
Because a deterministic engine can be replayed, not just trusted. State is rebuilt by replaying the write-ahead log rather than recomputed, so recovery lands on bit-identical state every time — which is what makes the audit chain and the conservation gate meaningful. A non-deterministic engine could not be re-derived from its log, so its history could not be independently checked.
What does WAL-before-ack mean?
Every accepted order is written to an fsync'd write-ahead log before it changes any state or is acknowledged — the log is the source of truth, and the engine's state is a deterministic replay of it. Logging before the acknowledgement is what makes a crash survivable: nothing is confirmed that was not first made durable, so recovery rebuilds bit-identical state from the log.
How is 0 drift enforced?
Balances move only as double-entry transfers, and a conservation gate checks cache against ledger in lockstep on every batch. If the two disagree the batch aborts rather than ships. '0 drift' is that property — the signed balances per asset always sum to zero — enforced continuously by the gate like a test, not asserted as a marketing benchmark.
What hardware are the numbers from?
All figures are measured on canary hardware under synthetic sustained load, on the in-process matching path with a single instrument, and the methodology is published next to every number — order-ack is shown as p50 and p99 together (5 µs / 9 µs), not just the flattering one. The synthetic load is deliberate: the measured ceiling sits above any real-world exchange order flow, and it is labelled a benchmark, not production traffic.
SEE IT RUN
One order,
five proofs.
The home page pins a single order as it moves through the engine — validated, logged, matched, booked, hashed — handing over a proof at each stage. It is the same pipeline these mechanisms describe, watched end to end.