A hybrid design: a deterministic matching engine off-chain for speed, with custody and settlement on-chain so the venue cannot quietly become insolvent. The engine is event-sourced and replayable, which means its execution can be independently audited rather than taken on trust.

It publishes a proof of solvency every five minutes — a cryptographic commitment that user liabilities do not exceed the vault's actual balance, verifiable by anyone with the open-source tool rather than by asking us. If the operator ever stops committing, an escape hatch lets users withdraw directly against the last honest state.