Programmable Perpetual Markets
Perpetual futures venues are built as monoliths, which makes them legible and makes anything built on them fragile. We describe a decomposition into independently-specifiable matching, risk and settlement layers, argue that determinism in the settlement layer is the property that makes the rest auditable, and report on the funding-rate behaviour we observed once the layers were separated.
The monolith
A perpetual venue typically owns its book, its oracle, its funding mechanism, its margin engine and its insurance fund as one system. Every integrator inherits all of those decisions together, and every post-mortem has to untangle them before it can assign a cause.
The coupling is not accidental — it buys latency and capital efficiency. Our claim is narrower than ‘monoliths are bad’: it is that the coupling should be a deliberate optimisation over a specified decomposition, not a starting condition.
Determinism as the interface
We define the settlement layer as deterministic if, given the same ordered inputs, any observer reconstructs identical position state, funding accrual and liquidation sets. No step may depend on the order in which an off-chain component observed the world.
This is a strong constraint and it costs latency. What it buys is that every liquidation becomes reproducible after the fact, every risk model becomes backtestable against real chain state, and every integrator can simulate exposure without trusting the venue’s own accounting.
Funding under decomposition
Separating the funding mechanism from the matching layer let us test funding designs against identical order flow. The result that surprised us: under the flow we replayed, funding-rate clamping — near-universal in production venues — degraded convergence to the index during precisely the volatile periods it was introduced to protect against.
We are not confident this generalises beyond the markets we tested, and we say so in the paper at more length than a reader may want.
Isolated risk and its cost
Per-market margin scoping and tranched insurance capital prevent a thin listing from socialising its failures across the book. The cost is measurable capital inefficiency, which we quantify. For a venue, that trade is probably wrong. For infrastructure other protocols compose against, we argue it is the only defensible one.