Why
The four capabilities look unrelated and are the same move four times. Clearing, matching, routing and resolution each name a property the on-chain design already has for free — and each is the price of keeping that property once the system has to be fast, capital-efficient, or connected to the world. That symmetry is the finding, and it is what stops the list from being a syllabus.
Netting is the clearest case. Full collateralisation is not a safety feature the chain gives you; it is what remains after the clearing house is removed. Novation, multilateral netting, margin models and the default waterfall exist to make capital go further, and every scheme that recovers that efficiency — portfolio margin at the account level, a hybrid engine with an off-chain credit pool — re-introduces exactly the credit relationship whose absence was the selling point. The honest framing is not how do we net on chain but what are we willing to trust again, and how much capital does that buy back.
Matching repeats it with a different noun. The chain is the audit trail only while the order lifecycle happens on it; move matching off-chain for cost and latency and the trail leaves with it. Sequencer log commitments, Merkle proofs and ZK state-transition proofs are how a hybrid venue buys back auditability it stopped getting for free — and the residual question is always which parts of the lifecycle remain unprovable, since amendments and cancellations are harder to commit to honestly than fills.
Routing and resolution close the pattern. There is no best-execution duty on chain, but the economics of routing return as MEV — an agency cost paid to whoever sequences, which auctions, private order flow and slashable solver commitments try to price rather than abolish. And the chain cannot see the world at all, so every oracle fallback, dispute escrow and TLS-attested feed is a trusted party added back one at a time, while surveillance — the invariant checks, circuit breakers and rate limits that a traditional venue staffs a desk for — has to be written as code that runs without anyone watching.
Which is the positioning argument, stated precisely. The scarce engineer is not the one who can deploy a token or an AMM. It is the one who can read a nineteenth-century clearing mechanism, identify which of its guarantees a chain already provides and which it merely removed, and then re-implement the second group under gas, asynchrony and permissionlessness. event-contract-plumbing established that the requirements list is public and free to read. This card is what reading it costs.
How it works
The four rows, and the number each one is measured by
| Capability | What the chain gives free | What re-acquiring it costs | The number |
|---|---|---|---|
| Clearing and netting — novation, multilateral netting, SPAN/VaR margin, default waterfall; on-chain portfolio margin and hybrid credit pools | No counterparty risk, because every position is fully collateralised | A credit relationship comes back. Netting without a CCP means somebody is exposed between the trade and the cover | Required collateral ÷ net exposure. 1.0 means no netting exists; the gap below 1.0 is what was bought and from whom |
| Hybrid matching — off-chain LOB with batch settlement; sequencer log commitments, Merkle proofs, ZK state-transition proofs | The chain is the audit trail, publicly and by construction | The trail leaves with the matching. It has to be re-bought cryptographically, and amendments and cancellations are the hard part, not fills | Share of the order lifecycle provable to an outsider — submissions, amendments, cancellations, fills |
| Intent routing — Dutch and batch auctions, private order flow, solver networks with slashable commitments | No best-execution obligation to satisfy | The obligation returns as MEV, paid to whoever sequences. Auctions price the agency cost rather than removing it | Realised slippage against the executable side of the book — ask when buying, bid when selling, never the mid |
| Oracle failure and surveillance — multi-oracle fallback, dispute escrow, TLS-attested feeds, MPC feeds; invariant checks, circuit breakers, rate limits | Deterministic settlement, once the input is known | The chain cannot see the world. Every fallback adds a trusted party, and surveillance must run with nobody watching | Time to resolution when the primary oracle is unavailable, and how many parties had to be trusted to get there |
Why the symmetry matters more than the list
Read the middle column downward and the same sentence appears four times: the free property was free because something had been removed, and putting the capability back puts the thing back too. That is not an argument against building any of it — a venue that refuses all four is slow, capital-hungry, unauditable and blind. It is an argument for stating the price each time, because a design that adds netting without naming the credit it re-introduced has not solved counterparty risk; it has stopped measuring it.
The order to learn them in, and why
Not the order above. Start with resolution, because a market that cannot settle correctly makes every other capability irrelevant, and because it is the row with the least public prior art. Then netting, which decides the capital structure everything else runs on. Then matching, which is a performance decision that can be deferred until volume exists. Routing last, because MEV is a cost that only appears at size — and by then the first three have determined how much of it there is to extract.
The honest limit of a card like this
Four capabilities is a career, not a sprint, and a list of things to learn is the least reliable artifact in this catalogue — it survives contact with reality only if each row is reduced to a number that can be produced for a real system. That is why the fourth column exists, and why a row without one should be dropped rather than admired.
Review clarification
Why use a chain if trust comes back?
The remaining value is not no trust but constrained trust. A sequencer may order trades without receiving custody or power to rewrite final settlement; an oracle may decide an event without authority over unrelated treasury funds. The deepest test is credible exit: if one service disappears, do users retain their assets, history and ability to continue elsewhere? If not, the chain may be extra cost around an effectively centralised system.
Every efficiency number needs a risk counter-number
| Capability | Efficiency measure | Risk counter-measure |
|---|---|---|
| Netting | 1 - net exposure / gross exposure |
collateral / stressed potential loss |
| Matching | lifecycle steps with proofs | meaningful deviations still undetectable |
| Routing | slippage from executable bid/ask | benchmark age, impact, accessible venues |
| Oracle fallback | time to resolution | incorrect-resolution risk and source independence |
Collateral below net exposure may be under-collateralisation, not netting. A high provable fraction can hide censorship. Slippage mixes routing quality with latency and impact. Fast oracle recovery can mean one unsafe fallback. The evaluation must pair efficiency gained with risk reintroduced.