Skip to main content
Ondo Perps runs as an offchain matching engine with onchain settlement. The two are separate by design: the matching engine optimizes for speed and determinism; the settlement layer handles onchain asset custody.

​
The Three Components

​
Exchange-Engine

The Exchange-Engine housing the matching engine, account manager, order book, position tracking, and liquidation logic. It runs entirely offchain. When a user funds their account or withdraws, the exchange-engine queries the chain-core for onchain state, it does not interact with the chain directly.

​
Chain-Engine

The chain-core is the onchain interface. It processes funding and withdrawals: it watches for incoming onchain transfers, confirms them, and signals the exchange-engine to credit the account. For withdrawals, it executes the onchain transaction and pays gas on behalf of the user.
The chain-core holds no knowledge of internal accounts. It sees only onchain addresses and transfer amounts sweeping funds into the main hot wallet.

​
Attestor Network

The attestor network is the trust layer between the exchange-engine and the chain-core. It distributes the cryptographic secrets each component needs to operate, and serves as the consensus mechanism for blockchain state. Neither component can function fully without it.

​
Execution Integrity

The matching engine runs inside an SGX (Software Guard Extensions) hardware enclave. SGX creates an isolated memory region that the operating system and the hardware owner cannot read or modify, including Ondo’s own infrastructure team. The enclave produces a cryptographic attestation proving it is running a specific, published binary. Reproducible builds ensure the binary is deterministic: the same source code produces the same binary every time, so the deployed code is independently verifiable against the published source. The attestation model removes operator trust as a variable. No party, including Ondo, can modify matching logic or access order state while the enclave is running.

​
Funding and Withdrawal Flow

Funding:
  1. User sends USDC or a supported tokenized equity to their assigned funding address onchain
  2. No bridge required, standard ERC-20 transfer
  3. Chain-core detects the transfer and notifies the exchange-engine
  4. Exchange-engine reflects the funding in the user’s Perps balance
  5. The chain-core sweeps the funds into its main hot wallet
Withdrawal:
  1. User requests withdrawal via API
  2. Exchange-engine checks the selected source balance and applicable withdrawal restrictions; withdrawals from Perps must also satisfy margin requirements
  3. Chain-core executes the onchain transfer; Ondo pays gas
  4. Withdrawal is marked as finalized when enough confirmations has been reached
USDC funding is supported on Ethereum and Arbitrum. Ondo tokenized stocks are supported on Ethereum. Funding addresses are specific to the asset and network.

​
Collateral Custody

The chain-core handles on-chain funding and withdrawals through an omnibus wallet. The exchange-engine tracks each user’s balances off-chain. Transfers between the user’s Spot and Perps balances update those records without an on-chain transaction. The described architecture does not use a pooled smart contract to govern user funds. The trust guarantee is the SGX attestation, a cryptographic proof that the running binary matches the published source, not onchain contract auditability.