White Paper
Abstract
PlasmaPerps is a high-performance, non-custodial perpetual futures exchange designed to deliver centralized-exchange (CEX) trading experience with sub-second execution, deep liquidity, and intuitive UX while preserving the trust guarantees of decentralized finance. The protocol combines an off-chain, ultra-low-latency sequencer and matching engine with fully on-chain settlement, margining, and vault-based custody on Plasma Chain (and mirrored on BSC).
User funds are held in audited smart contract vaults that enforce deterministic margin, PnL, and liquidation logic. Yield-oriented liquidity vaults operate alongside the perp DEX, supplying liquidity, absorbing risk, and earning trading fees, funding payments, and protocol incentives. This document outlines the design goals, system architecture, latency model, non-custodial properties, vault mechanics, and security considerations for PlasmaPerps.
1. Introduction
Perpetual futures have become one of the dominant venues for crypto trading volume. However, most activity is still concentrated on centralized exchanges that require full custody of user funds, opaque risk management, and trust in non-transparent matching engines.
On the other side, decentralized perpetual protocols often suffer from:
Slow and unpredictable transaction latency.
High gas costs during peak usage.
Fragmented or shallow liquidity.
Poor user experience compared to CEXs.
PlasmaPerps is designed to bridge this gap. The protocol aims to:
Deliver sub-second order acknowledgements and fills for traders.
Maintain robust, on-chain custody of user funds.
Provide composable liquidity via vaults that can be integrated across DeFi.
To achieve this, PlasmaPerps adopts a hybrid architecture:
Off-chain sequencer and matching engine for fast, ordered execution.
On-chain settlement contracts that hold funds, track positions, and enforce risk.
Vault contracts that manage margin accounts, liquidity provisioning, and insurance.
2. Design Goals
2.1 CEX-Like Performance
PlasmaPerps targets user-perceived latencies of under 500 milliseconds for:
Order placement.
Order cancellation.
Execution reports and position updates.
By decoupling execution from on-chain settlement and using WebSockets for real-time communication, the protocol seeks to make trading on PlasmaPerps feel indistinguishable from a modern centralized exchange.
2.2 True Non-Custodial Funds
User assets are never held by a centralized operator. Instead:
Funds are deposited into non-custodial smart contract vaults on Plasma Chain.
The sequencer and matching engine cannot withdraw or re-route funds.
All transfers occur according to deterministic rules encoded in smart contracts.
This design keeps custody trust-minimized while still enabling advanced features such as cross-margining and portfolio-level risk management.
2.3 Composable Liquidity & Yield
Vaults are first-class citizens in the PlasmaPerps architecture. They can:
Provide liquidity to the perp engine.
Earn trading fees, funding payments, and protocol incentives.
Be tokenized and integrated into the broader DeFi ecosystem as yield products.
This allows both passive LPs and sophisticated strategies to participate in the protocol.
2.4 Graceful Failure Modes
In the event of off-chain component failure (e.g., sequencer downtime), users must retain the ability to:
Prove their most recent valid state.
Withdraw their margin and close positions through on-chain mechanisms.
The design emphasizes graceful degradation: UX may temporarily suffer, but safety and fund recoverability are preserved.
3. System Architecture
PlasmaPerps is composed of the following core components:
Frontend Clients
Gateway & API Layer
Sequencer & Matching Engine
On-Chain Perpetual Contracts
Vault Contracts
Risk & Oracle Layer
3.1 Frontend Clients
Web and mobile interfaces connect to the PlasmaPerps gateway via WebSocket and HTTP.
Users interact with the protocol by signing all critical actions with their wallets:
Deposits and withdrawals.
Order placements and cancellations.
Position adjustments and leverage changes.
The frontend provides real-time updates on orderbooks, positions, margin, and PnL.
3.2 Gateway & API Layer
The gateway is a stateless edge service designed to:
Validate cryptographic signatures on user intents.
Perform basic anti-spam checks and rate limiting.
Provide WebSocket endpoints for streaming:
Orderbooks.
Trade feeds.
Execution reports and account updates.
The gateway is geographically distributed to minimize latency for users in major trading regions.
3.3 Sequencer & Matching Engine
The sequencer acts as the canonical off-chain ordering mechanism during normal operation. It:
Orders and timestamps all user actions (orders, cancels, liquidations).
Inserts orders into in-memory orderbooks and executes matching logic.
Maintains an internal representation of:
User positions and PnL.
Available margin and risk metrics.
Produces batches of state transitions to be committed on-chain.
The matching engine provides soft confirmations to traders in sub-second via execution reports, while ultimate settlement is handled by smart contracts on Plasma Chain.
3.4 On-Chain Perpetual Contracts
The on-chain contracts form the source of truth for:
User margin balances.
Open interest, positions, and leverage.
Realized and unrealized PnL.
Funding rate accrual and settlement.
Insurance and fee pools.
Vault balances and accounting.
These contracts verify batch updates from the sequencer, enforce risk constraints, and ensure system invariants such as solvency and collateralization thresholds.
3.5 Vault Contracts
There are two main categories of vaults:
User Margin Vaults
Represent a user’s margin account and positions.
Implement withdrawals, deposits, and liquidations.
Liquidity and Strategy Vaults
Pool capital from multiple depositors.
Provide liquidity or implement strategies.
Earn a share of fees and funding.
Vaults are fully non-custodial smart contracts; users interact with them via deposits, withdrawals, and share-based accounting.
3.6 Risk & Oracle Layer
The protocol relies on a robust price and risk infrastructure:
Oracles aggregate price feeds from multiple sources to determine mark prices.
Risk engine enforces:
Initial and maintenance margin requirements.
Liquidation thresholds.
Circuit breakers for extreme volatility or oracle anomalies.
This layer is critical for maintaining solvency and fair execution in all market conditions.
4. Latency Model
4.1 Definitions
User-Perceived Latency: Time from user action (e.g., clicking “Place Order”) to seeing a confirmation or fill on the UI. Target: < 500 ms in normal network conditions.
On-Chain Finality: Time from off-chain execution to the corresponding state being finalized in smart contracts. Target: 1–3 seconds, depending on block times and batching cadence.
PlasmaPerps is optimized for fast user-perceived latency while ensuring that on-chain state remains authoritative.
4.2 Fast Path: Off-Chain Execution
Signed Intent
User signs an order or action with their wallet.
The signature authorizes the sequencer to include that action in an upcoming batch without moving funds yet.
Gateway Validation
Verify signature validity.
Enforce nonces to prevent replay.
Apply basic rate limits and anti-abuse checks.
Matching and State Update
Sequencer inserts the order into an in-memory orderbook.
Matching logic identifies counterparties (trader vs trader or trader vs vault).
Internal state for positions, PnL, and available margin is updated.
Soft Confirmation
An execution report is streamed back to the user:
Order status: filled, partially filled, or resting.
Execution price and size.
Updated position and PnL.
This completes within hundreds of milliseconds under normal conditions.
4.3 Slow Path: On-Chain Finalization
Batch Construction
At fixed intervals or based on load, the sequencer:
Packages all processed actions since the last batch.
Computes a new state root or transition proof.
On-Chain Commitment
Settlement contract verifies:
Sequencer authorization and signatures.
Optional validity proofs, depending on implementation.
On-chain state is updated:
Margin balances and positions.
PnL and funding transfers.
Insurance and fee pools.
Vault balances.
Finality and Verification
Frontend periodically checks on-chain state.
Once the batch is finalized, UI marks trades and balances as “confirmed on chain.”
4.4 Sequencer Failure and Fallback
To maintain trustlessness:
Users can rely on failsafe withdrawals:
Prove their last valid state using signed snapshots or inclusion proofs.
Withdraw margin directly from contracts if the sequencer is unresponsive.
Governance may:
Promote a backup sequencer.
Temporarily switch to a more conservative, fully on-chain settlement mode, trading off performance for continued availability.
5. Non-Custodial Architecture
5.1 Ownership and Control
The fundamental ownership model is:
Users hold their assets in wallets they control.
When interacting with PlasmaPerps, users deposit funds into smart contract margin vaults, not into centralized accounts.
Smart contracts enforce that funds can only move according to predefined rules:
Margining and PnL settlement.
Liquidations under specified conditions.
Authorized withdrawals.
No off-chain system component, including the sequencer and matching engine, can unilaterally withdraw or redirect funds.
5.2 Margin Vault Design
Each user margin vault may be implemented as:
A mapping in a global margin contract from address → balance and positions, or
A dedicated proxy instance per user (e.g., ERC-1967 proxy).
Key properties:
Isolation from Protocol Solvency
Even if the protocol experiences insolvency or liquidity stress at the system level, non-negative balances in a user’s vault remain owned by that user.
The protocol cannot arbitrarily reassign user balances.
Programmatic Withdrawals
Users can withdraw any free collateral (above maintenance margin) at any time.
Withdrawals are restricted only when:
They would breach maintenance margin requirements.
A liquidation is actively in progress.
Deterministic Liquidations
When account equity falls below maintenance margin, keepers can trigger liquidations.
Liquidation logic:
Partially or fully close positions at oracle or auction prices.
Allocate liquidation fees to insurance pools or liquidation executors.
Return any remaining equity to the user’s vault.
5.3 Separation of Concerns
The system cleanly separates roles:
Off-chain: UX, ordering, and transaction sequencing.
On-chain: Custody, risk enforcement, and final netting of balances.
This separation enables high performance without compromising the core non-custodial guarantees.
6. Vault Architecture & Operation
Vaults are pooled smart contracts that deploy capital into PlasmaPerps according to predefined strategies.
6.1 Vault Types
Liquidity Vault (LP Vault)
Pools stablecoin capital to provide liquidity to the perp exchange.
Earns:
A share of trading fees.
A share of net funding payments when traders pay funding.
Potential protocol incentives (e.g., XPLPERP emissions).
Insurance Vault
Accumulates:
A portion of protocol fees.
Liquidation penalties.
Acts as a backstop in case of bad debt or extreme market moves.
Strategy Vaults (Optional / Future)
Encapsulate specific automated strategies, such as:
Delta-neutral funding harvesting.
Basis trades.
Quantitative market-making.
Users receive vault tokens representing proportional claims on NAV.
6.2 Vault Lifecycle
Deposits
Users deposit collateral (e.g., USDC) into a vault contract.
Vault mints vault shares (vTokens) based on current NAV:
shares_minted = deposit_amount / share_price.
Capital Deployment
The vault operates as a single margin account within PlasmaPerps.
A portion of vault capital is allocated as LP margin across markets.
Strategy logic (on-chain parameters plus off-chain controllers, where applicable) determines:
Exposure per asset.
Maximum leverage and skew.
Hedging behavior, if any.
Earning Yield
Vaults generate returns through:
Trading Fees
Maker/taker fees are split according to protocol rules.
A portion accrues to vault accounts that provide liquidity.
Funding Payments
Perpetual funding transfers value between longs and shorts.
When net funding flows to the LP side, vaults receive these payments.
Protocol Incentives (XPLPERP)
Governance can direct token emissions to vaults to incentivize TVL and depth, especially during bootstrapping.
These flows increase vault NAV, making each vault share more valuable over time.
Withdrawals
Users burn vTokens to redeem their share of vault assets.
If sufficient free collateral is available:
Withdrawal occurs immediately.
If too much capital is locked:
The vault may unwind positions gradually.
Epoch-based withdrawal or queue mechanisms can be used to manage liquidity safely.
All operations are governed by smart contract logic, preserving non-custodial guarantees.
6.3 Interaction with Trader Accounts
The interaction between vaults and traders includes:
Trade Matching
Traders submit orders that may be matched:
Against other traders.
Against vault liquidity when vaults quote as LPs.
Risk Netting
Vault exposure is managed via:
Per-market caps.
Portfolio-level risk limits.
In stressed conditions, vaults can:
Widen spreads.
Reduce available liquidity.
Hedge risk if external integrations exist.
Fee and Funding Distribution
During each settlement batch, contracts compute:
Fees owed to protocol, referrers, and vaults.
Funding payments between traders and LPs.
Vault balances are updated accordingly on-chain.
Bad Debt Handling
In extreme events leading to bad debt:
The insurance vault is tapped first.
If insufficient, governance-defined loss socialization mechanisms may apply, transparently encoded in contracts.
7. Security & Risk Considerations
7.1 Smart Contract Security
All core contracts (perp engine, margin vaults, liquidity vaults, settlement logic) must undergo:
Independent third-party audits.
Formal verification where feasible.
Ongoing bug bounty programs to incentivize responsible disclosure.
7.2 Sequencer Risk
While the sequencer cannot steal funds, it can:
Temporarily censor or delay actions.
Reorder included transactions within protocol-defined constraints.
Mitigation strategies:
Failsafe withdrawal paths via on-chain proofs of state.
Governance-controlled mechanisms to rotate or replace the sequencer.
Potential evolution toward multi-sequencer or shared sequencing designs.
7.3 Oracle Risk
Price oracle integrity is critical for fair liquidations and PnL:
Use multiple data sources per asset.
Aggregate with robust statistics and outlier filtering.
Implement circuit breakers when:
Deviations exceed thresholds.
Underlying markets show clear dislocation or downtime.
7.4 Vault & Market Risk
Vault depositors bear:
Strategy performance risk.
Market risk associated with providing liquidity.
Tail risk in extreme market conditions.
Mitigations include:
Strict leverage and exposure caps per vault.
Transparent reporting of:
Historical PnL.
Drawdowns.
Utilization.
Optionally, configurable risk profiles across multiple vaults (conservative vs aggressive).
8. Conclusion
PlasmaPerps aims to deliver a new standard for decentralized perpetual futures by combining:
Sub-second, CEX-like user experience via an off-chain sequencer and matching engine.
Strong non-custodial guarantees, with user funds held in audited smart contract vaults and deterministic risk logic.
Composable, yield-bearing liquidity through LP and strategy vaults that integrate with the wider DeFi ecosystem.
Last updated