Every other venue asks you to trust the operator. Midas replaces trust with proof, at the matching engine, the vault, the risk waterfall, and the settlement layer. Here is how.
Matching stays off-chain for speed, but nothing about it is taken on faith. Fills carry both traders' signatures, prices come from a source no one can write, and solvency is checkable in real time.
A deterministic, replayable engine matches; only fills and state roots touch the chain. One market, one risk brain.
TestnetMidasSettlement executes only with both traders' EIP-712 signatures and enforces both signed limit prices, the operator can't forge, over-fill, exceed a price, or replay.
TestnetThe endgame: a TEE enforces fair ordering in the latency budget, and zero-knowledge proofs of matching and liquidation, generated over the engine's own replay, are the guarantee.
RoadmapIndex price = median of a majority cluster across Chainlink, Pyth and a 6-venue mirror. Disagreement halts the market; no function anywhere can write a price. Re-pointing needs 2 days' notice.
TestnetLiability Merkle roots commit on a fixed cadence to a public verifier, with a staleness escape hatch, if the operator stops committing, you exit unilaterally.
Porting to MidasA single cancelAll() voids every order you've signed across all engines in one transaction, and keeps working even while the venue is paused.
TestnetOnboarding runs real AI, not a checkbox. And the anti-sybil defense doesn't care what document you bring; it recognizes your face.
Every KYC session runs AI document verification, passive liveness detection, and biometric face-match with a returned match score, plus proof-of-address and AML screening, driving tiered limits.
If the same live face already exists on an approved account, even under a different ID, the new account is auto-rejected, and it re-fires on every future attempt. Document-independent, self-sustaining.
Registry checks, officers and beneficial owners parsed into structured UBOs and directors, de-duped against the applicant, at the FATF 25% threshold.
A chain primitive: TEE-attested, then ZK-proven, inference with a model-commitment registry that proves which model ran, closing the model-swap threat. Provably-fair AI decisions.
Code-readyA blow-up hits an insurance fund first and orderly deleveraging only as a last resort, and the books account for every unit of PnL, so bad debt is visible, not silently socialized.
Per-asset funds absorb liquidation shortfalls before anything else. Balance is checked before liquidating; only if it can't cover does deleveraging trigger.
Own margin → insurance fund → ADL, closing the smallest fraction that restores health, judged at the price most favorable to the trader, so a wide oracle spread spares you.
PnL is split across four separate balances, winners' pool, insurance buffer, visible bad debt, redeemable claim, with an invariant that nothing is minted, destroyed, or double-promised.
Depositors supply collateral and take the protocol market-maker's real PnL, profit and loss alike, the true source of native yield, with a mandatory withdrawal delay so there's no bank run.
Code-readyOne shared registry caps liquidation notional per block across every engine, so a single distorted print can't take the whole book, a real cascade still completes across blocks.
Code-readyReserves-vs-liabilities coverage, conservative by default: a missing snapshot reads "unknown," never a false "fully backed."
On-chain you deposit and retain ownership: settlement can only move balances between users as a fill both signed, withdraw always pays msg.sender. No rescue, sweep, or emergency-withdraw exists.
TestnetLocked margin is segregated by bucket, so a blow-up in one engine or series can never seize collateral posted elsewhere, isolated perps, cross-margin and per-series options are walled off from each other.
TestnetAny new settlement authority faces a 3-day public timelock before it can touch a balance, and the exit is never pausable, so you always have a window to leave.
TestnetAnyone can list a market; who may trade it is decided by policy, per jurisdiction, per asset, with the identity kept off-chain and only an anonymous attestation hash on it.
An ERC-3643 / ONCHAINID-compatible claim registry that stores attestation hashes only, never PII, plus an on-chain jurisdiction/asset policy and a stateless eligibility verdict with machine-readable reasons.
A fail-closed sanctions edge (GeoIP + VPN/Tor detection), eligibility keyed on KYC-verified residency, not request IP, and per-user/per-country admin overrides, audited.
Real-time deposit/withdrawal/trade screening against the OFAC watchlist with velocity rules and 0–100 risk scoring; a hit blocks, freezes, and opens a case, one fail-closed choke-point.
Threshold checks with per-jurisdiction overrides, IVMS-101 payload generation, and delivery over the open Travel Rule Protocol, plus inbound receipt as a beneficiary VASP.
AML screening parsed into risk verdicts: confirmed sanctions auto-reject; PEP/AML open an Enhanced-Due-Diligence case, recorded to an auditor-facing register.
Post-closure PII erasure sweeps null personal data and delete provider-side sessions on a tunable retention window, keeping only a non-personal audit shell.
A native, every-block, threshold-VRF beacon (drand-style, commit-before-reveal, optionally VDF-hardened) whose output no single party, including the sequencer, can predict or bias. It feeds gaming, jury selection, and fair mints and airdrops.
Stand-in on testnetGames commit every bet before the result exists and settle against the beacon, the house cannot cheat even if it wanted to, with an on-chain bankroll that can't take a bet it couldn't pay.
TestnetSee it running: browse the live contracts on the explorer, or add Midas and try a market yourself.