GreenX

Dex

One signature replaces the entire onboarding funnel.

GreenX Dex is a perpetual futures venue with a Web3-native identity layer: wallet in, Hyperliquid-benchmark order book, USDT settlement. No email. No password. No friction. The program is governed by three planning principles — fixed now, enforced architecturally forever.

Enter as a broker.
Graduate as a venue.
Never rewrite.

The category produced three archetypes. Hyperliquid and dYdX proved the order book wins — at the cost of purpose-built chains, years, and token treasuries spent renting liquidity. GMX-lineage pools bootstrap fast and stay capital-capped forever. GreenX takes the third door with a pre-cut exit: route-through execution now, with the order-book-native end state already specified and an engine swap that is a routing decision, not a rewrite.

// the lesson the leaders converged on, adopted here as module R6
no market ships without funded liquidity behind it   — governance as an inequality, not a slogan

Nine domains. Three states.
Decided now.

The contract between phases. BUILT ships inside the 45-day window. RESERVED means the socket exists before the plug — interface, data model and extension point constructed in Phase 1. PLANNED is roadmapped with a defined dependency chain.

A complete venue in 45 days.

One deliberate decision makes it possible: execution routes through the Binance Link broker program. Every user maps to a segregated venue sub-account; margin, brackets, mark price, funding and liquidation run on battle-tested machinery and mirror to the user in real time. What GreenX builds — and owns:

// revenue per executed trade of notional N — ledger-native, reconciled daily
Revenue(trade) = m_p · N  +  r · f_v · N       // platform markup + broker rebate

Eight sockets, installed
before the plugs exist.

Every phase boundary is an activation,
not a construction site.

The state is a pure function
of the log.

State_t = f( State_0, e_1, e_2, …, e_t )

Every monetary state change is an append-only, totally ordered log entry. A regulator's question is answered by re-running history. The Phase-2 engine is validated by consuming the same stream in parallel and diffing against venue truth for weeks before it takes a single live order. Confirmation policy, likewise, is a probability statement — not a folk custom:

// and the ledger never stops asserting conservation — invariant I3, live from day one:
Σ balances + fees + treasury float  =  Σ deposits − Σ withdrawals

T+0 µs → T+40 ms.
One order, six stations.

Watch a single order traverse the Phase-1 pipeline. Green is inside GreenX — microseconds. Red is the venue leg — milliseconds. Every station is idempotent: retries collapse onto the same journal entry by construction.

// venue rate budgets enforced as a token-weight ledger per API key
a(t) = min( B, a(t₀) + r·(t − t₀) )        admit ⇔ a(t) ≥ w_c
t_retry = t₀·2^k + U(0, j)                  // exponential backoff + jitter under 429/418

Money flows one way.
Approval flows the other.

Deposits concentrate down a one-way gradient — user addresses, watermarked hot wallet, cold multisig. The only road back runs through a two-of-N approval gate. Watch the plant run: the gauge fills toward the watermark W*, then sweeps to cold.

// confirmations are a probability statement, not a folk custom
P(reorg ≥ k) ≈ (q/p)^k          k(V) = ⌈ log(ε/V) / log(q/p) ⌉   // scale with value at risk

// hot-wallet watermark — a newsvendor bound on compromise exposure
W* = μ_out·T + z_ε·σ_out·√T          stockout ≤ ε · exposure ≤ W*

The whistle blows early.
By design.

The reserved engine's triggers are closed-form. With entry E, leverage L, tiered maintenance m and taker fee f_t (m′ = m + f_t — the forced close pays fees too):

Long:   P_liq = E · (1 − 1/L) / (1 − m′)          Short:  P_liq = E · (1 + 1/L) / (1 + m′)
Bankruptcy:  P_bkr = E · (1 ∓ 1/L)                 Partial: x* = (ρ|Q|P − Eq) / (|Q|P(ρ − c))

Take a position.
Survive the corridor.

A live sandbox of the §18 mathematics. You have $1,000 of margin. Choose a side, choose leverage — and the same closed-form liquidation line the engine computes will hunt your position across a random-walking market. Green line: your entry. Red line: where the whistle blows.

A war of attrition
the attacker funds.

// index: MAD-filtered, volume-weighted median — 50% breakdown point
reject i  if  |pᵢ − p̃| > κ·MAD(t),  κ = 5
B_t = λ·B_{t−Δt} + (1−λ)·(mid − P_idx),   λ = e^(−Δt/60s)
P_mark = P_idx + clip( B_t, ±0.5%·P_idx )

// funding: impact-price premium, TWAP over 8h — manipulation cost ∝ time-integral of displacement
prem(t) = [ max(0, ImpactBid − P_idx) − max(0, P_idx − ImpactAsk) ] / P_idx
F = P̄ + clip( 0.01% − P̄, ±0.05% ),   |F| ≤ 0.75%,   Σ transfers ≡ 0  // peer-to-peer, zero-sum

Latency is a
pricing input.

The reserved DMM quotes around an inventory-adjusted reservation price (Avellaneda–Stoikov), and its stale-quote risk is a function of refresh latency — which is why the sub-millisecond internal budget exists in Phase 1, before the desk does.

r_t = s_t − q·γ·σ²·(T−t)          δ_a + δ_b = γσ²(T−t) + (2/γ)·ln(1 + γ/k)
p_pickoff = 2·Φ( −(δ/2) / (σ_$·√Δt) )                    // spread must scale as √latency

// hedging economics — every fill netted 250 ms, fired as one IOC on the reference venue
E[PnL_rt] = δ_eff − 2f_m − c_hedge − E[adverse]
Var[PnL_gap] = q_f²·σ_$²·Δt_h        VaR_α = z_α·σ_$·√Δt·|Δ_net|
W* = μ_out·T + z_ε·σ_out·√T          // hot-wallet watermark
H = w₁·ln(D_imp) − w₂·s_ref − w₃·(σ/σ_BTC) ≥ H_min
OI_max = φ·D_imp                     // listing gate, R6 quantified

Budgeted in microseconds.
Enforced in CI.

// matching envelope, M/M/1 — measured μ = 5×10⁵ ev/s, design load λ = 5×10⁴/s
ρ = λ/μ = 0.1        E[W] = 1/(μ−λ) ≈ 2.2 µs        // p99 lives in fsync + fan-out, not matching

What the system
will never permit.

Nothing in Phase 2 requires a decision that has not already been made here.

It requires only the turning of keys that Phase 1 installs. The module map fixes what exists; the reservation doctrine fixes how it grows; the mathematics fixes how it behaves under stress; the invariants fix what it will never permit.