Don't trust the venue. Verify it.
Every fill is recorded beyond revision. Every balance is anchored to Sui. Anyone can check — and a wrong number simply fails to verify.
Deterministic matching, permanent fills. Every fill lands in an append-only record — no silent rewrites.
The checkpoint. On a steady cadence, the engine commits a signed summary of every balance on-chain. Matching is built for hardware attestation.
The on-chain anchor. Sui holds the real coins and the latest checkpoint. Custody never sits with the engine.
Anyone verifies. Ask for any balance at any checkpoint; the proof comes with it. A wrong value simply fails to verify.
A balance that doesn't match the attested checkpoint fails to verify. The venue can never over-attest what it owes you.
History is append-only — an edit anywhere breaks everything after it, visibly.
If checkpoints stop for seven days, emergency withdrawal opens on-chain: prove your balance against the last checkpoint and exit with no venue signature.
Speed lives off-chain; truth is anchored on-chain. And every order is fully funded from free balance — no leverage, no credit — so settlement can never discover a shortfall.