System Architecture

Overview & Component Diagram

Origin is a hybrid on-chain/off-chain system. Latency-sensitive components (matching, risk evaluation, oracle ingestion) run off-chain. Custody, settlement, and the economic state of record run on-chain on Arc as smart contracts. The two layers are bound together by a settlement protocol that batches off-chain state transitions and commits them atomically.

Users always retain on-chain ownership of their collateral. The off-chain components have authority to update positions and balances only within constraints enforced by the on-chain margin contract: they cannot move collateral out of the system, increase a user's debt beyond posted collateral, or override the asset registry.

                  ┌─────────────────────────────────────────┐
                  │              CLIENT (REST/WS)           │
                  └────────────────────┬────────────────────┘
                                       │
                  ┌────────────────────▼────────────────────┐
                  │               API Gateway               │
                  └────────────────────┬────────────────────┘
                                       │
       ┌──────────────┬────────────────┼────────────────┬──────────────┐
       │              │                │                │              │
┌──────▼──────┐ ┌─────▼──────┐ ┌───────▼──────┐ ┌───────▼──────┐ ┌─────▼──────┐
│  Matching   │ │   Risk     │ │   Oracle     │ │ Liquidation  │ │ Settlement │
│   Engine    │ │   Engine   │ │  Ingestion   │ │   Engine     │ │ Submitter  │
└──────┬──────┘ └─────┬──────┘ └───────┬──────┘ └───────┬──────┘ └─────┬──────┘
       │              │                │                │              │
       └──────────────┴────────────────┴────────────────┴──────────────┘
                                       │ batched commits
                                       ▼
                ┌──────────────────────────────────────────┐
                │              ARC (on-chain)              │
                │                                          │
                │  Margin   Settlement   Insurance   ADL   │
                │  Vault    Contract     Fund        Coord │
                │                                          │
                │              Asset Registry              │
                └──────────────────────────────────────────┘

On-Chain Components

The on-chain footprint is a small, audited contract set:

All contracts are upgradeable only through the published governance flow with a timelock.

Off-Chain Components

The off-chain components are operated by Origin and are designed for low-latency execution:

1. Matching Engine. Maintains the order book per market, applies price-time priority, produces fills.
2. Risk Engine. Evaluates each account's margin ratio on every mark-price update and every fill. Detects liquidation conditions.
3. Oracle Ingestion. Pulls Pyth feeds for index prices. Polls configured external venues for the CEX price set used in mark price (Section 8.2).
4. Liquidation Engine. Routes flagged accounts to the internal closeout flow first, then to public keepers if necessary.
5. API Gateway. REST + WebSocket endpoints for clients. Authenticates, rate-limits, forwards.
6. Settlement Submitter. Batches fills, funding payments, liquidations, and ADL events; submits them to the on-chain Settlement contract.

Order Flow

A typical limit order flows through the system as follows:

1. Submission. Client signs and submits via REST or WebSocket to the API Gateway.
2. Pre-trade checks. Gateway verifies authentication, rate limits, and order validity (symbol, side, size, price, flags).
3. Risk check. Risk Engine confirms the account has sufficient initial margin to support the order if it fills.
4. Book entry. Matching Engine accepts the order onto the book and assigns it a sequence number.
5. Match. When a counterparty order arrives that crosses the resting order, the engine produces one or more fills.
6. Mark-to-market. Risk Engine updates both accounts' positions and balances in working state.
7. Batch. Settlement Submitter accumulates fills into the next on-chain batch.
8. Commit. Batch is submitted to Arc; on finality (sub-second), on-chain state matches off-chain state.
9. Confirmation. Client receives a fill notification via WebSocket and a settlement event when the batch finalizes on-chain.

Steps 1 through 7 happen in the off-chain hot path within single-digit milliseconds in the typical case. Steps 8 and 9 add Arc finality (sub-second). The full state machine governing order transitions is specified in Section 5.3.

Trust & Authority Model

The off-chain operator can:

• Match orders and produce fills.
• Compute funding rates and liquidation eligibility.
• Submit settlement batches.

The off-chain operator cannot:

• Move user collateral to addresses outside the Margin Vault.
• Take a user's balance below zero (the Margin Vault rejects any settlement that would).
• Modify the asset registry or any market parameter.
• Pause withdrawals of free collateral via the on-chain emergency exit path (Section 9.4).

This split means the worst-case impact of off-chain operator failure or compromise is bounded: trading halts, but funds remain in the user's control on-chain.

Failure Modes

Origin is designed to fail safely. The following table summarizes the system's response to each major failure class. System-wide states and their transitions are specified in Section 10.

Settlement Batching

Off-chain state changes are committed to Arc through batched settlement (Section 9.3 specifies the batch structure). Each batch is signed by the Settlement Submitter and validated by the on-chain Settlement contract against the invariants of the Margin Vault. A batch that would violate solvency for any account is rejected atomically; no partial application.