Architecture
How CRX prices, margins, and settles an on-chain NDF — box by box.
CRX is on-chain FX hedging. A smart contract holds pre-funded margin from two counterparties, marks the position to market continuously, and settles it against an institutional benchmark at expiry. It replaces the bank-intermediated NDF — the 50–300 bps spread that legacy correspondent banking charges to lock a forward exchange rate.
This doc transcribes the working architecture diagram (the whiteboard sketch) and grounds each box in the litepaper. Source of record for the prose: CRX: On-Chain FX Hedging, Jake Schkolnick, May 2026.
TL;DR
- Product. Non-deliverable forward (NDF) on an emerging-market currency pair. Launch pairs: USD/INR, USD/PHP. Cash-settled in a USD-backed stablecoin.
- Three components. Off-chain execution engine (the matcher), on-chain smart contract (the custodian + settler), and oracles (the price truth).
- Two price regimes. Margin marks against a continuous feed (Pyth). Settlement pays against a discrete bank fixing (EMTA) at expiry. These are different numbers from different sources — never conflate them.
- Chain. Base.
- Counterparties. Taker and Maker, both KYB'd as eligible contract participants (ECPs). CRX stands as principal between them.
- Failsafe. If the execution engine is down, Taker and Maker can close the position on-chain themselves.
The flow, end to end
| Step | Where | What happens |
|---|---|---|
| 1. Onboard | Off-chain | Taker and Maker each pass KYB. Only ECPs trade. |
| 2. RFQ | Execution engine | Taker submits a request: pair, tenor, notional, direction. |
| 3. Quote | Makers → engine | Makers return firm, signed quotes on the full notional, each valid for a window. Routed via Paradigm. |
| 4. Select | Execution engine | CRX picks the best quote, offers it to the Taker as principal counterparty. |
| 5. Accept | Taker | Taker signs to confirm, or lets the quote expire. |
| 6. Bind | Engine → contract | CRX submits both signed agreements to the smart contract from its operator wallet. |
| 7. Custody | Smart contract | Signatures validated. Initial margin pulled from both wallets, held in stablecoin until expiry. |
| 8. Mark | Keeper + contract | Position marked to market continuously against Pyth. TWAP smooths the mark. |
| 9. Margin call | Smart contract | If margin falls below maintenance, the contract emits an on-chain margin call. Fixed window to top up, or liquidate. |
| 10. Settle | Smart contract | At expiry, validate the EMTA bank fixing against Pyth within tolerance, compute payout, pay the winner, return remaining margin. Atomic or revert. |
The diagram, box by box
The diagram is shorthand. Here is what each box means, with the litepaper section that defines it.
Counterparties and the engine
- Taker / Maker — the two sides of the NDF. Taker requests, Maker quotes. (§2.1)
- CRX — the off-chain execution engine plus its operator wallet. It matches, then submits both signed agreements on-chain. CRX is principal counterparty to each side, not a passive matcher. (§2.1)
- KYB (one per side) — Know-Your-Business onboarding. Gates the venue to eligible contract participants. Required by the regulatory posture (§5).
- Paradigm — institutional RFQ liquidity network. The rail makers quote over.
The product
- Non-Deliverable Forward / Lock-In Rate / Dollar–Rupee — an NDF locks a future exchange rate and settles the difference between locked and market rate in cash. No currency is delivered. (§1.1)
- INR / PHP — launch pairs against USD. (§1.4)
- Quote payload — what a maker quote carries:
- IM / MM — initial margin and maintenance margin levels.
- Tenor — measured in bank business days against a notional.
- List of non-bank days — the holiday calendar. Tenor math must skip these.
Margin
- IM: 2% of daily rate — Taker / IM: 1% of daily rate — Maker — initial margin per side, in USDC. Calibrated per pair from historical volatility plus a stress buffer anchored to five-year worst-case single-day moves. The two sides need not post symmetric margin. (§2.2)
- IM / MM for MC — initial margin, maintenance margin, and the margin-call threshold. Maintenance sits below initial, giving the position room to absorb normal moves before a call fires. (§2.2)
- Default handling — miss a margin call → default registered, defaulter's collateral forfeited, CRX assumes the position from an insurance layer and opens an offsetting hedge. The non-defaulting side is preserved. (§2.2)
Price and settlement — the two regimes
This is the load-bearing distinction. Two different prices, two different jobs.
- Margin: continuous price — mark-to-market runs continuously against Pyth. TWAP (time-weighted average price, run by the Keeper) smooths it so a single tick can't trigger a spurious liquidation.
- Settlement: bank price — at expiry the payout is computed from the EMTA fixing — the same institutional benchmark banks use for EM FX. Two independent oracles retrieve it and submit on-chain. The contract validates the fixing against Pyth within a per-pair tolerance before accepting it. (§2.3)
- Guarantee feed / compounding — a guaranteed settlement feed backing the fixing; the insurance/compounding layer behind default handling.
Infrastructure
- Base — the chain CRX deploys to.
- Keeper / TWAP — the off-chain daemon (
keeper/). Watches the chain, computes the TWAP mark, triggers margin calls and liquidations. - UI — the frontend (
frontend/). - Minimum ticks — minimum tick / trade-size floor on quotes. (Diagram label "Minimul tacs" — read as minimum tick size; confirm with Jake.)
- GitHub code — this repo,
github.com/crxfoundation/mono.
Failsafe and governance
- "If CRX down, Maker and Taker can close on-chain themselves" — the engine is off-chain and could go offline. The contract must let both parties settle a position directly on-chain without the engine in the loop. This is a hard requirement, not a nicety — it is what makes the custody trustless.
- Cayman Island DAO Foundation / "admin keys on later" — the legal wrapper. Admin keys held by the foundation at launch, decentralised progressively. (Not in the litepaper; implementation note.)
- CFTC US swap dealer — CRX is principal to ECPs, operating below the CFTC swap-dealer de minimis threshold. Registration is planned when rolling 12-month gross notional crosses $8B. Reg strategy led by Orrick's Dan Ullman, ex-CFTC. (§5)
What this repo ships today vs. what the architecture needs
The repo is a skeleton on the General Market toolchain. The gap to the architecture above:
| Component | Today | Needs |
|---|---|---|
contracts/src | HelloWorld.sol placeholder | NDF contract: signature validation, IM custody, MTM, margin call, default handling, EMTA settlement, on-chain close failsafe |
keeper/src | minimal stub (interval poll loop, no logic) | TWAP mark loop against Pyth, margin-call + liquidation triggers |
frontend/app | homepage + wallet connect (wagmi, Base) | RFQ flow, position view, margin status, KYB onboarding |
| Execution engine | absent | off-chain matcher: RFQ in, signed quotes out, best-quote select, dual-signature submit |
| Oracles | absent | two independent EMTA-fixing submitters + Pyth tolerance check |
Glossary
| Term | Meaning |
|---|---|
| NDF | Non-deliverable forward. A contract locking a future FX rate, cash-settled on the difference at expiry. No currency delivered. |
| Taker | The side requesting a quote and accepting it. |
| Maker | The side providing a firm, signed quote. |
| RFQ | Request for quote. The taker's order specifying pair, tenor, notional, direction. |
| IM | Initial margin. Posted up front by both sides at trade open. |
| MM | Maintenance margin. The floor below initial margin; breaching it triggers a margin call. |
| MTM | Mark-to-market. Continuous revaluation of the open position. |
| Tenor | Time to expiry, counted in bank business days. |
| Notional | The face amount the contract is written against. |
| EMTA | Emerging Markets Traders Association. Publishes the standard fixings for EM FX settlement. |
| Pyth | On-chain price feed used for continuous mark-to-market. |
| TWAP | Time-weighted average price. Smooths the mark against single-tick noise. |
| KYB | Know-Your-Business. Counterparty onboarding check. |
| ECP | Eligible contract participant. The CFTC class CRX trades with. |
| Paradigm | Institutional RFQ liquidity network for routing maker quotes. |
| Base | The L2 chain CRX deploys to. |
Next step: replace HelloWorld.sol with the NDF contract skeleton and write the on-chain-close failsafe first — it is the invariant every other contract function must preserve. See CLAUDE.md for protocol invariants.