Whitepaper
CRX on-chain FX hedging, the full draft. Extends the litepaper and the architecture.
Whitepaper — Draft v0.1 Jake Schkolnick · jake@crxfx.com · May 2026
This whitepaper extends the CRX litepaper (CRX: On-Chain FX Hedging, May 2026) and the working architecture. It is a working draft, not a final document and not an offer of any security or financial instrument. Numbers labelled illustrative are worked examples, not quotes. See the disclaimer at the end.
TL;DR
- What. CRX puts the non-deliverable forward (NDF) — the instrument used to hedge emerging-market currency risk — fully on-chain. A smart contract holds margin from both sides, marks the position continuously, and settles it at expiry against the same bank benchmark institutions already use.
- Why. The NDF market is ~$300–340B/day (BIS, April 2025) and structurally expensive: hedging through correspondent banking costs 50–300 bps, because every link in the bank chain adds credit, capital, and operational cost.
- How. Three components — an off-chain execution engine (RFQ matcher, CRX as principal), an on-chain smart contract (custody, margin, settlement), and oracles (the price truth).
- The load-bearing rule. Two price regimes, never conflated: margin marks against a continuous price oracle (Pyth or an equivalent feed — see §2.4; the choice is not yet final), smoothed by TWAP; settlement pays against a discrete bank fixing (EMTA) at expiry, validated against that oracle within tolerance.
- The trust model. Custody is trustless: if the execution engine goes offline, Taker and Maker can still close the position directly on-chain.
- Where it starts. Launch pairs USD/INR and USD/PHP, on Base, cash-settled in a USD-backed stablecoin, for stablecoin-native EM businesses.
1. Introduction
1.1 The market
A non-deliverable forward locks a future exchange rate and settles the difference between locked and market rate in cash at expiry. No currency is delivered. It is the primary instrument for managing emerging-market currency risk. Estimated daily NDF volume is $300–340 billion (BIS, April 2025).
Pricing in this market is structurally expensive. Participants pay 50 to 300 basis points or more to hedge through traditional banking channels. That spread is not a market price for risk — it is the cost of the model. Trades flow through correspondent banking chains, and each link adds credit, capital, and operational cost. The instrument is sound; the plumbing is legacy.
Therefore: the saving is not in pricing the risk better — it is in removing the chain.
1.2 The landscape
FX activity today flows through three channels. None of them hedge forward-dated EM exposure on open infrastructure.
| Channel | Examples | What it does | What it doesn't do |
|---|---|---|---|
| Institutional FX venues | CME, EBS Markets, 24 Exchange, bank dealer platforms | Forward-dated contracts against institutional benchmarks | Open access — needs FCM relationships, ISDA docs, credit lines, prime brokerage |
| Stablecoin spot rails | OpenFX, Circle StableFX, Mento | Cheaper, faster spot stablecoin transactions | No forward-dated contracts to manage FX exposure |
| FX perpetuals | Hyperliquid, Ostium | On-chain perpetuals on G10 pairs | No expiry, marks against an index — serves speculators on majors, not hedgers |
Forward-dated FX hedging does not exist outside the bank-intermediated system. That is the gap.
1.3 Why now
Two curves crossed.
- Supply. FX market making used to live only inside institutional firms. Crypto-native market makers now have real FX capability.
- Demand. Stablecoin adoption is accelerating, and roughly two-thirds of global stablecoin supply is held outside the US. The businesses driving that adoption carry significant FX exposure and no efficient way to hedge it.
1.4 The entry point
Stablecoin-native companies in emerging markets are the most underserved hedgers: payment platforms holding EM currency inventory, their cross-border customers, and lenders with EM-denominated balance sheets. They carry real FX risk, but hedging is gated behind minimum trade sizes, bilateral credit relationships, and documentation. CRX launches with on-chain NDFs in emerging markets, beginning with USD/INR and USD/PHP.
2. Architecture
CRX has three components: an off-chain execution engine that matches takers to makers, an on-chain smart contract that holds collateral and settles, and oracles that bring benchmark rates on-chain.
2.1 The flow, end to end
| Step | Where | What happens |
|---|---|---|
| 1. Onboard | Off-chain | Taker and Maker each pass KYB. Only ECPs trade. |
| 2. RFQ | Execution engine | Taker submits: pair, tenor, notional, direction. |
| 3. Quote | Makers → engine | Makers return firm, signed quotes on the full notional, each valid for a window. |
| 4. Select | Execution engine | CRX picks the best quote, offers it to the Taker as principal counterparty. |
| 5. Accept | Taker | Taker signs to confirm, or lets the quote expire. |
| 6. Bind | Engine → contract | CRX submits both signed agreements to the smart contract from its operator wallet. |
| 7. Custody | Smart contract | Signatures validated. Initial margin pulled from both wallets, held in stablecoin until expiry. |
| 8. Mark | Keeper + contract | Position marked to market continuously against the price oracle (Pyth or equivalent). TWAP smooths the mark. |
| 9. Margin call | Smart contract | If margin falls below maintenance, an on-chain margin call is emitted. Fixed window to top up, or liquidate. |
| 10. Settle | Smart contract | At expiry, validate the EMTA fixing against the price-oracle mark within tolerance, compute payout, pay the winner, return remaining margin. Atomic or revert. |
2.2 Execution engine
The engine sits off-chain to meet institutional latency requirements. A Taker submits an RFQ; Makers return firm, signed quotes on the full notional; CRX selects the best and offers it to the Taker as principal counterparty — not a passive matcher. On acceptance, CRX binds the trade and submits both signed agreements to the contract from its operator wallet.
CRX standing as principal between the two sides is what lets the on-chain contract treat the trade as a single bilateral position with known parameters.
2.3 Smart contract
The contract performs the functions a bank traditionally handles, but it is publicly auditable, deterministic, and free of the correspondent-banking chain. Its five jobs:
- Collateral custody. Validates both signatures, then pulls initial margin from both wallets and holds it in a USD-backed stablecoin until settlement.
- Margin enforcement. Marks the position continuously against the price oracle; emits a margin call when margin falls below maintenance; liquidates if the call goes unanswered.
- Benchmark validation. At expiry, validates the oracle-submitted fixing against the price-oracle mark within a per-pair tolerance; rejects out-of-tolerance submissions into a fallback.
- Atomic settlement. Computes the payout from stored parameters, pays the winner, returns remaining margin — atomically, or reverts.
- Default handling. Registers defaults, forfeits collateral, and hands the position to the insurance layer (Section 5).
2.4 The two price regimes — the load-bearing distinction
This is the rule every other design decision bends around. Two different prices do two different jobs. Conflating them is the single most dangerous error in the system.
| Margin (mark-to-market) | Settlement (payout) | |
|---|---|---|
| Source | Continuous price oracle — Pyth or an equivalent feed | EMTA bank fixing |
| Cadence | Continuous | Once, at expiry |
| Smoothing | TWAP (time-weighted average), run by the Keeper | None — it is the official fix |
| Job | Decide when a margin call fires | Decide who is paid and how much |
| Why this source | Live, on-chain, tamper-resistant, smooth enough that one tick can't trigger a spurious liquidation | The same benchmark banks settle EM FX against — institutional-grade and externally defensible |
The continuous oracle is not yet finalised. Pyth is the leading candidate; the contract treats the continuous mark as a single, configurable price source, so the specific feed can be chosen — or swapped — without changing the settlement design. Settlement is validated against the margin feed (EMTA checked against the price-oracle mark within tolerance), but the two are never substituted for each other.
3. The margin model
Initial margin (IM) is calibrated per pair from historical volatility plus a stress buffer anchored to five-year worst-case single-day moves. The two sides need not post symmetric margin. A maintenance margin (MM) sits below IM, giving the position room to absorb normal moves before a call fires.
3.1 Per-side, asymmetric initial margin
At launch, IM is set per side as a percentage of notional:
- Taker IM: 2% of notional
- Maker IM: 1% of notional
(Per-pair values; the figures above are the launch calibration and may be re-tuned per pair before a contract is offered.)
3.2 A worked example (illustrative)
A USD/INR NDF. Numbers are illustrative, chosen to show the mechanics — not a quote.
| Parameter | Value |
|---|---|
| Pair | USD/INR |
| Notional | $1,000,000 |
| Tenor | 30 bank business days |
| Locked (forward) rate | 84.00 INR/USD |
| Taker IM (2%) | $20,000 |
| Maker IM (1%) | $10,000 |
| Maintenance margin (illustrative) | 50% of IM |
Mark-to-market. Each day, the contract marks the position against the TWAP'd USD/INR rate from the price oracle. Say the spot moves to 85.50 against the Taker. The mark-to-market loss on $1M notional is roughly the rate move scaled by notional; as the Taker's posted margin is drawn down toward the maintenance level, the contract watches the threshold.
Margin call. When the Taker's margin falls below maintenance ($10,000 in this example), the contract emits an on-chain margin call. The Taker has a fixed window to top up. Top up → position continues. Miss the window → liquidation and default handling (Section 5).
Settlement. At expiry, the contract takes the EMTA USD/INR fixing — say 85.20 — validates it against the last price-oracle mark within tolerance, and pays the winner the difference between locked (84.00) and fixing (85.20) on the notional, in stablecoin. Remaining margin returns to both sides. Atomic, or revert.
3.3 Why asymmetric margin is correct
The Taker and Maker do not carry symmetric risk into the position, so they should not post symmetric collateral. Margin is sized to the side's exposure, not to a flat rule. This is standard institutional practice; CRX makes it explicit and on-chain.
4. Settlement and oracles
4.1 The settlement source
The settlement source for each pair is the EMTA fixing — the Emerging Markets Traders Association benchmark, the standard institutions already settle EM FX against. Using the same fix as the rest of the market is what makes a CRX NDF interchangeable with a bank-intermediated one from the hedger's point of view.
4.2 Two independent oracles
Two oracles, each on independent infrastructure, retrieve the EMTA fixing at expiry and submit it on-chain. Independence is the point: a single oracle is a single point of failure and a single point of capture.
4.3 Tolerance validation and fallback
At expiry the contract validates the submitted fixing against the last price-oracle mark within a per-pair tolerance. A fixing inside tolerance is accepted and settlement proceeds atomically. A fixing outside tolerance is rejected into a pre-defined fallback procedure rather than settling on a suspect number.
This is the safety interlock between the two price regimes: the discrete bank fix must agree, within bounds, with the continuous market feed before any money moves.
4.4 Atomic settlement
Once a validated fixing is accepted, the contract computes the payout from stored parameters, transfers it to the winner, and returns remaining margin to both parties — in one transaction that either completes whole or reverts whole. There is no partial-settlement state to dispute.
5. Default handling and the insurance layer
A missed margin call is not a negotiation. The waterfall:
- Default registered. The counterparty failed to meet the call inside the window.
- Collateral forfeited. The defaulter's remaining collateral is seized.
- CRX assumes the position. CRX posts additional margin from an insurance layer and steps into the defaulting side.
- Offsetting hedge opened. CRX immediately opens an offsetting hedge with another maker through the standard RFQ flow.
- Non-defaulting side preserved. The honest counterparty's contract is untouched. They are made whole as if no default occurred.
The non-defaulting party should never bear the cost of the other side's default. The insurance layer exists to hold that line.
6. Trust model
CRX is designed so that the parts that can be trustless are trustless, and the parts that aren't are named plainly.
- Custody is trustless. Margin sits in the contract, not in a CRX account. CRX cannot move it except along the rules the contract enforces.
- The on-chain-close failsafe. The execution engine is off-chain and could go offline. The contract lets Taker and Maker close an open position directly on-chain, without the engine in the loop. This is a hard invariant, not a feature — every contract function preserves it. It is what makes the custody actually trustless rather than trustless-until-CRX-disappears.
- What still requires trust. Oracle honesty (mitigated by independent submission + price-oracle tolerance), the EMTA fixing itself, and the off-chain engine's matching while it is online. These are stated, not hidden.
7. Use cases
- Operational hedging. A remittance company holding a multi-currency working-capital position across NGN, KES, ZAR locks forward rates against USD, sized and dated to its operational flow.
- Platform distribution. A stablecoin payment platform embeds CRX hedging in its existing customer interface. A Brazilian importer with a 30-day USD payable locks the BRL cost through the platform it already uses.
- Automated hedging. A corporate treasury tool detects FX exposure as it is created and routes the hedge to CRX programmatically. A US company with Indian operations auto-hedges a rupee payable in USD/INR at the matching tenor, no human in the loop.
8. Roadmap
| Phase | Capability | What it adds |
|---|---|---|
| Launch | Per-position margin, stablecoin collateral | NDFs on USD/INR, USD/PHP, Base |
| Next | Portfolio margining | Margin computed across all open positions — better capital efficiency |
| Next | Yield-bearing collateral | Additional collateral types (incl. yield-bearing tokens), each individually audited before it is added |
9. Regulatory approach
CRX is the principal counterparty to eligible contract participants (ECPs), operating below the CFTC's swap-dealer de minimis threshold. Swap-dealer registration is planned when aggregate gross notional crosses $8 billion over a rolling 12-month period. Regulatory strategy is led by Orrick's Dan Ullman, formerly of the CFTC.
KYB onboarding gates the venue to ECPs. This is a deliberate constraint, not an afterthought — it is what keeps CRX inside its regulatory posture while it scales.
10. Risk factors
Stated out loud, because a hedging product that hides its own risks is not a hedging product.
- Oracle risk. A wrong or stale EMTA fixing, or collusion between submitters, would mis-settle. Mitigated by independent submission and price-oracle tolerance validation, not eliminated. The continuous price oracle itself is not yet finalised; its choice carries its own dependency and tail risk.
- Liquidity risk. Settlement and default-handling assume a Maker is available to take the offsetting hedge. Thin maker liquidity raises cost and slippage.
- Stablecoin risk. Collateral and payout are in a USD-backed stablecoin; a de-peg affects both.
- Smart-contract risk. The contract holds funds. Bugs are catastrophic. Mitigated by audits and the atomic-or-revert settlement design; never zero.
- Benchmark risk. CRX inherits any flaw, suspension, or discontinuation of the EMTA fixing for a pair.
- Regulatory risk. The ECP-only, below-de-minimis posture depends on facts that can change with volume and jurisdiction.
11. Conclusion
As stablecoin adoption accelerates, demand for on-chain derivatives hedging grows with it. CRX brings an institutional-grade instrument — the NDF — onto open infrastructure, settled against the same benchmark the rest of the market uses, with custody that does not depend on CRX staying online.
Trading that once required bank intermediation is moving to open infrastructure. CRX is built for that move.
Glossary
| Term | Meaning |
|---|---|
| NDF | Non-deliverable forward. A contract locking a future FX rate, cash-settled on the difference at expiry. No currency delivered. |
| Taker | The side requesting a quote and accepting it. |
| Maker | The side providing a firm, signed quote. |
| RFQ | Request for quote — the Taker's order: pair, tenor, notional, direction. |
| IM | Initial margin. Posted up front by both sides at trade open. |
| MM | Maintenance margin. The floor below IM; breaching it triggers a margin call. |
| MTM | Mark-to-market. Continuous revaluation of the open position. |
| Tenor | Time to expiry, counted in bank business days. |
| Notional | The face amount the contract is written against. |
| EMTA | Emerging Markets Traders Association. Publishes the standard fixings for EM FX settlement. |
| Price oracle | The on-chain feed used for continuous mark-to-market. A single configurable source; Pyth is the leading candidate, not yet finalised. |
| TWAP | Time-weighted average price. Smooths the mark against single-tick noise. |
| KYB | Know-Your-Business. Counterparty onboarding check. |
| ECP | Eligible contract participant. The CFTC class CRX trades with. |
| Base | The L2 chain CRX deploys to. |
| bps | Basis points. 1 bp = 0.01%. |
Disclaimer
This document is a working draft for discussion. It is not an offer or solicitation to buy or sell any security, swap, or financial instrument, not investment, legal, tax, or accounting advice, and not a binding description of any live product. Forward-looking statements (roadmap, regulatory plans, thresholds) are intentions, not commitments, and may change. Illustrative figures are worked examples, not quotes. CRX services are intended for eligible contract participants only, where lawful. Nothing here creates any obligation on any party.