An asset can trade in fifteen places and still settle no contracts, because settlement needs a fixing — one struck price, at a defined time, that neither side can move. Bitcoin trades 24/7 and CME still settles every future on a once-a-day fixing for exactly that reason. CrossDesk produces that price, signs it K-of-N, and creates and redeems fund shares against it. One ledger, no reconciliation.
The recorded walkthrough shows the desk switching parties — the venue sees the whole book, each trader sees only its own, the auditor sees none of it. The shared HackCanton participant the hosted desk ran on went offline when the season ended, so ask for a live demo and I will run it from a local node. Source-available, not open source — read the code.
To launch a tokenised fund you hire an exchange to discover a price, an administrator to strike the NAV, and a custodian to settle the shares. Each hands a number to the next — and the gaps between them are where the money leaks.
Closing a fund's discount means three legs on three venues, carrying price risk between each. So arbitrageurs quote wide and only show up when the gap is big. The fund's own investors pay that spread.
Put the order book on a public chain and the mempool is the book. Every resting order is visible before it executes. Index funds are estimated to leak $1–2bn a year to exactly this.
Oracles put NAVs on-chain, but they only deliver a number one administrator already decided — struck once a day, stale the moment it's signed.
Everyone lodges orders nobody can see. At the close the venue uncrosses the whole book at one uniform price — one the orders determine, not one the operator supplies.
And it signs the recipe — base, rate, day-count — not a number. So the ledger keeps deriving the value every second between strikes instead of going stale for twenty-four hours.
In kind, atomically, all-or-nothing. Deliver the underlyings, receive shares — or the reverse. The mechanism that keeps a fund glued to its NAV.
A market maker can be flat on price between creating and selling, which turns the arbitrage into a fully-hedged basis trade rather than a directional bet.
On Canton a contract is visible only to its signatories. A resting order is signed by the venue and the trader and observed by nobody — so a sealed book isn't a feature we bolted on, it's the default. One order book, four resting orders, four parties looking at it:
Unbuildable on a public chain. Unprovable in a private database.
Verified on the shared Canton participant. Every fill still prints to a public tape that names nobody.
What a fund accountant charges to strike a daily NAV. Disclosed by Brown Brothers Harriman in an SEC filing — and it fell 19% at the last renewal.
What State Street pays S&P Dow Jones for SPY. Index providers take roughly a third of every ETF management fee on earth.
One is accounting. One is a benchmark. Ten to fifteen times the money.
BBH Trust, Form N-CSR FY2023 · An, Benetton & Song, Journal of Financial Economics
| Line | Who pays | Price |
|---|---|---|
| NAV-as-a-service — a private, auditable daily strike | the issuer | $50–150k/yr flat → 1–3 bps at scale |
| Execution — notional crossed at the close | traders | bps on notional |
| Platform licence — run the venue for your own members | market infrastructure | annual licence |
Your administrator loses nothing. It keeps the mandate and the fee — and becomes one of the signers.
A continuous book with price-time priority, plus the sealed cross.
Bilateral atomic delivery-versus-payment.
Cash-settled perpetuals — margin, funding rate, liquidation.
An accruing money-market NAV and in-kind create & redeem.
Real BitSafe cBTC claimed through the CIP-56 registry flow, on their own templates.
Around 15,700 lines of Daml across the settlement, auction, committee and perpetual layers.
Every settlement path asserts total cash before equals total cash after.
Registered on a shared Canton participant, running against the real Ledger API.
Twelve slides and a screen recording of the desk executing a hedged arbitrage on a live Canton participant — the problem, the mechanism, the numbers and the ask. Arrow keys to advance; it runs in the browser.
Press F for full screen, P to print it as a PDF.
We strike the NAV alongside whoever strikes it today, and publish both. Nobody switches. Nothing is at risk. At the end you own a signed, auditable price history a regulator can read — and a daily measurement of how far your current mark drifts between strikes.
We derive your NAV from the signed recipe. One signer — you. You get a continuous indicative NAV you don't have today.
Your administrator joins as a second signer. The fixing becomes genuinely multi-party.
A market maker or collateral taker joins. K-of-N is real, and the price history is the artefact.