An asset can trade in fifteen places and still settle no contracts, because settlement needs a fixing — one struck price, at a defined time, that neither side can move. Bitcoin trades 24/7 and CME still settles every future on a once-a-day fixing for exactly that reason. CrossDesk produces that price, signs it K-of-N, and creates and redeems fund shares against it. One ledger, no reconciliation.
The recorded walkthrough shows the desk switching parties — the venue sees the whole book, each trader sees only its own, the auditor sees none of it. The shared HackCanton participant the hosted desk ran on went offline when the season ended, so ask for a live demo and I will run it from a local node. Source-available, not open source — read the code.
To launch a tokenised fund you hire an exchange to discover a price, an administrator to strike the NAV, and a custodian to settle the shares. Each hands a number to the next — and the gaps between them are where the money leaks.
Closing a fund's discount means three legs on three venues, carrying price risk between each. So arbitrageurs quote wide and only show up when the gap is big. The fund's own investors pay that spread.
Put the order book on a public chain and the mempool is the book. Every resting order is visible before it executes. Index funds are estimated to leak $1–2bn a year to exactly this.
Oracles put NAVs on-chain, but they only deliver a number one administrator already decided — struck once a day, stale the moment it's signed.
Everyone lodges orders nobody can see. At the close the venue uncrosses the whole book at one uniform price — one the orders determine, not one the operator supplies.
And it signs the recipe — base, rate, day-count — not a number. So the ledger keeps deriving the value every second between strikes instead of going stale for twenty-four hours.
In kind, atomically, all-or-nothing. Deliver the underlyings, receive shares — or the reverse. The mechanism that keeps a fund glued to its NAV.
On Canton a contract is visible only to its signatories. A resting order is signed by the venue and the trader and observed by nobody — so a sealed book isn't a feature we bolted on, it's the default. One order book, four resting orders, four parties looking at it:
Unbuildable on a public chain. Unprovable in a private database.
Every fill still prints to a public tape that names nobody. Observed on the shared Canton participant during Season 2; that node went offline when the season closed.
What a fund accountant charges to strike a daily NAV. Disclosed by Brown Brothers Harriman in an SEC filing — and it fell 19% at the last renewal.
What the SPY trust pays S&P Dow Jones — 0.03% of the daily size of the trust plus an annual licence fee of $600,000, stated verbatim in the trust's own filing.
One is accounting. One is a benchmark. Ten to fifteen times the money.
0.325 bps: BBH Trust, Form N-CSR · 3 bps + $600,000: SPDR S&P 500 ETF Trust, Form N-30D
| Line | Who pays | Price |
|---|---|---|
| NAV-as-a-service — a private, auditable daily strike | the issuer | $50–150k/yr flat → 1–3 bps at scale |
| Creation & redemption — a flat fee per order | the authorised participant | flat, per creation unit |
| Platform licence — run the venue for your own members | market infrastructure | annual licence |
Your administrator loses nothing. It keeps the mandate and the fee — and becomes one of the signers.
A closing auction that uncrosses the whole book at one uniform price.
An attested fixing, provable from the contract's own signatures.
In-kind, atomic — deliver the underlyings, receive shares.
Bilateral atomic delivery-versus-payment.
Real BitSafe cBTC claimed through the CIP-56 registry flow, on their own templates.
15,984 lines of Daml across the settlement, auction, committee and perpetual layers.
Every settlement path asserts total cash before equals total cash after.
A legal smart-contract upgrade of 2.0.0 — every new field Optional and appended, so no contract on a participant is orphaned.
A continuous order book and a cash-settled perpetuals layer are also built and tested, and neither is sold. Operating a market and running leverage are licensed activities; publishing a number and having a committee sign a valuation are not. That line is deliberate, and it is what keeps this operable by a small team.
Twelve slides and a screen recording of the desk executing a hedged arbitrage on a live Canton participant — the problem, the mechanism, the numbers and the ask. Arrow keys to advance; it runs in the browser.
Press F for full screen, P to print it as a PDF.
We strike the NAV alongside whoever strikes it today, and publish both. Nobody switches. Nothing is at risk. At the end you own a signed, auditable price history a regulator can read — and a daily measurement of how far your current mark drifts between strikes.
We derive your NAV from the signed recipe. One signer — you. You get a continuous indicative NAV you don't have today.
Your administrator joins as a second signer. The fixing becomes genuinely multi-party.
A market maker or collateral taker joins. K-of-N is real, and the price history is the artefact.