Cross-venue portfolio
margin for the EVM.
One wallet posts collateral once and trades across multiple on-chain venues with a single margin number.
Run positions on more than one venue, and your capital splits into silos.
A long perp on one venue and a hedge or yield position on another sit as two locked balances, even though the net risk is far smaller than the sum. Most of that capital does nothing.
There is no neutral place to net that risk. Every venue can only cross-margin positions held inside its own walls, because the venue on the other side is a competitor.
One neutral vault. One portfolio-margin number across every venue.
Put the collateral in one non-custodial vault and price net exposure with a single number. The same deposit then backs a perp on one venue, a tokenized T-bill on another, and a yield position on a third, at the same time. One balance, doing several jobs.
This is what a TradFi prime broker does for institutions, except Atrium does it on-chain, non-custodially, and with no minimums.
$100K, a long ETH perp, and T-bills for carry.
The $100K of T-bills earns yield but does nothing for the perp. To open it, the trader posts its initial margin as a separate idle balance.
The $100K goes into the Coffer vault once. It earns the T-bill yield and counts as collateral. Plinth charges only the perp's initial margin and leaves the rest as buying power.
Illustrative scale, not a measured reading. The live number is computed by Plinth on /app/trade; the ~51% saving is locked by a passing unit test with a 40-70% guardrail band.
A venue cannot be neutral to itself.
To net your risk against a position on a competitor's venue, a venue would have to extend margin credit on a rival's book and trust the rival's liquidation engine in real time. That is commercially adversarial and technically fragile. No venue will do it.
The same reason prime brokerage exists as a separate entity in TradFi, not as a feature of one exchange.
- Cofferholds the collateral, so no venue extends credit to another.
- Plinthcomputes one portfolio-wide SPAN number, owned by neither venue.
- Porticolets each venue pull collateral only within a per-block cap, never freely.
A neutral core in Rust, with adapters in Solidity.
ERC-4626 vault. Holds collateral once; orchestrators pull up to a per-block cap.
SPAN margin engine. One buying-power number across venues, netting correlated risk.
EIP-712 mandates. Bounded agent delegation an agent physically cannot exceed.
Liquidation queue and execute engine, gated on keeper stake.
Margin to vault to adapter in one transaction.
Kill switch. Revoke every mandate in one tx.
Signed Merkle proof-of-reserves root.
Chainlink CCIP collateral bridge.
The compute-heavy core is Arbitrum Stylus; adapters and the cross-chain layer are Solidity, because every venue documents in Solidity.
See the full system map ↗Arbitrum Stylus makes the margin engine feasible on-chain.
SPAN portfolio margin is a scenario grid: shock every instrument up and down, net the correlated classes, take the worst case. In hand-written Solidity, that math is too expensive to run per block. Atrium's engine is Rust, deployed as Stylus.
The wedge itself, neutrality, is chain-agnostic. What Stylus changes is the feasibility of running the engine at all. A faster L1 does not close this gap, because the gap is cross-venue netting, not latency.
Not a mockup. Deployed, wired, and verified on two testnets.
0x976e…ddbf0x8c8d…03470x4b9e…ef1f0272,828,085Verifier Mode (/verify) walks seven steps against the live contracts: deposit, open, see the saving, trigger a chaos fault, run a liquidation drill, verify reserves, revoke with the kill switch. You can check every claim yourself.
Three traders, one structural fix.
Posts full margin at each venue; capital sits idle in silos.
One vault, one netted number; the same collateral does several jobs.
Handing an agent a key hands over everything.
A signed, bounded mandate the agent cannot exceed; one-tap kill switch.
Won’t custody with a venue they cannot audit.
Non-custodial ERC-4626 vault plus signed proof-of-reserves they verify in seconds.
Many products cross-margin inside their own walls. None net across them.
The first column is the point. None net your position on venue A against venue B, because A and B are competitors.
Stating what is not done, in the same breath as the claim.
Testnet, Year 1.
Arbitrum Sepolia and Robinhood Chain. Nothing here has economic value yet.
Upgradeable contracts.
UUPS behind a 48-hour timelock, today a founder key, production is a 3-of-5 multisig.
Some venues are mocked or relayed.
Where the real upstream isn’t on testnet. Each is named with its mechanism on /docs/honesty.
Trade-fill on a new venue is timelock-gated.
Enabling a live fill needs a scheduled 48-hour batch. The gate is by design.
None of these change the wedge. They are the honest state of a Year-1 testnet build, and disclosing them is part of the trust argument, not a footnote to it.
The wedge is structural. The proof is that it already runs.
Flip the deployer-key timelock owner to the 3-of-5 multisig.
Open the public app at a hosted URL, it already reads the live contracts.
Year-2 mainnet, with the most critical contracts locked.
Pratik
Master's in blockchain · India · Author of The Blockchain Path
- Hosted offline Web3 events at two universities.
- Contributed to multiple Web3 products.
- Product, marketing, and community experience.