Crossbook

Crossbook Architecture

Crossbook

Crossbook is a noncustodial hybrid decentralized exchange built around signed intents. A maker signs an EIP-712 order off-chain with no gas, the engine validates and crosses it in a pure, single-writer matching core, and a Solidity settlement contract independently rechecks the signature, expiry, fill accounting, and each maker's limit price before pulling and sending tokens in one atomic transaction. The contract never trusts the engine, so a buggy or malicious matcher can never move funds against a maker's signed limits. Funds stay in the maker's wallet behind a one-time ERC-20 allowance until execution, following the same signed-intent and allowance-pull model as CoW Protocol. The repo carries property tests, Foundry fuzz and invariant suites, a PoC-backed threat model, and a live dashboard that follows an order from signature to settlement.

GitHub Repository: https://github.com/frdrckj/crossbook

Features

Signed, Gasless Intents: Makers sign EIP-712 orders off-chain and grant a one-time ERC-20 allowance; the contract pulls tokens only at execution, so the venue stays fully noncustodial.
Pure Matching Core: A single-writer, deterministic price-then-time-priority matcher in Rust with no async, no I/O, and no clock. It rounds in the maker's favor, uses overflow-safe 512-bit price math, and runs the hot match path with zero heap allocation (asserted by a test), at about 165 nanoseconds per fill on an M4.
Batch Auction: A second matching mode, selectable by config, that collects orders over a window and clears each token pair at one uniform price, a CoW-style call auction. Integer lot quantization makes every fill land on exactly that price with the pair netting to zero, and the contract asserts the single price per pair on-chain and emits a BatchSettled event. A property suite proves one price per pair, conservation, maximal volume, and determinism.
Ring Trades: Multi-token coincidence of wants: three orders that each sell one token and buy the next (A to B to C to A) all trade with no external liquidity, even though no two share a pair. Clearing is exact in integers and nets to zero across the cycle, so a ring settles through the same contract with no special trust. Proven by a golden ring and a property test over random cycles.
EIP-712 Parity Gate: The Rust and Solidity order digests are proven byte-identical by a cross-language test that gates all settlement work.
Settlement Contract: Re-verifies signatures, expiry, cumulative fills keyed by order hash, and each maker's limit price on-chain with a 512-bit cross-multiply, and requires every settlement to net to zero so it never holds inventory. It is hardened with a reentrancy guard, checks-effects-interactions, SafeERC20, owner pause, and solver rotation.
Adversarial Test Suite: Foundry unit, fuzz, and invariant tests cover every revert path, fee-on-transfer tokens, a reentrancy proof of concept, and a zero-inventory invariant over thousands of random settlements, plus a PoC-backed threat model that maps each threat to the test that proves it. A cross-implementation differential test fuzzes random batches through the Rust core and the live Solidity contract on Anvil and asserts they always agree on accept, reject, and exact amounts.
Engine Service: A Tokio service with a single-writer task, an Alloy chain client, a Postgres layer with compile-time-checked sqlx queries, an indexer that reads Trade events into Postgres and broadcasts them over WebSocket, and an axum REST and WebSocket API with a typed rejection reason per order, Prometheus metrics, and tracing.
End-to-End and CI: Full end-to-end tests deploy the contracts and tokens on Anvil and exercise both modes over HTTP: the continuous flow and the batch flow, the latter asserting one BatchSettled event at the uniform price. Each asserts the settlement lands on-chain, reaches Postgres, is broadcast, and swaps balances. CI runs three jobs: the Rust suite, the Foundry suite, and an integration job with Postgres and Anvil.
Live Dashboard: A single page showing the order lifecycle (Sign, Match, Settle, Index, Feed), a live order book, and a trade tape. Sign and submit orders in the browser and watch them cross and settle in real time. The whole thing comes up with one command, just demo.

Stack

• Matching Core & Client

Rust - The matching core, engine, and CLI.
Alloy - Ethereum types, signing, providers, and EIP-712 hashing (not the deprecated ethers-rs).
proptest / criterion - Property tests and benchmarks for the matching core.

• Contracts

Solidity - 0.8.x settlement contract and order library.
Foundry - Build, fuzz, and invariant testing, plus the Anvil dev chain.
OpenZeppelin - ECDSA, EIP712, ReentrancyGuard, SafeERC20, Ownable, and Pausable.

• Engine

Tokio - Async runtime and the single-writer task.
axum - REST and WebSocket API.
sqlx - Compile-time-checked queries over PostgreSQL.
metrics / tracing - Prometheus metrics and structured tracing.

• Demo Dashboard

viem - In-browser EIP-712 signing.
A single static HTML page served by the engine, with no build step.

Crossbook

Features

Signed, Gasless Intents: Makers sign EIP-712 orders off-chain and grant a one-time ERC-20 allowance; the contract pulls tokens only at execution, so the venue stays fully noncustodial.

Pure Matching Core: A single-writer, deterministic price-then-time-priority matcher in Rust with no async, no I/O, and no clock. It rounds in the maker's favor, uses overflow-safe 512-bit price math, and runs the hot match path with zero heap allocation (asserted by a test), at about 165 nanoseconds per fill on an M4.

Batch Auction: A second matching mode, selectable by config, that collects orders over a window and clears each token pair at one uniform price, a CoW-style call auction. Integer lot quantization makes every fill land on exactly that price with the pair netting to zero, and the contract asserts the single price per pair on-chain and emits a BatchSettled event. A property suite proves one price per pair, conservation, maximal volume, and determinism.

Ring Trades: Multi-token coincidence of wants: three orders that each sell one token and buy the next (A to B to C to A) all trade with no external liquidity, even though no two share a pair. Clearing is exact in integers and nets to zero across the cycle, so a ring settles through the same contract with no special trust. Proven by a golden ring and a property test over random cycles.

EIP-712 Parity Gate: The Rust and Solidity order digests are proven byte-identical by a cross-language test that gates all settlement work.

Settlement Contract: Re-verifies signatures, expiry, cumulative fills keyed by order hash, and each maker's limit price on-chain with a 512-bit cross-multiply, and requires every settlement to net to zero so it never holds inventory. It is hardened with a reentrancy guard, checks-effects-interactions, SafeERC20, owner pause, and solver rotation.

Adversarial Test Suite: Foundry unit, fuzz, and invariant tests cover every revert path, fee-on-transfer tokens, a reentrancy proof of concept, and a zero-inventory invariant over thousands of random settlements, plus a PoC-backed threat model that maps each threat to the test that proves it. A cross-implementation differential test fuzzes random batches through the Rust core and the live Solidity contract on Anvil and asserts they always agree on accept, reject, and exact amounts.

Engine Service: A Tokio service with a single-writer task, an Alloy chain client, a Postgres layer with compile-time-checked sqlx queries, an indexer that reads Trade events into Postgres and broadcasts them over WebSocket, and an axum REST and WebSocket API with a typed rejection reason per order, Prometheus metrics, and tracing.

End-to-End and CI: Full end-to-end tests deploy the contracts and tokens on Anvil and exercise both modes over HTTP: the continuous flow and the batch flow, the latter asserting one BatchSettled event at the uniform price. Each asserts the settlement lands on-chain, reaches Postgres, is broadcast, and swaps balances. CI runs three jobs: the Rust suite, the Foundry suite, and an integration job with Postgres and Anvil.

Live Dashboard: A single page showing the order lifecycle (Sign, Match, Settle, Index, Feed), a live order book, and a trade tape. Sign and submit orders in the browser and watch them cross and settle in real time. The whole thing comes up with one command, just demo.

Stack

• Matching Core & Client

Rust - The matching core, engine, and CLI.

Alloy - Ethereum types, signing, providers, and EIP-712 hashing (not the deprecated ethers-rs).

proptest / criterion - Property tests and benchmarks for the matching core.

• Contracts

Solidity - 0.8.x settlement contract and order library.

Foundry - Build, fuzz, and invariant testing, plus the Anvil dev chain.

OpenZeppelin - ECDSA, EIP712, ReentrancyGuard, SafeERC20, Ownable, and Pausable.

• Engine

Tokio - Async runtime and the single-writer task.

axum - REST and WebSocket API.

sqlx - Compile-time-checked queries over PostgreSQL.

metrics / tracing - Prometheus metrics and structured tracing.

• Demo Dashboard

viem - In-browser EIP-712 signing.

A single static HTML page served by the engine, with no build step.