Ekiden draws a clear line between execution and custody.
Collateral stays inside the on-chain Vault until a batch passes Merkle verification.
Orders are matched off-chain by the Engine Service. The resulting orderbook state is reduced to an Orderbook Root Hash anchored on Canton.
Before collateral moves or positions are updated, the Orderbook Verifier checks the Merkle inclusion proofs against that root.
If verification fails, nothing settles.
1. Engine failure ≠ custody failure
An Engine Service failure is primarily a liveness problem, not a custody problem.
If matching stops:
- Trades do not finalize
- Soft fills remain unfinalized
- Collateral stays in the Vault
- Positions are not updated
The matching engine can go down without automatically putting user funds at risk.
2. Why not put everything on-chain?
A fully on-chain CLOB makes matching part of network consensus.
That provides stronger transparency, but execution speed becomes tied to network finality.
A fully centralized orderbook has the opposite problem: matching and custody depend on the same operational layer.
Ekiden takes a middle path:
Off-chain matching for speed.
Canton settlement for verification and custody.
The Engine Service does not need to wait for consensus to match orders. Canton only receives the committed root and resulting state transitions.
3. Privacy starts at the architecture level
Canton does not need to process the raw high-frequency orderbook.
Instead, it receives the information required to verify the resulting state.
That means Ekiden does not need to expose raw order flow and then solve the problem of hiding it afterward.
The privacy burden is reduced at the source.
4. But the Merkle proof has a limit
A Merkle proof can verify that a trade was correctly included in the committed orderbook state.
It cannot prove that the upstream ordering was fair.
That leaves important questions:
- Who controls sequencing?
- How is execution order determined?
- How is that authority governed?
- Can the sequencing layer be independently verified?
These are separate from custody and liveness.
The cryptographic boundary can verify what was committed, but not necessarily why it was ordered that way.
5. The real test is still ahead
Ekiden has been live on Canton Testnet since June 2026 and became a Canton Featured App in July.
That demonstrates integration, but not yet institutional-scale production volume.
The stated baseline PoC fee structure is:
0% maker / 0.02% taker
There are also claims of trading firms already quoting on the book.
But mainnet remains the bigger milestone, and published capacity figures such as 200k orders per second per market have not yet been demonstrated under live conditions.
The interesting part of Ekiden is not simply that it uses Merkle proofs.
It is where the Merkle boundary is placed.
Matching can fail without automatically becoming a custody failure.
That guarantee comes from the architecture.
The remaining question is whether the same separation can hold under real institutional volume—and, more importantly, who ultimately controls ordering inside the Engine Service.
