A bank that settles in seconds still funds like it settles in days.
Instant payment means holding the destination currency before the money arrives. Every corridor, all day. Idle, and unhedged.
NEAP sizes that buffer by stochastic control. Where a rebalance costs cents, it doesn't shrink. It collapses.
Idle capital per corridor, averaged over 30-day evaluation windows. 20 seeds × 6 walk-forward windows, calibrated only on the past.
The saving does not come from where you would guess.
At a 6% cost of capital, carrying a million dollars for a month is noise next to execution costs. The buffer collapsing is the visible result; it is not the mechanism.
-
Market impact grows with the square root of size
Executing one large order costs more than executing many small ones, because impact is concave in size while total cost is superlinear. Splitting is structurally cheaper.
-
A fixed cost of cents unlocks that regime
On correspondent-bank rails at tens of dollars per transfer, 2 879 orders would cost seven times the entire budget. Splitting is only available once the fixed cost is gone.
-
So execution cost falls despite thirty times more orders
Down 19.7%, while order count rises 3 113%. The band width follows the cube root of the fixed cost: divide that cost by 10 000 and the band divides by 21.5.
Measured, with the parts that do not flatter it.
Walk-forward: every parameter used at time t is estimated only from data before t. A canary test injects a shock into the future and fails if any earlier decision moves.
| Policy | Idle capital | ES 97.5% | Total cost | Orders | Breaches |
|---|---|---|---|---|---|
| Loading measured results… | |||||
- Robust Capital falls 84.6%, and holds between −84.9% and −84.2% across the full sensitivity range of the one uncalibrated parameter.
- Conditional Cost falls 24.4%, but moves from −13% to −38% over that same range. It should never be quoted without it.
- Worse NEAP crosses the threshold more often than conservative pre-funding. That is the optimiser applying the $50 000 breach cost it was given.
- Synthetic The payment flows. No institution publishes its own, by corridor or otherwise.
Positions stay inside the enclave. The contract still doesn't trust the model.
Live balances, upcoming commitments and internal limits map an institution's liquidity position precisely enough for a counterparty to trade against it. They never leave the enclave, and what does leave is still bounded on-chain.
Chainlink CRE
Decide in a TEE
Balances, commitments and internal limits enter the enclave encrypted. What comes out is a signed report carrying a commitment to the orders and metrics in basis points. No amount ever leaves.
Privy
Authorise with two keys
Each role wallet may call three function selectors and nothing else, with zero native value attached. A stolen key still passes authentication. It does not pass the policy.
Settle PvP
Both legs of the swap complete, or neither does. Finality lands under a second, and gas is denominated in USDC, which turns the fixed cost of a rebalance into a number the model can use.
Built, not sketched.
- 241tests: 151 TypeScript, 90 Solidity, zero type errors
- 0JavaScript dependencies outside the CRE workflow
- 1command runs the whole chain: deploy, decide, sign, approve, execute
- 2independent implementations of every hash, cross-checked each test run