Business model
The unit economics of one trade
Three things about this waterfall matter more than the exact numbers:
- The costs come out of the quote. The hedge's exchange fee, its funding, and the settlement gas are separate layers of the spread (the spread), so the margin shown already has them subtracted. A desk that skips this step reports margins it never actually earns.
- The margin is fixed at fill. Every fill is hedged within moments (hedging and risk), so the number on the right doesn't move with the market afterward.
- The spread is adjustable. Today's 150 bps base is wide because the market is young and flow is thin. As volume grows the same system runs at a fraction of that, and the operator changes the number without a deploy.
The business model
A market maker sells immediacy. Someone who wants to swap right now, at a known price, without hunting for a counterparty, pays a small premium for that. That premium is Abyss's revenue, collected trade by trade, with the risk of each trade hedged moments after it's taken.
Revenue tracks volume, not market direction. The desk earns whether prices rise or fall, because it never holds the position; it needs flow, not a correct call on the market.
The one way this breaks is if the desk ends up holding risk it meant to pass on: a wrong fair value, a spread that misses a real cost, an unhedged fill, inventory committed twice, or a risk limit that silently stopped working. Most of the system, the price pipeline, the spread engine, the hedging, the treasury controls, and the console, exists to keep any of those from happening without anyone noticing.
What it is measured against
The system is benchmarked against five kinds of real system: open-source market-making stacks (Hummingbot), institutional liquidity desks (Wintermute, GSR, Keyrock, B2C2, Flowdesk), delta-neutral basis desks (Ethena), trading-infrastructure platforms (Talos, CoinRoutes), and the exchanges it hedges on (Binance, OKX, Bybit, Deribit). It covers the same core: multi-venue fair value, composable spreads, systematic hedging, exposure budgets, layered breakers, and audited operations.
Why this is hard to copy
The hard part isn't any one component, it's the combination the venue forces:
- Settling on a privacy chain has no off-the-shelf equivalent. No vendor platform (Talos, CoinRoutes, Hummingbot) settles self-custodially on Midnight. The escrow, the fee sponsorship, the shielded-balance accounting, and the wallet machinery all had to be built.
- The privacy is real, not cosmetic. Prices are computed off-chain and there's no public order pool before settlement, so there's nothing for front-runners to watch. Institutions read that as execution quality.
- First liquidity on the network. The desk launches with the Midnight ecosystem, with NIGHT as a perp-hedgeable market from day one, and a partner API other participants can build on instead of rebuilding the same infrastructure.
- The desk is configured, not hardcoded. Tokens, pairs, venue mappings, spreads, exposure budgets, credentials, and partner keys are runtime settings, changed live and under audit. That's what lets it go from three tokens to thirty, or reprice a pair for a new market, in the time it takes to file a ticket. The only real engineering is connecting a new exchange the first time, and that's a one-time cost per venue.
What the desk is built to hit
These aren't live readings, they're the targets the system is built around, the numbers a market-making desk is judged on:
| Target | What it means |
|---|---|
| Spread capture net positive, per pair, every day | The margin has to clear every hedge, funding, and settlement cost, not just look wide on paper |
| Hedge latency in seconds, from fill to placement | While a fill sits unhedged, the desk is holding directional risk, so that window should be as short as the chain and exchange allow |
| Residual net delta inside the dead-band, per asset | What's left after hedging should stay too small to matter, all the time, not just on average |
| Zero undetected limit breaches | Every breaker either holds or is caught when it trips; a limit that silently stops working is worse than none |
| Uptime with zero bad prices served | Pricing and hedging stay up, and when something fails it fails toward refusing to quote, never toward quoting wrong |
Choices made on purpose
Some design choices were deliberate trade-offs. Stating them so they read as decisions, not gaps:
- All-or-nothing settlement, no partial fills. The escrow either completes or refunds both sides; there's no partial-fill or resting-order model. That buys atomic self-custody and clean settlement, at the cost of not serving passive liquidity. For a desk whose promise is no counterparty risk, that's the right trade.
- Escrow terms on-chain, not a signed off-chain quote. The contract enforces the amount and deadline, so there's nothing to verify off-chain. The cost is that a quote isn't a portable signed object a third party could reuse.
- Hedge collateral pre-funded on the exchanges. Today the desk's collateral sits on each exchange. It's simpler to run, and it's why exchange counterparty risk is named plainly in security and custody. Moving to a delegated custodian removes that exposure and is the next step.
- One non-custodial maker, not a shared solver network. Abyss prices and fills its own book instead of competing in someone else's auction. That gives up pooled order flow in exchange for full control over pricing, risk, and the app.
- Building the settlement and treasury stack instead of buying one. No vendor product settles self-custodially on a privacy chain, so this wasn't really build-vs-buy. It was build, or don't operate on Midnight.