Titan Exchange
Engineering documentation for the Canton-native perpetual-futures DEX — interface, BFF, matching engine, indexer, and the design system.
Titan is a perpetual-futures DEX on the Canton Network. Collateral and settlement live on-chain as Daml contracts; matching runs off-chain in a deterministic engine that commits merkle roots back to the ledger on a fixed cadence.
The stack is four services and one front end:
Read this first
Architecture
Trust model, parties, batch commitments, and how a fill becomes an on-chain leaf.
Interface
The trading terminal: routing, state ownership, the typed BFF boundary, wallets.
Design system
Apple HIG × trading density — the tokens every surface is built from.
BFF API
The /v1 contract: REST reads, the non-custodial proxy, the WebSocket firehose.
The one-paragraph version
A trader connects a Canton wallet, derives an Ed25519 session key, and signs it once into the engine. Every order after that is signed with the session key — never the wallet key, and never by any server. The BFF forwards those signatures verbatim to the engine and holds no key material of its own. The engine matches, writes a signed WAL, and the Go indexer projects that WAL plus the on-chain ledger stream into Postgres. The BFF reads Postgres for history and fans the engine's live SSE firehose out to browsers over one WebSocket.
Non-custodial means non-custodial. No component between the wallet and the engine can produce a valid order signature. See Authentication.
Repository map
The deployed indexer is server/indexer. A standalone titan/indexer tree also exists and
is stale — never implement there.