The Perp Architecture Endgame

No other financial primitive has reshaped crypto market structure as profoundly as perpetual futures. By stripping away expiry dates and standardizing leverage, these instruments offer traders a streamlined and capital efficient way to gain synthetic exposure to an underlying asset. Despite the common belief that perps exist merely as tools for speculation, their standardization and efficiency make them core to price discovery, helping keep volatility grounded in fundamentals rather than noise and thereby supporting more efficient capital allocation. Total perp volume is massive, crossing 9 trillion dollars in October alone. This is nearly three times the volume of spot markets which cleared around 3 trillion in the same period. While most perp volume still runs through centralized exchanges, DEX share is roughly 20 percent with a clear trend: up and to the right. 

Decentralized exchanges have structural advantages in self custody, verifiability, security and composability but they must compete head to head with centralized venues on spread, order book depth and latency. The recent rise in decentralized adoption is driven by novel DEX designs that are closing the execution gap without giving up on trust minimization.

This report covers the basics of how perps work but more importantly profiles four decentralized perp exchanges that have achieved significant traction and represent distinct design philosophies. These are Hyperliquid, Lighter, Extended, and Jupiter. Our goal is to evaluate their architectures along the axes of trust, scale, and composability. By doing so we aim to provide a reasoned outlook on which design is best positioned to capture most market share at scale in this high growth market.

Our theoretical conclusion is simple: despite monolithic designs like Hyperliquid leading the market today, they are structurally limited to scale. The winning architecture is one that inherits the strongest security and composability from the most liquid and battle tested network, while being unconstrained to scale like a CEX. 

1. What Is a Perpetual Future, How Perp Exchanges Work, and Why They Don’t Exist in TradFi

A perpetual future is a cash‑settled derivative with no expiry. It tracks an asset’s spot price through periodic funding payments between longs and shorts, usually every hour, facilitated by an exchange. If the perp trades above spot, longs pay shorts. If it trades below, shorts pay longs. These carry payments keep the contract anchored to the underlying.

1.1 Why the Peg Holds in Practice

Basis arbitrage ties the perp to the underlying. When the perp price trades above spot, one  can capture the funding payments by buying spot and shorting the perp. In the opposite case, where spot trades above the perp price,  one can capture funding payments by going long the perp and short spot.

In equilibrium, this dynamic tends to resolve into a positive fair perp basis. The reason this basis often tends to be non zero is that the arbitrage trade needs to be compensated for the cost of carry (financing the position) as well as market frictions, which include everything from fees and slippage to ADL risks.

Futures in traditional finance achieve the same linkage differently. They have fixed expiries and internalise the carry into the futures price. Arbitrage keeps that price aligned with spot and cost of carry through the life of the contract. At expiry the future converges to spot and settles in cash or physical.

1.2 What a Perp Exchange Does

A perp exchange is the venue where traders post collateral and trade the derivative. The venue runs the order book and matching engine, settles assets, enforces risk rules, and defines the loss waterfall to guarantee solvency.

As part of the risk engine, the exchange sets two core parameters for each market:

• Initial margin sets how much leverage you can take at entry

• Maintenance margin is the floor below which account equity cannot fall without triggering liquidation

The exchange continuously marks positions to market and settles both PnL and funding in the settlement asset, usually USDC or USDT. Account equity moves between longs and shorts as prices move and as funding accrues. If an account’s equity drops below maintenance, the venue liquidates part or all of the position.

In healthy market conditions, liquidations are cleared through available liquidity in the orderbook. In case prices drop sharply and an account’s equity does not suffice to cover the account’s loss, bad debt can accrue to the system. This is often driven by a liquidation cascade, where forced selling drives prices further down, triggering more liquidations that overwhelm available liquidity in the order book. In order to prevent insolvency usually some kind of loss absorption waterfall mechanism is put in place. The first line of defense is usually an insurance fund, which steps in to absorb the bad debt. As a last resort the venue triggers auto deleveraging (ADL) that forces the closure of profitable positions. As such profitable traders plug the hole. Different venues parametrize ADL and insurance fund intervention differently. Being conservative on ADL tends to favour traders whereas being conservative on insurance fund intervention favours the backers of that fund.

The loss absorption mechanism is crucial to ensure solvency and, by extension, withdrawability. Any account should be able to withdraw its equity at all times. Perps are synthetic and cash-settled, unlike spot markets that exchange the physical underlying. This means, a perps exchange is a zero sum set up, one trader’s gain is another trader’s loss after fees. If a gain isn’t fully covered by an offsetting loss, you end up with a hole in the system.

An important distinction from TradFi, which separates the exchange from the clearing house, is that a perp venue vertically integrates both. Matching, margining, liquidations, and default management all live inside one unified system.

1.3 Why Perps Are Crypto Native and Do Not Exist in TradFi

Perps are crypto native for structural reasons. Funding needs a live spot reference and continuous settlement. Blockchains clear 24/7, while traditional finance doesn’t. Markets close at night and on weekends, and clearing runs in batches. That pause breaks the arbitrage loop that keeps a perp glued to spot through periodic funding.

History and sources of demand play a role as well. Dated futures were built for natural hedgers who need to lock risk to a specific date. That demand doesn’t really exist in crypto. The closest analogy would be PoW miners whose “harvest” timing is uncertain in time. A never expiring hedge fits crypto better than a quarterly roll here.

Lastly, today, clearing houses, risk management practices around margin, and the regulatory apparatus in traditional finance are built around dated contracts and session closes. A contract that never expires and settles funding hourly would require a complete overhaul of the system. For now, there is not enough potential energy to move from one equilibrium to another.

2. Perp Exchange Types

Perp exchanges fall into two broad buckets: centralized and decentralized. Centralized venues are closed systems where users fully trust the operator for custody, execution, and risk management. Decentralized exchanges aim for trust minimization by enforcing transparent rules, so users keep control of funds through their own keys and can exit without permission.

The case for decentralized perps was proved the hard way in 2022 with the collapse of FTX. When users tried to withdraw, the exchange was insolvent after commingling customer funds. More malpractice surfaced, like privileged accounts being exempt from liquidation. In the aftermath, early decentralized perp venues saw a jump in adoption, with pioneers like dYdX and GMX benefiting most. Since then, the design space has moved fast, pushing perp liquidity and latency closer to what centralized venues offer, while also pushing the frontier of transparency and trust minimisation.

However not all DEXes make the same promises. The label "decentralized" has become a spectrum rather than a definition. To get a better picture about the true decentralization of these venues we like to assess them across the following 5 dimensions.

Self custody and settlement: This measures the hardness of asset ownership. Can users strictly withdraw the funds they are entitled to based on a correct state enforced by a battle tested decentralized consensus? True self-custody of these assets requires not just holding your own keys but also censorship resistance and liveness.

Matching and execution: This determines the fairness of trade execution. In TradFi exchanges like the NYSE follow price-time priority standards. As the name suggests, this standard prioritizes orders by price and secondarily by time of arrival, meaning two orders with the same price but different timestamps will prioritize the order that arrived first. This standard is imposed by law to prevent operators from front-running users or skipping the queue ahead of resting limit orders. In the self regulated crypto market the relevant question is whether this price-time priority ordering is enforced by a verifiable mechanism or merely promised by a centralized operator. 

Liquidations: The liquidation engine should be impartial. Accounts should only be liquidated under programmatic rules (equity < maintenance ratio) applied consistently to all accounts. For example there should not be the possibility to exempt specific accounts at centralized discretion.

Oracles: Oracles impact everything from PnL calculations to funding rates and liquidations. Therefore it is critical to assess the source of these data feeds and determine whether they are properly authenticated by the provider through cryptographic signatures.

Governance: This defines who holds the rights to change parameters that impact user safety. Most importantly it determines the conditions under which the system logic can be upgraded. Ideally users should have a guaranteed time-lock to withdraw assets before any code change takes effect ensuring they are never forced to accept a new security model against their will.

3. The Value of an Exchange

At its core, an exchange’s job is to align the incentives of three distinct parties. Market makers require a return on inventory that exceeds their cost of capital. Traders demand the lowest possible total cost of execution, which is a function of tight spreads, deep order books, and low fees. The venue, in turn, captures value by efficiently matching the two.

We view the sustainable value of an exchange as a function of its ability to attract uninformed flow. This refers to taker flow that is not driven by superior short-term price information. Think hedgers, asset allocators or retail users. This contrasts with toxic flow from high-frequency arbitrage bots, which typically results in losses for the market maker.

This "non-toxic" flow allows market makers to capture the spread without suffering from adverse selection. When makers are not constantly picked off, they are more profitable and can quote tighter spreads with deeper size. This kickstarts a liquidity flywheel: deep liquidity attracts more uninformed flow, which incentivizes more market makers and further deepens liquidity.

A perp DEX's primary goal is to design a market structure that lets this flywheel spin up and scale sustainably. Once that loop is running, revenue becomes a natural byproduct of the size of cleared volume. However there is a hard infrastructure requirement for this flywheel to begin and sustain at scale. The underlying infrastructure must support high throughput and low latency execution comparable to a centralized service. Without this scale market makers cannot update quotes fast enough to manage risk and the flywheel remains weak.

4. The Current Market Landscape

Perp trading is still dominated by centralized exchanges. While decentralized exchange volume reached approximately 1.2 trillion dollars in October 2025 centralized venues processed roughly 8 trillion dollars in that same period. Today about 80 percent of total volume still runs through CEXs with DEXs capturing the remaining 20 percent.

The trend however speaks for itself. Over the last twelve months DEX market share has surged from roughly 5 percent to about 20 percent marking a 300 percent increase in relative dominance. On the centralized side five venues effectively control the field according to data that is reported. Binance accounts for roughly half of the top five volume and open interest followed by OKX, Bybit, Gate and KuCoin.

On the decentralized front Lighter currently edges out Hyperliquid on raw volume while Hyperliquid maintains a decisive lead on open interest, sitting at around 6 billion dollars versus roughly 2 billion dollars for Lighter at the time of writing. 

When assessing market dominance, we generally prioritize open interest over raw volume. Volume drives fees but it is easily gamed through incentives or wash trading. Open interest is significantly harder to fake without assuming real risk making it a cleaner proxy for the amount of sticky and largely uninformed risk a venue is actually hosting. Market makers and high frequency traders typically do not carry large open interest because they open and close positions rapidly. Therefore high OI signals that a venue has successfully attracted the organic demand required to sustain the liquidity flywheel. By this measure Hyperliquid currently maintains a decisive lead in the perp DEX landscape.

5. Four Venues, Four Architectures

As mentioned in the intro, we will compare four DEXes that have reached meaningful adoption. Each of these exchanges is characterised by a distinct architecture. We categorize them as follows:

• Hyperliquid: A monolithic application-specific L1 that natively powers a perps exchange.

• Lighter: A ZK-rollup app-chain on Ethereum that powers a perps exchange and exemplifies the modular L2 thesis.

• Extended: A hybrid model that settles on Starknet (Ethereum rollup) while running matching off-chain.

• Jupiter Perps: A pool-to-trader model where LPs face traders as the counterparty.

In the next section, we deconstruct each venue’s architecture and the guarantees it provides across the five critical dimensions defined earlier: self custody and settlement, matching and execution, liquidations, oracle inputs and governance. Note that while we provide an overview of each exchange today, the main takeaway of this analysis should be whether a chosen architecture fundamentally limits an exchange's ability to compete on security, scale, and composability in the long run. After covering each design the goal is to evaluate each exchange on its structural potential on the scorecard below.

5.1 Hyperliquid Exchange

Hyperliquid is a purpose built layer 1 designed to run a fully onchain CLOB for perps. All core exchange functions live in the chain’s native state machine, HyperCore. Matching, margining, funding, and liquidations execute at the protocol level rather than as bytecode in a general virtual machine. For example a DEX like Uniswap is deployed as smart contracts that execute against a VM, as opposed to being enshrined at the infrastructure level. Consensus is HyperBFT powered by 24 validators, a proof of stake variant tuned for sub second blocks and high throughput. In practice that means trading logic is verified and finalized at block speed. Hyperliquid claims to power 200k TPS with a median transaction latency around 200 ms.

On the commercial side, Hyperliquid’s growth has been impressive and currently ranks 3rd in terms of revenues among all onchain crypto businesses.  

Hyperliquid’s growth story was among others due to a community first approach. A large airdrop heavily rewarded the user base early on, giving them large ownership in a project that did not raise any outside capital. It also pioneered a community‑funded market making vault (HLP) that lets traders participate in a transparent market making strategy that conforms to the same rules as any other account on the exchange. This transparency stood in sharp contrast to CEXs that are often accused of running their own market makers in obscure ways.

Combined with the high performance CEX-like UX, this has translated into sticky use. Weekly active users sit around 150k. Open interest is roughly 6.4 billion dollars, TVL about 4.2 billion dollars, and 30 day volume near 270 billion dollars. High OI and TVL together with sustained volume point to significant organic usage.

5.1.1 How Hyperliquid Scores on the Trust Axes

Self custody and Settlement. Hyperliquid accounts are key controlled so balances are self custodial within the system. However exiting to Ethereum depends on Arbitrum bridge which is controlled by multisig with 4 signers. Settlement happens natively on the Hyperliquid L1 where trading logic is transparent and enforced by Hyperliquid’s consensus. Unlike a stage 2 L2 that inherits Ethereum's battle tested settlement assurance and censorship resistance, Hyperliquid's settlement guarantee relies entirely on the integrity of its own consensus.

Matching and execution. Hyperliquid enforces price-then-time priority based on the order transactions land on-chain. The block proposer controls inclusion order so MEV risk exists. In that sense price-time is enforced but only relative to the block order, not mempool arrival.

Liquidations and solvency. Liquidations are programmatically enforced when equity runs below maintenance margin without preferential treatment. When book liquidity cannot absorb the flow a backstop vault takes over. If there is residual loss ADL kicks in to keep the system solvent. ADL ranks profitable accounts with a public rule-based index and trims the highest ranked first.

Oracles. Index prices come from a validator-run oracle. Each validator computes a weighted median across major spot venues plus Hyperliquid spot. The network then stake-weights submissions to get the final index. As with consensus oracle integrity depends on a 2/3rd majority of validators.

Governance and upgradability. The rules of the exchange are effectively governed by a two-thirds supermajority that can in practice change exchange logic by adopting new node software.

A Caveat with Regards to Safety/Transparency. Hyperliquid is different from most perp DEX designs because it runs its own L1 and consensus. The strength of every rule the exchange encodes, from liquidations to oracles to settlement, is only as strong as the validator set and the governance that steers it. Running a node is permissionless, but only the top 24 validators by stake produce blocks. Today that stake is highly concentrated, and recent reporting suggests the Hyper Foundation controls roughly two thirds of staked HYPE, which is enough to steer governance outcomes.

The incident around the JELLY meme token highlighted this centralization risk. An attacker took a large short position in an illiquid meme token and squeezed the price, liquidating himself and forcing HLP market making vault to take over the position. To avoid large HLP losses, Hyperliquid validators intervened via staked supermajority to close the market and settle the HLP vault at a pre-attack reference price rather than the market price. The attacker’s account was frozen and unable to withdraw his remaining assets. This speed of intervention highlighted centralization and raises questions about the definition of self-custody when centralized governance can override outcomes. Furthermore the node software is not yet open source meaning users trust signed binaries rather than auditable code.

5.1.3 Outlook

Hyperliquid’s team has stated it will open source when they deem it to be secure. For now the network has 24 active validators that are likely co-located and stake is highly concentrated, so decentralization is weak. Critics argue the venue is marketing itself as a DEX while effectively having similar control than a CEX. Being centralized also puts you at the mercy of regulatory intervention, a real risk to users.

Bottom line, Hyperliquid needs to broaden stake and validator distribution. The team says it plans to do that. The catch is that more decentralization usually adds consensus overhead and network synchronization, which increases latency and lowers throughput. Thus Hyperliquid’s chosen architecture, to power its own consensus, forces it to choose between performance and security in the long run.

Scorecard:

5.2 Lighter Exchange

Lighter launched in early 2025 and really started to become a major player in August. What pushed its growth was not only the product experience but the architecture that sets it apart. DYdX pioneered the perp DEX as a zk app chain, but they only settled on Ethereum. They proved that matched trades were backed by valid signatures, yet the actual matching lived off chain which was neither transparent nor did it provide guarantees to enforce fairness. Lighter decided to push the trustless frontier forward by proving the correctness of everything that matters for a perp exchange.

That ambition is a real challenge. General purpose L2s are not built for the level of throughput a competitive venue needs, especially one where orders are constantly updated or cancelled. To reach the scale required, Lighter built custom zk circuits that are optimized for the throughput profile of an exchange. A sequencer executes the state transitions, a prover generates proofs for matching, funding, liquidations, and account updates, and Ethereum smart contract verifies those proofs and stores the proven state root as well as the user assets.

The result is a model where self custody, matching rules, and liquidations are enforced under Ethereum consensus while throughput scales the same way any specialized system does, by adding more machines. In many ways this is a strong validation for the Ethereum rollup-centric roadmap applied to a perp exchange. 

The data underlines Lighter’s success. Lighter is currently the fourth largest Ethereum rollup by TVL and the rollup with the highest TPS across the entire Ethereum ecosystem.

Today Lighter stands as the largest perp DEX by monthly volume at around 300 billion. It is the second largest by TVL at roughly 1.2 billion and by OI at around 1.7 billion. What stands out is the high ratio of volume to OI. Lighter sits at roughly 180x while Hyperliquid is closer to 42x. One reason for this may be the revenue model that Lighter chose. Instead of charging taker fees and paying maker rebates like most venues, Lighter introduced a two tier account system. Traders on the free tier face a small speed lag relative to paying accounts but enjoy zero fee trading. This naturally attracted a large wave of taker scalping activity that benefits from a zero fee environment. Scalping works by opening and closing positions within very short time windows to capture small price movements. It contributes almost nothing to OI, yet heavily boosts volume.

5.2.1 How Lighter Scores on the Trust Axes

Self custody and settlement. User assets are custodied in Ethereum contracts that also store Lighter state roots. Batches of state updates are only accepted when accompanied by a zk proof that verifies the correctness of balance updates according to the proven program. Users can always withdraw their funds according to this state root on Ethereum. If the sequencer censors or stops running, users can submit priority transactions on Ethereum. If the sequencer does not include these transactions, a user can trigger the escape hatch on Ethereum and prove their balance as eligible for withdrawal according to the latest proven state root. This can be done by leveraging Ethereum data blobs that contain all necessary information to generate the proof. This anchors custody trustlessly to Ethereum.

Matching and execution. Price‑time priority is enforced by proof, rather than promised by the operator. This is the crucial part that differentiates it sharply with regards to dYdX v3. However there is a small caveat to this. The sequencer still sets the sequence of transactions. Only on that sequence is price time priority then enforced. However the surface to exploit this is limited since major reorderings would be observable to outside players. The team is working on completely eliminating this tiny trust vector as the white paper mentions “ongoing research into fair sequencing techniques and cryptographic methods (e.g. transaction encryption and pre‑commitment schemes) to mitigate MEV risks.”

Liquidations and solvency. Liquidations trigger programmatically when account value falls through margin thresholds. The logic is part of the proven execution. Similarly to the Hyperliquid HLP fund, Lighter runs the LLP fund that actively makes markets and serves as a backstop when the book cannot absorb liquidations. ADL is applied as a last resort. It became evident in the Oct 10th crash that Lighter’s system is more trader friendly in the sense that it more aggressively  allocates bad debt to the insurance fund as opposed to winning traders through auto deleveraging compared to hyperliquid. The LLP took heavy losses, but ADL stayed minimal, whereas Hyperliquid traders were heavily impacted by ADL.

Oracles. Index and mark prices are provided as input by the sequencer from Stork as a decentralized oracle network. These calculations are part of the proof ensuring that the system uses the inputs correctly. However it seems today users must trust that the operator forwards oracle prices accurately as the oracle signatures of third-party feeds don’t seem to be verified as part of the proof.

Governance and upgradability. As mentioned, smart contracts verify proofs and maintain the state root on Ethereum. It is not entirely clear how Lighter upgrades its circuit or verifier. But L2beat classifies it as stage 0 meaning there is a centralized control on upgradability currently that can happen without notice.

5.2.2 Outlook

Lighter is in a great position to scale throughput like a centralized venue while rooting trust in Ethereum’s consensus, in our view the highest degree of trustlessness.

To get there a few things still need to happen, none of which are structural or fundamental blockers of the underlying architecture. The proven program needs to be fully open source, upgradability should be timelocked so users can exit under pre-upgrade rules, remaining MEV surface needs to be addressed, and oracle inputs need to be authenticated inside the proofs. Since none of this touches a hard architectural limit, we think Lighter’s design has a clear path to offer a high degree of trust minimization while matching centralized venues on latency and throughput. Truly the best of both worlds!

Scorecard:

5.3 Extended Exchange

Disclaimer: cyber•Fund is investor in Extended.

Extended operates as a hybrid perpetual DEX similar to dYdX v3. "Hybrid" here refers to the fact that Extended runs its order book and matching engine off-chain while settlement and custody happen on-chain via Starknet. Practically speaking Extended’s off-chain system aggregates signed orders, matches them and submits the trade data to its smart contracts on Starknet. The order signatures are authenticated and trades verified before the state is updated. This way Extended scales for the throughput required by CLOB while relying on Starknet’s validity proofs to secure state transitions based on Ethereum’s consensus. The thesis is simple: CEX-like performance, with Ethereum L2-grade custody/settlement guarantees.

On the commercial front Extended has been growing quickly since its migration in August. While smaller than Hyperliquid or Lighter it has found traction ranking roughly ninth by monthly volume at about 27 billion dollars, with open interest around 75 million dollars and TVL near 95 million dollars..

5.3.1 How Extended Scores on the Trust Axes

Self custody and settlement. Extended offers users self-custody with deposits held in smart contracts on Starknet. Because Starknet operates as a validity rollup every state transition must be proven valid via a STARK proof before finalizing on Ethereum.

This means Extended inherits Ethereum’s safety guarantees. In theory no invalid trade that violates margin rules or falsifies balances can ever settle because the proof would simply fail verification on L1.

However self custody or withdrawability comes with a caveat. While the integrity of funds is guaranteed by Ethereum, access to them relies on Starknet. Starknet does not yet offer a permissionless force inclusion mechanism to bypass the L2 sequencer. If the Starknet sequencer censors a user or goes offline, funds are effectively frozen.

Matching and execution. Price-time priority is not enforced on-chain. Extended’s matching engine runs off-chain and functions as a black box. This means the operator theoretically retains the power to reorder transactions or front-run users. To mitigate this the team has signaled an ambition to migrate the matching engine into a Confidential Compute environment (TEEs like AWS Nitro). This would shift the trust model from trusting the operator’s honesty to trusting cryptographic attestations generated by secure hardware. By running the matcher inside an isolated enclave, Extended could prove that the code executing trades is adhering strictly to price-time priority even while running off-chain.

Liquidations and Solvency. Extended’s liquidation engine is permissionless at the trigger level meaning any third party can liquidate an account that falls below maintenance margin. Crucially the smart contract prevents invalid liquidations. To handle insolvency Extended leverages a similar market making vault than Hyperliquid or Lighter and falls back to Auto-Deleveraging (ADL) as a last resort.

Oracles. Index and mark prices are derived from a median of signatures provided by a whitelist of external oracle providers. The smart contract enforces a minimum quorum of signatures before accepting a price update.

Governance and upgradability. Currently the system is governed by a multisig controlled largely by the Extended team. This multisig has broad powers to upgrade core contract logic essentially giving it control over settlement.The team has clearly stated its ambition to transition to a Security Council model.

A Caveat on Starknet as the Settlement Layer. Extended’s trust kernel is Starknet. While it inherits Ethereum’s integrity for state transitions via validity proofs it does not fully inherit liveness or censorship resistance due to the lack of a forced exit mechanism. However worth mentioning is that Extended’s settlement smart contracts are all open source and auditable.

5.3.3 Outlook 

Extended has a strong setup to scale offering high throughput and low latency. However, its path for its design to becoming a truly trustless exchange requires overcoming two critical hurdles. First, the off-chain matching engine must be verified. The team’s ambition to migrate this component to a Confidential Compute environment (TEEs like AWS Nitro) represents a significant upgrade. By running the matcher inside a secure enclave, Extended could generate cryptographic attestations proving that order execution adheres strictly to price-time priority. Second, Extended’s decentralization is inextricably tied to Starknet’s. The exchange cannot offer fully trustless exits or censorship resistance until Starknet itself matures into a Stage 2 rollup. This external reliance gives it a Medium score on Security.

Scorecard:

5.4 Jupiter Exchange

Jupiter represents a completely different approach to the three venues analyzed above. While Hyperliquid, Lighter, and Extended all implement variations of a CLOB to match buyers with sellers, Jupiter utilizes a "Trader-to-Pool" model.

This model exists because of the constraints of the underlying infrastructure. General purpose blockchains like Solana, despite prioritizing low latency and high throughput, are not designed for the high-frequency of order updates a CLOB based exchanges require. This limitation historically made decentralized order books less practical and shifted innovation toward Automated Market Makers or AMMs.

However, Jupiter differs from traditional invariant-based AMMs like Uniswap. Instead of relying on some algorithmic pricing curve for internal price discovery, Jupiter operates as an Oracle-based AMM. It imports price data directly from external oracles, removing the need for arbitrageurs to keep prices in line. Instead of running an order matching engine Jupiter’s design powers a massive liquidity pool called JLP that acts as the counterparty to every trade.

With this setup there is no need for active market makers. There are only traders and passive liquidity providers . When a trader opens a position they are effectively “reserving” liquidity from this pool to back their trade. For example, if a trader goes long 5 SOL Perps, then 5 SOL is explicitly “reserved” from the pool to cover potential gains and ensure the pool remains solvent. In exchange for providing liquidity, the pool earns yield from the negative pnl of traders, borrowing fees, and transaction fees. One downside which should have become obvious from this example is that it is not capital efficient in the sense that trading demand requires it to be fully covered by the capital available in the liquidity pool. This is a significant drawback compared to the CLOB exchanges, where both the market maker and the taker can utilize leverage, rather than just the taker. Hence the OI of Jupiter is by design capped to the TVL of the JLP pool.

Nonetheless this design has found strong product-market fit among others because it can coexist on a general-purpose blockchain like Solana. This allows it to benefit from synchronous composability with the broader DeFi ecosystem while inheriting the settlement guarantees of a battle-tested L1. Furthermore Jupiter Perps has benefited significantly from being natively integrated into the Jupiter aggregator which is the default interface for Solana DeFi.

Commercially Jupiter has a strong foot in the market. As a dominant user interface within the Solana ecosystem, it captures large amounts of non toxic flow and consistently prints billions in volume per week. Despite its less capital efficient design it ranks as the 15th largest perp DEX by volume and its JLP pool has an impressive 1.7 billion dollars in TVL. The JLP pool has become one of the biggest yield bearing assets in Solana DeFi. The sheer size of it often allows for lower slippage than a trader would face on some CLOB based venues.

5.4.1 How Jupiter Scores on the Trust Axes

Self custody and settlement. Custody and settlement are fully inherited from Solana. Funds reside in non-custodial program accounts and settlement is atomic. As long as the blockchain produces blocks, users' collateral remains safe and retrievable on-chain.

However, liveness and censorship resistance do not inherit Solana guarantees. Jupiter utilizes a request-fulfillment model where users sign intents and off-chain and bots execute them against the pool. Currently this relies on a limited set of team-operated bots creating a critical centralization vector. If these bots go offline or censor a request the user is effectively frozen out. To mitigate this Jupiter could adopt a decentralized keeper network similar to GMX allowing third-party watchers to execute trades permissionlessly.

Matching and execution. In the pool-to-trader model there is no order book to traverse with orders to match. Execution is deterministic based on the oracle price and some slippage based on pool balances.

Liquidations and Solvency. Liquidations are programmatic and executed by keeper bots against the pool by closing the position. However, this process currently relies on whitelisted keepers operated by the team similarly to opening and closing positions. This creates a centralized "liveness" dependency: if the team's bots go offline, needed liquidations fail to trigger. This could leave the JLP pool exposed to bad debt if positions fall into negative equity before the bots recover.

Solvency for traders is primarily ensured through the inventory reservation mechanics: for longs the pool reserves the actual tokens, for shorts it locks stablecoins.  This guarantees the pool never owes more than its physical holdings. On the other hand, if a trader’s equity should fall negative , the JLP pool itself acts as the insurance fund, absorbing the shortfall directly.

Oracles. Oracles are the primary factor for execution price. To ensure integrity Jupiter uses the median price from a decentralized network of oracle publishers whose signatures are verified on-chain.

Governance and Upgradability. The smart contracts are currently upgradable by a Team Multisig, not a direct time-locked DAO vote, placing ultimate trust in the team.

A caveat on Price Discovery vs. Price Import. It is important to understand that Jupiter is not a market that offers price discovery. Jupiter instead relies on external venues like Binance to establish fair value. Consequently it cannot exist without primary discovery venues.

5.4.2 Outlook

Jupiter success is to a large extent attributable to coexisting with the Solana ecosystem, a battle tested infra with the second largest DeFi ecosystem after Ethereum, allowing users to stay within one unified infrastructure without needing to bridge funds to a new chain to trade perps. Furthermore the high amount of capital on Solana has driven yield hungry investors to fund the JLP pool creating a deep reservoir of passive liquidity. For many retail traders the ease of staying within one ecosystem outweighs the higher latency and costs compared to a capital efficient CLOB based DEX. This dynamic is likely to remain the case. However the model will always face a hard scalability ceiling defined by the size of the JLP pool. As such this design will likely retain market share as a retail interface and yield source for LPs, but it cannot scale to the levels of capital efficient DEXes that contribute to  global price discovery.

6. Composability as a Key to Success

After dissecting how various DEX architectures handle scale and security the final component to evaluate is their ability to compose with the broader DeFi space. In this context composability refers to the ability for an exchange’s assets and positions to interact synchronously with other financial applications.

The most difficult path to composability is operating on an isolated Layer 1. In this model capital is inefficient. When a user deposits funds they sit idle in that ecosystem. Hyperliquid attempts to mitigate this by building HyperEVM, a permissionless layer designed to seed a native DeFi ecosystem on top of its L1. However this approach faces a cold start problem as it requires bootstrapping an entire DeFi stack and deep liquidity from scratch rather than tapping into existing networks.

The most effective form of composability is to coexist natively with an existing deeply liquid DeFi ecosystem. Jupiter exemplifies this on Solana. Because it lives directly on the L1, the JLP token can be leveraged as collateral in lending markets. However, while powerful, this is only as strong as the degree of DeFi activity of the underlying chain. Solana’s DeFi ecosystem, while growing, is still significantly smaller than Ethereum’s. With close to 70 billion usd in DeFi TVL, Ethereum powers around 70% of all blockchain’s DeFI TVL combined.

Consequently, in our opinion, the north star for composability is direct integration with Ethereum. This is where a zk app chain like Lighter or an exchange like Extended hosted on a zk rollup, have an edge. By plugging directly into Ethereum and having their state transitions verified via ZK proofs, both have the potential to trustlessly import massive amounts of high-quality collateral from Ethereum’s deeply liquid DeFi layer. Think of assets like stETH, ETH itself, or yield-bearing stablecoins serving as collateral in a universal cross-margin system. 

Moreover, Lighter having its state directly on Ethereum, could potentially compose with L1 Defi via its L1 priority transactions which force the sequencer to include a transaction such as a withdrawal. The lighter whitepaper calls out this priority queue on L1, mentioning it could be “serving as a composability interface between Lighter and the broader Ethereum ecosystem”.

Consider a future implementation where a liquidity provider deposits USDC to Lighter’s LLP vault directly on L1 minting an ERC20. This means the LLP token could be used immediately to compose with DeFi primitives on Ethereum functioning for instance as collateral to borrow against on Aave or Fluid, while still having a clearly defined, Ethereum-enforceable redemption path back into underlying assets.

Final scoreboard:

7. A Look into the Future

The perpetual market today revolves almost exclusively around crypto-native assets. While equities, commodities and FX pairs have started to roll out, it is still early days. With crypto-native assets growing in volume themselves these new markets should act as a powerful tailwind for the sector. For comparison the total notional trading volume of derivatives in traditional finance is in the quadrillions (1000^5) annually. Given the open and permissionless nature of DeFi compared to the gated infrastructure of traditional finance it can be argued that the total addressable market for perps is even larger.

The market is massive and competition is fierce. To assess which architecture will likely dominate and scale to serve this demand, we make the assumption that the end user or the downstream integrator, such as a wallet or a fintech, are rational in their choice and aim to optimize some kind of utility function. This function is weighted to some degree across three factors: the cost of execution, security, and composability. Below are some theoretical values for visualization purposes.

The Cost of Execution is the baseline requirement. It is a function of the scale an architecture can bear in terms of throughput and low latency which is required to sustain the liquidity flywheel we mentioned earlier. Security encompasses transparency, integrity of state transitions, liveness and censorship resistance. For an exchange to power the large-scale demand the market is likely to see in the future, it cannot require trust by the user. We argue that the north star here is inheriting Ethereum’s security, it is not a coincidence that Ethereum secures over 70% of all blockchain DeFi TVL. Finally Composability determines the capital efficiency of the system. It defines whether capital is trapped or if it can integrate with the broader on chain economy. 

Starting with the CEX model, we believe its dominance is structurally doomed. While it scores high on cost of execution, it scores a zero on security and composability. It is not transparent, state transitions are decided by a centralized operator who can censor at will. As DEXes start competing on the cost of execution, the only historical advantage of a CEX evaporates. 

This leaves us with the battle for DEX dominance. To be clear, our judgment here relies on an exchange’s architectural potential endgame, rather than the current state of any specific implementation. For example if Lighter is currently upgradable by a centralized operator, we evaluate it based on its structural capacity to transition toward a transparent and timelocked governance model.

The Pool-to-Trader model exemplified by Jupiter is not designed to be a venue for price discovery. Despite scoring well on security and composability the architecture faces a hard ceiling. Its open interest is 1:1 tied to the TVL of the liquidity pool. This capital inefficiency makes it impossible to scale significantly in size. While it will likely retain market share among retail users who value the simplicity of a single ecosystem it cannot serve as the market structure that will power perps in size to serve the world’s demand.

Next and probably most controversial given its success today, is our assessment of DEX L1s like Hyperliquid. While Hyperliquid currently powers most activity, we think this is in part due to a very successful growth and marketing approach that led to a die hard advocating community. In the long term and in the next leg of growth it faces a structural dilemma. To maintain high throughput and low latency it has to keep compromising on decentralization which caps its security score. Furthermore it suffers under a structurally larger cost basis, which is due to allocating a security budget via token inflation to secure its consensus. This establishes a higher long-term cost base compared to a rollup like Lighter that pays much less for security to Ethereum. These cost savings can eventually be passed on to the user via zero taker fees for example, providing a potential edge with regards to cost of execution assuming order book liquidity is equal. Finally it fails on composability. It is an isolated system that must bootstrap its own DeFi primitives from scratch.

This leaves us with the hybrid design of Extended settling on an L2 and Lighter’s ZK app-chain on Ethereum.

We believe both architectures score highly on scalability, composability and trust minimization. Our assessment is that Lighter holds the long-term edge due to its vertical integration directly to Ethereum. The main advantage is that this removes reliance on a general-purpose Layer 2 to effectively transition to a Stage 2 rollup in order to inherit Ethereum’s settlement guarantees, liveness and censorship resistance.

That being said we expect a handful of DEXs to coexist given the sheer size this market will likely grow into. Our best assessment is that it will be dominated by architectures that structurally optimize around scale, composability and trust minimization. The north star for security and composability is Ethereum itself, while the north star for scalability is the unconstrained performance of a centralized server. For the reasons outlined in this report, we believe that the ZK-rollup app-chain design exemplified by Lighter is well positioned for achieving all three in its final state.

Acknowledgements: we thank Nick Forster, Ruslan (CEO of Extended), Art VanDelay, Dima Zakharov, YQ, Lakshman, Alex Nezlobin, Artem Kotelskiy and Rico Mueller for helpful discussions.