16 · Matching: how an order finds its maker

Matching: how an order finds its maker

Every order on the venue, or every piece of it, is matched by one rule. The venue asks every connected maker for a firm price on that exact option and size. Only quotes that are signed, fresh, for exactly that size and inside the price limit around the oracle venue's bid and ask can win. Of those, the best price for you wins and the whole size goes to that one maker, at the maker's own signed price. If several makers are tied on the best price, one is drawn at random, and each tied maker's chance is its share of the tied makers' room, so over many trades tied makers share the fills in proportion to their size. If nobody can take the whole size, the order is refused by name and nothing moves. The contract checks the signature, the price limit, the room and your slippage limit on every fill. A model of this rule is proved in Lean (see the end of this page).

The rule, step by step#

The steps are in the order the venue and the contract apply them.

Who is asked. The venue sends the request to every connected maker's quoting program at once: the asset, call or put, strike, duration, side and size. A maker sees what is asked, never who asks. A maker has a short window to answer (500 ms by default) or may pass. A late or missing answer is no quote.
What makes a quote count. A quote is a candidate only if every one of these holds. The venue tests them in this order and stops at the first that fails:
It is signed by the maker's registered signer, and that signer is authorised for the maker account named in the quote.
It is for exactly this option and exactly the size asked. A quote for a different size does not count, so a maker cannot inflate its chance by quoting more.
It is open to you: a quote reserved for one taker counts only for that taker.
It has a price above zero.
It has not expired (it must stay firm at least 2 seconds past the moment it is checked) and its nonce is unused (each nonce is single use per maker account, so a quote cannot be replayed).
It is inside the price limit. With h = half the oracle venue's bid–ask spread for that option:
an ask (the maker sells, you buy) counts if oracle bid ≤ ask ≤ oracle ask + h;
a bid (the maker buys, you sell) counts if oracle bid − h ≤ bid ≤ oracle ask.

The at-intrinsic rule (ruling 1060): a quote within one micro-dollar of the option's intrinsic value skips these limits only where intrinsic value sits above the limit's upper edge (the oracle's own side is below intrinsic, so intrinsic is the sensible floor). Everywhere else a quote at intrinsic must pass the price limit like any other.

The maker has room for the whole size. Room is what the maker's caps, deposit and margin allow right now.
It is not from your own wallet. A quote from any maker account owned by the wallet that is asking is never a candidate (self-fill is excluded on testnet and mainnet).

The contract repeats the signature, the price limit and the room check when the fill lands. The venue's list is only a first pass.

How the winner is chosen. Among the candidates, the winner is the maker with the best price for you: the lowest ask for a buy, the highest bid for a sell.
If one maker has the best price, it wins.
If several are tied on the best price, the venue draws one at random, weighted by room: a maker with twice the room has twice the chance. A tied maker with no cap counts as unlimited; if any are unlimited, those share the draw equally.
The fill goes whole to that one maker. It is never split across makers, and there is no averaging of prices.
The fill price is the winner's own signed price. There is no crossing breaker: if one maker's bid is above another's ask, that is the makers' risk, and the price limit caps what a round trip across them can gain at about the oracle venue's spread.
Your slippage limit is measured against the oracle venue's side: its ask when you buy, its bid when you sell. The contract refuses a fill priced past your limit, and nothing moves.
When nobody qualifies, the order is refused by name and nothing moves:
no_quote: no maker gave a quote that counts. Each refused quote is recorded with its reason (for example no_room, expired, nonce_reused).
no_single_maker (NoSingleMaker(qty, maxRoom) on chain): some makers quote, but none has room for the whole size. The reply carries the largest room, maxRoom.

With Slice order, the venue then sends smaller pieces, each matched on its own (see Execution programs). Without it, offer maxRoom or a smaller size.

A worked example#

You buy 2 BTC of a 3-month call. The oracle venue shows bid $1,000 and ask $1,040 for it, so h = $20 and an ask counts between $1,000 and $1,060. Prices are per coin.

Maker	Ask	Room	What happens
A	$1,020	2 BTC	Counts. Best price.
B	$1,020	6 BTC	Counts. Best price, tied with A.
C	$1,035	10 BTC	Counts, but a worse price than A and B. Loses.
D	$1,070	20 BTC	Outside the price limit ($1,060 is the top). Does not count.
E	$1,015	1 BTC	Best ask, but room for only 1 BTC of the 2. Does not count.

A and B are tied at $1,020. Their rooms are 2 and 6, so A wins with chance 2 ÷ 8 = 25 % and B with chance 6 ÷ 8 = 75 %. Say B is drawn: you buy all 2 BTC from B at $1,020, below the oracle ask of $1,040. Run the same order many times and B takes about three fills in four, A about one in four. C, D and E never win this order. If A and B were both gone, C would win at $1,035. If only E and D were quoting, you would get no_quote or no_single_maker.

Special cases#

Closing. A close settles against the writer of record of the leg, the maker that wrote your option, at the best closing price from any maker. The writer takes the other side at that price, and a fill still never splits.
A Protect swap. The swap, or each slice of it, is one package with both legs, quoted and filled by one maker, atomically. Makers quote the package, the lowest net cost for you wins, and equal packages are drawn by room as above.
Slice order and Flex strike/duration. These choose which requests to send, and when. Every request they send is matched by the rule on this page, and nothing about them changes how a request is matched or priced. See Execution programs.
TLPs. Every TLP quotes the oracle venue's own bid and ask, so TLPs are normally tied with one another and with other makers at that price. A tie is drawn by room, so a TLP's expected share of the fills is its room over the tied makers' room (with rooms of 250 and 3,000, the smaller TLP gets about one fill in thirteen, not none). See Earn.

Who enforces what#

Step	Who
Asking the makers, collecting the quotes, the first pass over the checks, the draw among tied makers	The venue server
The maker's signature, the price limit, the room, your slippage limit, all-or-nothing fills, margin	The contract on chain

The chain does not run the draw. It takes the quotes it is given and fills the best admitted price with room for the whole size; among equal prices it keeps the first one it holds, and the venue puts the drawn maker first. So what the contract enforces is the price, and what the venue controls is which tied maker is placed first.

What a maker can gain. A maker wins only by quoting a better price than the others, or by tying and winning the draw. Its price is always its own signed price, and it must sit inside the price limit. A quote far off the oracle venue never fills, so one fat-finger quote cannot cost a taker or a writer more than the limit allows. A crossing between two makers gains a trader at most about the oracle spread.

What a maker cannot do. Win with a quote for a different size, quote a price outside the limit, be filled past its room, reuse a nonce, or fill against its own wallet.

What the contract does not check. That the venue drew fairly among tied makers. The draw is the venue's, and the weighting is published here. The tie rule can be checked from the fills over time (see below).

What is proved#

The core matching rule is written as a Lean model, lean/core/MATCHING_V1.lean, and the nine statements below are proved in it. The proofs were built locally with Lean 4.28 and checked by the Lean kernel (lean/core/runs/MATCHING_V1/). They are conditional on the inputs as given: the oracle's two sides, the intrinsic value, the quotes after their signatures were verified, and each maker's room.

Statement	What it says	Status
K1 `admit_iff_price_limit`	A quote is admitted exactly when it is above zero and inside the price limit, or at intrinsic where intrinsic is above the limit's upper edge.	proved (model)
K1b `admit_iff_in_limit_when_intrinsic_not_above`	Where intrinsic is not above that edge, admitted means inside the price limit, with no exception.	proved (model)
K2 `winner_is_best_admitted`	The winner is a real, admitted quote of a maker other than the taker whose size and room cover the whole order, and no other such quote has a strictly better price.	proved (model)
K3a `winner_price_equals_best_eligible_price`	The winner's price equals the best eligible price. Among tied quotes the contract prefers none (the venue draws).	proved (model)
K3b `price_and_refusal_independent_of_arrival_order`	The price, and a refusal, are the same whatever order the quotes arrive in. Only the winner among tied quotes can differ.	proved (model)
K4 `fill_at_winners_own_price_within_limit`	The fill is the whole order at the winner's own price, and that price is within the slippage bound: a buy pays at most oracle ask + h, a sell gets at least oracle bid − h (except the at-intrinsic case above).	proved (model)
K5 `no_eligible_maker_means_refusal`	A fill happens exactly when some admitted maker has room for the whole order. Otherwise the order is refused (`NoSingleMaker` or nobody quoting), never partly filled.	proved (model)
K6 `cross_maker_round_trip_gain_bounded`	Buying from one maker and selling to another at unchanged oracle inputs gains at most the oracle spread when both quotes are inside the price limit.	proved (model)
F1 (the at-intrinsic finding)	The finding that an at-intrinsic quote skipped the limit however far off it was. Fixed by ruling 1060: the exception now applies only above the limit's upper edge.	proved (model)

What this does not say. This is a model of the contract's matching rule, written from the Solidity and tied to the code by checks. It is not a verification of the deployed bytecode. It does not cover the oracle's own correctness, whether a maker's price is good, the signature scheme, the execution programs (Slice, Flex, the Protect solver and TLP allocation only choose which requests are sent), or the venue's random draw among tied makers. The money rules have their own model; see Risks & security. The proofs here were built locally and not by the external prover that built the money model's.

Check it yourself. The files are in the repository: lean/core/MATCHING_V1.lean (the statements), lean/core/runs/MATCHING_V1/ (the local proofs and how to compile them), and the price-limit rule in contracts/src/FrontMath.sol (_admit, _pick). These checks pin the code to the rule, and anyone with the repository can run them:

node checks/admit_intrinsic_1060_check.mjs: every copy of the price-limit test agrees with the contract's rule, including the at-intrinsic case.
node checks/truer_rfq_check.mjs: the engine's single-best-maker choice against the contract's own test vectors on thousands of boards.
node checks/tied_draw_1066_check.mjs: over 10,000 seeded draws, each tied maker's share matches its share of the room.

On the public reads you can also check a fill: GET /chain/fills and GET /chain/quote show the price you got against the oracle venue's side. See Verify it yourself.

Kept in lockstep with the code: a check fails if this page drifts.