HFT Market-Maker Guide

This page is the front door for quote engines and HFT desks. It states what the venue is, what each lane measurably does, and what it does not do yet — so an integration can distinguish protocol guarantees from observations. The latency table is one external market maker's measurement from 2026-09-13 (client in Vienna, 29.5 ms network round trip to the venue). It is not a benchmark, capacity guarantee or SLA; measure your own path before sizing. Those round trips are distance plus processing, and at that distance the distance dominates — see the Colocation Latency Benchmark for the two terms measured separately.

The venue in one paragraph

September 12 feature update: the Core-owned Dead Man Switch is configured for opted-in delegated HTTP and BSL SessionKey orders. A bounded live BSL Spot expiry canary passed after the September 12 API/WS replay correction. This does not replace the dated latency measurements below or establish a production cancellation SLA.

Senticore is a single deterministic matching primary (no consensus round) in front of an on-chain vault on Arbitrum One. Every lane — HTTP, WebSocket, FIX 4.4, FIXP/SBE, BSL Direct TCP — uses a protocol/API adapter and a shared Core at Hetzner Online in Germany (your-server.de); only api.sentico-labs.xyz sits behind Cloudflare, the three binary lanes are DNS-only TCP/TLS ports. Do not infer current sub-millisecond admission from an old client RTT or by subtracting an estimated network RTT. Measure each boundary at the intended load, session count and deployment.

From inside the same facility the network term collapses: TCP connection establishment is 0.44 ms to FIX, 0.47 ms to FIXP and 0.48 ms to BSL Direct TCP, against 21.67 ms to the CDN-fronted api. name. Market data over the direct route arrives at 1.80 ms p50 against 8.55 ms via the CDN. Those figures, their clock discipline and their limits are in the Colocation Latency Benchmark. A FIX 4.4 order acknowledgement measured from inside the facility on 2026-09-21 took 6.22 ms p50 and 183.78 ms p99, with the network contributing 0.44 ms — the venue's own processing, not distance, dominates.

Lane measurements (2026-09-13, one client, 29.5 ms network RTT)

Lane	Client round trip	What the ack means	Auth	Cancel-on-disconnect
FIX 4.4 fix.sentico-labs.xyz:9878	29.9 ms order ack, 29.7 ms cancel ack	PendingNew (150=A) / 150=4 in the ack; fills and terminal states on drop-copy	Session logon (HMAC credential)	per credential (cancelOnDisconnect)
FIXP/SBE fixp.sentico-labs.xyz:9879	35–40 ms order ack; ExecutionReport New 10–22 ms and Canceled 90–130 ms after send; mass-status median 38 ms	Session ack, then per-order ExecutionReport with transactTimeNs	Negotiate credentials, no per-order signing	per credential; kill-and-block 530=100
BSL Direct TCP bsl.sentico-labs.xyz:9001	CoreAck p50 30–38 ms with Ed25519 session keys	Sequenced CoreAck; reports on the same connection (kind 26) or drop-copy	Session key (AuthSidecarV2); wallet-signed V1 frames are 202 accepted-not-applied	session-key policy, plus opt-in DMS
BSL HTTPS /api/v1/bsl/orders/compact	p50 ~74 ms	Ingress-WAL ack with seqs[]	HMAC headers + per-action signature	none automatic — cancel-all
Signed HTTP /api/v1/trading/actions	edge path; 10 req/s per IP	SubmitResponse with seq	per-action signature	none

One client's numbers, not a contract

These are single-client measurements from one location on one day. Gate each lane on real command, terminal and replay evidence for your own account. Never infer a fill from admission, a HELLO ACK, a timer, or /status returning 200.

Recommended stack: FIXP/SBE for order entry (session auth, atomic MassQuoteRequest, explicit retransmission/recovery), BSL Direct TCP with session keys for the native frame path, or FIX 4.4 if you already run an engine; market feed lines a + b for the book; private WebSocket orderUpdates + userFills or FIX drop-copy for fills; BSL HTTP for onboarding, funding checks and scoped recovery.

What an acknowledgement means

Boundary	Where you see it	Guarantee
Admission	FIX PendingNew, FIXP session ack, BSL ackMode: ingress_wal	Sequenced and written to the ingress WAL; not matched yet
Apply	FIXP transactTimeNs, BSL actionResults[] in full mode, engineTsMs	Engine executed the action; fills exist
Report	drop-copy / orderUpdates / userFills / FIXP ExecutionReport	Client-visible outcome; measure apply-to-report independently from admission
Durable	BSL durable result mode, durableLsn	Persisted across a primary restart
Committed	finalized checkpoint (/api/v1/protocol/settlement/epochs/latest)	Anchored on-chain; a withdrawal additionally needs its matching valid proof and contract eligibility

Never treat admission as a fill and never resend on a timeout: an accepted action with an unknown outcome must be reconciled by seq, idempotency key or ClOrdID (FIXP businessRejectReason=7 is "terminal state pending", not a rejection).

Timestamps you can measure against

Lane	Field	Meaning
FIXP	transactTimeNs on ExecutionReport (schema ≥ v2)	Engine apply time, unix ns
BSL HTTP	bsl.timing.durationsUs.coreAck, x-mm-perf-* headers	Server-side stage timings per request
BSL full	engineTsMs, serverTsMs per action	Apply vs. response emit
FIX 4.4	TransactTime(60), SendingTime(52)	Gateway times, ms
WebSocket	ts on every frame, tsMs on feed heartbeats	Server send time, ms

The venue does not publish a clock-synchronisation guarantee; treat server timestamps as internally consistent, not as UTC-traceable.

Capacity and limits (live GET /api/v1/bsl/limits)

The following is a historical configured envelope, not measured sustained capacity. Read current limits and benchmark accepted/terminal throughput, queue age and drain separately. A 4,000-actions/s limit does not prove 4,000 terminal results/s at a specified latency.

per account 4,000 actions/s · cancels 64,000/s (separate scope) · per API key 16,000/s · per market 64,000/s
low-latency batch ≤ 32 actions · batch ≤ 1,000 · timestamp skew ≤ 15 s
open orders 50,000 per account · 10,000 per account and market · 1,000 price levels per side and book (overflow prunes the worst level)

Cancels are free against the action budget and quote-replace charges only net-new legs. A FIXP MassQuoteRequest is charged per leg. Every accepted BSL response carries usedActions / remainingActions / resetInMs.

Pipelining

Each engine account has a 256-wide nonce window; any unused nonce inside it is accepted in any order, so up to 256 actions can be in flight without waiting for acks. Execution order is arrival order at the sequencer, not nonce order. Two processes on one account share one window — shard strategies across accounts or coordinate the counter. After a crash: bootstrap → cancel-all → AdvanceNonceFloor fence → resume. See Order Concurrency & Nonces.

Inventory and capital

• Spot asks reserve the base asset (WETH, WBTC, ARB, CKT, TCO, FYT); bids reserve USDC. Balances are per asset with no cross-collateral or margin — one isolated ledger per registered asset. An ask above free inventory drops the action it travels in — for a QuoteReplace that is every leg of it, bids included (batch atomicity).
• Outcome asks sell shares. Create them with Split (1 USDC → 1 YES + 1 NO, 1 bp mint fee at tier 0), dissolve with Merge, settle with Claim. There is no mint-on-fill: a two-sided outcome quote needs a complete-set inventory up front.
• Fees (live tier 0 schedule): spot maker 0 ppm, spot taker 800 ppm (8 bps), mint/redeem 100 ppm, prediction 40 000 ppm applied to p(1-p). Read feeSchedule on GET /api/v1/accounts/{account} for your tier; the earlier 200/350 ppm values are obsolete. See Fees and Liquidity Incentives.
• Funding: confirmation policy, finalized settlement epoch, claim proof, expiry and contract conditions determine availability. An hourly checkpoint or fixed withdrawal delay is not guaranteed by this guide. Reconcile funding status rather than repeatedly submitting an uncertain withdrawal.

Risk controls available today

Control	Where	Notes
Self-trade prevention	all lanes (stp_mode, FIX 7928)	cancel_taker default; cancel_maker, reject, skip_self
Post-only	HTTP, BSL, FIXP (TimeInForce=PostOnly)	not on FIX 4.4
Cancel-on-disconnect	FIX/FIXP credential flag, BSL session-key policy	HTTP and wallet-signed TCP have no automatic sweep
Kill-and-block	FIXP OrderMassCancelRequest 530=100, re-enable 530=101	Latched trading block enforced on FIX/FIXP admission
Scoped cancel-all	POST /api/v1/bsl/orders/cancel-all (account, market, book, side)	Recovery primitive; ack is not terminal
Halt signalling	reject 103 (halted) / 104 (ledger degraded), feed status frame, /api/v1/readiness	Not load: pause, do not back off and retry

Not available today: market-maker protection counters (volume / delta / percent within a window), portfolio margin, colocation, a published clock-sync guarantee.

A full off-chain sandbox (launching — see Status) with the same API, the same five lanes on the same ports and mock USDC from a faucet is the place to rehearse these controls before you point a quote engine at production.

Recovery playbook

Event	Do
Process crash	GET /accounts/{acct}/bootstrap?fresh=true → cancel-all scoped to your books → AdvanceNonceFloor → resume
Private stream gap / resume_required	Pause the account's quote loop; rebuild from /orders, /fills and /bsl/accounts/{acct}/executions?cursor=; resubscribe with fromSeq
Feed gap_fill	Book/BBO: accept the snapshot that follows; trades: backfill via REST sinceId
FIXP reconnect	Same sessionId, Negotiate the same account, Establish, RetransmitRequest; if the resume window (default 30 s) passed, OrderMassStatusRequest rebuilds open orders
FIX reconnect	Keep SenderCompID; ResendRequest for the gap; OrderMassStatusRequest (AF) for the open set
Reject 105 / 106	Reconnect; reconcile by idempotency key or gateway seq; never auto-replay the frame

Known gaps (as of 2026-09-13)

This list is not a health dashboard. A healthy discovery/status endpoint does not establish that every protocol adapter is accepting commands; read tradingHalted and expectedReopenMs on GET /api/v1/status and gate on your own lane evidence.

• BSL Direct TCP wallet-signed (AuthSidecarV1) frames are acknowledged 202 but not applied; use Ed25519 session keys.
• A session-key policy without cancel in allowedActions cannot arm the DMS (DMS_AUTH_REJECTED).
• Atomicity is per action: one unfunded ask, over-cap price or below-minimum leg rolls back the whole QuoteReplace it belongs to, bids included. Other actions in the same request are applied or dropped on their own. Put bids and asks in separate actions if one side can fail.
• An accepted BSL response can omit order ids; derive child ids locally from the signed payload (deriveQuoteReplaceOrderIdHex).
• GET /api/v1/accounts/{acct} can omit recently added assets; bootstrap is engine truth.
• Engine credit for a vault deposit arrives about 15–20 minutes after the on-chain transaction; deposits credit msg.sender only.
• Conformance belongs in the sandbox (launching — see Status) first: identical API and lanes, mock USDC, no collateral at risk. Production runs remain real-collateral and should be sized accordingly.
• Legacy admin EOA still holds vault roles next to the timelock (see Addresses).

Go-live checklist

1. institutional_agent with HMAC credential; a second credential with only read + drop_copy for the drop-copy consumer.
2. Connectivity bundle cached; action-signing chain binding verified against the golden vectors.
3. Funded bootstrap: USDC plus base assets plus complete sets for every book.
4. One resting quote, one cancel, one replace per lane you will run; drop-copy shows all three.
5. Cancel-on-disconnect drill: kill the process, confirm the book is clean.
6. Crash drill: bootstrap → cancel-all → fence → resume inside your latency budget.
7. Feed lines a + b consumed with dedupe; a forced gap_fill handled.
8. Reject codes 100/103/104/105/106/108/202/203–205 mapped to strategy actions.

Next: Market Maker Start Here for the onboarding steps, Institutional Conformance Kit for the harness, Live Verified Beta for the measurement history.