Opening the dealing desk everyone hides

The fastest-growing DEX venues of 2026 don’t have LPs, don’t have public curves, and quote tighter than Binance at retail size. They did it by moving the entire market-making desk off-chain and leaving only a settlement stub on the chain. BTR’s AIMM starts from the same literature and makes the opposite cut: the desk stays on-chain, and the only thing pushed is a signed mark. Venue by venue, with the columns each design loses.

Where the wave came from

Every figure in this section for a competing venue is a third-party on-chain observation from public analytics, not a vendor-published spec. These venues are closed-source and do not publish their methods, so treat the numbers as indicative orders of magnitude rather than measurements we can reproduce. Our own numbers, where they appear, are reproducible from the repo.

The model is Solana’s, roughly eighteen months old. SolFi (Ellipsis Labs, launched late 2024), Obric v2 and then HumidiFi run proprietary quoting engines off-chain, hold their own inventory in program-owned vaults with no public LPs, and refresh on-chain prices continuously - HumidiFi at roughly 17 to 75 updates a second, SolFi around 13. The refresh is a 143-compute-unit transaction, three orders of magnitude cheaper than the swap that trades against it, so a modest Jito tip per compute unit buys what amounts to cancel priority ahead of any taker. Some of them refuse taker transactions under 100k CUs outright, because a transaction that small is shaped like a snipe.

It worked. Prop AMMs went from 7% of Solana DEX volume at SolFi’s launch to the point where, in September 2025, they out-traded traditional AMMs for the first month ever. HumidiFi alone cleared roughly $100B cumulative in under five months and peaked near half of all SOL-stable volume.

The structural insight underneath, which we wrote about before, is that an AMM that knows the off-chain price doesn’t pay LVR. The reserve-priced pool leaks to arbitrageurs by construction; the oracle-priced pool charges a spread instead of paying rent. That advantage is not Solana-specific. In May 2026 it ported to Ethereum.

The EVM wave, venue by venue

The enabler on Ethereum L1 is the block builder. Titan - building a majority of Ethereum blocks - ships a prop-AMM lane: a maker streams signed quote updates to the builder over WebSocket, and the builder guarantees the latest quote update lands in the block before any taker that trades against it. Makers are asked to requote within ~50ms; a quote idle for more than 400ms is evicted. A per-session freshness bound refuses takers whose transaction arrived too close behind the last quote. The live curve is, in effect, off-chain state: takers subscribe to a state-diff stream and simulate against it with eth_call state overrides, because on-chain storage only reflects a quote once taker flow forces its inclusion.

• FermiSwap is the volume leader of the wave - about $1.36B in the last 30 days and near $2B all-time per DefiLlama, on the order of 1% of Ethereum DEX volume - and it is fully dark: no docs, no site, an anonymous prop firm behind a Titan stream and a settlement contract.
• Kipseli replaces the builder stream with per-quote signatures: every quote is EIP-712-signed by a whitelisted maker key, valid for 10 seconds from its timestamp, fees quoted in 0.1bp units and settled monthly off-chain in an agreed currency. Verification is on-chain; price formation is not.
• Tempest (the Ethereum L1 venue, not the Sui protocol of the same name) is a whitelisted venue in the community router with ~$47M/30d, and otherwise undocumented.
• ElfomoFi (Base, BSC) quotes a “theoretical asset price from our internal trading team combined with on-chain signals”, refreshed every block, readable through getAmountOut view functions. Roughly $280M/30d, and - unusually for the category - it takes public vault capital.
• LunarBase (Base, BSC, Monad) is the most transparent of the group about its model: an operator pushes an anchorPrice (Q64.96 sqrt-price) plus directional feeBidX24/feeAskX24 fees, derived off-chain from a Pyth Hermes + CEX-median (Binance, Coinbase, OKX) mid, with Avellaneda-Stoikov inventory management in the operator’s engine and a claimed 250ms quote-tracking loop. Staleness is handled by refusal: one block of price age and the pool reverts with StalePrice().
• Rialto (Robinhood Chain, engine “Rivo Altus”) rebuilds an order book on-chain in Arbitrum Stylus, targets an oracle update every block, scores takers by priority fee - a taker paying aggressively to land ahead of the next update is probably picking off a stale quote - and can deplete levels, widen, or withhold depth within the same block. Its router ranks every venue net of network costs.

On pamm.wtf, which walks the venues’ executable quotes against the Binance book (including top-tier taker fees), recent $1k ETH/USDC clips show FermiSwap around 2.0bps round-trip and Kipseli around 2.3bps, against roughly 3.5bps for a Binance VIP9 account and ~10bps+ on Uniswap V3’s 5bp tier. At $100k USDC/USDT FermiSwap still prints ~1.6bps. At $100k ETH/USDC Binance wins again - prop-AMM depth is thin at size. A community router (LambdaClass) has pushed over $546M across 68k+ swaps through these venues.

Tight spreads, no LVR, real flow. The question is what you had to give up to get them.

What a prop AMM actually puts on-chain

Strip any venue above to its on-chain residue and you get the same short list: a settlement function, a signature or freshness check, and whatever numbers the operator last pushed. Everything that decides the price - the fair-value model, the inventory response, the spread policy, the concentration profile, the decision to pull quotes - runs on a desk you cannot see.

Four consequences follow:

• The quote is not reproducible. Given the chain’s public state, you cannot recompute what FermiSwap will fill you at; you simulate against a stream the operator chose to publish (and can whitelist). LunarBase publishes the most - anchor, fees, a punishment cap - but the derivation of those numbers is the operator’s.
• The curve can change between your read and your fill. That is the design intent: Titan’s ordering guarantee exists precisely so the maker’s newest quote beats your taker. Rialto widens and withholds depth in-block. You trade against a counterparty with a last look, formalised at the builder layer.
• There is no LP question because there are no LPs. The inventory is the firm’s. ElfomoFi excepted, you cannot be on the maker side of these venues, and where you can, the pricing of your exposure is not something you can audit.
• Portability is the infrastructure’s, not the contract’s. The L1 venues exist because one dominant builder offers quote-before-taker ordering. Kipseli’s signature scheme escapes that, at the cost of a 10-second quote validity window. Rialto needs its own chain’s cadence and Stylus.

On their own terms the venues are not doing anything wrong. It is a description of a trust surface: you trust the operator’s model, the operator’s keys, and (on L1) the builder’s ordering, and in exchange you get CEX-grade spreads at retail size.

Where BTR draws the line

Both designs push something signed across a boundary. The question is how much of the desk sits behind it. A prop AMM pushes the finished quote, so the model, the inventory policy and the spread all stay private. We push only the mark: the skew, the spread, the depth curve and the toll are public bytecode, and anyone can rerun them against the same inputs and get the same number.

A prop AMM pushes the finished quote and settles it. We push only the mark, and the quote is derived on chain from it.

BTR runs the same playbook from the literature - oracle-anchored fair value, Avellaneda-Stoikov inventory reservation, volatility-scaled spreads - but compiles the desk into the pool. The keeper pushes exactly three numbers per feed: a mark, a σ (short-horizon volatility), and a confidence interval, EIP-712-signed by a k-of-n quorum into a packed push oracle. Every other quantity in the quote is derived on-chain, from public state, by code you can read:

• The mid is not pushed - it’s the mark plus an inventory reservation shift. Each leg’s coverage ratio (reserves over liabilities) maps through a fixed piecewise-linear law to a skew in [−100, +100], and the skew displaces the evaluation point on the liquidity curve. Price improves for flow that rebalances the book, worsens for flow that leans on it. The saturation band is a compile-time constant, not a parameter: no admin write can reprice a leg out from under its LPs.
• The spread is not pushed - it’s computed from σ, confidence, and age. The quoted spread is a per-asset floor plus a σ-proportional term (a per-asset vega dial), plus the feed’s confidence interval, plus a staleness premium that grows as σ·√(age beyond a short grace). Multi-leg paths compose these: σ in quadrature, fees and premia summed, never a max. All terms and their derivation are published.
• The shape is not pushed - it’s a quartic density preset. Concentration comes from on-chain non-uniform quartic B-spline curves that legs point into; live volatility y-scales the fitted shape (quiet tape quotes the per-asset floor, a vol spike widens it), and the swap integrates the curve analytically for an exact VWAP. Curve refits go through a public queue, not a stream.
• Depletion is priced, not managed. A prop desk protects its inventory by pulling quotes and rebalancing on a CEX. An open-LP pool can’t. Instead, a convex coverage toll (κ-weighted, from the same Q(c) = ln c − c + 1 family as the coverage wall) charges any fill that pushes a leg’s coverage below peg for the deficit it creates, scaled by the pool’s κ, and blocks a full drain outright. Charge-only: restoring trades pay nothing.
• Staleness is priced first, refused second. Inside a ~30s grace, nothing. Beyond it, the σ√τ premium widens the quote continuously - a late keeper degrades gracefully instead of being picked off at a cliff - until the feed’s TTL fails the read closed. LunarBase’s one-block refusal is the other reasonable answer; ours trades a wider stale quote for uptime, theirs trades uptime for a hard edge.

The oracle side has its own defenses that don’t depend on the keeper being honest about anything except the mark’s authenticity: per-push deviation bands reject a jump beyond a per-feed bound (a legitimate gap move must be laddered), a σ floor at the realised move stops a signer from collapsing the spread with σ=0, a monotonic attested source clock makes a withheld blob price its own staleness rather than being restamped fresh, and every settled path runs a reference-band breaker against a second feed, plus a guardian that can freeze a feed - tighten-only at runtime, never loosen.

The net effect: any observer can recompute the exact quote from public chain state. The mid, the spread, every premium and the toll are deterministic functions of stored values and pushed values, and the pushed values are signed, banded, and timestamped. There is no state the operator sees that you don’t. That is the whole difference.

The comparison

The trade-offs we chose

Four places where a prop AMM’s numbers look better on a spec sheet. Each is a choice, and each buys something we wanted more.

We requote on movement, not on a clock. Rialto targets an update per block, LunarBase claims 250ms, Titan makers requote in 50ms. We push on deviation and heartbeat, gated by measured volatility, because most of what a per-block requote achieves happens on chain here without a push at all: inventory skew moves our mid between pushes. A fill shifts the book, the quote leans against it in the same transaction, and no keeper had to notice. A prop AMM has to push a new quote to express the same thing, which is why its cadence has to be that high. Ours pays gas only when the market has actually moved past a threshold we set, and the venue stays quotable the entire time: always on, and it does not revert on you because a quote expired mid-flight.

We pick chains where blocks are already fast. A desk can pull a quote the instant it smells toxic flow, and inside one block we cannot. So we deploy where the block time makes that window small in the first place, which is the structural fix rather than a reflex arms race we would lose. Inside the block we are not static either: the skew updates intra-block, so the second fill of a block already prices against the inventory the first one left. For chains where block time is the constraint rather than the solution, Ethereum being the obvious one, builder-integrated ordering of the kind Titan offers is a road we have not closed.

The risk surface retunes continuously; the shape does not. A risk steward can move an asset’s fee floor, vega and haircut suppressor in real time, with no timelock, bounded per step by a fence the owner sets. That is the surface that responds to a regime change, and it is deliberately not on a queue: adaptivity is the point. What does queue is the depth curve and the density profile, at one hour, on every chain including mainnet, because swapping a curve reprices the whole book at once where a vega nudge moves the spread by a bounded step. An hour is the floor the timelock will arm at, not a compromise. A new custom preset and the repoint onto it are two separate queued ops keyed differently, so they run in parallel rather than in series: a shape that does not exist yet is live on an asset an hour after you ask for it. Against LunarBase’s continuous operator retuning that is parity on the parameters that price risk, and one hour on the shape they price it on.

Our spreads are derived, and about to be public at size. FermiSwap’s 2bps at $1k and 1.6bps at $100k stable clips are measured on a public dashboard against a live Binance book, and that is the right bar. Our spread model produces comparable numbers from measured density and published parameters, and every term in it is on chain and recomputable today. Mainnet is where that stops being a model and starts being a tape, and we would rather be measured on it than argue about it.

Two columns are not theirs at all. Both designs eliminate the stale-reserve leak, so LVR is not a differentiator between us. Verifiability is, and it is not a column a prop AMM can win: it could publish receipts, but it cannot publish reproducibility without publishing the desk.

Where RFQ and intents sit

A third design answers the same question by removing the venue’s quote entirely. In an RFQ or intent system, a taker states what they want, solvers or market makers compete off chain, and the winner settles on chain. CoW Protocol, UniswapX and 1inch Fusion all work this way. It is a good design and it beats a passive AMM on exactly the axis this article is about: the price comes from someone who is actively pricing, not from reserves.

What it does not give you is a quote you can get without asking.

• Latency to a price. An RFQ has a round trip in it. A pool has a function call. For a router pathing across ten venues in one simulation, that difference decides whether you are in the route at all.
• Composability. A contract cannot wait for a solver auction inside its own transaction. Anything that has to price atomically, a liquidation, a leveraged position unwind, another protocol quoting off you, needs a venue that answers synchronously.
• Who bears the no-fill. An intent that finds no solver simply does not execute. That is a fine outcome for a discretionary swap and a bad one for a liquidation engine.
• What is auditable. The winning solver’s price is observable after the fact. The function that produced it is not, which is the same boundary a prop AMM draws, moved one step further out.

These are complements rather than competitors: solvers route into pools, and a pool that quotes tightly and never refuses is a good place for them to land. We are one of the venues an intent system should be able to fill against, which is a reason to be synchronous, cheap to simulate, and honest about the quote before anyone commits to it.

The actual disagreement

The prop AMMs and the AIMM agree on nearly everything that matters technically: reserves are a terrible price source, the mid must track an external mark, inventory must shift the quote, volatility must widen it, and staleness is the attack surface. The disagreement is a single design bit: is the pricing function a secret or a contract?

Their answer buys milliseconds and a desk’s discretion, and costs you a counterparty you must trust and a maker side you cannot join. Our answer costs seconds and discretion, and buys a quote that anyone can recompute, an operator who cannot silently change the curve between your read and your fill, and an LP side open to a single-asset deposit with no rebalancing - with the IL protection priced into the toll instead of promised in an APR.

Both beat reserve-priced AMMs. One of them is still one.

BTR is live on Arc testnet - contracts deployed, keeper pushing marks, pools open. The pricing law above is not a roadmap; it is the deployed code, and the quote you get is the one you can recompute.

Break it if you can.

• The AIMM in detail
• Spread fees, derived
• The push oracle, on chain
• Prop AMMs in Foundations