25 tokenized equity markets
Every print,
settled onchain.
Ponstocks is a trading venue for tokenized shares. Exchange depth and prints on the screen, a matching engine with price-time priority behind it, and custody in a vault only you can withdraw from.
- Matching
- Price-time priority
- Fees
- 6 / 10 bps maker-taker
- Settlement
- EIP-712, onchain
Token
$PONSTOCKS
Contract address
25
Listed markets
Equities and index ETFs
6 / 10
Maker / taker bps
Capped at 100 bps in the contract
18
Share contracts onchain
Each verified against a node
EIP-712
Order authorisation
Signed in your own wallet
How a trade works
Three steps, and you can audit every one of them
- 01
Deposit into the vault
Approve the exact amount, never an unlimited allowance, then deposit. The vault tracks what is available and what is locked against working orders, separately. No administrator can reach a customer balance, and withdrawals cannot be paused.
TradingVault.deposit() - 02
Sign the order
Orders are EIP-712 typed data signed in your wallet: market, side, price, quantity, nonce, expiry. Signing authorises that order and nothing else. The engine matches with strict price-time priority and integer arithmetic.
Order(address maker, bytes32 marketId, …) - 03
Settle onchain
Fills are batched, checked against the oracle for staleness and deviation, then settled into the vault. Settlement status is tracked apart from order status, so a filled order whose transaction is still pending is reported as exactly that.
OrderSettlement.batchSettle()
Custody
Where the money sits, and who can move it
A venue is trusted for what it cannot do as much as for what it can. These four properties are enforced by the contract, not by policy.
Balances are earned, never granted
The ledger opens empty. An account is credited only by a deposit that has been read back off the chain, so every figure on a statement traces to a transaction.
No administrator path to customer funds
The vault has no drain function. An operator can pause a market and grant roles; it cannot move a balance to itself. A test asserts this by inspecting the compiled ABI.
Withdrawals cannot be halted
Trading pauses; withdrawals do not. A venue that can freeze the exit is a venue that can trap capital, so that switch was never built.
Execution you can reconstruct
Every fill carries its price, size, fee, role and venue. Settlement status is separate from order status, and reconciliation replays receipts after any restart.
Architecture
What is under the terminal
Six workspaces: the web terminal, an API, a matching engine, a router, shared domain types and the contracts. No mock stands in for a component a venue would need.
- Matching
- Deterministic CLOB, price-time priority, integer arithmetic, atomic FOK, self-trade prevention
- Order types
- Market, limit, stop-market and stop-limit, with GTC, IOC, FOK, post-only and slippage caps
- Routing
- Best execution across the internal book and external quote sources, gas- and fee-aware
- Custody
- Available and locked held apart, no administrator drain path, withdrawals never pausable
- Settlement
- EIP-712 orders, batched, tracked from pending through confirmed, reconciled after a restart
- Guards
- Oracle staleness and deviation, per-market circuit breaker, replay and overfill protection
- Market data
- Provider prices and OHLCV, Cboe BZX depth and prints, this venue’s own book and fills
25 markets · 18 contracts onchain