HFT Market-Maker Guide

This page is the front door for quote engines and HFT desks. It states what the venue is, what each lane measurably does, and what it does not do yet — so an integration decision can be made from this page alone. Everything below was verified on 2026-09-04 against production, the chain and the gateway sources; measured numbers come from an external market maker's live run.

The venue in one paragraph

Senticore is a single deterministic matching primary (no consensus round) in front of an on-chain vault on Arbitrum One. Every lane — HTTP, WebSocket, FIX 4.4, FIXP/SBE, BSL Direct TCP — terminates in-process on the same host at Hetzner Online in Germany (your-server.de); only api.sentico-labs.xyz sits behind Cloudflare, the three binary lanes are DNS-only TCP/TLS ports. Admission is sub-millisecond; the network round trip from Central Europe is about 30 ms. There is no colocation or proximity offering today.

Lanes: measured, not claimed

Lane	Client round trip (30 ms network)	Venue share	What the ack means	Auth	Cancel-on-disconnect
FIX 4.4 fix.sentico-labs.xyz:9878	29.2–29.8 ms order, 29.9–32.2 ms cancel	0.3–0.4 ms	PendingNew (150=A) / 150=4 in the ack; fills and terminal states on drop-copy	Session logon (HMAC credential)	per credential (cancelOnDisconnect)
FIXP/SBE fixp.sentico-labs.xyz:9879	31.0 ms order ack	~1 ms	Session ack in ~1 ms; engine applied at +66–190 ms; ExecutionReport delivered +4.7 s (open item)	Negotiate credentials, no per-order signing	per credential; kill-and-block 530=100
BSL HTTP /api/v1/bsl/orders/compact	p50 79 · p90 110 · p99 158 · max 7,339 ms	~49 ms at p50 (TLS, HMAC, signature verify)	Ingress-WAL ack with seqs[]; receipts p50 70 · max 14,880 ms	HMAC headers + per-action signature	none automatic — cancel-all
BSL Direct TCP bsl.sentico-labs.xyz:9001	handshake within network noise	not measurable	—	per-frame signature or session key	session-key policy
Signed HTTP /api/v1/trading/actions	edge path; 10 req/s per IP	—	SubmitResponse with seq	per-action signature	none

Two things to design around today

1. BSL Direct TCP rejects wallet-signed frames on production with GatewayReject 202 (the gateway's environment lacks the action-signing chain binding). Quote through FIXP, FIX or BSL HTTP until the connectivity bundle advertises the fix.
2. Report delivery lags engine apply by seconds on FIXP (2–5 s measured) and on the BSL receipt path (max 14.9 s). Admission is fast; confirmation is not. Hedge from drop-copy, never from a timer.

Recommended stack: FIXP/SBE for order entry (session auth, atomic MassQuoteRequest, iLink-3-class recovery) or FIX 4.4 if you already run an engine; market feed lines a + b for the book; private WebSocket orderUpdates + userFills or FIX drop-copy for fills; BSL HTTP for onboarding, funding checks and scoped recovery.

What an acknowledgement means

Boundary	Where you see it	Guarantee
Admission	FIX PendingNew, FIXP session ack, BSL ackMode: ingress_wal	Sequenced and written to the ingress WAL; not matched yet
Apply	FIXP transactTimeNs, BSL actionResults[] in full mode, engineTsMs	Engine executed the action; fills exist
Report	drop-copy / orderUpdates / userFills / FIXP ExecutionReport	Your view of the fill; today seconds after apply
Durable	BSL durable result mode, durableLsn	Persisted across a primary restart
Committed	checkpoint (/api/v1/protocol/settlement/epochs/latest), hourly	Anchored on-chain; withdrawal-eligible

Never treat admission as a fill and never resend on a timeout: an accepted action with an unknown outcome must be reconciled by seq, idempotency key or ClOrdID (FIXP businessRejectReason=7 is "terminal state pending", not a rejection).

Timestamps you can measure against

Lane	Field	Meaning
FIXP	transactTimeNs on ExecutionReport (schema ≥ v2)	Engine apply time, unix ns
BSL HTTP	bsl.timing.durationsUs.coreAck, x-mm-perf-* headers	Server-side stage timings per request
BSL full	engineTsMs, serverTsMs per action	Apply vs. response emit
FIX 4.4	TransactTime(60), SendingTime(52)	Gateway times, ms
WebSocket	ts on every frame, tsMs on feed heartbeats	Server send time, ms

The venue does not publish a clock-synchronisation guarantee; treat server timestamps as internally consistent, not as UTC-traceable.

Capacity and limits (live GET /api/v1/bsl/limits)

per account 4,000 actions/s · cancels 64,000/s (separate scope) · per API key 16,000/s · per market 64,000/s
low-latency batch ≤ 32 actions · batch ≤ 1,000 · timestamp skew ≤ 15 s
open orders 50,000 per account · 10,000 per account and market · 1,000 price levels per side and book (overflow prunes the worst level)

Cancels are free against the action budget and quote-replace charges only net-new legs. A FIXP MassQuoteRequest is charged per leg. Every accepted BSL response carries usedActions / remainingActions / resetInMs.

Pipelining

Each engine account has a 256-wide nonce window; any unused nonce inside it is accepted in any order, so up to 256 actions can be in flight without waiting for acks. Execution order is arrival order at the sequencer, not nonce order. Two processes on one account share one window — shard strategies across accounts or coordinate the counter. After a crash: bootstrap → cancel-all → AdvanceNonceFloor fence → resume. See Order Concurrency & Nonces.

Inventory and capital

• Spot asks reserve the base asset (WETH, WBTC, ARB, CKT, TCO); bids reserve USDC. Balances are per asset with no cross-collateral or margin — seven isolated ledgers per account.
• Outcome asks sell shares. Create them with Split (1 USDC → 1 YES + 1 NO, 1 bp mint fee at tier 0), dissolve with Merge, settle with Claim. There is no mint-on-fill: a two-sided outcome quote needs a complete-set inventory up front.
• Fees are charged in ppm of notional: tier 0 maker 200 ppm (2 bps), taker 350 ppm (3.5 bps); makers reach 0 at tier 4. Read your tier from the account bootstrap. See Fees.
• Deposits credit after 12 confirmations; withdrawals wait a 10-minute challenge window plus the next hourly checkpoint and an executor. Size working capital for that float.

Risk controls available today

Control	Where	Notes
Self-trade prevention	all lanes (stp_mode, FIX 7928)	cancel_taker default; cancel_maker, reject, skip_self
Post-only	HTTP, BSL, FIXP (TimeInForce=PostOnly)	not on FIX 4.4
Cancel-on-disconnect	FIX/FIXP credential flag, BSL session-key policy	HTTP and wallet-signed TCP have no automatic sweep
Kill-and-block	FIXP OrderMassCancelRequest 530=100, re-enable 530=101	Latched trading block enforced on FIX/FIXP admission
Scoped cancel-all	POST /api/v1/bsl/orders/cancel-all (account, market, book, side)	Recovery primitive; ack is not terminal
Halt signalling	reject 103 (halted) / 104 (ledger degraded), feed status frame, /api/v1/readiness	Not load: pause, do not back off and retry

Not available today: market-maker protection counters (volume / delta / percent within a window), portfolio margin, a sandbox or testnet, colocation, a published clock-sync guarantee.

Recovery playbook

Event	Do
Process crash	GET /accounts/{acct}/bootstrap?fresh=true → cancel-all scoped to your books → AdvanceNonceFloor → resume
Private stream gap / resume_required	Pause the account's quote loop; rebuild from /orders, /fills and /bsl/accounts/{acct}/executions?cursor=; resubscribe with fromSeq
Feed gap_fill	Book/BBO: accept the snapshot that follows; trades: backfill via REST sinceId
FIXP reconnect	Same sessionId, Negotiate the same account, Establish, RetransmitRequest; if the resume window (default 30 s) passed, OrderMassStatusRequest rebuilds open orders
FIX reconnect	Keep SenderCompID; ResendRequest for the gap; OrderMassStatusRequest (AF) for the open set
Reject 105 / 106	Reconnect; reconcile by idempotency key or gateway seq; never auto-replay the frame

Known gaps (as of 2026-09-04)

• FIXP/BSL report delivery seconds after engine apply.
• An accepted BSL response can omit order ids; derive child ids locally from the signed payload (deriveQuoteReplaceOrderIdHex).
• BSL Direct TCP wallet-signed frames rejected on production.
• GET /api/v1/accounts/{acct} can omit recently added assets; bootstrap is engine truth.
• No sandbox; conformance runs against production with real collateral.
• Legacy admin EOA still holds vault roles next to the timelock (see Addresses).

Go-live checklist

1. institutional_agent with HMAC credential; a second credential with only read + drop_copy for the drop-copy consumer.
2. Connectivity bundle cached; action-signing chain binding verified against the golden vectors.
3. Funded bootstrap: USDC plus base assets plus complete sets for every book.
4. One resting quote, one cancel, one replace per lane you will run; drop-copy shows all three.
5. Cancel-on-disconnect drill: kill the process, confirm the book is clean.
6. Crash drill: bootstrap → cancel-all → fence → resume inside your latency budget.
7. Feed lines a + b consumed with dedupe; a forced gap_fill handled.
8. Reject codes 103/104/105/106/202/203–205 mapped to strategy actions.

Next: Market Maker Start Here for the onboarding steps, Institutional Conformance Kit for the harness, Live Verified Beta for the measurement history.