GreenX

Exchange

Not a feature project.
A change of ownership
over the machine itself.

GreenX Exchange runs today on a rented SaaS platform. Tomorrow it is a fully self-developed system GreenX owns down to the last key, table, and deploy pipeline — executed without interrupting the business already running on it. Three planning principles govern the program, fixed now and enforced architecturally forever.

Retain the logic.
Replace the machine.
Never interrupt the business.

Renting an exchange was right when speed mattered most. It is the wrong steady state for a platform that intends to matter. Four arguments, and they compound — watch what ownership changes:

Nine domains. Three states.
Decided now.

The contract between phases. BUILT ships inside the 45-day window. RESERVED means the socket exists before the plug. PLANNED is roadmapped with explicit dependencies. Note the shape: on this program, the vault is BUILT and the engine is RESERVED — security before trading, made structural.

Everything to production standard —
except the one thing deferred on purpose.

The brief's own principle, taken seriously rather than apologetically: matching and live execution are Phase 2. What that discipline buys in 45 days:

Eight sockets,
installed before the plugs exist.

A rebuild that drops the business
is a failure. So it can't.

Parallel-track doctrine: the SaaS platform keeps serving users for the whole window; logic parity is signed off before improvement; data migration is a rehearsed, replayable event; and cutover proceeds by cohort with the old system as fallback. Watch a cohort move:

Every phase boundary is an activation,
not a construction site.

Money is a log.
Everything else is a view.

State_t = f( State_0, e_1, e_2, …, e_t )          // every posting strictly double-entry
Σ balances (trading + eco) + fees + treasury float  =  Σ deposits − Σ withdrawals

Every monetary state change — credit, transfer, eco movement, fee, withdrawal — is one sequenced journal event, debiting one account class and crediting another. Conservation is asserted continuously, not audited quarterly. Watch the journal breathe:

Three chains in.
One gradient down.
Approval back up.

The Phase-1 centerpiece, running live: TRON, Ethereum and BNB Chain feed reorg-safe scanners; the hot wallet fills toward the watermark W*, then sweeps to cold multisig. The only road back runs through machine risk checks and a 2-of-N approval gate.

// keys are governed, not kept
KMS envelope keys · role separation · scheduled rotation · single-call revocation
every control is cryptographic, double-entry, or dual-control
// no security property rests on one honest human

The moat is not a feature.
It's an accounting theorem.

Every movement between the exchange and a GreenX eco application posts as a paired journal — debit here, credit there — so conservation extends across the whole ecosystem. An eco app can never mint, strand, or double-spend platform assets without tripping the invariant. Try it yourself:

Σ exchange balances + Σ eco-app balances = Σ deposits − Σ withdrawals
// per asset · continuously asserted
adapter contract: per-app keys · transfer intents · idempotency · quotas · quarantine switch

Confirmations scale
with value at risk.

P(reorg ≥ k) ≈ (q/p)^k          k(V) = ⌈ log(ε/V) / log(q/p) ⌉
// per chain · per tier · never one magic number

Every request is scored
before it is routed.

S(w) = Σᵢ βᵢ·xᵢ(w)
xᵢ ∈ { amount/tier-limit · velocity(1h·24h·7d) · address novelty · device/geo drift · KYC tier }
route:   S < θ₁ → auto-approve
         θ₁ ≤ S < θ₂ → dual-approval review
         S ≥ θ₂ → block + alert

Hold enough to serve.
Not one coin more.

// hot-wallet watermark — a newsvendor bound on compromise exposure
// the same construction sizes each chain's gas float
W* = μ_out·T + z_ε·σ_out·√T
minimize  c_risk·E[hot] + c_fee·N_sweeps      s.t.  P(stockout) ≤ ε

And onboarding is a funnel whose product is conversion — every stage instrumented, vendor SLOs monitored, appeal a first-class state:

The Phase-2 engine is
already written.

// the matching core is already specified — GreenX DEX Perp Solution v0.1
// spot matching is a strict subset · it activates first
M/M/1 envelope:  ρ = λ/μ = 0.1  at  μ = 5×10⁵ ev/s, λ = 5×10⁴/s   ⇒   E[W] = 1/(μ−λ) ≈ 2.2 µs

What the system
will never permit.

Note what is different from a trading-first program: all six invariants are live on day one — because Phase 1's product is the money machine. The trading invariants arrive with their engine, tests already written.

The vault was designed before the first deposit exists.

The module map fixes what exists; the reservation doctrine fixes how it grows; the custody mathematics fixes what any incident can cost; the invariants fix what the system will never permit. Phase 2 requires only the turning of keys that Phase 1 installs.