BULK Exchange Architecture: The Complete Technical Breakdown

BULK Exchange is built as an L0 execution layer running natively alongside Solana. It uses a custom consensus mechanism (BULKBFT), a deterministic matching engine, a portfolio margin risk system, and Solana as the settlement layer. This article is the complete technical reference.

All claims in this article are sourced from the BULK Exchange architecture documentation.

The Four-Layer Architecture

Layer 4: Solana Settlement
  ↑ Deposits, Withdrawals, FROST threshold signatures
  
Layer 3: Executor
  ↑ Matching Engine + Risk Engine
  
Layer 2: BULKBFT Consensus
  ↑ CommittedBatch — canonical transaction ordering
  
Layer 1: BULK Net Transport
  ↑ Noise Protocol + AEGIS-128L encryption

Each layer serves a distinct function. The I/O separation is explicit: the core deterministic logic (consensus, matching, risk) is in pure protocol crates with no network calls, no disk I/O, and no Solana dependencies. The I/O layers wrap these crates. This makes the core logic independently auditable and testable.

Layer 1: BULK Net Transport

What it is: The networking layer connecting BULK validators.

Protocol: Noise Protocol framework with AEGIS-128L encryption. Ed25519 keys inherited from Solana validator identity.

Validator connectivity: Each BULK validator runs a bulk-agave binary alongside their standard Agave/Solana validator on the same machine. The two processes share identity keys and stake weights. They communicate via local IPC.

Current validator set: 20+ independent validators representing ~5% of Solana’s total stake. These validators were active Solana validators first — they inherited economic security without needing a new staking round.

Layer 2: BULKBFT Consensus

The Core Design Choice: Leaderless BFT

Every competing perp DEX architecture assigns a leader per round who proposes the block. The leader sees transactions first. The leader can reorder them. This is a structural front-running opportunity that cannot be designed away within a leader-based system.

BULKBFT has no leader. All validators participate equally in every consensus round. The canonical transaction set — the CommittedBatch — is determined by the intersection of pending transaction sets across >2/3 of the validator stake weight.

How a Round Works

Step 1: Transaction propagation A user submits an order via HTTP or WebSocket. The order propagates to all validators using the minisketch reconciliation protocol.

Step 2: Batch preparation Each validator prepares its own candidate batch from its pending transaction set.

Step 3: Consensus Validators exchange compact sketches (not full transaction data — only the differences). The fast path achieves agreement in 2 message delays.

“The theoretical minimum for BFT agreement.” — BULK Architecture Documentation

The CommittedBatch is the intersection: transactions that appeared in the pending sets of >2/3 stake weight of validators.

Step 4: Execution Every validator executes the CommittedBatch through the Executor (Layer 3) independently and in parallel. No further communication is needed. Any validator producing a different output state is immediately detectable via state hash comparison.

Byzantine Fault Tolerance

BULKBFT tolerates ⌊(n-1)/3⌋ faulty validators. With 20 validators, up to 6 can fail or be malicious without disrupting consensus. The system continues operating as long as >2/3 of validators are honest and online.

Minisketch Reconciliation

Transaction propagation uses the minisketch set reconciliation protocol. The key property: O(d) communication complexity where d is the number of transactions one party has that another doesn’t. Instead of each validator broadcasting every transaction to every other validator, they exchange small sketches representing only the differences.

At high transaction throughput, this dramatically reduces network bandwidth requirements.

The Deterministic Timestamp

BULK’s consensus produces a batch timestamp that serves as the seed for the fair ordering shuffle. The timestamp mechanism is Byzantine-fault tolerant:

T_batch = T_anchor + (R - R_anchor) × Δt

Where R is the current round and Δt is the target interval. The timestamp is anchored to real wall-clock time via validator beacons, using the median value from all validators and tolerating up to ⌊(n-1)/2⌋ faulty clock values.

This timestamp cannot be predicted before consensus and cannot be manipulated by a minority of validators — making the subsequent Fisher-Yates shuffle genuinely unpredictable.

Layer 3: The Executor

Fair Ordering (Applied Before Matching)

The CommittedBatch enters the Executor and immediately goes through the 4-layer fair ordering system before any matching occurs. See the fair ordering deep dive for the complete breakdown.

Summary: Fisher-Yates shuffle → Structural priority queues → Price-time matching.

Matching Engine

Deterministic CLOB. The matching engine is a central limit order book with fully deterministic output. Every validator, running the same CommittedBatch through the same matching engine, produces identical output — no communication required post-consensus.

Five priority queues per batch:

1. Config / oracle updates
2. Liquidations
3. Cancellations (always before fills)
4. ALO (post-only) orders
5. Regular orders

Pre-flight checks for every order:

• Equity check (sufficient collateral)
• Leverage limit validation
• Order parameter validation
• Reduce-only verification

State updates are atomic per fill. A fill that partially matches produces two state transitions: one for the filled amount, one for the remaining resting order.

Risk Engine

The risk engine runs on every validator simultaneously, in parallel with matching. It evaluates portfolio margin requirements continuously.

The 9-regime HMM: Classifies each market into one of nine states (Bearish/Neutral/Bullish × Low/Medium/High volatility). Lambda surfaces map position characteristics to margin requirements within each regime.

Cascade adjustment: 2-round iteration that estimates the price impact of potential liquidations and adjusts margin requirements to prevent cascade failures. Described as: “prevents positions appearing well-margined in isolation but causing systemic risk.”

Liquidation optimizer: Evaluates which positions to close to resolve a margin breach, specifically preserving hedges. Up to 100 cycles per liquidation event. See liquidations guide.

Layer 4: Solana Settlement

Custody Model

All funds are held in per-user program-derived accounts (PDAs) on Solana. A PDA is deterministically derived from the user’s public key — the address is predictable but no one holds its private key directly. Only the BULK program can transact with a user’s PDA on their behalf.

No user funds are ever in a pooled custodial account. Each user’s assets are in their own on-chain address.

Withdrawal Security: FROST Threshold Signatures

Withdrawals from the BULK Layer to Solana require a FROST threshold signature from the validator set.

FROST (Flexible Round-Optimized Schnorr Threshold Signatures) is a threshold cryptography scheme: no single party holds a complete signing key. A withdrawal requires a supermajority of validators to cooperate in signing.

This means: even if BULK’s servers are compromised, an attacker cannot withdraw user funds without controlling the distributed validator key material.

Upgrade Authority

BULK’s Solana programs are controlled by a Squads 3-of-5 multisig. Any upgrade to the on-chain program code requires 3 of 5 keyholders to sign. This prevents a single compromised key from deploying a malicious upgrade.

Native Protocol Primitives

Native Multisig

Up to 32 signers with M-of-N threshold. 0–30 day time lock on execution. Up to 64 concurrent proposals. This is built into the BULK protocol, not as a third-party contract.

Native Sub-Accounts

Up to 64 sub-accounts per master. Off-curve accounts derived deterministically from the master public key. No separate private key — fully owned by the master. Gasless internal transfers.

Native Isolated Margin

Per-instrument isolated accounts, auto-created on first i=true order. One instrument per isolated account. Liquidation in an isolated account doesn’t affect the main portfolio.

Native Transfers

Gasless, instant transfers between master and sub-accounts. External transfers to other BULK accounts via on-chain signed transaction.

Protocol Crate Architecture

The protocol logic is split into pure and impure layers:

Pure crates (no I/O):

• bulk-consensus-proto: pure deterministic state machine for BULKBFT
• bulk-core-proto: pure deterministic state machine for the matching and risk engine

I/O wrappers:

• Network layer wrapping bulk-consensus-proto
• Solana program wrapping bulk-core-proto

This separation is architecturally important: the pure crates can be tested and audited without any network or blockchain infrastructure. Correctness is verifiable in isolation.

Performance Targets

Source: BULK Exchange architecture documentation. Last updated: June 4, 2026.

See the architecture in action → early.bulk.trade