A Safe and Reliable MultiPlanetary Exchange System

Inspiration

On Earth, an exchange can ask another exchange "do you have this?" and get an answer in milliseconds. Across the solar system, that answer can take hours, can be lost, or can be blocked by the Sun for weeks. We wanted to design a market that stays correct even when no exchange knows what the others are doing right now.

What it does

Our design paper proposes a prefunded exchange system for nine settlements, from Mercury to Neptune. It covers equities, a capped futures contract, and the clearing and settlement that ties them together.

One writer per balance. Each settlement runs one exchange, and only that exchange can change its own customers' balances.
Trade only with funds already there. To trade remotely, a client first moves assets to an account at the market's exchange over the reliable backbone. The market executes only against balances already in its own ledger.
Value in transit can't be spent. Transfers are credited exactly once. Lost, delayed or duplicated packets can slow service but can't create, destroy or double-spend anything.
Futures with a finite worst case. The contract's payoff is capped, and each side escrows its maximum possible loss before the contract opens. No price path can leave a payout unfunded.

The paper defines eight operating rules (R1–R8): transfers, orders and matching, withdrawals, futures and margin, communication, client behavior, recovery, and forwarding through a third exchange when the Sun blocks a direct path. It separates guarantees that hold under any pattern of loss or delay (conservation, no double use, fully funded payouts, exactly-once credit) from measured performance that depends on the orbital model.

Results, backed by the evidence appendix

An Earth client buys 1,000 Mars shares and has them at home in 3.07 h. With random loss, the 99th percentile is 7.70 h.
The 300-hour futures contract settles correctly on both rising and falling price paths.
Every settlement can reach every product. Neptune, the hardest case, completes within a week with probability 0.97.

How we built it

The design came first. We started from ownership: for every piece of shared state, which single institution is allowed to change it. Every rule follows from that table.
Every claim is tested. We built a discrete-event simulator of the brief's network: Kepler orbits, light time to moving receivers, solar exclusion, relays, quotas, loss and incidents. We used it to stress the design:
- traced scenarios;
- 56,280 simulated incidents;
- runs at shifted dates, including the 2028 Mars conjunction;
- relocating clients to every settlement.
Writing and evidence. The team wrote the paper in Overleaf. The 12-page evidence appendix and its supplement are generated directly from simulation results, so every number traces back to a run.
Iterating with judges. We revised through several rounds of judge feedback, fixing each inconsistency between the paper's rules and the simulator's behavior.

Challenges we ran into

Physics, not finance, was the hard part. During the 2028 conjunction, the Earth–Mars direct path closes for 53 days and Earth clients can't reach Mars at all. Our forwarding rule (R8) sends instructions through Mercury instead, and the trade completes in 4.55 h.
The outer planets are very lossy. Each direct copy from Neptune is lost about 91% of the time. Raising the copy count and shortening the fallback timer took Neptune's 72-hour completion rate from 0.34 to 0.47. That is a real improvement, and we report the remaining gap honestly in the risks section.
Guarantees versus evidence. We had to be precise about which properties the rules prove and which the simulation only supports.
Space limits. We fit a 60+ page body of evidence into a 12-page appendix without dropping any required item.

Accomplishments that we're proud of

Conservation is guaranteed by the rules, not by luck. It is checked after every ledger event of every traced run.
A ranked risk table built from real findings. The worst of 56,280 incidents (a Mars reset just after the handshakes) delays the futures by about 125 h but puts no money at risk.
An honest look at deployment. The paper estimates effects a real system would add: Earth rotation, Doppler shift, relativistic clock drift and ephemeris drift.
Every number in the paper is reproducible from the supplemental code.

What we learned

Settle only on what you hold. Over interplanetary delays, acting only on your own ledger is simpler and safer than any commit protocol between exchanges.
Fallback rules are the design. Most of a reliable system is deciding in advance what happens when an observation is missing, a copy is duplicated or a result never arrives.
Prose and code must agree. Precise wording matters: the most damaging judge comments came from places where the paper and the simulator disagreed.

What's next

More products: capped options and backed currencies, which the paper already sketches as extensions.
Better outer-planet service: for example, staging orders closer to the market.
Less concentration risk: independent audit of custodian exchanges, and multiple price sources to replace the single index source.
Live operation: a live ephemeris and real ground-station schedules in place of the idealized model.