Sentry

When you buy 100 shares of Apple, you do not own 100 shares of Apple. Your broker holds an interest in 100 shares at the Depository Trust Company; the DTC holds those shares — along with nearly every other public American share — in the name of its nominee partnership, Cede & Co. The trade itself clears not directly between you and the seller, but through the National Securities Clearing Corporation, which steps between every buyer and every seller as central counterparty, accepts both legs, computes the obligations, and tells participants what they owe. NSCC and DTC are the two principal subsidiaries of the Depository Trust & Clearing Corporation. Together they are the post-trade infrastructure of U.S. capital markets.

The DTCC moves about $2.15 quadrillion in trade volume each year on roughly $103 billion of participant deposits — a 21,000-to-1 capital-efficiency ratio. This number is the most consequential and least understood statistic in American finance. It is the result of multilateral netting: every clearing day, NSCC accumulates obligations from every member, computes the net position of each member against the system, and settles only those net positions. Gross settlement of every individual trade would require participants to pre-fund the maximum gross exposure; netting reduces required deposits by approximately the square root of the number of obligations per pair. For this section it is enough to know that the leverage shown above is achievable, has been achieved, and is the difference between a $2.15 quadrillion market and one that does not exist.

Custody works through a chain of nominees. Cede & Co. is registered on every issuer's books as the legal owner of nearly every public share. Brokers hold an interest at the DTC. You hold an interest at your broker. Corporate actions — dividends, splits, votes — propagate down this chain on the DTCC's schedule. Transfers between brokerages route through the Automated Customer Account Transfer Service, ACATS, which still takes about six business days end-to-end.

This system is foundational. It is also nearly fifty years old. The DTC was set up in 1973 to solve a paperwork crisis: brokerages were drowning in physical share certificates and the back offices could not process them fast enough. The DTC's job was to immobilize the certificates in one central depository and let ownership move on its books instead of on paper. It was supposed to be a stopgap. Half a century later it still owns nearly every public American share, and the assumptions baked into its architecture — known clearing members, end-of-day batch settlement, ownership defined as a beneficial interest in a position held by a nominee — have not been revisited.

The DTCC works. It works the way it worked in 1985, with most of the same architectural assumptions, and the world around it has changed.

The system was designed for a closed set of clearing members. Membership is administered through a regulated process; participants fund a clearing pool; obligations are tracked between members. This works when “the market” means a few hundred broker-dealers and a few dozen exchanges. It does not generalize to the longer tail of capital formation — venture-backed companies, private credit, secondaries — which today operate with even older infrastructure: paper agreements, manual cap tables, and signature pages routed by fax.

Settlement happens in batches. Trades clear on a T+1 schedule, meaning the cash and securities legs of a trade actually move one business day after execution. T+1 was a major improvement over T+5; it is still slow enough that institutions hold large idle balances against settlement risk. Continuous settlement is the natural answer, but it cannot be retrofitted onto a depository whose state machine advances once per day.

None of these constraints have to hold any longer. Settlement can be continuous. Ownership can be direct. The participant set can be open. The reason these things have not happened is not regulatory — the SEC's modernized ATS regime explicitly contemplates distributed-ledger settlement — and not cultural; it is architectural. The post-trade rails are a single piece of infrastructure operated by a single entity, and incremental modernization has not been able to dislodge it.

The natural rebuild is a protocol. A protocol can do the four things the DTCC does — clearing, custody, netting, transfer agency — in software, on a permissionless base, with the same capital efficiency the DTCC took fifty years to engineer. The remainder of this paper describes that protocol.

To replace the DTCC, a protocol has to provide four capabilities, each a direct substitute for what the existing system does.

These capabilities require four pieces of protocol-level infrastructure. First, capital-efficient settlement at the consensus layer, so participants can opt into multilateral netting rather than pre-funding gross exposure (§4). Second, a yield-bearing settlement asset so institutional balances earn the risk-free rate by default rather than sitting idle (§7). Third, a regulatory-aware identity layer so qualification can be enforced without sacrificing permissionless access (§8). Fourth, frictionless transfers of stocks so brokerage-to-brokerage moves complete in a single state transition rather than six business days (§9).

The next chapters describe each capability in turn. By the end of Part III the reader will have seen, for each piece of the DTCC, what Sentry replaces it with and why. Part IV describes the underlying protocol that makes it run.

Why netting is the load-bearing primitive

Atomic gross settlement is mechanically simple — every trade clears on its own, every leg fully funded at the moment of execution — but the cost is structural. A participant trading at meaningful scale must immobilize capital against the maximum gross exposure they might run, regardless of offsetting flows later in the day. At institutional volume that pre-funding requirement — not slippage, not gas, not infrastructure — is what makes the strategy uneconomic. The 21,000-to-1 ratio at the DTCC is not an optimization; it is the entire reason the U.S. equity market can operate at the size it does, on the capital it does.

The cost of forcing every participant to fund gross is best shown concretely.

Market making.A maker quoting two-sided liquidity in 100 listed names, each turning over $100M a day, must post $20B against gross flow under atomic settlement. The same activity at the NSCC requires roughly $1M of clearing-fund deposit. The capital that does not exist on the maker's balance sheet is the spread it cannot quote.

Prime brokerage.A broker financing a hedge-fund client's book — equities long, equities short, options, treasuries — runs the entire portfolio through one risk model and one net-margin account. Atomic per-trade settlement breaks that model: every leg has to be pre-funded in the underlying, regardless of offsetting positions elsewhere. The portfolio-margin efficiency that makes prime brokerage viable disappears.

Treasury management. A clearing member parking operating cash that gets drawn down for trade settlement cannot run a $103B float against $2.15Q of gross obligations. It runs a 1:1 float — capital trapped against payments that, at the close of the day, net to zero. That capital produces no return and serves no economic function other than satisfying the settlement rail.

This is the load-bearing reason institutions have stayed off public chains. The barrier is not technical: atomic settlement is mechanically simple. It is structural — the cost of capital trapped against gross exposure makes institutional-scale strategies uneconomic on rails that cannot net. To replace the DTCC, the protocol has to replicate the netting layer at the consensus level. The remainder of this section is the mechanics of doing so.

Sentry maintains two state versions per account: finalized state $S_F$ (settled balances) and provisional state $S_P$ (balances after intra-epoch trades that have executed but not yet cleared). For permissionless participants the two are identical; transactions update both atomically. For qualified participants, transactions during an epoch update only $S_P$. The difference, ${\Delta }_p=S_P(p)-S_F(p)$, represents that participant's net obligation to the system. Positive ${\Delta }_p$: the system owes the participant. Negative: the participant owes the system. By construction, net positions sum to zero across qualified participants.

At epoch close — typically 24 hours later — the protocol computes ${\Delta }_p$ for every qualified participant, takes the obligations from those with negative net positions into a settlement pool, and distributes from that pool to those with positive net positions. Finalized state then matches provisional state. The next epoch begins from settled balances.

The capital-efficiency math is the same one the DTCC relies on. With $n$ qualified participants each executing $k$ transactions per epoch at value $v$, gross settlement volume is $V_{\text{gross}}=nkv$. By the Central Limit Theorem, net positions concentrate around zero with standard deviation $\sigma =v\sqrt{k}$, so netted settlement is $V_{\text{net}}\approx nv\sqrt{k}$, and the ratio $V_{\text{net}}/V_{\text{gross}}=1/\sqrt{k}$. For $k=100$, settlement volume drops 90%; for $k=1000$, 97%.

Settlement and credit are deliberately separated. Settlement, here, means the protocol computing net positions and executing transfers. Credit — what happens when a participant cannot meet a net obligation — is handled bilaterally between brokers and their clients, described in §8. The protocol provides transparent record-keeping and on-chain settlement of netted obligations; the broker extends credit, manages risk, and bears default. This split mirrors traditional prime brokerage.

Real equity, not synthetic representations

A protocol that hosts on-chain securities is only useful if those securities carry the same legal weight as the ones they replace. Sentry is designed to host the authoritative shareholder register, operated on-protocol by an SEC-registered transfer agent. Under that arrangement — which has explicit grounding in state corporate law and standing SEC transfer-agency rules — the on-chain record is the shareholder register, not a mirror of one held elsewhere.

Why this distinction matters

For institutional holders, a synthetic representation is a fundamentally different security from the underlying, and the difference shows up in exactly the places where it matters. The most consequential cases:

Mandate compliance.A pension fund or mutual fund operates under an investment policy statement that names the securities it may hold. A mandate to hold S&P 500 constituents permits Apple stock; it does not permit a synthetic wrapper of Apple stock, which is — for compliance, accounting, and regulatory-capital purposes — a different security. Many of the largest pools of capital in the world are structurally precluded from holding wrapped positions, regardless of how well-collateralized the wrapper might be.

Voting and governance.A wrapper that holds an underlying share does not pass voting rights through to the wrapper holder by default. An activist investor accumulating a position to vote at an issuer's annual meeting, a proxy advisor managing a fiduciary duty to vote on behalf of clients, or a shareholder pursuing a §220 books-and-records demand cannot do any of these things through a wrapper. They must be record shareholders.

Legal recourse.In a merger, bankruptcy, securities-fraud class action, or appraisal proceeding, the record shareholder has direct legal standing against the issuer. The holder of a wrapper has a contractual claim against the wrapper's issuer, which then has a claim against the underlying. Each layer of intermediation is a point of failure and a step removed from the protections the underlying security carries.

Dividends, splits, and corporate actions. Cash and stock distributions pass through an intermediary's books, arriving net of administrative costs and potentially different tax withholding. Corporate actions — splits, spinoffs, tender offers — are mirrored at the wrapper-issuer's discretion, with capital-gains treatment that may diverge from the underlying. None of these is fatal in every case, but cumulatively they reduce the after-tax economic equivalence between holding the wrapper and holding the share.

The institutional baseline is real equity. Wrapped equity is a useful derivative of it for specific applications. For a protocol that aspires to host the post-trade infrastructure of U.S. capital markets, the on-chain representation has to be the baseline, not a derivative.

What holdings give you

Holdings on Sentry are not depositary receipts, not beneficial interests in an off-chain custodied position, and not synthetic wrappers backed 1:1 by something elsewhere. They are the actual share register, operated by a registered transfer agent under SEC oversight. Holders of an on-chain Sentry security have the same legal claim against the issuer as any holder of a registered position today: full voting rights, dividend distributions, corporate-action participation, access to issuer communications, and the legal protections that come from being a record shareholder.

The transfer-agent-operated model collapses the chain. The on-chain record is the shareholder register, and the holder is the shareholder, in the same sense as any registered owner on the cap table of a traditional public company. Existing tokenization platforms — wrapped equity products, depositary-receipt issuers — give holders a contractual claim against an intermediary that, in turn, holds the underlying security. That works for some use cases. It is a fundamentally different legal instrument.

Issuance and corporate actions, in code

An issuer deploys an on-chain security with the legal terms encoded as protocol-enforceable rules: who is permitted to hold it (geographic restrictions, accredited-investor status, lock-up periods); corporate-action behavior (dividends, splits, votes); transfer-agency semantics (registry maintenance, beneficial-ownership tracking). The shares themselves move on the standard protocol rails. Anything more sophisticated — a private secondary, a forced sale, a corporate-action cutoff — runs as application logic against application state. The registered transfer agent of record signs off on the rules and attests to the resulting state, in the same way it does today against an off-chain register.

Transfer agents as protocol operators

The transfer-agent role does not go away — it operates on the protocol. The SEC-registered transfer agent maintains the official shareholder register, and that register lives on Sentry. Issuers don't need to leave their existing TA relationship; the same agent that runs the register today can run it here. From the issuer's perspective, the only operational change is that the authoritative ledger is distributed and programmable. Reconciliation with any legacy DTC position is continuous.

Transfers as a primitive

A six-day ACATS sequence — broker-to-broker messaging, position reconciliation, cash-and-securities netting, settlement — collapses to a single signed state transition. The protocol enforces qualification at each endpoint (the destination must be eligible to hold the asset class), and the transition either succeeds atomically or it doesn't. The same primitive serves retail brokerage transfers, institutional in-kind redemptions, and private-secondary trades.

Why per-venue privacy is non-negotiable

Privacy in capital markets is not a matter of preference; it is a structural prerequisite. A lit book broadcasts every order to every participant. For retail-sized flow in a liquid name, that is fine — the order does not move the market. For institutional flow, it is fatal: a $500M block, a multi-leg derivatives strategy, a position accumulated quietly over weeks — each is information that, if visible in real time, lets every other participant trade against the originator before execution completes. The economic loss is the difference between expected and realized fill, measured in institutional markets in basis points of every trade.

The ATS regime in U.S. markets exists for exactly this reason. It is a regulatory construct — encoded in SEC Regulation ATS — that legitimizes private execution for the venues where institutional liquidity actually lives. Roughly a third of U.S. equity volume runs through ATSs at any given moment. A protocol that publishes every transaction by default cannot host an ATS, which means it cannot host that third of the market.

The same logic operates one layer deeper. Even within the set of private venues, exposing order flow to a shared validator set leaks competitively-sensitive information across markets. A market maker's quoting strategy on Venue A is a trade signal for the participants of Venue B. The traditional answer is to run each venue on a separate chain — but doing so destroys composability across markets, which is the point of building on a shared protocol in the first place.

The construction below is what makes both properties hold at once: privacy is per-venue, integrity is global, and assets move freely between venues because the coordinator has already certified — cryptographically, without seeing the trades — that they really moved.

An application $A$ consists of a validator set $V_A$, application-specific state $S_A$, and an encryption key $K_{\text{enc}}$ shared only among validators in $V_A$. Transactions submitted to $A$ are encrypted under $K_{\text{enc}}$. Validators in $V_A$ decrypt and execute them; validators outside $V_A$ see only encrypted ciphertext. When the application finalizes a block, it produces a commitment $c=(h,H(B),\text{root}(S_A),\pi )$ — block height, block hash, post-execution state root, and a zero-knowledge proof that the state transition is valid. The coordinator orders the commitment globally and verifies $\pi$.

This achieves three properties simultaneously. Transaction confidentiality: validators outside $V_A$ cannot read application transactions, by semantic security of the encryption. State integrity with privacy: the coordinator certifies that the state root in each commitment is the result of a valid execution, by zero-knowledge proof soundness — without seeing the underlying transactions. Cross-application composability: applications can reference each other's commitments through the coordinator; an asset transfer in one subnet can be accepted by another, because the coordinator has already certified that it really happened.

Byzantine applications cannot fabricate state transitions. A byzantine majority in $V_A$ can produce a signed commitment for an invalid block — but cannot produce a valid $\pi$. The coordinator verifies $\pi$, rejects the commitment, and slashes the validators who signed. Privacy does not compromise security; the coordinator enforces correctness cryptographically.

Because privacy is per-application, the regulatory mapping is per-application. A trading venue can operate under an ATS framework with its own compliance posture; an issuance application can be operated by an SEC-registered transfer agent under that regulatory regime; a treasury application can be operated by a bank. They share rails without sharing data.

Why the numéraire choice is load-bearing

The unit of account in any financial system is one of the most consequential design choices it makes. On existing public chains, that choice has been made by accident. Trading happens in non-yield-bearing stablecoins; gas is paid in a separate volatile asset; institutional balances sit idle. The two-asset operating model — working capital in stablecoin, plus a protocol token for fees — is a structural inefficiency that has no analog in traditional markets, where institutional cash sits in a Treasury fund by default and gas does not exist as a category.

For a treasury desk operating a $100M trading book, a 5% Treasury yield is $5M of foregone income per year on idle collateral. At the scale of the DTCC's members — hundreds of billions in active deposits — that gap is defining. It is also, for many institutions, dispositive: investment-policy statements specify what working capital may be held in, and a stablecoin denominated against bank deposits or commercial paper does not qualify as a Treasury equivalent. The choice for these participants is not “less yield” — it is “not eligible to hold the asset at all.”

The reserve dollar described below is the resolution of that constraint. It is a yield-bearing claim denominated in the same instruments institutional cash already sits in; every other design decision in the protocol — gas, collateral, margin, settlement — flows from that choice.

The protocol's settlement asset is a yield-bearing instrument backed 1:1 by a regulated, on-chain money-market fund holding U.S. Treasury bills, repurchase agreements, and cash. We call it the reserve dollar. Holding it is equivalent to holding short-duration U.S. Treasuries: the fund distributes daily yield, the protocol tracks NAV updates, and balances accrue the risk-free rate automatically. Mint requires depositing shares of the underlying fund into a protocol-controlled vault; redeem returns the shares plus accumulated yield. The 1:1 backing invariant is enforced by the protocol.

The reserve dollar is the protocol's universal accounting unit. Every market quotes prices in it. Every collateral posting is denominated in it. Every settlement is finalized in it. Margin requirements, fee schedules, and netting computations all run against it. The protocol does not have a separate fee asset in the usual sense — validators are compensated through the gas mechanism (§9) — and there is no speculative protocol asset whose value is decoupled from real assets.

The economic loop is reflexive. Because the reserve dollar is the numéraire, every protocol interaction increases reserve-dollar exposure, which increases demand for the underlying Treasury-backed fund. As trading volume grows, collateral and margin grow with it; that growth mechanically increases demand for U.S. government debt. There is no economic pathway by which protocol growth produces demand for anything other than regulated U.S. Treasuries.

For institutional balance sheets the consequence is direct. A treasury desk holding $100M against trading activity earns the overnight rate on every dollar by default — not by actively redeploying into external protocols, not by accepting smart-contract risk on a yield-farming strategy, but by holding the protocol's base asset. The opportunity cost of operational cash effectively goes to zero.

Replacing the DTCC requires a regulatory-aware identity layer. Some assets can only be held by accredited investors, some venues by KYC-verified counterparties, some jurisdictions by qualified institutional buyers. A protocol that treats every participant identically cannot host regulated finance. But a protocol that requires identity to do anything cannot host the open access that makes blockchains useful in the first place.

Composable qualification hooks

Sentry partitions the participant space into permissionless participants $P_0$ and qualified participants $P_1$, with the partition determined per application. Qualification is enforced through composable hooks — small deterministic functions that validators execute against credential attestations during transaction validation. An equity venue might require [geographic_restriction, kyc_verification, non_blacklist]; a derivatives platform might require [kyc_verification, accredited_investor, position_limit]. Hooks are written once and reused across applications. Off-chain verifiers — Coinbase, Circle, Securitize, traditional KYC providers — sign attestations that participants register on-chain; verifiers face slashing for false attestations.

Bilateral credit

Multilateral netting makes capital efficiency possible; bilateral credit makes it usable. During an epoch, qualified participants need to be able to take positions that exceed their finalized balance — that is the entire point. The protocol cannot extend that credit (it has no legal basis to). Brokers do, exactly as they do in traditional prime brokerage.

A broker $b\in P_1$ extends credit to participant $p$ with a loan transaction specifying principal $L$, interest rate $r$, and maturity. The transaction increases $S_P(p)$ by $L$ while leaving $S_F(p)$ unchanged; the protocol records the loan obligation. The participant trades against the augmented provisional balance during the epoch. Repayment transfers funds back from $p$ to $b$; the protocol verifies the repayment covers accrued interest and reduces principal. Default resolution is bilateral, off-chain, and governed by the broker-client agreement.

Portfolio margining over arbitrary assets

Brokers extending credit on Sentry observe each participant's entire on-chain portfolio: positions across all assets, active trades in $S_P$, loans outstanding with other brokers. Collateral can be posted in any on-chain asset — Treasury holdings, equities, EUR stablecoins, derivatives positions — valued in real time using the same streaming-quote infrastructure that powers gas (§9). A market-neutral equity strategy requires less collateral than a directional one, even at identical notional sizes. The protocol provides the data; the broker provides the risk model.

How transfers work today

Moving a brokerage position is mechanically harder than it sounds. The standard pathway, ACATS, involves the receiving broker (TIF initiation), the delivering broker (validation and asset-list reconciliation), the NSCC (clearing of cash legs), and the DTC (re-registration of securities on its books). Each handoff is a separate inter-institutional message routed over the ACATS messaging system, and each step can fail or be rejected. Six business days is the average end-to-end completion; the long tail extends to weeks for non-standard positions.

During the transfer window, the customer's assets are frozen. The sending broker no longer has dispositional authority; the receiving broker does not yet. Market events during this window — earnings releases, takeover announcements, macroeconomic surprises — translate directly into losses or opportunity costs the customer cannot react to. For institutional positions of any size, the cost of being out of the market for a week is higher than any conceivable transfer fee.

Cap-table consequences propagate upward. The issuer's transfer agent receives the re-registration message after settlement; the issuer's official register updates with multi-day lag. For private companies, where cap-table accuracy matters for fundraising rounds, secondaries, and 409A valuations, that lag is a constraint on operational tempo. For public companies it is an irritant; for the issuer of an active security under takeover or proxy contest, it is an attack surface.

Why none of this is necessary

ACATS exists because no party holds the authoritative position record. The sending broker records the customer's position on its books. The receiving broker records the customer's position on its books. The DTC records the omnibus-account positions on its books. The issuer's transfer agent records the registered owner on its books. The transfer's job is to coordinate the propagation of a state change across all of these systems, sequentially, while ensuring no one creates a double-spend by transacting against a position that is in flight. ACATS is, in effect, a distributed-ledger consensus protocol implemented in interbank messages over five days.

If the position record lives on a single shared ledger, the transfer is trivial: one party debits, the other party credits, in one transaction.

How Sentry handles transfers

A transfer on Sentry is a single signed state transition. The sending and receiving accounts update atomically in the same block. Qualification rules — that the destination is eligible to hold the asset class, that the asset is not subject to a transfer restriction, that the account types match — are enforced by validators before the transition is included; if any rule fails, the transaction is rejected and never executes. Settlement is immediate.

Because the protocol isthe position record, there is no “in flight” state to defend against. There is no parallel set of books to reconcile. The cap table updates in the same block as the transfer, atomically, and the issuer's transfer agent (which operates on the protocol — see §5) sees the new register simultaneously with everyone else.

The same primitive serves a $200 retail transfer and a $200M institutional in-kind redemption. The protocol does not care about the size of the position; it cares only that the qualification rules are satisfied. Six business days collapse to one block.

The fee leg — paying in any asset

Transfers carry a fee for validator compensation, denominated in the protocol's native gas asset. To avoid re-introducing the friction this section is trying to eliminate, Sentry includes an in-line conversion mechanism: when a user pays the fee in an arbitrary asset (TSLA, EUR, the asset being transferred), the validator resolves the conversion atomically with the transfer. The user sees a single asset move; the validator is paid as if the user had paid in the native asset. There is no funded gas account, no separate balance to maintain.

The mechanism is request-for-quote, replaced by quote streaming. In a traditional RFQ flow, a system asks market makers for a current price, waits 100–500 milliseconds for responses, picks the best, and executes. That round-trip is too slow to fit inside block construction — quotes go stale before the block closes, and validators cannot wait for synchronous price discovery. Sentry inverts the flow. Market makers continuously broadcast cryptographically signed price quotes at 100–500 Hz over a dedicated gossip network. Each validator maintains a quote cache in memory, updated off the critical path. When a transaction arrives paying its fee in an arbitrary asset, the validator does a constant-time lookup (sub-microsecond), picks the best ask, and executes the swap. The market maker has a fixed settlement window to deliver the gas asset; failure to settle slashes their collateral and invalidates their quotes.

An economic side effect is the elimination of latency arbitrage. In continuous markets, market makers' standing quotes go stale when external prices move, and latency-advantaged participants race to pick them off. The market-maker response is to widen spreads — empirical estimates put the cost at 17–33% of effective spread. Sentry executes all transactions in a block against identical cached quotes that were committed before the block began. Either everyone benefits from a price move or no one does. Spreads should tighten by the same 17–33%.

Sentry is a two-layer consensus system. Application subnets run private consensus over encrypted transactions; a global coordinator orders application commitments and verifies their zero-knowledge proofs. The two layers use different consensus protocols because they have different finality requirements.

Layer 1 — Application subnets

Each application $A_i$ maintains its own validator set $V_i$ and runs a deterministic-finality BFT consensus protocol: within $3\Delta$ network delay, honest validators agree on the same block at every height, and that agreement is irreversible. Deterministic finality is required at the application layer because internal application state must not roll back — once a trade finalizes inside a venue, that finality must be permanent. The choice of specific BFT protocol is an implementation detail.

Layer 2 — Global coordinator

The coordinator runs an optimistic-finality BFT consensus protocol — one that supports speculative ordering and graceful rollback. Each application commitment carries a zero-knowledge proof of a valid state transition; the coordinator orders the commitment before its proof has been verified, then rolls back if verification later fails. This separation matters because proof generation has significantly higher latency than consensus rounds. With speculative finality, cross-application composability resolves in seconds rather than minutes.

Cross-application dependencies and rollbacks

Applications can reference each other's commitments while those commitments hold only speculative finality. When application $A_i$ spends an asset minted in $A_j$, the coordinator validates the dependency: was $c_j$ ordered before $c_i$ in the canonical sequence? If yes, $c_i$ is accepted. If the canonical sequence later changes — typically because the coordinator leader equivocated — and $c_j$ is no longer where $A_i$ expected, then $c_i$ is rejected; application validators submit a corrected commitment $c_i^{\prime }$. The application's internal state remains deterministically finalized; only the global ordering branch is rolled back.

Several lines of work have approached pieces of the problem. None has converged on a system that can replace the DTCC end-to-end.

Rollups, sidechains, shared sequencers. The blockchain-scaling literature has established the technical primitives for high-throughput, low-fee execution. None of these systems provide qualified-participant infrastructure, multilateral netting, or per-application privacy as protocol-level primitives. They are designed for permissionless DeFi, where every participant is identical and every settlement is gross.

Tokenization platforms.Securitize, Provenance, ADDX, and similar platforms have demonstrated that regulated securities can exist on-chain — including the largest on-chain Treasury-backed funds in production today. These are issuance platforms, not settlement protocols; they assume the existence of a clearing layer underneath them and don't replace it.

Privacy-preserving consensus. Three approaches dominate. Trusted execution environments (Oasis, Secret) achieve confidentiality through hardware attestation, replacing decentralized consensus with dependence on chip manufacturers. Fully homomorphic encryption (Zama, Sunscreen) imposes orders-of-magnitude overhead that makes real-time trading infeasible. Application-isolated chains (Aztec) sacrifice composability — assets cannot move freely between domains. Sentry partitions the validator set per application and composes via ZK verification at the coordinator, avoiding all three trade-offs.

Direct DTCC modernization. The DTCC has piloted DLT-based settlement (Project Ion) and continues incremental improvements (T+1, ACATS modernization). These initiatives are valuable but constrained by the existing architecture. They cannot produce native ownership, native multilateral netting, and native privacy in a single coherent stack — those capabilities require redesigning the post-trade rails from first principles.

The DTCC is the engine of U.S. capital markets. It is also nearly fifty years old, designed for a world of known clearing members, batch settlement, and physical certificates. Sentry rebuilds the four jobs the DTCC does — clearing, custody, multilateral netting, transfer agency — in software, with the same capital efficiency, cryptographic privacy, and a regulatory mapping that maps cleanly onto existing transfer agents and ATS frameworks.

What we have specified here is the protocol. What remains is the operational and regulatory work of shipping it: registering as a clearing agency or equivalent, partnering with existing transfer agents, connecting to the broker-dealer network, and convincing issuers that the protocol's ledger is more reliable than a depository's. Some of this is engineering; much of it is institutional. None of it is theoretical. The protocol exists. The next paper in this series will describe the operational rollout.

1. [1]
   Guillermo Angeris, Theo Diamandis, Kshitij Zhang, and Tarun ChitraMultidimensional gas pricing. arXiv preprint arXiv:2402.14172, 2024.
2. [2]
   Matteo Aquilina, Eric Budish, and Peter O’NeillQuantifying the high-frequency trading “arms race”. The Quarterly Journal of Economics, 137(1):493–564, 2022.
3. [3]
   Vitalik Buterin, Eric Conner, Rick Dudley, Matthew Slipper, Ian Norden, and Abdelhamid BakhtaEIP-1559: Fee market change for ETH 1.0 chain. Ethereum Improvement Proposals, 2019.https://eips.ethereum.org/EIPS/eip-1559
4. [4]
   Miguel Castro and Barbara LiskovPractical Byzantine fault tolerance. OSDI, volume 99, pages 173–186, 1999.
5. [5]
   Depository Trust & Clearing CorporationDTCC Annual Report, 2023.https://www.dtcc.com/annuals/2023/financial-performance
6. [6]
   Cynthia Dwork, Nancy Lynch, and Larry StockmeyerConsensus in the presence of partial synchrony. Journal of the ACM (JACM), 35(2):288–323, 1988.