Nanosecond-Scale Matching

Ultra-low-latency
order matching.

A high-performance matching engine built entirely in safe Rust. Price-time priority, O(1) cancellation, and 21M+ orders per second on a single core.

Request accessSee benchmarks
~32ns
Match Latency
21M/s
Throughput
0 unsafe
In Core

Features

Built for the hot path

Every allocation, every branch, every cache line considered. Designed from the ground up for deterministic, predictable latency.

P/T

Price-Time Priority

Sorted-vec order book with O(log n) binary-search insertion and O(1) best-price access. FIFO execution within each price level.

  • Bids descending, asks ascending
  • Deterministic match ordering
  • Fixed-point pricing (no floats)
  • Zero-allocation matching loop
4x

Four Order Types

Full order type support out of the box. Each type with well-defined semantics and deterministic execution behavior.

  • Limit — rest on book at price or better
  • Market — fill at best available
  • IOC — immediate fill or cancel
  • FOK — atomic all-or-nothing
O1

O(1) Cancellation

Intrusive doubly-linked list with pool allocator. Cancel is a pointer unlink — zero hash lookups, zero searching.

  • Direct slot addressing via OrderHandle
  • Pool allocator with free list reuse
  • Contiguous memory layout
  • ~32ns cancel latency (warm)

Architecture

How it works

Single-threaded matching core with no locks on the hot path. Every layer designed for deterministic, cache-friendly execution.

1

Ingest

Zero-copy binary codec with length-prefixed framing. Messages decoded directly from the wire buffer with no intermediate allocations.

2

Match

Single-threaded core executes price-time priority matching. No locks, no atomics, no contention — fully deterministic on every invocation.

3

Allocate

Pool allocator backs all order storage. A single Vec with free list provides O(1) alloc and dealloc with optimal cache locality.

4

Deliver

Lock-free SPSC ring buffers shuttle execution reports to the I/O layer. CPU core affinity pinning minimizes context switch overhead.

Benchmarks

Measured, not estimated

Criterion.rs benchmarks on production-representative workloads. All numbers single-core, no SIMD, no kernel bypass.

~32ns
warm cache
Insert + Cancel
Round trip for the most common operation pair
~49ns
warm cache
Market Fill
Aggressive order fully matched against resting liquidity
21M/s
sustained
Throughput
Mixed workload on a single core, no batching
FerroMatchJava (JVM)C++ (Typical)
Warm insert + cancel~32 ns1 – 4 us200 – 800 ns
Warm market fill~49 ns2 – 8 us300 ns – 1 us
Warm limit insert~37 ns1 – 5 us150 – 600 ns
Throughput21M ops/s1 – 6M ops/s5 – 15M ops/s
GC / stop-the-worldNone5 – 50 ms tailNone
Memory safetyCompile-timeRuntime (GC)Manual

Code Quality

Safe by default

#!

100% Safe Rust

deny(unsafe_code) enforced across the entire matching core. No raw pointers, no transmutes, no undefined behavior.

150

Test Coverage

Comprehensive test suite covering order types, edge cases, partial fills, and adversarial inputs. Zero clippy warnings.

5

Modular Crates

Clean separation into core, I/O, server, and ADX crates. Each with its own responsibility boundary and independent versioning.

Enterprise

Production-grade modules

Purpose-built add-ons for regulated environments, high availability, and institutional-grade operations.

HA
Core

HA/DR Cluster

Active-active replication with automatic leader election and sub-millisecond failover. Zero message loss guarantee.

RK
Core

Risk Controls

Pre-trade limits, position kill switches, and real-time credit checks. Configurable per account, symbol, or firm.

AU
Core

Compliance & Audit

Immutable audit trail with nanosecond timestamps. Regulatory export formats for SEC, FINRA, and MiFID II.

GW
Protocol

Protocol Gateways

Native FIX, ITCH, OUCH, and SBE adapters. Drop-in protocol translation without touching the matching core.

MT
Protocol

Multi-Tenant

Account hierarchy with role-based access control. Firm-level isolation with shared infrastructure efficiency.

OB
Protocol

Observability Suite

Tail latency analytics, real-time histograms, and forensics UI. SLO monitoring with automatic alerting.

Wire Protocol

Binary. Compact. Fast.

Zero-copy binary protocol designed for the lowest possible serialization overhead

Length-prefixed framing with a single-byte message type discriminator. No schema negotiation, no version headers, no padding — just raw, structured bytes on the wire.

Prices use fixed-point integer representation to eliminate floating-point ambiguity. All arithmetic stays in integer space throughout the matching pipeline.

// Wire format: length-prefixed binary
[4 bytes] payload length (u32 BE)
[1 byte ] message type

// Message types
0x01 — NewOrder
0x02 — CancelOrder
0x03 — ExecutionReport

// Fixed-point pricing
$100.50 = 100_500_000
Zero-copy decodeFixed-point pricesLength-prefixed framing3 message types

Talk to us

FerroMatch is available under a source-available commercial license. Reach out to discuss your infrastructure requirements and integration timeline.

info@morphiqlabs.com

Tell us about your use case

  • Your target throughput and latency requirements
  • Asset classes and order types you need to support
  • Regulatory environment and compliance needs
  • Integration timeline and existing infrastructure