A trader opens one app, buys a perp, then a yes-or-no contract on a data release, all from the same balance in under a minute. It looks like a single product. Underneath it’s several systems stitched together by a few decisions that are quick to go wrong.
I want to walk through those decisions as a practitioner would, starting with the wallet and the risk engine and ending with the module that settles events. Then the failure modes, because a terminal is judged less by a calm day than by what it does when a feed dies.
One margin wallet underneath
The first decision is the wallet. In a single-account terminal, perps, spot crypto, forex pairs and event contracts draw on one collateral balance instead of separate ones. The user sees one equity number. Underneath, the ledger tracks what’s locked as margin, what’s reserved for open orders and what’s free to withdraw.
That sounds simple until two products want the same collateral. A spot buy and a perp margin requirement can both claim the same free balance, so the order service has to reserve funds atomically before an order reaches the book. Get that wrong and you’ll see rejected fills or duplicate holds that confuse support.
The risk engine and netting
The risk engine is the part users never see. It turns every position into one exposure view and decides who gets a margin call. When perps and event contracts sit on a platform that lists both, margin and risk can be netted in one place, which is a design choice with upsides and downsides.
The upside is capital efficiency: a long perp and an offsetting contract can need less collateral together than apart. The downside is coupling. A shock in one product now moves the margin of another, and the engine must model correlations it may not understand. Cautious designs net only within a product family.
Mark price from several feeds
Perp margin runs on a mark price, not the last trade. A sound mark takes the median or a weighted blend of several spot feeds and drops any feed that strays too far from the rest. That stops one thin print from liquidating accounts it shouldn’t touch, which is the failure users remember longest.
Crypto and forex differ here. Crypto feeds run day and night, so staleness is the main risk. A feed that goes quiet looks like a calm market. Forex has session hours, so the engine needs a rule for weekends and thin periods. A stale mark past its timeout should freeze new risk, not keep pricing margin from old numbers.
Order routing and the resolution module
Orders for a perp go to a matching engine, while spot orders may go to an internal book or an outside route. Forex orders can hit a liquidity provider. A router must apply the right rules to each, such as tick sizes and minimum notional. One order ticket on screen hides several separate pipelines.
Event contracts add a resolution module. It stores the question and the named source, stops trading at the cutoff and settles the payout from the confirmed, published outcome. It also needs a human review path for disputes. Automating the happy path is routine. The messy case is a revised data release.
A mobile terminal that mirrors the desktop
A mobile terminal should read from the same order book and account state as the desktop, not a cached copy. Otherwise a user sees a position on the phone that the web terminal already closed. Push updates through one stream, and treat the app as another client of the same API.
Mobile adds its own failure modes: backgrounded apps that miss a stream, and double taps that send two orders. Idempotency keys on each order and a visible connection state save a lot of support tickets, and they spare traders from guessing what happened to an order they sent a minute ago.
Failure modes and trade-offs
Feed outages are the classic one here. If a price source goes quiet, the engine can widen margin or halt new positions, and each choice annoys someone. Cross-product margin calls come next: a drop in a perp can force the sale of a spot holding the user wanted to keep.
There’s no clean answer, only choices you can document. A single wallet buys convenience and efficiency at the cost of contagion. Separate wallets add friction and cap the damage, though they also tie up more capital. Leveraged and event-based trading can lose the entire amount put in, and architecture can limit that only so far.
Round-the-clock crypto next to forex sessions
Crypto never closes, so maintenance windows hurt. Teams use rolling deploys and hot standby matching engines, and they keep a status page that tells the truth. Forex closes for the weekend, which gives a natural window to rebuild things, but also creates a gap when prices reopen far from where they stopped.
A shared terminal must show both clocks clearly. Gray out the pair that’s closed and say why, and don’t let a stop order sit at an old level as if the market were open. A little interface honesty prevents most of the arguments that come later, and it costs almost nothing to build.