NEAP

Demo

About

NEAP is an intraday treasury engine for institutions that promise instant cross-border payments. To settle a payment in seconds, a bank has to be holding the destination currency before the customer's money arrives. It cannot wait for the transfer to clear. So it pre-funds every corridor and every currency, all day. That capital earns nothing, and it carries an exchange rate position nobody chose. The usual way to size it is to look at the worst day of the last quarter and provision that much. It is robust, and it is far more cash than an ordinary day needs. NEAP replaces that heuristic with stochastic control. It forecasts net flow per corridor and solves the rebalancing bands that minimise a single cost function: the carry on the balance, the fixed cost of a rebalance, execution cost under square root market impact, foreign exchange risk priced as expected shortfall, and the cost of a payment failing for lack of funds. The band is not a setting. It is the minimum of that function, and it is recomputed whenever the parameters change. This only becomes possible now because band width grows as the cube root of the fixed cost of a rebalance. On correspondent banking rails that cost is tens of dollars and settlement takes two days, so rebalancing during the day is uneconomic. On Arc it is about two cents in USDC, final in 350 milliseconds. Divide the fixed cost by ten thousand and the optimal band divides by twenty one. Three integrations, none of them decorative. The decision runs inside a Chainlink CRE confidential handler, because live balances, upcoming commitments and internal limits map a liquidity position precisely enough for a counterparty to trade against it. They never leave the enclave. What leaves is a signed report carrying a commitment to the orders and metrics in basis points, never amounts. Privy holds the role wallets, whose policies allow three function selectors and nothing else, so a stolen key passes authentication but does not pass the policy. Arc settles payment versus payment, both legs or neither, with gas denominated in USDC, which is what turns the fixed cost into a known number inside the objective. The contract never trusts the report. A cap per order, a cap per epoch, a rolling twenty four hour window and a price deviation check against an oracle are all applied independently, because a broken model produces a perfectly signed and perfectly absurd plan. Measured over twenty random seeds and six walk forward windows, with every parameter estimated only from data predating the decision it informs, idle capital falls 84.6 percent and tail risk 89.4 percent. The mechanism is not the one you would expect. Carry is almost negligible at a six percent cost of capital. What actually happens is that execution cost falls 19.7 percent while the engine places thirty times more orders, because many small orders cost less than a few large ones once the fixed cost collapses. What is honest about it: the payment flows are synthetic, since no institution publishes its own by corridor. They come from a compound Poisson process calibrated on public aggregates, with five validity tests and a fixed seed. The market impact coefficient is not calibrated, so its sensitivity is published next to every number that depends on it, and the cost reduction moves between 13 and 38 percent across that range. 241 tests, no JavaScript dependencies outside the CRE workflow, and one command that runs the whole chain: deploy, decide, sign, approve, execute.

How it's made

The system is built around one constraint: the decision is a pure function. No I/O, no clock, no randomness. That rule is what lets the same code run inside a Chainlink CRE confidential handler and in a local runner, and it is what makes the backtest binding, because the policy tested is literally the policy executed. Stack: TypeScript run natively by Node 24, Solidity with Foundry, a dashboard served by node:http with hand written SVG. No npm install, no build step, zero JavaScript dependencies outside the CRE workflow. Vercel serves it as a static site plus one serverless function, since exactly one endpoint computes anything. The engine: compound Poisson flows with seasonal intensity, EWMA volatility at the RiskMetrics lambda of 0.94, Ledoit Wolf shrinkage on the correlation of standardised residuals, and expected shortfall at 97.5 percent by filtered historical simulation. Math.random is banned repository wide, and the Poisson sampler is exact in both regimes rather than normal approximated, because that approximation biases the lower tail and the quiet hours are what cause a breach. Bands come from a pattern search warm started by the Miller Orr closed form, evaluated on common random numbers so the optimiser is not chasing simulation noise. Miller Orr doubles as the regression test: on the driftless case the numerical solver must recover the closed form. Three places where the obvious implementation is silently wrong. Pricing a rare event. Counting breaches in simulation leaves the solver completely insensitive to their cost: from 20k to 5M per breach, the optimum does not move by a dollar. That is a resolution limit, not a bug. The breach probability at the optimum is about ten to the minus five, and 300 paths of 400 periods is 120,000 draws, so the term is zero everywhere and its gradient with it. It is now charged in expectation against an exponential tail fitted by peaks over threshold. The test guarding it checks a relation rather than a value: at the optimum the breach probability must scale as one over the breach cost. Measured across four decades: 1.29e-5, 1.34e-6, 1.35e-7, 1.32e-8. Hashing like Ethereum. Node exposes sha3-256, which is not Keccak: standardisation moved the padding byte from 0x01 to 0x06 after Keccak was published, and Ethereum kept the original. Keccak256 is implemented here in 64 bit bigints with a minimal ABI encoder and EIP-712 struct hashing, validated against cast at the 135, 136 and 137 byte block boundaries where padding bugs hide. A committed fixture is then checked in both directions: Solidity recomputes it, and a TypeScript test asserts it is still what the engine produces. Without that second direction, regenerating the fixture would make both suites pass while silently changing the contract. Proving the absence of lookahead. A canary injects an extreme shock into the future and asserts no earlier band moves. Its counter test matters as much: the same shock in the past must move them, otherwise a canary that detects nothing could simply be dead. The contracts assume the model will one day be wrong. Separation of duties is a revert, not a UI rule. The EIP-712 quorum requires strictly increasing signer addresses, so one signature cannot be replayed to reach it, and the EIP-2 low s bound stops a single report having two identifiers. The attestation is bound to the payload hash, otherwise a valid attestation could be recycled onto another report: it would prove an enclave exists, not that this content came out of one. The vault reveals a salted commitment, then applies caps the report cannot influence. What each partner unlocks. Arc denominates gas in USDC, turning the fixed cost of a rebalance from an estimate into a known number inside the objective, and its atomic PvP let a compensation state be deleted from the vault state machine rather than defended. Chainlink CRE is what makes the product commercially plausible, since no institution will publish its liquidity position, and its synchronous handler is exactly the shape of a pure function. Privy catches what the contract structurally cannot see: a compromised key signing a transaction the contract never receives. All of it is checkable: 241 tests, a committed end to end trace, and one command that deploys, decides, signs, approves and executes in five seconds.