Efficient and Verified Continuous Double Auctions

TL;DR

This work addresses the need for a fast, formally verified implementation of continuous double auctions to support automated log checkers. It introduces eProcess_instruction, a $O(n log n)$-time verified implementation based on red-black trees and dual-key BSTs, and proves its outputs match the prior list-based approach, alongside a $Ω(n log n)$ lower bound for any algorithm. The authors provide a Coq formalization with extracted OCaml code and strengthen standard-library red-black-tree guarantees to support correctness. Empirical results show the method scales to $10^7$ orders in minutes, a dramatic improvement over prior approaches. This work strengthens regulatory tooling for high-frequency exchanges by delivering fast, reliable offline verification of trade logs.

Abstract

Continuous double auctions are commonly used to match orders at currency, stock, and commodities exchanges. A verified implementation of continuous double auctions is a useful tool for market regulators as they give rise to automated checkers that are guaranteed to detect errors in the trade logs of an existing exchange if they contain trades that violate the matching rules. We provide an efficient and formally verified implementation of continuous double auctions that takes $O(n \log n)$ time to match $n$ orders. This improves an earlier $O(n^2)$ verified implementation. We also prove a matching $Ω(n\log n)$ lower bound on the running time for continuous double auctions. Our new implementation takes only a couple of minutes to run on ten million randomly generated orders as opposed to a few days taken by the earlier implementation. Our new implementation gives rise to an efficient automatic checker. We use the Coq proof assistant for verifying our implementation and extracting a verified OCaml program. While using Coq's standard library implementation of red-black trees to obtain our improvement, we observed that its specification has serious gaps, which we fill in this work; this might be of independent interest.

Figures (8)

• Figure :
• Figure :
• Figure :
• Figure :
• Figure :

Theorems & Definitions (9)

• Theorem 1
• Theorem 2
• Definition 1: $\mathsf{cda\_tree}$, $\mathsf{cda\_list}$
• Theorem 3
• Theorem 4
• Theorem 5
• proof : Proof of Theorem \ref{['thm:runningTime']}
• Remark 1
• proof : Proof of Theorem \ref{['thm:lowerBound']}