cNGN Stablecoin Settlement Hub
Sold once. One buyer acquires the complete IP outright — every line of source, every test, every audit artefact — and it is then denied to every other party. No licence, no recurring, no second buyer.
Acquire — begin due diligence →Technical Ledger
| SKU | VLA-GEN-CNG-V1.0 |
|---|---|
| Vendor | Vlaander LTD |
| Classification | Engineering Asset |
| Variant | Default Title |
| Availability | ProvisionedPASSING |
Provenance & integrity.
| Language | C++23 |
|---|---|
| Build | warnings-as-errors · dynamic-analysis-clean |
| Sanitizers | ASan · UBSan · TSanPASSING |
| Fuzzing | 1M-iteration campaignPASSING |
| Formal verification | 2 machine-checked TLA+ safety proofsPASSING |
| Forensic review | independent · 17/17 findings remediated & regression-testedPASSING |
| Tests | ~192 property/integration · 8 self-verifying binariesPASSING |
| Signing scheme | ed25519 signed releases |
| Signing key | Publishing 2026-Q3 |
| SHA-256 | Publishing 2026-Q3 |
| Release | Publishing 2026-Q3 |
| External audit | Publishing 2026-Q3 |
Value, in your metrics.
| Metric you track | Magnitude |
|---|---|
| On-chain settlement cost | Clear internally and instantly, settle only the net position on-chain — gross per-transaction settlement collapses to a minimal netted set. |
| Intraday liquidity requirement | Multilateral netting compresses gross obligations; net-debit caps and Cover-2 adequacy bound member exposure. |
| Clearing decision latency | ~0.17µs median / ~1.4µs p99 per decision; ~3.5M decisions/sec on a single core. |
| Recovery point objective | RPO-0: any state reconstructs by byte-exact replay of a SHA-256 hash-chained event log. |
| Audit / regulator readiness | 12 architecture decision records, 2 machine-checked TLA+ safety proofs, forensic review with 17/17 findings remediated. |
Build-vs-buy basis.
Reproducing this in-house: approximately 30–54 engineer-months for a senior team familiar with deterministic clearing-and-settlement systems, CCP/CLS risk machinery, and ISO 20022 compliance. At a loaded cost of $25,000 per engineer-month, that is $750,000–$1,350,000, or $1,822,500 after a 35% risk premium for scope overrun. Purchasing the source: $650,000 plus approximately 12 weeks of integration effort. Stated biases: we compare against the high end of the build estimate, apply a 35% risk premium for scope overrun, and exclude opportunity cost. Editable assumptions: engineer-months (30–54), loaded cost per month ($25,000), risk premium (35%). Flip any of these and the comparison adjusts accordingly — the model is yours to defend, not ours to dictate.
Risk allocation.
| Risk | Borne by | Basis | Buyer’s recourse |
|---|---|---|---|
| IP cleanliness | Vlaander LTD | Source warranted as original work, clean of third-party IP at point of sale. | Indemnification capped at the purchase price paid. |
| Benchmark performance | Vlaander LTD | Published numbers must reproduce on the documented hardware. 30-day inspection window from delivery. | Refund of the purchase price within the inspection window. |
| Integration into buyer’s stack | Buyer | Integration footprint published on every product page. No warranty extends to bespoke environments outside the documented targets. | Use the published footprint as the integration spec; engage Vlaander engineering at sales@vlaander.com for paid support. |
| Regulatory compliance in buyer’s jurisdiction | Buyer | Export classified EAR99. Buyer self-screens against restricted jurisdictions and parties under their own legal counsel. | Request a pre-sale export review at sales@vlaander.com — provided at no charge. |
| Vendor continuity | Buyer | No vendor can warrant its own continuation. Source delivered without licence server, kill-switch, or expiry — risk transferred to buyer by the outright-sale model. | Self-maintain in perpetuity using the delivered source; fork freely under the Sale terms. |
| Source-code escrow | Joint | Source is delivered to the buyer at sale, so escrow is structurally unnecessary. Available on request when buyer counsel mandates a third-party deposit. | Request escrow at sales@vlaander.com — buyer-funded; Vlaander participates without charge. |
| Security disclosure post-sale | Joint | Vlaander acknowledges security reports within 24 hours and honours coordinated disclosure indefinitely on shipped versions. Buyer applies remediation in their environment. | Report to sales@vlaander.com — disclosure policy published at /security. |
Scope & maturity.
- The deterministic settlement core, the compliance plane, multilateral netting, and the CCP-style default-management waterfall.
- ISO 20022 ingress and the real protocol layers for EVM JSON-RPC and NIBSS.
- The assurance suite, 2 TLA+ specs, 12 ADRs, and 8 self-verifying binaries demonstrating every flow end-to-end.
- Reserve reconciliation (proof-of-solvency) and threshold custody at the cryptographic layer.
- External connectors are bound to deterministic simulators, not live endpoints — the seams are explicitly built for them.
- Custody uses real threshold-sharing but not yet a production HSM/TSS signer.
- Security-audit sign-off, regulatory approval, and live on-chain volume.
- Live endpoint integration (production chain and NIBSS rails) and an HSM/TSS custody signer.
System Abstract
A production-grade, bare-metal C++23 clearing-and-settlement engine, purpose-built to run an institutional cNGN regional settlement hub. It clears high-value B2B stablecoin obligations between members instantly and internally, then settles only the net position on-chain and over Nigerian bank rails — the model central banks and CLS use for fiat, brought to stablecoin settlement.
At its core is a deterministic, single-writer, event-sourced state machine: money is integer minor units, every transaction passes an inline invariant gauntlet before any balance changes, and state is a pure fold over an append-only, SHA-256 hash-chained event log — tamper-evident, replay-bit-identical, RPO-0 recoverable. A clearing decision runs in ~0.17µs median, ~3.5M/sec on a single core. Around the core sit a fail-closed compliance plane (KYB, sanctions, AML, FATF Travel Rule) and a settlement plane with multilateral netting, continuous reserve reconciliation, threshold custody, and a CCP-style default-management waterfall.
The differentiation is determinism and speed together, paired with risk machinery banks recognise. Delivered as source with formal TLA+ specifications, ~190 tests, an independent forensic security review with all findings remediated, and 12 architecture decision records.