The flow
Who signs what
The NAV file, off the ledger, carries the price source’s official NAV, an optional indicative one (shown, never used for pricing), an expiry, and an emergency stop (the ripcord). Its arrival starts a reconciliation run on NodeAsset, which compares it with Tx 1’s NAV of the same day. A pulled stop, an expired NAV or a disagreement holds the fund: its distributions, redemptions and new orders stop. A fresh NAV clears the finding but not the hold: risk asks for the release, and two approvers sign it.
The DA Registry does not value assets; NodeAsset adds the price source only where an asset’s price moves. A tokenized deposit or a stablecoin is at par, so in a subscription paid in one only the fund is priced: the payment leg is just the amount. A product issued against the fund inherits its price, in units of its collateral, from the collateral’s own price source.
Worked example
The feed against the ledger:
In the demo (chapter 4), the price source publishes the day’s NAV, and the ledger strip shows it signed by the price source alone and seen by the venue.
Controls
- Only the price source prices: every choice that reads a NAV checks who signed it and for which asset, and the venue reads only NAVs the asset’s own price source signed.
- The venue cannot set a price. A subscription settles at the NAV the price source signed for it, and a redemption at the price it signed for that claim.
- An order, its audit trail and any dispute all refer to the order’s one signed figure, not to a price fetched from a shared feed (which would also tell the feed’s operator about every order).
- A feed can halt pricing on its own, and only the venue’s people release it: two approvers besides the maker.
- A falling NAV is absorbed: income is measured from each holder’s high-water mark, so a fall is never clawed back.
- No outside provider’s figure overrides, replaces or is averaged into the price source’s signature.