We rebuilt the buy and sell path on Coinbase's L2 to get sub-2-second confirmation across every supported market. Without sacrificing the institutional-custody guarantees underneath.
Two years ago we had the buy path open in front of us on a Tuesday afternoon and watched it take eleven seconds end-to-end. Six of those seconds were a custodian confirmation we couldn't move. The other five were us. We closed the laptop and decided we needed to rebuild the on-chain leg before any partner saw it. Last quarter we shipped the rebuild on Base. The user-visible part now lands under 1.8 seconds across every market we support. Here's the architecture, and the trade-offs that made it work.
The custodian leg still settles T+1 (US equities) or T+2 (other markets) with the exchange. That's not a problem I get to solve at the engineering layer. What I can solve is the user-facing part. From "call buy" to "token in wallet, contractually backed." Buys clear instantly because token supply is pre-positioned; Flo Finance reconciles with the custodian leg on the standard cycle in the background.
We're not replacing T+1. We're carrying liquidity so the typical user doesn't feel it.
Three things mattered to me when I picked the chain. Block time, cost, and Coinbase's distribution. Base's 2-second block time is fast enough that the on-chain confirmation isn't the bottleneck anymore. The custodian fill is. Gas is cheap enough that we can sponsor it on the consumer side without burning unit economics. And every Coinbase customer is one click from a Base wallet, which makes partner UX shorter than it would be on any L1.
Steps 2 and 3 take about six seconds end to end. We don't make the user wait for them. The contract issues the token the moment the custodian fill confirms. The Flo Finance legal-title transfer happens in the background and reconciles inside the same daily reporting cycle.
Proof of reserves runs daily. At 00:00 UTC we rebuild the full Merkle tree of custodian-side positions and post the root on-chain. In parallel, Accountable runs an independent diff against the contract's total supply and serves the result via a public API. If the diff drifts past two basis points, new buys halt automatically until the Flo Finance operator reconciles. We've tripped this twice in staging. Both were custodian-side reporting lag, not actual divergence. I'd rather false-positive on this than false-negative on it, and the math says the same thing.
We're not replacing T+1. We're carrying liquidity so the typical user doesn't feel it.
I over-engineered the cross-chain bridging on day one. Chainlink CCIP wired to Arbitrum and Ethereum before we had a single partner who needed either. If I did this again, Base-only for the first ninety days, then add chains based on actual partner demand. Build for the user you have, not the user you think you'll have.
I'm sure we'll find more of these as more customers go live. If you're building something similar and you've made different trade-offs at the on-chain leg, I'd actually like to hear what broke first.
