Skip to content
PaxLabs.
— Argus · Risk Engine

A virtual machine that thinks in risk.

Argus is not a risk library, a scoring script, or an oracle feed. It is a full 256-bit register-based virtual machine, purpose-built for the decisions capital markets need a protocol to make autonomously.

Every protocol that has ever allocated capital automaticallylending markets, perps exchanges, prop trading deskshas done it with the same tool: an opaque Python service, off-chain, running on someone's server, trusted by no one and audited by fewer. Argus is the bet that that era is ending.

Argus is a register-based virtual machine with 256-bit native arithmetic, deterministic gas metering, and a typed contract languageArgLangthat compiles to its bytecode. It is Paxeer Network's autonomous risk layer, and it runs on-chain alongside the exchange it governs.

Why a new VM

The EVM was designed for value transfer. It is brilliant at that. It is not brilliant at the specific workload of risk computationthe kind of high-frequency numerical work that looks at thousands of on-chain signals per block and decides who gets capital, who gets gated, and who gets liquidated.

Risk engines built on the EVM have to fight the stack, pay huge gas costs for 256-bit math on every operation, and twist themselves around the 24 KB contract size limit. Off-chain risk engines avoid those costs by leaving the chain entirelywhich means leaving determinism and auditability behind.

Argus takes the third path. It is a VM designed from scratch for this workload: register-based for speed, 256-bit native for cryptographic and financial math, sandboxed for safety, and gas-metered for deterministic termination.

Architecture

Register set

ArgusVM has 32 general-purpose 256-bit registers and a small set of control registers:

r0-r31    : 32 general-purpose 256-bit registers
pc        : Program counter (64-bit)
sp        : Stack pointer (64-bit)
fp        : Frame pointer (64-bit)
gas       : Remaining gas (64-bit)
status    : Status flags (64-bit bitfield)

Register-based execution means no stack-push / stack-pop overhead on every operation. For the kind of workload Argus runshot paths of arithmetic and comparisons over thousands of signalsthis is a significant performance win.

Memory model

ArgusVM defines four memory regions with strict boundaries:

┌─────────────────────────┐ 0x00000000
│   Code Segment          │   Read-only, bytecode
│   (Max 24 KB)           │
├─────────────────────────┤ 0x00006000
│   Data Segment          │   Read/Write, initialised
│   (Max 8 KB)            │
├─────────────────────────┤ 0x00008000
│   Stack                 │   Grows downward
│   (Max 64 KB)           │
├─────────────────────────┤ 0x00018000
│   Heap                  │   Dynamic allocation
│   (Max 128 KB)          │
└─────────────────────────┘ 0x00038000

Storage is a separate persistent key-value store, accessed only via SLOAD and SSTORE opcodes. Exactly as on the EVM, but with the pricing rebalanced for ArgusVM's workload: 200 gas for a cold SLOAD, 100 gas warm.

Instruction format

Every instruction is exactly 8 bytes. Fixed-width encoding means the decoder never has to look ahead:

┌────────┬────────┬────────┬────────┬────────────────┐
│ opcode │  dst   │  src1  │  src2  │   immediate    │
│ 8-bit  │ 8-bit  │ 8-bit  │ 8-bit  │    32-bit      │
└────────┴────────┴────────┴────────┴────────────────┘

The opcode space is organised by category: arithmetic at 0x00-0x0F, bitwise at 0x10-0x1F, comparison at 0x20-0x2F, memory at 0x30-0x3F, storage at 0x40-0x4F, control flow at 0x50-0x5F, and so on through syscalls, blockchain context, external calls, and logging.

Gas, finality, and determinism

Every opcode has a fixed gas cost. Arithmetic and bitwise operations cost 3 gas. A memory load is 3 gas. A cold storage read is 200 — warm is 100. A KECCAK256 costs 30 base plus 6 per word. External calls cost 100 plus the forwarded gas budget.

Memory expansion follows a quadratic cost model:

memory_cost = (size_in_words² / 512) + (3 · size_in_words)

The determinism guarantees are where Argus earns its name. A risk engine that gives different answers on different nodes is worse than no risk engine at all. ArgusVM enforces:

  • All arithmetic is 256-bit integer. No floats.
  • Division by zero returns zero, not an exception.
  • Out-of-bounds memory access reverts the entire transaction.
  • All randomness derives from blockchain state, never from a host clock.
  • No file system. No network. Only whitelisted syscalls.

The result: for any given input and any given state, every validator in the network computes the same answer. Argus's decisions are a matter of consensus, not of which server happened to serve the request.

ArgLangthe language

Argus bytecode is a real machine-code surface, but nobody writes it by hand. ArgLang is the source languagestatically typed, contract-oriented, with Rust's safety borrowed into Solidity's familiar syntax. 

contract HelloWorld {
    state greeting: string;

    init(initial_greeting: string) {
        greeting = initial_greeting;
    }

    pub fn set_greeting(new_greeting: string) {
        greeting = new_greeting;
    }

    pub view fn get_greeting() -> string {
        return greeting;
    }
}

Functions carry visibility and effect annotations directly in their signatures. pub exposes a function externally. view marks it as read-only. pure forbids state access entirely. payable permits value transfer. The type system knows about u8 through u256, signed equivalents, bool, address, bytes, and first-class Map<K,V> / Vec<T> generics.

An ERC-20 in ArgLang

contract ERC20Token {
    state name: string;
    state symbol: string;
    state total_supply: u256;
    state balances: Map<address, u256>;
    state allowances: Map<address, Map<address, u256>>;

    event Transfer(
        from: address indexed,
        to: address indexed,
        amount: u256,
    );

    init(
        token_name: string,
        token_symbol: string,
        initial_supply: u256,
    ) {
        name = token_name;
        symbol = token_symbol;
        total_supply = initial_supply;
        balances[msg.sender] = initial_supply;
    }

    pub fn transfer(to: address, amount: u256) -> bool {
        require(to != address(0), "Invalid recipient");
        require(balances[msg.sender] >= amount, "Insufficient balance");

        balances[msg.sender] -= amount;
        balances[to] += amount;

        emit Transfer(msg.sender, to, amount);
        return true;
    }
}

Storagemaps, arrays, and the hash trick

ArgLang's Map<K,V> and Vec<T> compile down to the same Keccak-256-anchored storage scheme Solidity uses, with one adaptation to ArgusVM's register architecture: 

storage_slot = keccak256(key ∥ base_slot)

The compiler emits the sequence: store the key in the data segment at 0x6000, store the base slot at 0x6020, invoke the KECCAK256 opcode over those 64 bytes, then SLOAD the resulting slot. Nested maps apply the hash recursively. Arrays use keccak256(base_slot) + index. The entire sequence costs about 251 gas for a readroughly 8× cheaper than equivalent Solidity dispatch, because the register ISA doesn't have to stack-dance the intermediate values.

Syscalls and precompiles

ArgusVM ships a syscall table for the expensive primitives risk engines actually usesignature verification, elliptic curve operations, BLS aggregation, modular exponentiation. These are implemented in host code and exposed through the SYSCALL opcode with a numeric id: 

0    ecrecover         → address
4    verify_ed25519    → bool
5    verify_secp256k1  → bool
6    bls_verify        → bool
7    bls_aggregate     → aggregated_sig
8    modexp            → result
10   bn256_mul         → x2, y2
11   bn256_pairing     → bool

The EVM precompile address space is also mirrored at 0x01-0x0F for compatibility: ECRecover, SHA256, RIPEMD160, ModExp, BN256 operations, Blake2F, BLS12-381 verification and aggregation. Code compiled for EVM-style cryptography ports with minimal modification.

Security

Sandboxing is strict: no file system access, no network access, no host-level syscalls outside the whitelisted table, and full memory isolation between contracts. Gas limits bound execution time and prevent denial-of-service. Reentrancy protection derives from a hard 1024-frame call stack limit; state changes commit only on successful completion; reverts cascade up the entire stack.

The bytecode format itself is explicit:

Magic Number (4 bytes)   0x41564D00  ("AVM\0")
Version      (2 bytes)   0x0001
Code Size    (4 bytes)
Data Size    (4 bytes)
Code Section (variable)
Data Section (variable)
Metadata     (variable)

Every byte accounted for. Every section length declared. Every instruction aligned to its 8-byte boundary. No room for ambiguity about what the VM is about to execute.

Performance

The design targets are explicit:

  • Throughput: 10,000+ simple transactions per second per core.
  • Latency: under 1 ms per simple contract call.
  • Memory: under 100 MB per VM instance.
  • Startup: under 10 ms cold start.

The optimisation roadmap includes JIT compilation for hot paths, register allocation passes in the compiler, instruction fusion for common patterns (ADD followed by STORE becomes a single compound operation), and lazy memory allocation for sparse workloads.

Versus EVM and WASM

Feature ArgusVM EVM WASM
Architecture Register Stack Stack
Word size 256-bit 256-bit 32 / 64-bit
Gas metering Yes Yes External
Deterministic Yes Yes Depends
Precompiles Yes Yes No
JIT support Roadmap No Yes

What this unlocks

Argus exists so that Paxeer Network can make capital-allocation decisions autonomously without asking anyone to trust a server. The protocol reads on-chain activityfill quality, drawdown, realised PnL, volatilityand decides which operators get access to which capital. The logic is open source. The execution is on-chain. The VM is ours, because the workload demands one that does not exist elsewhere.

In time, Argus will be more than the risk engine for one exchange. The determinism, the gas model, the typed language, and the cheap 256-bit math make it a reasonable substrate for any protocol whose logic is too numerical for comfortable EVM execution. The PaxLabs team will ship the reference implementation in Go, a bytecode assembler, a test suite, and the ArgLang compiler. Everything is published as it ships.