Cancel-Replace Races in Simulation

A trader sees a price move against their resting order and immediately sends a cancel, intending to pull it before it fills at the now-unfavorable price. In a naive backtest, "immediately" means instantly and unconditionally — the cancel is treated as taking effect the moment it's decided. On a real exchange, the cancel is itself just another message that has to travel across the network and be processed in the order it's received, not the order it's sent — and an incoming trade that was already in flight, or arrives at the exchange microseconds before the cancel is processed, can fill the old order anyway. This is a cancel-replace race, and whichever message the exchange processes first wins, regardless of trader intent.

Why this matters more than it sounds

Cancel-replace races are the mechanism behind a specific, painful failure mode: a market maker's risk system detects an adverse price move and fires a cancel to pull a stale quote, but the cancel loses the race to an incoming marketable order that was already en route. The result is a fill at a price the trader's own logic had already flagged as unacceptable — not because the logic was wrong, but because the cancel arrived a few hundred microseconds too late relative to the trade. A simulator that treats cancels as instant and unconditional will never reproduce this failure mode, and will systematically understate the risk of exactly the adverse-selection scenario that stale-quote risk management exists to prevent.

Worked example: simulating the race by comparing arrival times

A market maker's risk system decides to cancel a stale bid at $t = 100.000s$; the venue's outbound-to-exchange latency for this trader is 400μs, so the cancel arrives at the exchange at $t = 100.000400s$. Independently, a marketable sell order from another participant, sent at $t = 100.000200s$ with only 150μs of latency to the same exchange, arrives at $t = 100.000350s$ — fifty microseconds before the cancel. A simulator that only tracks "when did the trader decide to cancel" would conclude the cancel succeeded, since it was decided first in wall-clock time. A simulator that correctly tracks each message's own latency and compares true arrival times at the exchange would correctly determine the trade arrives first, fills the resting order, and the cancel — arriving 50μs later — finds nothing left to cancel.

What this means in practice

Simulating cancel-replace races requires modeling per-message latency for every participant's messages, not just the strategy being tested, which is usually approximated with a calibrated latency distribution for "the rest of the market" rather than perfect knowledge of every competitor's exact timing. This matters most for market making and any strategy relying on fast risk controls to limit adverse selection — for those strategies, ignoring race risk in a backtest doesn't just introduce a small error, it removes the single scenario most responsible for real losses on stale quotes.