Arcobaleno — a check that carries on past the ring Arcobaleno Research
Backtest Forensics/ What we check

The eight checks, and what we need from you

So you can tell before you email us whether there is a job here, what it would involve, and whether we are the right people for it. If we aren't, we would rather you knew now.

Every audit runs the same eight checks

They come from mistakes we have actually hit in our own research — not from a textbook. All eight are published on our front page as case studies against ourselves, with the dated internal document each one came from.

We number them FC-1 to FC-8 so that findings in your report point at something specific. A finding reads FC-3, not "we had concerns about costs".

  1. FC-1Does it repeat?

    We run your code twice, on two different machines, and see whether the same number comes back. Nothing else means anything until this does.

    What going wrong looks likeThe author cannot get their own headline number out again — far more common than anyone expects, and usually something unfixed in how the program orders or seeds its work.
  2. FC-2Are the dead ones missing?

    Was the list of assets built as it looked back then, or from the ones still trading today? And if something was already patched to fix this, does the patch actually test the thing it claims to?

    What going wrong looks likeThe names that disappeared are absent from the test — and the ones that disappear are usually the losers, so the record flatters itself.
  3. FC-3Are the costs real?

    Where did the fee figure come from? Is it charged the right way round — per book, or per position? Was it measured at the order sizes you would actually trade, or read off a screen?

    What going wrong looks likeOne cost assumption appears in three documents with three different numbers, and nobody has measured which is right.
  4. FC-4Is the data clean?

    Was every row checked, or a sample? We run the checks that already exist across the whole set rather than the slice someone looked at.

    What going wrong looks likeA single bad print carries thirty months of apparent return, and removing it removes the strategy.
  5. FC-5Is the data current?

    Do the filters meant to exclude stale data actually look at a date? We read what the code does, not what the variable is called.

    What going wrong looks likeA filter named for recency that never reads a timestamp — it counts rows and wears the name.
  6. FC-6Was it cherry-picked?

    How many versions were tried before this one, and was this one chosen before or after seeing how it performed? Is there any data it has genuinely never been run on?

    What going wrong looks likeHundreds of variants tested, the best one reported, and nothing held back to check it against. The result is the search.
  7. FC-7Could you have traded it?

    Could every position in the result actually have been bought and sold, at the price used, in the size assumed — and using only what was knowable at that moment?

    What going wrong looks likePositions opened and closed at prices that existed, in sizes that did not. Or open positions quietly dropped at the end instead of valued, which turns a loss into a profit.
  8. FC-8What is really being claimed?

    Is the headline a single number or a range? We put an error bar around it and ask whether that range is wide enough to include zero.

    What going wrong looks likeA figure quoted to two decimal places that is really a distribution — and a perfectly reasonable alternative way of running the same code lands somewhere else entirely.

What we need from you

Three things. If you don't have all three, say so on the call — it usually changes what is worth doing, and occasionally it means there is no job, which we will tell you.

  1. The code that produced the number. Ideally the repository, and which commit it was.
  2. The data it ran on, or credentials for us to fetch it.
  3. The claim itself, written down — the number, the period it covers, the assets, and where it appears: a tearsheet, a deck, a spreadsheet, a notebook.

What suits us best

None of this is a rule. It is what makes an audit quick and cheap rather than slow and expensive, and anything in the middle column simply means we say so in the quote.

IdealWorkableAsk us first
FormatParquetCSV, a database dumpa live API we must poll; a platform you can't export from
SizeUp to ~2 GB2–20 GB, adds a day or twolarger than ~20 GB
FrequencyDaily or hourly barsminute barsevery trade, or full order book
CodePython, in version controlR, MATLAB, C++a sealed binary; a signal you can't show us
Run timeUnder 2 hours a run2–6 hours, adds dayslonger than that

Run time matters more than people expect. FC-1 alone means running your backtest at least twice, and every variant we test in FC-6 is another run. A six-hour backtest is not a six-hour job.

On confidentiality: tell us if any part of the strategy can't be shown to us — we can usually work around a sealed component, and it is far better known before we start than halfway through. Your code and data are deleted when we deliver, unless you ask us to keep them.

What we can and can't audit

The eight checks are not specific to any market — survivorship, look-ahead, cost realism and selection are older and better documented in equities than anywhere. But knowing a market's mechanics is a different thing from knowing method, and we would rather be straight about where ours stop.

  • StrongestCrypto perpetual futures. Funding, mark versus last price, margin tiers, delistings, fee tiers, liquidation cascades. All five published case studies come from here.
  • YesCrypto spot, equities, futures. The method transfers directly, and most audit findings live in the method rather than the instrument.
  • Tell youWhere a claim rests on mechanics we haven't exercised — dividend and corporate-action adjustment, point-in-time fundamentals, exchange calendars and halts, borrow cost and short availability, options exercise and surface construction. If your result hinges on one of these, we will say so in writing before quoting, and you can decide.
  • NoWhere there is nothing to reproduce — no code, no data, or a strategy nobody has run in months and nobody knows the expected output of. That is code recovery, not an audit, and we don't sell it.

We don't claim to cover every market. Outside crypto we hold no market data of our own, so you would either send us yours or we buy it in — and we tell you which, and what it costs, before any work starts.

How an audit actually runs

Start to finish, for a full audit. A Triage is steps 1 to 3 and stops there.

  1. We take delivery and freeze it. Your code and data go into a working copy with a recorded fingerprint. We never work in your live repository.
  2. FC-1 first, before anything else. Run it clean, end to end, twice. If the number won't come out, we stop here and tell you — everything downstream would be worthless.
  3. We reconcile against your claim. Our number against the number in your document. Any gap is itself a finding, and often it is the finding.
  4. We work FC-2 through FC-8 in order. Structural and cheap first, subtle last. Each check is a script we run, not a read-through of your code.
  5. Every finding gets a number. Not "costs look understated" but "costs are understated by this much, which moves the headline from here to here". A finding without a number is an opinion.
  6. You get the report, each finding with the script that demonstrates it, ranked by what it does to your claim rather than by the order we found things.
  7. One call to walk through it. No ongoing obligation, in either direction.

Two things worth saying up front

The fee is for the work, not for finding something. An audit that finds nothing wrong is a real and useful outcome — it is what you are buying the right to conclude. We would rather agree that now than argue about it later.

If a Triage uncovers something bigger, we stop and re-quote. We don't silently absorb it, and we don't silently bill for it.

Still not sure whether it fits?

That is what the first call is for, and it is free. Tell us what the strategy is and what you have. If there isn't enough there to reproduce anything, we'll tell you on that call and turn the work down — before any money changes hands.

Arcobaleno Research Backtest forensics & research due diligence
We split the number into what actually produced it
dvt@arcobaleno.cloud

Prices, and the five findings we published against our own research, are on the front page.

Research due-diligence and code-audit services only. This is not investment advice, not a recommendation to buy or sell anything, and not an offer to manage money. Our findings say whether a stated result can be reproduced from the material supplied — they are not an opinion on how any strategy will perform in future. The case studies referred to describe defects found in our own internal research; no client work is described.