Oracle

Every perpetual market on the Exchange marks positions against a price that must be resistant to both fat-finger errors and deliberate manipulation. The oracle validator accepts a new print only if it stays within a per-step deviation bound of the current anchor $P_{oracle}$ and, once ten prints have accumulated, within a wider path bound of the oldest print in the window. When the anchor is stale, a large move is never trusted on a single print: it must be confirmed by $k$ consecutive mutually-consistent prints, with a per-step bound that widens only after an escalation trigger fires.

The mark price $P_{mark}$ that drives margin and liquidation is not the raw oracle price: it blends the trusted oracle anchor with a robust trade reference — the volume-weighted median of the last five trades — so that neither a single anomalous oracle tick nor a lone wash trade can move the mark across a liquidation threshold.

Every print must clear both deviation bounds (a conjunctive fan-in on the anchor), while staleness opens a widening re-anchor loop whose confirmation threshold relaxes under escalation.

Every print must clear both deviation bounds (a conjunctive fan-in on the anchor), while staleness opens a widening re-anchor loop whose confirmation threshold relaxes under escalation.

Setting

Symbol	Name	Description	Units	Domain
$P_{oracle}$	oracle_price	The current trusted oracle anchor price for the market. Strictly positive whenever the market has bootstrapped; a zero value denotes a brand-new market with no prior print.	USDX per unit of asset	(0, ∞)
$P_{new}$	new_price	The incoming oracle print being validated.	USDX per unit of asset	(0, ∞)
$P_{old}$	oldest_price	The oldest accepted print in the rolling ten-entry update history, used by the path-manipulation check.	USDX per unit of asset	(0, ∞)
$\theta$	deviation_threshold	Per-market single-step deviation threshold (oracle_deviation_threshold); a print deviating from the anchor by strictly more than this is rejected.	dimensionless fraction	(0, 1]
$N_h$	history_size	Fixed size of the rolling price-update window used for path-manipulation detection (HISTORY_SIZE = 10). The path check is armed only when the window is full.	prints	[10, 10]
$P_{trade}$	trade_ref	Robust trade reference for the mark blend: the volume-weighted median price of the last five recorded trades, falling back to the last trade price when the window is empty. Weighting by traded size means moving the reference requires washing a majority of traded volume, not trade count.	USDX per unit of asset	(0, ∞)
$w$	oracle_weight	Per-market oracle weight in the mark blend (MarketParams.oracle_mark_weight), a unit-interval value defaulting to 0.95 (oracle-dominant).	dimensionless fraction	[0, 1]
$P_{mark}$	mark_price	The Exchange's mark price for the market: the oracle-weighted blend of the trusted anchor and the trade reference. Equals the oracle price when no trade has ever been recorded.	USDX per unit of asset	(0, ∞)
$t_{now}$	current_time	Timestamp of the incoming print or the staleness evaluation, in Unix milliseconds.	milliseconds	[0, ∞)
$t_{last}$	last_update_time	Timestamp of the last trusted oracle update, in Unix milliseconds. Not advanced by pending (un-trusted) re-anchor prints.	milliseconds	[0, ∞)
$\tau_s$	staleness_seconds	Per-market staleness threshold (oracle_staleness_seconds); the anchor is stale when strictly more than this many seconds have elapsed since the last trusted update.	seconds	(0, ∞)
$P_{cand}$	candidate_price	The provisional re-anchor candidate: the running price level being confirmed while the anchor is stale. Not trusted and never used as the mark while pending.	USDX per unit of asset	(0, ∞)
$\theta_r$	reanchor_max_deviation	Per-step consistency bound for re-anchor confirmations (oracle_reanchor_max_deviation): a confirming print must land within this fraction of the running candidate or the confirmation counter restarts.	dimensionless fraction	(0, 1]
$\theta_e$	escalation_max_deviation	Widened per-step bound (oracle_reanchor_escalation_max_deviation) applied once the escalation trigger has fired, letting a sustained-but-volatile legitimate correction accumulate confirmations. Finite: a step beyond it still restarts the counter.	dimensionless fraction	(0, 1]
$k$	required_confirmations	Number of consecutive mutually-consistent prints required to trust a large move off a stale anchor (oracle_reanchor_confirmations). Floored at 2 in code so a misconfigured value of 1 cannot re-open the single-print bypass.	prints	[2, ∞)
$n_p$	pending_prints	Total prints observed during the current pending re-anchor sequence. Unlike the confirmation counter it never resets on an inconsistent step; it measures how long the market has been wedged.	prints	[0, ∞)
$N_e$	escalation_prints	Print-count arm of the escalation trigger (oracle_reanchor_escalation_prints).	prints	[1, ∞)
$t_0$	pending_since	Timestamp (Unix milliseconds) of the print that opened the current pending re-anchor sequence; zero when not pending.	milliseconds	[0, ∞)
$\tau_e$	escalation_seconds	Wall-clock arm of the escalation trigger (oracle_reanchor_escalation_seconds), measured against the feed-supplied update time.	seconds	(0, ∞)

The mechanism

Deviation Guards

When the stored anchor is usable — positive and not stale — every incoming print is first measured against it as a relative deviation. The print is rejected when this deviation strictly exceeds the per-market threshold $\theta$ (the comparison is strict, so a move of exactly $\theta$ is accepted). This is the workhorse guard: a fat-finger print or a single-tick spike from the price producer is rejected here and never moves the anchor.

$$\Delta_{step} = \frac{\lvert P_{new} - P_{oracle} \rvert}{P_{oracle}}, \qquad \text{accept only if } \Delta_{step} \le \theta \tag{O.1}$$

A manipulator who keeps each step under $\theta$ could still walk the price far over many prints. Once the rolling update history holds $N_h = 10$ accepted prints, the validator also measures the incoming print against the oldest print in the window. This cumulative move is compared against the path threshold (O.3): a random walk over $N$ steps has expected deviation proportional to $\sqrt{N}$, while a directed walk grows proportionally to $N$, so scaling the threshold by $\sqrt{N_h}$ separates the two regimes. The check is inactive while the window is refilling — after a re-anchor or on a brand-new market — a documented, accepted residual exposure.

$$\Delta_{path} = \frac{\lvert P_{new} - P_{old} \rvert}{P_{old}} \tag{O.2}$$

The path bound applied to (O.2) is the single-step threshold scaled by $\sqrt{N_h}$. With the default $\theta = 0.10$ and $N_h = 10$, the bound is $0.10 \times \sqrt{10} \approx 0.3162$: a cumulative move of more than about $31.6\%$ across the window is rejected even though every individual step passed the single-step guard. The implementation uses the fixed decimal constant $\sqrt{10} = 3.16227766016838$.

$$\theta_{path} = \theta \cdot \sqrt{N_h} \tag{O.3}$$

Staleness and Re-anchoring

The anchor is stale when strictly more than $\tau_s$ seconds have elapsed since the last trusted update. Timestamps are Unix milliseconds, so the threshold is converted by multiplying by 1000 (with saturating integer arithmetic in the implementation). A stale anchor may hold an arbitrarily wrong value, so the deviation guards (O.1) and (O.2) cannot be trusted against it — staleness routes the print into the re-anchor path instead.

$$\mathrm{stale} = \mathbb{1}\left[\, t_{now} - t_{last} > 1000\,\tau_s \,\right] \tag{O.4}$$

A large move off a stale anchor — one whose deviation from the last-known-good price exceeds $\theta$ — is never trusted on a single print. It only seeds a candidate $P_{cand}$; the mark does not move and the market stays fail-closed. Each subsequent print is measured against the running candidate: if the step stays within the active per-step bound (base $\theta_r$, or the widened $\theta_e$ once (O.6) fires) the confirmation counter advances; a larger step makes the print the fresh candidate with the counter restarted at 1. Only after $k$ consecutive consistent prints (with $k$ floored at 2) is the level trusted, the anchor moved, and the bookkeeping cleared. A benign recovery — a post-staleness print within $\theta$ of the old anchor — skips confirmation entirely and is trusted immediately.

$$\Delta_{cand} = \frac{\lvert P_{new} - P_{cand} \rvert}{P_{cand}}, \qquad \text{confirm if } \Delta_{cand} \le \theta_{r}\ (\text{or } \theta_{e} \text{ when escalated}) \tag{O.5}$$

A legitimate correction whose true price moves more than $\theta_r$ per print would reset the confirmation counter on every step and wedge the market fail-closed forever. The escalation trigger fires once the pending sequence has accumulated $N_e$ prints or once $\tau_e$ seconds have elapsed since it opened, whichever crosses first — the print counter $n_p$ never resets on an inconsistent step, so it measures how long the market has been wedged. When active, the per-step bound in (O.5) widens from $\theta_r$ to $\theta_e$; no single print is ever trusted, and the widened bound remains finite.

$$\mathrm{escalated} = \mathbb{1}\left[\, n_p \ge N_e \;\lor\; t_{now} - t_0 \ge 1000\,\tau_e \,\right] \tag{O.6}$$

Mark Price

The mark price used for margin and liquidation blends the trusted oracle anchor with a robust trade reference. Because $w \in [0,1]$, the mark always lies between the oracle price and the trade reference — an anomalous-but-accepted oracle tick is damped by trades, and vice versa. The trade reference $P_{trade}$ is the volume-weighted median of the last five recorded trades: sorting the window by price and walking cumulative traded size, the reference is the first price at which cumulative size strictly exceeds half the total (when a sample's cumulative size lands exactly on half, the straddling price and the next positive-size price are averaged). Moving this reference therefore requires washing a majority of traded volume, not merely a majority of trade count. When the window is empty the reference falls back to the last trade price, and when no trade has ever been recorded the mark is simply the oracle price. A confirmed re-anchor over a large jump clears the trade window so pre-gap trades cannot pull the fresh mark back toward the stale level.

$$P_{mark} = w \cdot P_{oracle} + (1 - w) \cdot P_{trade} \tag{O.7}$$

Invariants

• The trusted anchor is strictly positive after bootstrap: $P_{oracle} > 0$, and validation divides only by positive prices.
• On the fresh-anchor path, every accepted print satisfies $\Delta_{step} \le \theta$ ((O.1)); the comparison is strict, so a move of exactly $\theta$ is accepted.
• When the ten-print history is full, every accepted print also satisfies $\Delta_{path} \le \theta \sqrt{10}$ ((O.2), (O.3)).
• Because $w \in [0,1]$, the mark is always bounded: $\min(P_{oracle}, P_{trade}) \le P_{mark} \le \max(P_{oracle}, P_{trade})$ ((O.7)).
• A pending re-anchor never moves the anchor or advances the trusted timestamp: $P_{oracle}$ and $t_{last}$ are unchanged until $k$ consecutive consistent confirmations accumulate ((O.5)).
• The required confirmation count is floored at 2 in code, so a single print can never promote a large move off a stale anchor.
• A single trade with a minority of the window's traded volume cannot move the volume-weighted median trade reference, and hence cannot move the mark by more than the blend permits.
• Escalation widens the per-step bound to $\theta_e$ but never removes it: a step beyond $\theta_e$ still restarts the confirmation counter ((O.6)).

Worked example

Consider a market with anchor $P_{oracle} = 100{,}000$ USDX, deviation threshold $\theta = 0.10$, staleness window $\tau_s = 30$ s, and oracle weight $w = 0.95$. A print of $P_{new} = 105{,}000$ arrives one second after the last update. The anchor is fresh, so (O.1) gives $\Delta_{step} = |105{,}000 - 100{,}000| / 100{,}000 = 0.05 \le 0.10$: the print is trusted and becomes the new anchor. Had the print been $115{,}000$, the deviation of $0.15$ would strictly exceed $\theta$ and the print would be rejected outright. Even a sequence of near-threshold steps is bounded: once ten prints fill the history, (O.2) is checked against (O.3) $= 0.10 \times \sqrt{10} \approx 0.3162$, so a compounding $9\%$-per-print walk is cut off at the eleventh print.

Now suppose four trades of size 1 execute at $99{,}000$, $100{,}000$, $101{,}000$, and $102{,}000$. The equal-size volume-weighted median lands exactly on half the total volume between the two central prices, so the trade reference averages them: $P_{trade} = 100{,}500$. By (O.7), $P_{mark} = 0.95 \times 100{,}000 + 0.05 \times 100{,}500 = 100{,}025$ USDX. A lone wash trade at $50{,}000$ appended to a window of genuine $100{,}000$ trades leaves the median — and therefore the mark — unmoved, whereas the old single-last-trade blend would have dropped the mark to $97{,}500$.

Finally, suppose the feed goes silent for two minutes, so (O.4) fires ($120{,}000 - 0 > 30 \times 1000$), and the next print is $42{,}000$ against a stale anchor of $160.165$. The move is far beyond $\theta$, so it only seeds a candidate: the anchor and mark stay at the old level and the market remains fail-closed. Each subsequent print within $\theta_r = 0.10$ of the running candidate ((O.5)) advances the confirmation counter; after $k = 3$ consecutive consistent prints the level is trusted, the anchor moves, and the stale pre-gap trade window is cleared so the fresh mark is the pure re-anchored oracle price.

Analysis

Sensitivity

Elasticities ε = (∂y/∂x)·(x/y), computed numerically from the verified expressions at each worked-example point. |ε| > 1 means the output moves more than proportionally with that input.

Expression	Input	Elasticity ε
single_step_deviation	new_price	21
single_step_deviation	oracle_price	-21
path_deviation	new_price	4.165
path_deviation	oldest_price	-4.165
path_threshold	deviation_threshold	1
is_stale	current_time	0
is_stale	last_update_time	0
is_stale	staleness_seconds	0
reanchor_step_deviation	new_price	1.111
reanchor_step_deviation	candidate_price	-1.111
escalation_trigger	pending_prints	5e+05
escalation_trigger	escalation_prints	-5e+05
escalation_trigger	current_time	0
escalation_trigger	pending_since	0
escalation_trigger	escalation_seconds	0
mark_price	oracle_price	0.9505
mark_price	trade_ref	0.04952
mark_price	oracle_weight	0.009505

Sensitivity tornado — Single-step deviation

Sensitivity tornado — Mark price blend

Response curves

Relative deviation of an incoming print from a fixed 100,000 anchor; prints outside the ±10% band are rejected by the single-step guard.

Relative deviation of an incoming print from a fixed 100,000 anchor; prints outside the ±10% band are rejected by the single-step guard.

The mark blend as the trade reference varies, with the oracle anchor held at 100,000; higher oracle weights flatten the mark's sensitivity to trades.

The mark blend as the trade reference varies, with the oracle anchor held at 100,000; higher oracle weights flatten the mark's sensitivity to trades.

The cumulative path bound is the single-step threshold scaled by √10 ≈ 3.162, holding the ten-print window size fixed.

The cumulative path bound is the single-step threshold scaled by √10 ≈ 3.162, holding the ten-print window size fixed.

Parameter space

Joint parameter effects evaluated from the verified expressions over 2-D grids.

The fresh/stale boundary is the line elapsed_ms = 1000 × threshold, showing directly how tightening the staleness parameter shrinks the fresh region; last update time held at 0.

The fresh/stale boundary is the line elapsed_ms = 1000 × threshold, showing directly how tightening the staleness parameter shrinks the fresh region; last update time held at 0.

Level sets fan out from the anchor point where trade_ref equals the oracle price, showing that manipulation of the trade reference moves the mark by only (1 − weight) of the displacement; oracle price held at 100,000.

Level sets fan out from the anchor point where trade_ref equals the oracle price, showing that manipulation of the trade reference moves the mark by only (1 − weight) of the displacement; oracle price held at 100,000.

References

• Derived from and adversarially verified against the Exchange's Rust implementation and its test suite.
• Sibling model: funding-rate
• Sibling model: insurance-fund
• Sibling model: liquidation-engine
• Sibling model: margin-math
• Sibling model: order-book
• Sibling model: position-tracker
• Sibling model: settlement